@sema-agent/client-core 0.97.1 → 0.98.0

package/dist/hitl/toolApprovalWire.js

@@ -1,27 +1,29 @@
-import { APPROVAL_CARD_PORT_KEY_MISMATCH_REASON, DEFAULT_DENY_REASON, DecideTransportRetryExhaustedError, HitlBridge, NO_APPROVAL_CARD_PORT_REASON, denyReasonForWire, findPendingForTask, hitlSafetyCodeOf, readDecideCurrentPending, readWireCodes, readWireErrorCodeReading, } from './hitlBridge.js';
+import { APPROVAL_CARD_PORT_KEY_MISMATCH_REASON, DEFAULT_DENY_REASON, HitlBridge, NO_APPROVAL_CARD_PORT_REASON, denyReasonForWire, findPendingForTask, readWireErrorCodeReading, } from './hitlBridge.js';
 import { askParkRowArm } from './askParkRowRouting.js';
 import { parkGateArmOf } from './frameRouter.js';
 import { seatSessionRowOf } from './standingRows.js';
 import { hostLog } from '../host.js';
 import { guardedRead, readAskOrigin, readOwnDataNonEmptyString, readOwnDataValue, readOwnNonEmptyString } from '../ownKey.js';
-import { readAskClassPair } from './askClassPair.js';
-import { readAllowRuleShadowFromWire } from './allowRuleShadow.js';
+import { DEPLOYMENT_LIST_ASK_CLASSES, readAskClassPair } from './askClassPair.js';
+import { invokeHostCallbackIsolated } from '../hostCallbackGuard.js';
+import { approvalWindowKeysOf, readRequiresRealApproval } from './approvalCardReading.js';
+import { readAllowRuleShadowFromWire, retiredAllowRuleShadowKeyPresent, RETIRED_SHADOW_EVIDENCE_LABEL } from './allowRuleShadow.js';
 import { createSessionSlot, DEFAULT_SESSION_KEY } from '../sessionSlot.js';
 import { readEngineActiveBgTasks } from '../fleet/fleetLedger.js';
 import { CORE_SKILL_TOOL_NAME } from '../generated/toolNameTables.js';
 import { INTERRUPT_DENY_REASON, observeCancelByDeny, surfaceApprovalParking, surfaceRememberNotApplied, surfaceEditNotForwarded, surfaceEditRefusedOnBlindAsk, surfaceRuleArmNotSent, surfaceRuleArmRejected } from './hitlHostSurface.js';
 import { approvalCallKey, liveFrameCallKey } from './gateIdentity.js';
 import { displayUntrusted } from '../displayUntrusted.js';
-import { approvalDecisionHolds, awaitLiveCardHolder, holdLiveCard, joinLiveCard, liveCardHoldFor, liveCardHoldOf, clearSettledApprovals, settledApprovalOf, settledForDurableLane, settledLiveCardOutcome } from './approvalHolds.js';
-import { approvalResolutionOf } from './approvalResolution.js';
+import { frameBindingOf } from '../frameBinding.js';
+import { approvalDecisionHolds, approvalHoldFor, awaitApprovalHolder, claimApprovalCardFor, holdLiveCard, joinLiveCard, liveCardHoldOf, clearSettledApprovals, noteHolderSettledApproval, settledApprovalOf, settledForDurableLane, settledLiveCardOutcome } from './approvalHolds.js';
+import { joinedResolution, resolutionOfDecisionFailure } from './approvalResolution.js';
+import { parkRowDeadlineState } from './parkExpiryJudgements.js';
 import { isApprovalMandateWord } from '../gateVocabulary.js';
 import { denyAttributionRefusalFromError } from '../wireRefusalCopy.js';
 import { approvalDecidedByAdmitted } from '../approvalDecidedByCapability.js';
 import { decideFailureNote } from '../decideFailureNote.js';
-import { readRefusalField, thrownIsInstanceOf, wireFailureTextsOf } from '../wireFailureShape.js';
-import { refusalCauseWordOf } from './approvalEndingCause.js';
-import { readDecisionRefusalAsk } from './decisionRefusal.js';
-import { DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, refusalSaysStillPending } from '../engineErrorCodes.js';
+import { wireFailureTextsOf } from '../wireFailureShape.js';
+import { DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED } from '../engineErrorCodes.js';
 import { readDecideReceipt } from '../decideReceipt.js';
 import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, ASK_ORIGINS, TOOL_APPROVAL_CARD_WORDS, } from '@sema-agent/sdk';
 export function toolNameIsFsWrite(name) {
@@ -82,6 +84,14 @@ export function readApprovalDenySettledBy(decision) {
         : undefined;
 }
 export const RETRACTED_CARD_DECISION_KIND = 'retracted';
+function parkRowOf(taskId, row, gatedCallId) {
+    const d = parkRowDeadlineState(row, Date.now());
+    return Object.freeze({
+        taskId,
+        ...(gatedCallId !== undefined && gatedCallId !== '' ? { gatedCallId } : {}),
+        ...(d.kind !== 'none' ? { deadlineMs: d.deadlineMs } : {}),
+    });
+}
 const cardPortByKey = createSessionSlot();
 const cardPortMissesByKey = new Map();
 function bumpCardPortMiss(sessionKey) {
@@ -149,14 +159,6 @@ export function rememberRefusalOf(error) {
 function rememberRefusalIn(reading) {
     return reading.state === 'code' ? REMEMBER_REFUSAL_CODES.find((c) => c === reading.code) : undefined;
 }
-function rememberFallbackKind(e) {
-    const reading = readWireErrorCodeReading(e);
-    if (rememberRefusalIn(reading) !== undefined)
-        return 'refused';
-    if (reading.state !== 'absent')
-        return undefined;
-    return readToolApprovalRespondRefusal(e)?.status === 400 ? 'legacy' : undefined;
-}
 function logAfterDecided(msg) {
     try {
         hostLog('debug', msg);
@@ -223,7 +225,7 @@ function heldDurableDecision(holdKey, readMark) {
     const recent = approvalDecisionHolds.settled.get(holdKey);
     return recent !== undefined && recent.at > readMark ? recent.hold : undefined;
 }
-function holdDurableDecision(holdKey, callerSignal, decide) {
+function holdDurableDecision(holdKey, identity, callerSignal, decide) {
     const h = approvalDecisionHolds;
     const interruption = new AbortController();
     let settled = false;
@@ -241,7 +243,7 @@ function holdDurableDecision(holdKey, callerSignal, decide) {
         resolveOutcome = resolve;
         rejectOutcome = reject;
     });
-    const hold = { lane: 'durable', outcome, presented: false, interrupt, cardSignal: interruption.signal };
+    const hold = { lane: 'durable', identity: Object.freeze({ ...identity }), phase: 'card', outcome, presented: false, interrupt, cardSignal: interruption.signal };
     h.inFlight.set(holdKey, hold);
     const release = () => {
         if (h.inFlight.get(holdKey) === hold)
@@ -283,7 +285,7 @@ async function joinDurableDecision(hold, deps, signal) {
         catch {
         }
     }
-    return { ...o, joinedInFlight: true };
+    return joinedResolution(o);
 }
 export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signal, parkGatedCallId, parkToolName) {
     const decidedByReading = decidedByReadingSnapshotOf(deps);
@@ -299,19 +301,22 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
         closeDurableRead(readMark);
     }
     if (!found.ok)
-        return { kind: 'failed', stage: 'fetch', reason: found.reason, ...(found.code !== undefined ? { code: found.code } : {}) };
+        return { kind: 'not_sent', lane: 'decide', cause: found.code ?? 'fetch_failed', ...(found.reason !== '' ? { detail: found.reason } : {}) };
     if (held !== undefined)
         return joinDurableDecision(held, deps, signal);
-    const liveHolder = liveCardHoldFor(parkRowHolderIdentity(found.pending, found.gatedCallId));
-    if (liveHolder !== undefined) {
-        const joined = await awaitLiveCardHolder(liveHolder, signal);
-        if (joined !== undefined)
-            return fsOutcomeOfJoinedLiveCard(joined, found.gatedCallId);
+    const rowIdentity = parkRowHolderIdentity(found.pending, found.gatedCallId);
+    const otherHolder = approvalHoldFor(rowIdentity, (h) => h.lane === 'durable');
+    if (otherHolder !== undefined) {
+        const wait = await awaitApprovalHolder(otherHolder, signal, 'decide');
+        if (wait.kind === 'settled')
+            return joinedResolution(wait.outcome, found.gatedCallId);
+        if (wait.kind === 'left')
+            return { kind: 'not_sent', lane: 'decide', cause: 'retracted', ...(found.gatedCallId !== undefined ? { gatedCallId: found.gatedCallId } : {}), joinedInFlight: true };
         return surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signal, parkGatedCallId, parkToolName);
     }
     const callKey = approvalCallKey(found.gatedCallId, taskId);
     const fetched = found;
-    return holdDurableDecision(durableHoldKey(fetched.pending, callKey), signal, async (hold) => {
+    return holdDurableDecision(durableHoldKey(fetched.pending, callKey), rowIdentity, signal, async (hold) => {
         const slot = {};
         const out = await presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, fetched, decidedByReading, callKey, hold, slot);
         noteCallOutcome(slot, out);
@@ -319,34 +324,17 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
     });
 }
 function parkRowHolderIdentity(row, gatedCallId) {
+    const askSig = carrierAskSig(row);
     return {
         ...(typeof row.taskId === 'string' && row.taskId !== '' ? { taskId: row.taskId } : {}),
         ...(gatedCallId !== undefined && gatedCallId !== '' ? { toolCallId: gatedCallId } : {}),
         ...(typeof row.sessionId === 'string' && row.sessionId !== '' ? { sessionId: row.sessionId } : {}),
-    };
-}
-function fsOutcomeOfJoinedLiveCard(o, gatedCallId) {
-    if (o.aborted === true)
-        return { kind: 'aborted', gatedCallId, joinedInFlight: true };
-    if (o.decision === 'unresolved')
-        return { kind: 'retracted', gatedCallId, joinedInFlight: true };
-    return {
-        kind: 'decided',
-        gatedCallId,
-        ...(o.decision === 'deny'
-            ? {
-                denied: true,
-                ...(o.denySettledBy !== undefined ? { denySettledBy: o.denySettledBy } : {}),
-                ...(o.denyReason !== undefined ? { denyReason: o.denyReason } : {}),
-            }
-            : {}),
-        ...(o.denyAttributionDropped === true ? { denyAttributionDropped: true } : {}),
-        ...(o.denyAttributionRenamed === true ? { denyAttributionRenamed: true } : {}),
-        joinedInFlight: true,
+        ...(askSig !== undefined ? { askSig } : {}),
     };
 }
 async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, found, decidedByReading, callKey, hold, ledgerSlot) {
     const { pending, gatedCallId } = found;
+    const at = { lane: 'decide', ...(gatedCallId !== undefined ? { gatedCallId } : {}) };
     const toolName = typeof pending.toolName === 'string' ? pending.toolName : '';
     const streamArgs = gatedCallId !== undefined ? argsByCall.get(gatedCallId) : undefined;
     const rowInput = pending.input;
@@ -359,7 +347,7 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
                 : undefined;
     const args = streamArgs !== undefined && streamArgs !== null ? streamArgs : rowArgsGap !== undefined ? {} : rowInput;
     if (typeof args !== 'object' || args === null) {
-        return { kind: 'failed', stage: 'input', gatedCallId, reason: 'gate has no tool input payload' };
+        return { kind: 'not_sent', ...at, cause: 'no_input', detail: 'gate has no tool input payload' };
     }
     const bridge = new HitlBridge(deps.client, taskId, deps.onDecideOperation ? { onDecideOperation: deps.onDecideOperation } : undefined);
     const ruleOffersReadOnly = readRuleOffers(pending.ruleOffers);
@@ -381,7 +369,7 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
             }
             : {}),
         ...(pending.governanceForced === true ? { governanceForced: true } : {}),
-        ...(pending.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+        ...(readRequiresRealApproval(pending) ? { requiresRealApproval: true } : {}),
         ...(hasOwnStrictTrue(pending, 'mandated') ? { mandated: true } : {}),
         ...((w) => (w !== undefined ? { mandate: w } : {}))(readApprovalMandate(pending)),
         ...((o) => (o !== undefined ? { origin: o } : {}))(readAskOrigin(pending)),
@@ -402,92 +390,81 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
             : {}),
         allowSessionCarried: true,
         grantBinding: readApprovalGrantBinding(pending),
+        parkRow: parkRowOf(taskId, pending, gatedCallId),
     }));
+    hold.phase = 'respond';
     if (rowArgsGap !== undefined && card.kind === 'allow' && card.updatedInput !== undefined) {
         hostLog('error', `liveToolApprovalWire: approval card for ${gatedCallId ?? `task ${taskId}`} returned an edited approval, but the tool input is ${rowArgsGap === 'truncated' ? 'a size marker on the pending row' : 'missing from both the stream and the pending row'} — nothing sent (the park stays pending)`);
         surfaceEditRefusedOnBlindAsk();
-        return { kind: 'failed', stage: 'card', gatedCallId, reason: PARK_EDIT_REFUSED_REASON, editRefused: true };
+        return { kind: 'not_sent', ...at, cause: 'edit_refused', detail: PARK_EDIT_REFUSED_REASON };
     }
     const decideSpan = bridge.openDecideOperation();
     const decideOpts = { ...(signal ? { signal } : {}), operation: decideSpan };
     try {
         switch (card.kind) {
             case 'failed':
-                return { kind: 'failed', stage: 'card', gatedCallId, reason: card.reason };
+                return { kind: 'not_sent', ...at, cause: 'card_unavailable', ...(typeof card.reason === 'string' && card.reason !== '' ? { detail: card.reason } : {}) };
             case 'retracted':
                 hostLog('debug', `liveHitlAskWire: approval card retracted without a decision for ${gatedCallId ?? '(no call)'} — nothing sent`);
-                return { kind: 'retracted', gatedCallId };
+                return { kind: 'not_sent', ...at, cause: 'retracted' };
             case 'aborted':
                 {
                     const cancelDeny = bridge.decideTool({ decision: 'deny', reason: INTERRUPT_DENY_REASON }, gatedCallId, undefined, pending);
                     hold.trailing = cancelDeny;
                     observeCancelByDeny(cancelDeny, taskId);
                 }
-                return { kind: 'aborted', gatedCallId };
+                return { kind: 'unsettled', ...at, cause: 'interrupted' };
             case 'allow':
                 try {
                     let rememberRefused = false;
-                    if (card.allowSession) {
+                    const approveBody = answerPayloadFor(card, 'decide');
+                    const { remember: _remember, ...plainApproveBody } = approveBody;
+                    void _remember;
+                    emitAnswerCommitted(callKey, 'decide', card, approveBody);
+                    if (approveBody.remember === 'session') {
                         let sessionReceipt;
                         let sessionDecided = false;
                         try {
-                            const raw = await bridge.decideTool({ decision: 'approve', remember: 'session', ...(card.updatedInput !== undefined ? { updatedInput: card.updatedInput } : {}) }, gatedCallId, decideOpts, pending);
+                            const raw = await bridge.decideTool(approveBody, gatedCallId, decideOpts, pending);
                             sessionReceipt = readDecideReceipt(raw);
                             sessionDecided = true;
                         }
                         catch (e) {
-                            const fallbackKind = rememberFallbackKind(e);
-                            if (fallbackKind === undefined)
+                            if (rememberRefusalOf(e) === undefined)
                                 throw e;
-                            rememberRefused = fallbackKind === 'refused';
+                            rememberRefused = true;
                             logAfterDecided(`liveToolApprovalWire: decide(approve+remember) refused the remember part (${String(e)}) — falling back to plain approve`);
                         }
                         if (sessionDecided) {
                             if (sessionReceipt?.rememberApplied === false)
                                 surfaceRememberNotApplied();
-                            return { kind: 'decided', gatedCallId, ...(sessionReceipt !== undefined ? { receipt: sessionReceipt } : {}) };
+                            return { kind: 'decided', ...at, decision: 'allow', ...(sessionReceipt !== undefined ? { receipt: sessionReceipt } : {}) };
                         }
                     }
-                    const raw = await bridge.decideTool({ decision: 'approve', ...(card.updatedInput !== undefined ? { updatedInput: card.updatedInput } : {}) }, gatedCallId, decideOpts, pending);
+                    const raw = await bridge.decideTool(plainApproveBody, gatedCallId, decideOpts, pending);
                     const receipt = readDecideReceipt(raw);
                     if (rememberRefused)
                         surfaceRememberNotApplied();
-                    return { kind: 'decided', gatedCallId, ...(receipt !== undefined ? { receipt } : {}) };
+                    return { kind: 'decided', ...at, decision: 'allow', ...(receipt !== undefined ? { receipt } : {}) };
                 }
                 catch (e) {
-                    const currentPending = readDecideCurrentPending(e);
-                    const wireCodes = readWireCodes(e);
-                    const wireRetriable = typeof e === 'object' && e !== null && refusalSaysStillPending(e);
-                    const safetyCode = hitlSafetyCodeOf(e);
                     const failureTexts = wireFailureTextsOf(e);
                     hostLog('debug', `liveToolApprovalWire: decide(approve) failed: ${failureTexts.log}`);
-                    return {
-                        kind: 'failed',
-                        stage: 'decide',
-                        gatedCallId,
-                        reason: `decide(approve) failed: ${failureTexts.reason}${decideFailureNote(e, 'approve')}`,
-                        ...(thrownIsInstanceOf(e, DecideTransportRetryExhaustedError) ? { retryExhausted: true } : {}),
-                        ...(currentPending !== undefined ? { currentPending } : {}),
-                        ...wireCodes,
-                        ...(wireRetriable ? { retriable: true } : {}),
-                        ...(safetyCode !== undefined ? { safetyCode } : {}),
-                    };
+                    return resolutionOfDecisionFailure(e, { lane: 'decide', route: 'approval_decide', gatedCallId, detail: `decide(approve) failed: ${failureTexts.reason}${decideFailureNote(e, 'approve')}` });
                 }
             case 'deny': {
                 const denySettledByForWire = readApprovalDenySettledBy(card);
                 const attributionKeys = decisionAttributionKeyOf(decidedByReading, denySettledByForWire);
-                const denyReasonSnapshot = typeof card.reason === 'string' ? card.reason : undefined;
+                const denyReasonSnapshot = ((r) => (typeof r === 'string' ? r : undefined))(card.reason);
                 let lastSendCarriedAttribution = false;
                 try {
-                    const denyBody = {
-                        decision: 'deny',
-                        reason: denyReasonForWire(denyReasonSnapshot, `task ${taskId}`) ?? DEFAULT_DENY_REASON,
-                        ...attributionKeys,
-                    };
+                    const denyPayload = { decision: 'deny', reason: answerPayloadFor({ kind: 'deny', ...(denyReasonSnapshot !== undefined ? { reason: denyReasonSnapshot } : {}) }, 'decide').reason };
+                    const denyBody = { ...denyPayload, ...attributionKeys };
                     let attributionDropped = false;
                     let attributionRenamed = false;
                     let raw;
                     lastSendCarriedAttribution = carriesAttributionKey(attributionKeys);
+                    emitAnswerCommitted(callKey, 'decide', card, denyPayload);
                     try {
                         raw = await bridge.decideTool(denyBody, gatedCallId, decideOpts, pending);
                     }
@@ -527,39 +504,25 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
                         }
                     }
                     const receipt = readDecideReceipt(raw);
-                    const denySettledBy = denySettledByForWire;
-                    const denyReason = denyReasonSnapshot !== undefined && denyReasonSnapshot.trim() !== '' ? denyReasonSnapshot : undefined;
+                    const deny = denyFactsOf(denySettledByForWire, denyReasonSnapshot, attributionDropped, attributionRenamed);
                     return {
                         kind: 'decided',
-                        gatedCallId,
-                        denied: true,
-                        ...(denySettledBy !== undefined ? { denySettledBy } : {}),
-                        ...(denyReason !== undefined ? { denyReason } : {}),
-                        ...(attributionDropped ? { denyAttributionDropped: true } : {}),
-                        ...(attributionRenamed ? { denyAttributionRenamed: true } : {}),
+                        ...at,
+                        decision: 'deny',
+                        ...(deny !== undefined ? { deny } : {}),
                         ...(receipt !== undefined ? { receipt } : {}),
                     };
                 }
                 catch (e) {
-                    const currentPending = readDecideCurrentPending(e);
-                    const wireCodes = readWireCodes(e);
-                    const wireRetriable = typeof e === 'object' && e !== null && refusalSaysStillPending(e);
-                    const safetyCode = hitlSafetyCodeOf(e);
-                    const attributionRefusal = denyAttributionRefusalFromError(e, lastSendCarriedAttribution);
                     const failureTexts = wireFailureTextsOf(e);
                     hostLog('debug', `liveToolApprovalWire: decide(deny) failed: ${failureTexts.log}`);
-                    return {
-                        kind: 'failed',
-                        stage: 'decide',
+                    return resolutionOfDecisionFailure(e, {
+                        lane: 'decide',
+                        route: 'approval_decide',
                         gatedCallId,
-                        reason: `decide(deny) failed: ${failureTexts.reason}${decideFailureNote(e, 'deny')}`,
-                        ...(thrownIsInstanceOf(e, DecideTransportRetryExhaustedError) ? { retryExhausted: true } : {}),
-                        ...(currentPending !== undefined ? { currentPending } : {}),
-                        ...wireCodes,
-                        ...(wireRetriable ? { retriable: true } : {}),
-                        ...(safetyCode !== undefined ? { safetyCode } : {}),
-                        ...(attributionRefusal !== null ? { denyAttributionRefusal: attributionRefusal } : {}),
-                    };
+                        detail: `decide(deny) failed: ${failureTexts.reason}${decideFailureNote(e, 'deny')}`,
+                        attributionCarried: lastSendCarriedAttribution,
+                    });
                 }
             }
         }
@@ -610,6 +573,7 @@ export const TOOL_APPROVAL_FRAME_KEYS_MIRROR = [
     'probeReason',
     'rememberRefused',
     'boundGrantDigest',
+    'boundGrantAbsence',
     'boundGrants',
     'classifierNoRuling',
     'ruleEvidence',
@@ -621,7 +585,7 @@ export const TOOL_APPROVAL_FRAME_KEYS_MIRROR = [
     'outcome',
     'cause',
 ];
-const _mirrorPin = [true, true];
+const _mirrorPin = [true];
 void _mirrorPin;
 const MANDATED_ABSENCE_WORD = 'mandated';
 export function approvalIsMandated(v) {
@@ -686,20 +650,76 @@ function isToolApprovalDelegation(v) {
     return d.agentName === undefined || typeof d.agentName === 'string';
 }
 export function isFromSubagent(frame) {
-    if (frame.fromSubagent === true)
-        return true;
-    return typeof frame.sourceTaskId === 'string' && frame.sourceTaskId.length > 0;
+    return frame.fromSubagent === true;
 }
-const RESPOND_DECISIONS = ['allow', 'allow_session', 'deny'];
+export const RESPOND_DECISIONS = Object.freeze(['allow', 'allow_session', 'deny']);
 const _respondDecisionPins = [true, true];
 void _respondDecisionPins;
 function isRespondDecision(v) {
     return typeof v === 'string' && RESPOND_DECISIONS.includes(v);
 }
+function respondDecisionOfAnswer(answer) {
+    if (answer.kind === 'allow')
+        return answer.allowSession ? 'allow_session' : 'allow';
+    return answer.kind === 'deny' ? 'deny' : undefined;
+}
+function respondNoteGate(reason, capable) {
+    if (reason === undefined || reason.trim() === '')
+        return { dropped: 'blank' };
+    if (!capable)
+        return { dropped: 'capability' };
+    if (reason.length > MAX_RESPOND_NOTE_CHARS)
+        return { dropped: 'oversize' };
+    return { note: reason };
+}
+export function answerPayloadFor(answer, lane, caps) {
+    const word = respondDecisionOfAnswer(answer);
+    if (word === undefined)
+        return undefined;
+    if (lane === 'decide') {
+        if (answer.kind !== 'allow') {
+            const reason = answer.kind === 'deny' && typeof answer.reason === 'string' ? answer.reason : undefined;
+            return Object.freeze({ decision: 'deny', reason: denyReasonForWire(reason, 'answer') ?? DEFAULT_DENY_REASON });
+        }
+        return Object.freeze({
+            decision: 'approve',
+            ...(word === 'allow_session' ? { remember: 'session' } : {}),
+            ...(answer.updatedInput !== undefined ? { updatedInput: answer.updatedInput } : {}),
+        });
+    }
+    if (answer.kind === 'allow')
+        return Object.freeze({ decision: word, ...(answer.updatedInput !== undefined ? { updatedInput: answer.updatedInput } : {}) });
+    const gate = respondNoteGate(answer.kind === 'deny' && typeof answer.reason === 'string' ? answer.reason : undefined, caps?.approvalDecisionNoteCapable === true);
+    return Object.freeze({ decision: word, ...('note' in gate ? { note: gate.note } : {}) });
+}
+const ANSWER_CARRIAGE_NONE = Object.freeze({ allowNote: 'none' });
+export function answerCarriage(card) {
+    void card;
+    return ANSWER_CARRIAGE_NONE;
+}
+export function observeApprovalAnswerCommitted(listener) {
+    answerCommittedListeners.add(listener);
+    return () => {
+        answerCommittedListeners.delete(listener);
+    };
+}
+const answerCommittedListeners = new Set();
+function emitAnswerCommitted(callKey, lane, answer, payload) {
+    if (answerCommittedListeners.size === 0)
+        return;
+    const event = Object.freeze({ callKey, lane, answer: Object.freeze({ ...answer }), payload });
+    for (const l of [...answerCommittedListeners])
+        invokeHostCallbackIsolated('liveToolApprovalWire: answer-committed listener', () => l(event));
+}
+export function isToolApprovalRespondReplayed(ack) {
+    return typeof ack === 'object' && ack !== null && ack.idempotent === true;
+}
 export function readToolApprovalRespondAck(v) {
     if (v === null || typeof v !== 'object')
         return undefined;
     const o = v;
+    if (o.idempotent === true)
+        return o.delivery === undefined ? readReplayedAck(o) : undefined;
     if (o.delivery !== 'applied')
         return undefined;
     if (typeof o.approvalId !== 'string' || o.approvalId.length === 0)
@@ -773,6 +793,48 @@ export function readToolApprovalRespondParking(v) {
         },
     };
 }
+function replayClaimOf(raw) {
+    const approvalId = guardedRead(() => readOwnDataNonEmptyString(raw, 'approvalId'));
+    const d = guardedRead(() => readOwnDataValue(raw, 'decision'));
+    let carriesDelivery = true;
+    try {
+        carriesDelivery = typeof raw === 'object' && raw !== null && Object.hasOwn(raw, 'delivery');
+    }
+    catch {
+        carriesDelivery = true;
+    }
+    return { ...(approvalId !== undefined ? { approvalId } : {}), ...(d === 'allow' || d === 'deny' ? { decision: d } : {}), carriesDelivery };
+}
+function ownIdempotentTrue(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return false;
+    try {
+        const d = Object.getOwnPropertyDescriptor(raw, 'idempotent');
+        return d !== undefined && Object.hasOwn(d, 'value') && d.value === true;
+    }
+    catch {
+        return false;
+    }
+}
+function readReplayedAck(o) {
+    if (typeof o.approvalId !== 'string' || o.approvalId.length === 0)
+        return undefined;
+    if (typeof o.askId !== 'string' || o.askId.length === 0)
+        return undefined;
+    if (o.decision !== 'allow' && o.decision !== 'deny')
+        return undefined;
+    if (typeof o.decidedAtMs !== 'number' || !Number.isFinite(o.decidedAtMs) || o.decidedAtMs < 0)
+        return undefined;
+    return {
+        approvalId: o.approvalId,
+        askId: o.askId,
+        idempotent: true,
+        decision: o.decision,
+        decidedAtMs: o.decidedAtMs,
+        ...(typeof o.decisionNote === 'string' && o.decisionNote !== '' ? { decisionNote: o.decisionNote } : {}),
+        ...(o.rememberApplied === false ? { rememberApplied: false } : {}),
+    };
+}
 function isNonEmptyStringArray(v) {
     return Array.isArray(v) && v.length > 0 && v.every(x => typeof x === 'string' && x !== '');
 }
@@ -852,58 +914,16 @@ function readDecidedByReadingOf(holder) {
 function decidedByReadingSnapshotOf(holder) {
     return approvalDecidedByAdmitted(readDecidedByReadingOf(holder)) ? Object.freeze({ kind: 'present', value: true }) : undefined;
 }
-export function readToolApprovalRespondRefusal(err) {
-    const pick = (key) => {
-        try {
-            return err?.[key];
-        }
-        catch {
-            return undefined;
-        }
-    };
-    const pickMachine = (key) => guardedRead(() => (typeof err === 'object' && err !== null ? readOwnDataValue(err, key) : undefined));
-    const rawStatus = pickMachine('status');
-    const rawCode = pickMachine('errorCode');
-    const status = typeof rawStatus === 'number' && Number.isFinite(rawStatus) ? rawStatus : undefined;
-    const errorCode = typeof rawCode === 'string' && rawCode.length > 0 ? rawCode : undefined;
-    const message = refusalTextOf(err, pick('message'));
-    if (status === undefined && errorCode === undefined && message === undefined)
+function denyFactsOf(settledBy, reasonSnapshot, dropped, renamed) {
+    const reason = reasonSnapshot !== undefined && reasonSnapshot.trim() !== '' ? reasonSnapshot : undefined;
+    const attributionKey = dropped ? 'dropped' : renamed ? 'renamed' : undefined;
+    if (settledBy === undefined && reason === undefined && attributionKey === undefined)
         return undefined;
-    const machine = typeof err === 'object' && err !== null ? err : undefined;
-    const retriable = machine !== undefined && refusalSaysStillPending(machine);
-    const cause = machine !== undefined ? refusalCauseWordOf(machine) : undefined;
-    const field = machine !== undefined ? readRefusalField(machine) : undefined;
-    const unreadable = machine !== undefined && readDecisionRefusalAsk(machine).reading === 'unreadable';
-    const rest = {
-        ...(status !== undefined ? { status } : {}),
-        ...(errorCode !== undefined ? { errorCode } : {}),
-        ...(message !== undefined ? { message } : {}),
-        ...(retriable ? { retriable: true } : {}),
-        ...(cause !== undefined || field !== undefined
-            ? { extra: { ...(cause !== undefined ? { cause } : {}), ...(field !== undefined ? { field } : {}) } }
-            : {}),
-        ...(unreadable ? { unreadable: true } : {}),
+    return {
+        ...(settledBy !== undefined ? { settledBy } : {}),
+        ...(reason !== undefined ? { reason } : {}),
+        ...(attributionKey !== undefined ? { attributionKey } : {}),
     };
-    if (status !== undefined)
-        return { ...rest, status };
-    if (errorCode !== undefined)
-        return { ...rest, errorCode };
-    return { ...rest, message: message };
-}
-const USELESS_REFUSAL_TEXTS = new Set(['[object Object]', 'null', 'undefined', '']);
-function refusalTextOf(err, message) {
-    if (typeof message === 'string' && message.length > 0)
-        return message;
-    if (typeof err === 'string' && err.length > 0)
-        return err;
-    let coerced;
-    try {
-        coerced = String(err);
-    }
-    catch {
-        return undefined;
-    }
-    return USELESS_REFUSAL_TEXTS.has(coerced) ? undefined : coerced;
 }
 const MACHINE_CODE_SHAPE = /^[A-Za-z0-9._:-]{1,64}$/;
 function logSafeErrorCode(code) {
@@ -1021,28 +1041,67 @@ export function readApprovalBoundGrants(v) {
         return undefined;
     return Object.freeze({ skill, allowedTools, disallowedTools });
 }
+const BOUND_GRANT_NOT_BINDABLE = 'not_bindable';
+const SERVER_CLASS_READ_CAP = 64;
 function readApprovalGrantBinding(carrier) {
     if (typeof carrier !== 'object' || carrier === null)
         return 'unreadable';
     try {
-        if (Object.hasOwn(carrier, 'boundGrantDigest')) {
-            const digest = ownDataValue(carrier, 'boundGrantDigest');
-            return typeof digest === 'string' && digest.length > 0 ? 'bound' : 'unreadable';
-        }
-        const tool = ownDataValue(carrier, 'toolName');
-        if (typeof tool !== 'string' || tool.length === 0)
+        const card = cardGrantBindingOf(carrier);
+        const mayCall = serverMayReadCallLaw(carrier);
+        if (cardGrantBindingOf(carrier) !== card)
             return 'unreadable';
-        return tool === CORE_SKILL_TOOL_NAME ? 'unreadable' : 'none';
+        if (!mayCall)
+            return card;
+        const call = callGrantBindingOf(carrier);
+        if (callGrantBindingOf(carrier) !== call || cardGrantBindingOf(carrier) !== card)
+            return 'unreadable';
+        return card === 'none' && call === 'none' ? 'none' : 'unreadable';
     }
     catch {
         return 'unreadable';
     }
 }
+function cardGrantBindingOf(carrier) {
+    if (Object.hasOwn(carrier, 'boundGrantDigest') || 'boundGrantDigest' in carrier) {
+        const digest = ownDataValue(carrier, 'boundGrantDigest');
+        return typeof digest === 'string' && digest.length > 0 ? 'bound' : 'unreadable';
+    }
+    const seen = carrier;
+    return ownDataValue(carrier, 'boundGrantAbsence') === BOUND_GRANT_NOT_BINDABLE && seen.boundGrantAbsence === BOUND_GRANT_NOT_BINDABLE && seen.boundGrantDigest === undefined
+        ? 'none'
+        : 'unreadable';
+}
+function callGrantBindingOf(carrier) {
+    const tool = ownDataValue(carrier, 'toolName');
+    return typeof tool === 'string' && tool.length > 0 && tool !== CORE_SKILL_TOOL_NAME && carrier.toolName === tool ? 'none' : 'unreadable';
+}
+function serverMayReadCallLaw(carrier) {
+    const seen = carrier;
+    const classes = seen.classes;
+    if (!Array.isArray(classes))
+        return false;
+    const listClass = (c) => DEPLOYMENT_LIST_ASK_CLASSES.includes(c);
+    if (listClass(seen.askClass))
+        return true;
+    const length = classes.length;
+    if (typeof length !== 'number' || !Number.isSafeInteger(length) || length > SERVER_CLASS_READ_CAP)
+        return true;
+    for (let i = 0; i < length; i++)
+        if (listClass(classes[i]))
+            return true;
+    let n = 0;
+    for (const c of classes) {
+        if (listClass(c) || ++n > SERVER_CLASS_READ_CAP)
+            return true;
+    }
+    return false;
+}
 const UNREADABLE_EVIDENCE_KEYS = Object.freeze({
     frame: Object.freeze([
         ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['requiresRealApproval', 'requiresRealApproval'],
         ['mandated', 'mandated'], ['mandate', 'mandate'], ['origin', 'origin'], ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffers'],
-        ['allowRuleShadowed', 'allowRuleShadow'], ['persistedRuleShadowed', 'allowRuleShadow'], ['askClass', 'askClass'], ['classes', 'classes'],
+        ['allowRuleShadowed', 'allowRuleShadow'], ['askClass', 'askClass'], ['classes', 'classes'],
     ]),
     row: Object.freeze([
         ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['requiresRealApproval', 'requiresRealApproval'],
@@ -1051,8 +1110,9 @@ const UNREADABLE_EVIDENCE_KEYS = Object.freeze({
     ]),
     v1: Object.freeze([
         ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffersReadOnly'],
-        ['allowRuleShadowed', 'allowRuleShadow'], ['persistedRuleShadowed', 'allowRuleShadow'], ['askClass', 'askClass'], ['classes', 'classes'],
+        ['allowRuleShadowed', 'allowRuleShadow'], ['askClass', 'askClass'], ['classes', 'classes'],
     ]),
+    generic: Object.freeze([['ruleOffersAbsence', 'ruleOffersAbsence'], ['askClass', 'askClass'], ['classes', 'classes']]),
 });
 function carrierHas(carrier, key) {
     if (typeof carrier !== 'object' || carrier === null)
@@ -1075,17 +1135,21 @@ function v1RiskUnreadable(card) {
         return true;
     }
 }
-function withUnreadableEvidence(carrier, leg, req) {
-    const keys = new Set();
+function withUnreadableEvidence(carrier, leg, req, reported = []) {
+    const keys = new Set(reported);
     for (const [from, to] of UNREADABLE_EVIDENCE_KEYS[leg]) {
         if (carrierHas(carrier, from) && !Object.hasOwn(req, to))
             keys.add(from);
     }
     if (leg === 'row') {
         const rd = ownDataValue(carrier, 'riskDescriptor');
-        for (const k of ['allowRuleShadowed', 'shadowedRule'])
-            if (carrierHas(rd, k) && !Object.hasOwn(req, 'allowRuleShadow'))
-                keys.add(`riskDescriptor.${k}`);
+        if (carrierHas(rd, 'allowRuleShadowed') && !Object.hasOwn(req, 'allowRuleShadow'))
+            keys.add('riskDescriptor.allowRuleShadowed');
+    }
+    if (leg !== 'generic' && !Object.hasOwn(req, 'allowRuleShadow')) {
+        const shadowLeg = leg === 'row' ? 'row' : 'frame';
+        if (retiredAllowRuleShadowKeyPresent(carrier, shadowLeg))
+            keys.add(RETIRED_SHADOW_EVIDENCE_LABEL[shadowLeg]);
     }
     if (leg === 'v1' && v1RiskUnreadable(carrier))
         keys.add('risk');
@@ -1130,7 +1194,18 @@ const CALL_LEDGER_MAX_CALLS = 256;
 const CALL_LEDGER_MAX_ASKS_PER_CALL = 8;
 const callCardLedger = new Map();
 function askSignatureOf(req) {
-    return JSON.stringify([req.classes !== undefined ? [...req.classes] : null, req.origin ?? null, req.mandate ?? null]);
+    return askSigOf(req.classes, req.origin, req.mandate);
+}
+function askSigOf(classes, origin, mandate) {
+    return JSON.stringify([classes !== undefined ? [...classes] : null, origin ?? null, mandate ?? null]);
+}
+function carrierAskSig(v) {
+    try {
+        return askSigOf(readAskClassPair(v)?.classes, readAskOrigin(v), readApprovalMandate(v));
+    }
+    catch {
+        return undefined;
+    }
 }
 function priorCardView(a) {
     return Object.freeze({
@@ -1154,33 +1229,65 @@ function noteCardOnCall(callId, approvalId, req) {
         }
     }
     let at = asks.findIndex((a) => a.sig === sig);
+    let supersedes;
     if (at < 0) {
         asks.push({ sig, ...(approvalId !== undefined ? { approvalId } : {}), ...(req.origin !== undefined ? { origin: req.origin } : {}), ...(req.mandate !== undefined ? { mandate: req.mandate } : {}) });
         while (asks.length > CALL_LEDGER_MAX_ASKS_PER_CALL)
             asks.shift();
         at = asks.length - 1;
     }
-    else if (asks[at].approvalId === undefined && approvalId !== undefined) {
-        asks[at].approvalId = approvalId;
+    else {
+        supersedes = supersedesOf(asks[at]);
+        delete asks[at].answered;
+        delete asks[at].answerFate;
+        if (asks[at].approvalId === undefined && approvalId !== undefined)
+            asks[at].approvalId = approvalId;
     }
     const entry = asks[at];
     const prior = asks.slice(0, at);
-    return { entry, ...(prior.length > 0 ? { prior: Object.freeze(prior.map(priorCardView)) } : {}) };
+    return { entry, ...(prior.length > 0 ? { prior: Object.freeze(prior.map(priorCardView)) } : {}), ...(supersedes !== undefined ? { supersedes } : {}) };
+}
+function supersedesOf(a) {
+    const settled = settledApprovalOf(a.approvalId);
+    return Object.freeze({
+        ...(a.approvalId !== undefined ? { approvalId: a.approvalId } : {}),
+        ...(settled?.parked === true ? { parked: true } : {}),
+        ...(a.answered !== undefined && a.outcome === undefined ? { priorAnswer: a.answered, priorAnswerOutcome: a.answerFate ?? 'unconfirmed' } : {}),
+    });
 }
 async function surfaceCallTrackedCard(callId, approvalId, slot, req) {
     if (callId === undefined || callId === '')
         return surfaceApprovalCard(req);
-    const { entry, prior } = noteCardOnCall(callId, approvalId, req);
+    const { entry, prior, supersedes } = noteCardOnCall(callId, approvalId, req);
     slot.entry = entry;
-    return surfaceApprovalCard(prior !== undefined ? { ...req, priorCardsForCall: prior } : req);
+    const decision = await surfaceApprovalCard(prior === undefined && supersedes === undefined ? req : { ...req, ...(prior !== undefined ? { priorCardsForCall: prior } : {}), ...(supersedes !== undefined ? { supersedes } : {}) });
+    const answered = respondDecisionOfAnswer(decision);
+    if (answered !== undefined)
+        entry.answered = answered;
+    return decision;
 }
-function noteCallOutcome(slot, outcome) {
+function noteCallOutcome(slot, r) {
     const entry = slot.entry;
     if (entry === undefined)
         return;
-    const r = approvalResolutionOf(outcome);
-    if (r.kind === 'decided')
+    if (r.kind === 'decided') {
         entry.outcome = r.decision === 'deny' ? 'denied' : 'allowed';
+        delete entry.answerFate;
+        return;
+    }
+    const unsettledFate = {
+        engine_refused: 'not_accepted',
+        parking_in_progress: 'not_accepted',
+        engine_error: 'unconfirmed',
+        no_answer: 'unconfirmed',
+        transport_exhausted: 'unconfirmed',
+        interrupted: 'unconfirmed',
+        orchestration: 'unconfirmed',
+        unreadable: 'unconfirmed',
+    };
+    const next = r.kind === 'not_sent' ? 'not_sent' : Object.hasOwn(unsettledFate, r.cause) ? unsettledFate[r.cause] : 'unconfirmed';
+    const fateRank = { not_sent: 0, not_accepted: 1, unconfirmed: 2 };
+    entry.answerFate = entry.answerFate !== undefined && fateRank[entry.answerFate] > fateRank[next] ? entry.answerFate : next;
 }
 export function approvalPriorCardsDetail(card) {
     const prior = ownDataValue(card, 'priorCardsForCall');
@@ -1208,6 +1315,30 @@ export function approvalPriorCardsDetail(card) {
     }
     return `This is a second approval for the same call: ${earlier}. This one is a separate check and needs its own answer.`;
 }
+const PRIOR_ANSWER_PHRASE = Object.freeze({
+    allow: 'Yes',
+    allow_session: 'Yes for this session',
+    deny: 'No',
+});
+export function approvalSupersedesDetail(card) {
+    const sup = ownDataValue(card, 'supersedes');
+    if (typeof sup !== 'object' || sup === null)
+        return undefined;
+    const parked = ownDataValue(sup, 'parked') === true;
+    const prior = ownDataValue(sup, 'priorAnswer');
+    const head = parked
+        ? 'This card replaces an earlier one for the same request, which moved to the engine\'s waiting queue.'
+        : 'This card replaces an earlier one for the same request.';
+    if (typeof prior !== 'string' || !Object.hasOwn(PRIOR_ANSWER_PHRASE, prior))
+        return head;
+    const said = PRIOR_ANSWER_PHRASE[prior];
+    const fate = ownDataValue(sup, 'priorAnswerOutcome');
+    if (fate === 'not_sent')
+        return `${head} Your earlier answer (${said}) did not reach the engine, so answer again here.`;
+    if (fate === 'not_accepted')
+        return `${head} Your earlier answer (${said}) was not accepted by the engine, so answer again here.`;
+    return `${head} Your earlier answer (${said}) was not confirmed by the engine — it may already have taken effect, so check the request before answering again here.`;
+}
 function isNonNegativeFinite(v) {
     return typeof v === 'number' && Number.isFinite(v) && v >= 0;
 }
@@ -1379,32 +1510,44 @@ function v1Bit(stamp) {
     catch {
     }
 }
-export function approvalCardFactsOfV1(card) {
-    if (typeof card !== 'object' || card === null)
-        return undefined;
-    const c = card;
-    const asFrame = card;
-    const fromSubagent = (() => {
-        try {
-            return isFromSubagent(asFrame);
-        }
-        catch {
-            return false;
-        }
-    })();
+const SUSPENDED_ASK_ARGS_NOTE = "this request's tool arguments are not available on this surface — it was raised while no client was connected, " +
+    'so you are deciding without seeing them; deny it if you are not sure what it will do. ' +
+    'Edits are not accepted on this card: there is no original input to edit';
+function cardFactsOf(carrier, leg, opts) {
+    const c = carrier;
+    const full = leg !== 'generic';
+    const asFrame = carrier;
+    const fromSubagent = full
+        ? (() => {
+            try {
+                return isFromSubagent(asFrame);
+            }
+            catch {
+                return false;
+            }
+        })()
+        : false;
     const argsPart = (() => {
         try {
-            const raw = c.args !== undefined && c.args !== null ? c.args : undefined;
+            let stream;
+            let blind = false;
+            if (leg === 'frame' && typeof opts === 'object' && opts !== null) {
+                stream = opts.streamArgs;
+                blind = opts.argsUnavailable === true;
+            }
+            const raw = stream !== undefined && stream !== null ? stream : c.args !== undefined && c.args !== null ? c.args : undefined;
             if (typeof raw === 'object' && raw !== null)
-                return { args: raw };
+                return blind ? { args: raw, argsUnavailable: true } : { args: raw };
             const fallback = argsFallbackOf(c.message, c.argsOmitted);
-            return { args: fallback.args, argsUnavailable: true, ...(fallback.omittedNote !== undefined ? { wireNote: fallback.omittedNote } : {}) };
+            const note = blind ? SUSPENDED_ASK_ARGS_NOTE : fallback.omittedNote;
+            return { args: fallback.args, argsUnavailable: true, ...(note !== undefined ? { wireNote: note } : {}) };
         }
         catch {
             return { args: {}, argsUnavailable: true };
         }
     })();
-    const out = { toolName: '', ...argsPart };
+    const out = { toolName: '', args: argsPart.args };
+    let realApprovalUnreadable = false;
     v1Bit(() => {
         if (typeof c.toolName === 'string')
             out.toolName = c.toolName;
@@ -1417,44 +1560,79 @@ export function approvalCardFactsOfV1(card) {
         if (fromSubagent)
             out.workerBadge = subagentBadgeFor(asFrame);
     });
-    v1Bit(() => {
-        if (c.governanceForced === true)
-            out.governanceForced = true;
-    });
-    v1Bit(() => {
-        const d = c.delegation;
-        if (fromSubagent && isToolApprovalDelegation(d))
-            out.delegation = d;
-    });
-    v1Bit(() => {
-        const offers = readRuleOffers(c.ruleOffers);
-        if (offers !== undefined)
-            out.ruleOffersReadOnly = offers;
-    });
-    v1Bit(() => {
-        const shadow = readAllowRuleShadowFromWire(card, 'frame');
-        if (shadow !== undefined)
-            out.allowRuleShadow = shadow;
-    });
-    v1Bit(() => {
-        const pc = c.probeCause;
-        if (isWireRecordCarrier(pc))
-            out.probeCause = pc;
-    });
-    v1Bit(() => {
-        if (readApprovalRememberRefused(card))
-            out.rememberRefused = true;
-    });
-    v1Bit(() => {
-        const re = c.ruleEvidence;
-        if (isWireRecordCarrier(re))
-            out.ruleEvidence = re;
-    });
-    v1Bit(() => {
-        const risk = c.risk;
-        if (typeof risk === 'object' && risk !== null && risk.requiresRealApproval === true)
-            out.requiresRealApproval = true;
-    });
+    if (argsPart.wireNote !== undefined)
+        out.wireNote = argsPart.wireNote;
+    if (argsPart.argsUnavailable === true)
+        out.argsUnavailable = true;
+    if (full) {
+        v1Bit(() => {
+            if (c.governanceForced === true)
+                out.governanceForced = true;
+        });
+        v1Bit(() => {
+            const d = c.delegation;
+            if (fromSubagent && isToolApprovalDelegation(d))
+                out.delegation = d;
+        });
+        v1Bit(() => {
+            const offers = readRuleOffers(c.ruleOffers);
+            if (offers === undefined)
+                return;
+            if (leg === 'frame')
+                out.ruleOffers = offers;
+            else
+                out.ruleOffersReadOnly = offers;
+        });
+        v1Bit(() => {
+            const shadow = readAllowRuleShadowFromWire(carrier, 'frame');
+            if (shadow !== undefined)
+                out.allowRuleShadow = shadow;
+        });
+        v1Bit(() => {
+            const pc = c.probeCause;
+            if (isWireRecordCarrier(pc))
+                out.probeCause = pc;
+        });
+        if (leg === 'frame') {
+            v1Bit(() => {
+                const r = readProbeReason(carrier);
+                if (r !== undefined)
+                    out.probeReason = r;
+            });
+        }
+        v1Bit(() => {
+            if (readApprovalRememberRefused(carrier))
+                out.rememberRefused = true;
+        });
+        v1Bit(() => {
+            const re = c.ruleEvidence;
+            if (isWireRecordCarrier(re))
+                out.ruleEvidence = re;
+        });
+        try {
+            if (readRequiresRealApproval(carrier))
+                out.requiresRealApproval = true;
+        }
+        catch {
+            realApprovalUnreadable = true;
+        }
+        if (leg === 'frame') {
+            v1Bit(() => {
+                if (hasOwnStrictTrue(carrier, 'mandated'))
+                    out.mandated = true;
+            });
+            v1Bit(() => {
+                const w = readApprovalMandate(carrier);
+                if (w !== undefined)
+                    out.mandate = w;
+            });
+            v1Bit(() => {
+                const rc = readReadRootCandidate(c.readRootCandidate);
+                if (rc !== undefined)
+                    out.readRootCandidate = rc;
+            });
+        }
+    }
     v1Bit(() => {
         if (c.inputHasBidi === true)
             out.inputHasBidi = true;
@@ -1469,43 +1647,115 @@ export function approvalCardFactsOfV1(card) {
         if (dlf !== undefined)
             out.denialLimitFallback = dlf;
     });
+    if (leg === 'frame') {
+        v1Bit(() => {
+            const o = readAskOrigin(carrier);
+            if (o !== undefined)
+                out.origin = o;
+        });
+        v1Bit(() => {
+            const w = readApprovalCardWord(carrier);
+            if (w !== undefined)
+                out.approvalCard = w;
+        });
+    }
     v1Bit(() => {
-        const pair = readAskClassPair(card);
+        const pair = readAskClassPair(carrier);
         if (pair !== undefined) {
             out.askClass = pair.askClass;
             out.classes = pair.classes;
         }
     });
-    out.grantBinding = readApprovalGrantBinding(card);
-    return Object.freeze(withUnreadableEvidence(card, 'v1', out));
+    if (leg === 'frame') {
+        v1Bit(() => {
+            const g = readApprovalBoundGrants(carrier);
+            if (g !== undefined)
+                out.boundGrants = g;
+        });
+        v1Bit(() => {
+            const w = readApprovalClassifierNoRuling(carrier);
+            if (w !== undefined)
+                out.classifierNoRuling = w;
+        });
+    }
+    v1Bit(() => {
+        const msg = ownDataValue(carrier, 'message');
+        if (typeof msg === 'string' && msg.trim() !== '')
+            out.message = msg;
+    });
+    if (leg === 'generic')
+        out.cardPayloadUnreadable = true;
+    if (leg === 'frame')
+        out.allowSessionCarried = true;
+    out.grantBinding = readApprovalGrantBinding(carrier);
+    return withUnreadableEvidence(carrier, leg, out, realApprovalUnreadable ? ['requiresRealApproval'] : []);
+}
+export function approvalCardFactsOfV1(card) {
+    if (typeof card !== 'object' || card === null)
+        return undefined;
+    return Object.freeze(cardFactsOf(card, 'v1'));
+}
+export function approvalCardFactsOfFrame(frame, opts) {
+    if (typeof frame !== 'object' || frame === null)
+        return undefined;
+    return Object.freeze(cardFactsOf(frame, 'frame', opts));
+}
+export function approvalCardFactsOfGeneric(card) {
+    if (typeof card !== 'object' || card === null)
+        return undefined;
+    return Object.freeze(cardFactsOf(card, 'generic'));
 }
 const MAX_RESPOND_NOTE_CHARS = 2048;
 export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamArgs, signal, lane, run) {
+    const receivedAtMs = Date.now();
     const approvalId = frame.approvalId;
+    const entry = { frame, approvalId, identity: liveCardIdentityOf(approvalId, frame, run), respond, streamArgs, signal, lane, receivedAtMs };
+    return enterLiveCard(entry, 0);
+}
+const LIVE_ENTRY_MAX_ROUNDS = 8;
+function enterLiveCard(e, round) {
+    const { approvalId, signal } = e;
     const held = liveCardHoldOf(liveFrameCallKey(approvalId));
     if (held !== undefined)
         return joinLiveCard(held, signal);
     const settled = settledLiveCardOutcome(approvalId);
     if (settled !== undefined)
         return Promise.resolve(settled);
-    return holdLiveCard(liveCardIdentityOf(approvalId, frame, run), signal, async (hold) => {
+    const other = round < LIVE_ENTRY_MAX_ROUNDS ? approvalHoldFor(e.identity, (h) => h.lane === 'live') : undefined;
+    if (other !== undefined)
+        return joinOtherLaneHolder(e, other, round);
+    return holdLiveCard(e.identity, signal, async (hold) => {
         const slot = {};
-        const out = await presentToolApprovalFrameAndRespond(frame, approvalId, respond, streamArgs, signal, lane, hold, slot);
+        const out = await presentToolApprovalFrameAndRespond(e.frame, approvalId, e.respond, e.streamArgs, signal, e.lane, hold, slot, e.receivedAtMs);
         noteCallOutcome(slot, out);
         return out;
     });
 }
+async function joinOtherLaneHolder(e, other, round) {
+    const wait = await awaitApprovalHolder(other, e.signal, 'respond');
+    if (wait.kind === 'settled') {
+        noteHolderSettledApproval(e.approvalId, wait.how, wait.outcome);
+        return joinedResolution(wait.outcome);
+    }
+    if (wait.kind === 'left')
+        return { kind: 'not_sent', lane: 'respond', cause: 'retracted', joinedInFlight: true };
+    return enterLiveCard(e, round + 1);
+}
 function liveCardIdentityOf(approvalId, frame, run) {
     const toolCallId = typeof frame.toolCallId === 'string' && frame.toolCallId !== '' ? frame.toolCallId : undefined;
     const fromSubagent = isFromSubagent(frame);
-    const ownRun = fromSubagent ? frame.sourceTaskId : run?.taskId;
+    const bound = fromSubagent ? undefined : frameBindingOf(frame);
+    const source = bound ?? run;
+    const ownRun = fromSubagent ? frame.sourceTaskId : source?.taskId;
     const taskId = typeof ownRun === 'string' && ownRun !== '' ? ownRun : undefined;
-    const sessionId = !fromSubagent && typeof run?.sessionId === 'string' && run.sessionId !== '' ? run.sessionId : undefined;
+    const sessionId = !fromSubagent && typeof source?.sessionId === 'string' && source.sessionId !== '' ? source.sessionId : undefined;
+    const askSig = carrierAskSig(frame);
     return {
         approvalId,
         ...(toolCallId !== undefined ? { toolCallId } : {}),
         ...(taskId !== undefined ? { taskId } : {}),
         ...(sessionId !== undefined ? { sessionId } : {}),
+        ...(askSig !== undefined ? { askSig } : {}),
     };
 }
 function readApprovalHolderIdentity(v) {
@@ -1527,107 +1777,51 @@ function readApprovalHolderIdentity(v) {
 }
 export async function joinApprovalHolder(identity, signal) {
     const who = readApprovalHolderIdentity(identity);
-    const hold = liveCardHoldFor(who);
+    const hold = approvalHoldFor(who);
     if (hold === undefined) {
         const entry = settledApprovalOf(who.approvalId);
-        return settledForDurableLane(entry) && entry !== undefined ? { kind: 'joined', outcome: { ...entry.outcome, joinedInFlight: true } } : { kind: 'free' };
+        return settledForDurableLane(entry) && entry !== undefined ? { kind: 'joined', outcome: joinedResolution(entry.outcome) } : { kind: 'free' };
     }
-    const joined = await awaitLiveCardHolder(hold, signal);
-    return joined !== undefined ? { kind: 'joined', outcome: joined } : { kind: 'free' };
+    const wait = await awaitApprovalHolder(hold, signal, 'decide');
+    if (wait.kind === 'settled')
+        return { kind: 'joined', outcome: joinedResolution(wait.outcome) };
+    if (wait.kind === 'left')
+        return { kind: 'joined', outcome: { kind: 'not_sent', lane: 'decide', cause: 'retracted', joinedInFlight: true } };
+    return { kind: 'free' };
+}
+export function claimApprovalCard(identity, signal) {
+    return claimApprovalCardFor(readApprovalHolderIdentity(identity), signal);
 }
-async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, streamArgs, signal, lane, hold, ledgerSlot) {
+async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, streamArgs, signal, lane, hold, ledgerSlot, receivedAtMs) {
     const frameToolCallId = typeof frame.toolCallId === 'string' && frame.toolCallId !== '' ? frame.toolCallId : undefined;
     const decidedByReading = decidedByReadingSnapshotOf(lane);
-    const toolName = typeof frame.toolName === 'string' ? frame.toolName : 'Write';
-    let args = streamArgs !== undefined && streamArgs !== null
-        ? streamArgs
-        : frame.args !== undefined && frame.args !== null
-            ? frame.args
-            : undefined;
-    let wireNote;
-    let argsFallback = false;
-    if (typeof args !== 'object' || args === null) {
-        argsFallback = true;
-        const fallback = argsFallbackOf(frame.message, frame.argsOmitted);
-        args = fallback.args;
-        if (fallback.omittedNote !== undefined) {
-            wireNote = fallback.omittedNote;
-            hostLog('debug', `liveToolApprovalWire: frame ${approvalId} args omitted (>16KiB wire cap) — card falls back to ${fallback.pathRecovered ? 'the message-derived path' : 'an empty input (no path could be derived from the message)'}`);
-        }
-        if (lane?.argsUnavailable === true) {
-            wireNote =
-                "this request's tool arguments are not available on this surface — it was raised while no client was connected, " +
-                    'so you are deciding without seeing them; deny it if you are not sure what it will do. ' +
-                    'Edits are not accepted on this card: there is no original input to edit';
-        }
-    }
-    const argsNotRealInput = argsFallback || lane?.argsUnavailable === true;
-    const ruleOffers = readRuleOffers(frame.ruleOffers);
-    const denialLimitFallback = readDenialLimitFallback(frame.denialLimitFallback);
-    const frameShadow = readAllowRuleShadowFromWire(frame, 'frame');
-    const card = await surfaceCallTrackedCard(frameToolCallId, approvalId, ledgerSlot, withUnreadableEvidence(frame, 'frame', {
-        toolName,
-        args: args,
+    const facts = cardFactsOf(frame, 'frame', { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) });
+    const argsNotRealInput = facts.argsUnavailable === true;
+    const ruleOffers = facts.ruleOffers;
+    if (argsNotRealInput && lane?.argsUnavailable !== true && facts.wireNote !== undefined) {
+        hostLog('debug', `liveToolApprovalWire: frame ${approvalId} args omitted (>16KiB wire cap) — card falls back to ${Object.hasOwn(facts.args, 'file_path') ? 'the message-derived path' : 'an empty input (no path could be derived from the message)'}`);
+    }
+    const card = await surfaceCallTrackedCard(frameToolCallId, approvalId, ledgerSlot, {
+        ...facts,
         callKey: liveFrameCallKey(approvalId),
-        ...(frameToolCallId !== undefined
-            ? { toolCallId: frameToolCallId }
-            : {}),
         signal: hold.cardSignal,
-        ...(isFromSubagent(frame) ? { workerBadge: subagentBadgeFor(frame) } : {}),
-        ...(wireNote !== undefined ? { wireNote } : {}),
-        ...(argsNotRealInput ? { argsUnavailable: true } : {}),
-        ...(frame.governanceForced === true ? { governanceForced: true } : {}),
-        ...(lane?.windowIsCurrent === true
-            ? {
-                ...(isNonNegativeFinite(frame.expiresInMs) ? { expiresInMs: frame.expiresInMs } : {}),
-                ...(isNonNegativeFinite(frame.expiresAtMs) ? { expiresAtMs: frame.expiresAtMs } : {}),
-                ...(isNonNegativeFinite(frame.serverNowMs) ? { serverNowMs: frame.serverNowMs } : {}),
-                ...(isNonNegativeFinite(frame.expiresInMs) || isNonNegativeFinite(frame.expiresAtMs)
-                    ? { receivedAtMs: Date.now() }
-                    : {}),
-            }
-            : {}),
-        ...(isFromSubagent(frame) && isToolApprovalDelegation(frame.delegation)
-            ? { delegation: frame.delegation }
-            : {}),
-        ...(ruleOffers !== undefined ? { ruleOffers } : {}),
-        ...((sh) => (sh !== undefined ? { allowRuleShadow: sh } : {}))(frameShadow),
-        ...(isWireRecordCarrier(frame.probeCause) ? { probeCause: frame.probeCause } : {}),
-        ...((r) => (r !== undefined ? { probeReason: r } : {}))(readProbeReason(frame)),
-        ...(readApprovalRememberRefused(frame) ? { rememberRefused: true } : {}),
-        ...(isWireRecordCarrier(frame.ruleEvidence) ? { ruleEvidence: frame.ruleEvidence } : {}),
-        ...(frame.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-        ...(hasOwnStrictTrue(frame, 'mandated') ? { mandated: true } : {}),
-        ...((w) => (w !== undefined ? { mandate: w } : {}))(readApprovalMandate(frame)),
-        ...(() => { const rc = readReadRootCandidate(frame.readRootCandidate); return rc !== undefined ? { readRootCandidate: rc } : {}; })(),
-        ...(frame.inputHasBidi === true ? { inputHasBidi: true } : {}),
-        ...(typeof frame.ruleOffersAbsence === 'string' && frame.ruleOffersAbsence !== ''
-            ? { ruleOffersAbsence: frame.ruleOffersAbsence }
-            : {}),
-        ...(denialLimitFallback !== undefined ? { denialLimitFallback } : {}),
-        ...((o) => (o !== undefined ? { origin: o } : {}))(readAskOrigin(frame)),
-        ...((w) => (w !== undefined ? { approvalCard: w } : {}))(readApprovalCardWord(frame)),
-        ...(readAskClassPair(frame) ?? {}),
-        ...((g) => (g !== undefined ? { boundGrants: g } : {}))(readApprovalBoundGrants(frame)),
-        ...((w) => (w !== undefined ? { classifierNoRuling: w } : {}))(readApprovalClassifierNoRuling(frame)),
-        allowSessionCarried: true,
-        grantBinding: readApprovalGrantBinding(frame),
-    }));
+        ...approvalWindowKeysOf(frame, { windowIsCurrent: lane?.windowIsCurrent === true, receivedAtMs }),
+    });
     if (hold.superseded !== undefined) {
         hostLog('debug', `liveToolApprovalWire: ${approvalId} was settled by the engine while its card was up${hold.superseded.parked ? ' (parked)' : ''} — card withdrawn; ` +
             `the card came back ${card.kind}; nothing sent`);
         if (hold.superseded.parked && (card.kind === 'allow' || card.kind === 'deny'))
             surfaceApprovalParking();
-        return { decision: 'unresolved', retracted: true };
+        return { kind: 'not_sent', lane: 'respond', cause: 'retracted' };
     }
     if (argsNotRealInput && card.kind === 'allow' && card.updatedInput !== undefined) {
         hostLog('error', `liveToolApprovalWire: ${approvalId} card returned an edited approval on a card whose arguments are not the tool's real input (${lane?.argsUnavailable === true ? 'args-unavailable ask' : 'arguments omitted or absent on the frame'}) — nothing sent (the ask stays pending)`);
         surfaceEditRefusedOnBlindAsk();
-        return { decision: 'unresolved', editRefused: true };
+        return { kind: 'not_sent', lane: 'respond', cause: 'edit_refused' };
     }
     if (card.kind === RETRACTED_CARD_DECISION_KIND) {
         hostLog('debug', `liveToolApprovalWire: ${approvalId} card retracted without a decision${card.reason ? ` (${card.reason})` : ''} — nothing sent`);
-        return { decision: 'unresolved', retracted: true };
+        return { kind: 'not_sent', lane: 'respond', cause: 'retracted' };
     }
     if (card.kind === 'aborted') {
         hold.phase = 'respond';
@@ -1642,33 +1836,40 @@ async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, st
         hold.trailing = interruptDeny.then((body) => readToolApprovalRespondParking(body) === undefined, () => false);
         observeCancelByDeny(interruptDeny, approvalId);
         hostLog('debug', `liveToolApprovalWire: ${approvalId} card aborted — one tool-level deny issued to settle the pending ask`);
-        return { decision: 'unresolved', aborted: true };
+        return { kind: 'unsettled', lane: 'respond', cause: 'interrupted' };
     }
     hold.phase = 'respond';
-    const decision = card.kind === 'allow' ? (card.allowSession ? 'allow_session' : 'allow') : 'deny';
+    const noteCapable = lane?.approvalDecisionNoteCapable === true;
+    const denyReasonRead = card.kind === 'deny' ? ((r) => (typeof r === 'string' ? r : undefined))(card.reason) : undefined;
+    const answerSnapshot = card.kind === 'deny'
+        ? ((by) => ({ kind: 'deny', ...(denyReasonRead !== undefined ? { reason: denyReasonRead } : {}), ...(by !== undefined ? { settledBy: by } : {}) }))(readApprovalDenySettledBy(card))
+        : card;
+    const basePayload = answerPayloadFor(answerSnapshot, 'respond', { approvalDecisionNoteCapable: noteCapable });
+    const decision = basePayload?.decision ?? 'deny';
+    if (card.kind === 'allow' && typeof card.note === 'string' && card.note.trim() !== '' && answerCarriage({ callKey: liveFrameCallKey(approvalId) }).allowNote === 'none') {
+        hostLog('debug', `liveToolApprovalWire: ${approvalId} card carried a note on Yes (len=${card.note.length}) — this engine has no field that brings it to the model, so it was not sent`);
+    }
     const denySettledByForWire = card.kind === 'deny' ? readApprovalDenySettledBy(card) : undefined;
     const attributionKeys = decision === 'deny' ? decisionAttributionKeyOf(decidedByReading, denySettledByForWire) : {};
     const sentAttributionKey = carriesAttributionKey(attributionKeys);
     let lastSendCarriedAttribution = sentAttributionKey;
-    const denyReasonSnapshot = card.kind === 'deny' && typeof card.reason === 'string' ? card.reason : undefined;
+    const denyReasonSnapshot = denyReasonRead;
     if (card.kind === 'failed') {
         hostLog('debug', `liveToolApprovalWire: approval card unavailable (${card.reason}) — fail-closed deny for ${approvalId}`);
     }
-    let note;
-    if (denyReasonSnapshot !== undefined && denyReasonSnapshot.trim() !== '') {
-        if (lane?.approvalDecisionNoteCapable !== true) {
+    const note = basePayload?.note;
+    const noteGate = respondNoteGate(denyReasonSnapshot, noteCapable);
+    if ('dropped' in noteGate && noteGate.dropped !== 'blank' && denyReasonSnapshot !== undefined) {
+        if (noteGate.dropped === 'capability') {
             hostLog('debug', `liveToolApprovalWire: ${approvalId} card supplied a deny reason (len=${denyReasonSnapshot.length}) but the ` +
                 'approvalDecisionNote capability is not confirmed for this engine — note not sent (an unknown key would be ' +
                 'silently swallowed by an older server while still acking 200)');
         }
-        else if (denyReasonSnapshot.length > MAX_RESPOND_NOTE_CHARS) {
+        else {
             hostLog('debug', `liveToolApprovalWire: ${approvalId} deny reason exceeds the decision_note cap ` +
                 `(len=${denyReasonSnapshot.length} > ${MAX_RESPOND_NOTE_CHARS}) — note not sent at all (the server rejects the WHOLE ` +
                 'respond with 400 over an oversize note, and a silently halved audit reason is worse than none)');
         }
-        else {
-            note = denyReasonSnapshot;
-        }
     }
     try {
         let persistRule;
@@ -1735,7 +1936,7 @@ async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, st
         }
         const respondOpts = {
             ...(signal && !signal.aborted ? { signal } : {}),
-            ...(card.kind === 'allow' && card.updatedInput !== undefined ? { updatedInput: card.updatedInput } : {}),
+            ...(basePayload?.updatedInput !== undefined ? { updatedInput: basePayload.updatedInput } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(persistRuleEdited !== undefined ? { persistRuleEdited } : {}),
             ...(persistRuleBatchOfferIndex !== undefined ? { persistRuleBatchOfferIndex } : {}),
@@ -1745,6 +1946,8 @@ async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, st
         let attributionDropped = false;
         let attributionRenamed = false;
         let raw;
+        if (basePayload !== undefined)
+            emitAnswerCommitted(liveFrameCallKey(approvalId), 'respond', answerSnapshot, basePayload);
         try {
             raw = await respond(approvalId, decision, respondOpts);
         }
@@ -1790,41 +1993,56 @@ async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, st
                 hostLog('debug', `liveToolApprovalWire: respond(${decision}) for ${approvalId} answered 202 parking_in_progress${parking.retryAfterMs !== undefined ? ` (retryAfterMs=${parking.retryAfterMs})` : ''} — ` +
                     `the answer did NOT take effect${parking.decidePath !== undefined ? ' (the engine pointed at a decide path for the parked card)' : ''}; not re-sent, not reported as decided; the user is told to answer again on the parked card`);
                 surfaceApprovalParking(parking.retryAfterMs);
-                return { decision: 'unresolved', parking };
+                return { kind: 'unsettled', lane: 'respond', cause: 'parking_in_progress', parking };
             }
             hostLog('error', `liveToolApprovalWire: 202 parking body for ${approvalId} is ${parkingBody.kind === 'parking' ? `for another approval (${parkingBody.view.approvalId})` : 'unreadable (approvalId is not usable)'} — ` +
                 'reporting the answer as NOT settled (never as decided, never as parked); not re-sent');
-            return { decision: 'unresolved' };
+            return { kind: 'unsettled', lane: 'respond', cause: 'unreadable' };
         }
         const parsed = readToolApprovalRespondAck(raw);
+        const replayedForThisCard = parsed !== undefined && isToolApprovalRespondReplayed(parsed) && parsed.approvalId === approvalId;
+        const claimsReplay = ownIdempotentTrue(raw) || (parsed !== undefined && isToolApprovalRespondReplayed(parsed));
+        if (claimsReplay && !replayedForThisCard) {
+            const claimed = replayClaimOf(raw);
+            if (claimed.approvalId === approvalId && claimed.decision !== undefined && !claimed.carriesDelivery) {
+                hostLog('debug', `liveToolApprovalWire: respond(${decision}) for ${approvalId} answered with a replay (body not in the full replay shape) — the approval was already decided ` +
+                    `(${claimed.decision}); this answer was not delivered, reporting the earlier decision`);
+                return { kind: 'decided', lane: 'respond', decision: claimed.decision };
+            }
+            hostLog('error', `liveToolApprovalWire: respond(${decision}) for ${approvalId} answered with a replay of an earlier decision that cannot be read or names another approval — ` +
+                'reporting the answer as NOT settled (never as the decision this client sent); not re-sent');
+            return { kind: 'unsettled', lane: 'respond', cause: 'unreadable' };
+        }
         let ack = parsed;
-        if (parsed !== undefined && (parsed.approvalId !== approvalId || parsed.decision !== decision)) {
+        if (parsed !== undefined && (parsed.approvalId !== approvalId || (!isToolApprovalRespondReplayed(parsed) && parsed.decision !== decision))) {
             hostLog('error', `liveToolApprovalWire: DISCARDING respond ack for ${approvalId} — it does not correlate ` +
                 `(ack.approvalId=${parsed.approvalId} ack.decision=${parsed.decision}, sent decision=${decision}); ` +
                 'treating as "no ack" (unknown) — never surfacing a safety notice off an unrelated receipt');
             ack = undefined;
         }
-        if (ack !== undefined &&
-            (ack.persistedRule !== undefined || ack.persistedRules !== undefined || ack.persistedRuleAnchors !== undefined)) {
+        const replayed = ack !== undefined && isToolApprovalRespondReplayed(ack) ? ack : undefined;
+        let applied = ack !== undefined && replayed === undefined ? ack : undefined;
+        if (applied !== undefined &&
+            (applied.persistedRule !== undefined || applied.persistedRules !== undefined || applied.persistedRuleAnchors !== undefined)) {
             const sentEditedArm = persistRule !== undefined && persistRuleEdited === true;
             const expectedBatchCount = batchArmTarget?.rules.length;
             const anchorKeyOnWire = typeof raw === 'object' &&
                 raw !== null &&
                 Object.prototype.hasOwnProperty.call(raw, 'persistedRuleAnchors');
-            const anchors = ack.persistedRuleAnchors;
+            const anchors = applied.persistedRuleAnchors;
             const anchorsOk = anchors !== undefined
                 ? persistRuleBatchOfferIndex !== undefined &&
                     expectedBatchCount !== undefined &&
                     anchors.every(a => a.offerIndex === persistRuleBatchOfferIndex && a.memberIndex < expectedBatchCount)
                 : !anchorKeyOnWire;
-            const batchEchoOk = ack.persistedRules !== undefined &&
+            const batchEchoOk = applied.persistedRules !== undefined &&
                 expectedBatchCount !== undefined &&
-                ack.persistedRules.length === expectedBatchCount &&
+                applied.persistedRules.length === expectedBatchCount &&
                 anchorsOk;
             const strayEchoes = [];
-            if (ack.persistedRule !== undefined && !sentEditedArm)
+            if (applied.persistedRule !== undefined && !sentEditedArm)
                 strayEchoes.push('persistedRule');
-            if (ack.persistedRules !== undefined && !batchEchoOk)
+            if (applied.persistedRules !== undefined && !batchEchoOk)
                 strayEchoes.push('persistedRules');
             if (anchors !== undefined && !(anchorsOk && batchEchoOk))
                 strayEchoes.push('persistedRuleAnchors');
@@ -1833,60 +2051,53 @@ async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, st
                     `${approvalId} — they do not correlate with the persistence arm actually sent ` +
                     `(editedArm=${String(sentEditedArm)} batchArmMembers=${String(expectedBatchCount ?? 'none')} ` +
                     `sentOfferIndex=${String(persistRuleBatchOfferIndex ?? 'none')} ` +
-                    `echoedRules=${String(ack.persistedRules?.length ?? 'none')} ` +
+                    `echoedRules=${String(applied.persistedRules?.length ?? 'none')} ` +
                     `echoedAnchorOffer=${String(anchors?.[0]?.offerIndex ?? 'none')}); never telling the user a rule ` +
                     'was stored off a receipt that does not line up with what this client actually sent');
-                const { persistedRule: _pr, persistedRules: _prs, persistedRuleAnchors: _pra, ...rest } = ack;
+                const { persistedRule: _pr, persistedRules: _prs, persistedRuleAnchors: _pra, ...rest } = applied;
                 void _pr;
                 void _prs;
                 void _pra;
-                ack = {
+                applied = {
                     ...rest,
-                    ...(ack.persistedRule !== undefined && sentEditedArm ? { persistedRule: ack.persistedRule } : {}),
-                    ...(ack.persistedRules !== undefined && batchEchoOk ? { persistedRules: ack.persistedRules } : {}),
+                    ...(applied.persistedRule !== undefined && sentEditedArm ? { persistedRule: applied.persistedRule } : {}),
+                    ...(applied.persistedRules !== undefined && batchEchoOk ? { persistedRules: applied.persistedRules } : {}),
                     ...(anchors !== undefined && anchorsOk && batchEchoOk ? { persistedRuleAnchors: anchors } : {}),
                 };
+                ack = applied;
             }
         }
-        if (ruleArmDroppedForCaps)
+        if (replayed === undefined && ruleArmDroppedForCaps)
             surfaceRuleArmNotSent();
-        if (ruleArmDroppedForCheck !== undefined)
+        if (replayed === undefined && ruleArmDroppedForCheck !== undefined)
             surfaceRuleArmRejected(ruleArmDroppedForCheck);
-        if (decision === 'allow_session' && ack?.rememberApplied === false) {
+        if (decision === 'allow_session' && applied?.rememberApplied === false) {
             logAfterDecided(`liveToolApprovalWire: ${approvalId} allow_session ack rememberApplied=false — grant not stored, surfacing honest notice`);
             surfaceRememberNotApplied();
         }
-        if (respondOpts.updatedInput !== undefined && ack?.updatedInputForwarded === false) {
+        if (respondOpts.updatedInput !== undefined && applied?.updatedInputForwarded === false) {
             logAfterDecided(`liveToolApprovalWire: ${approvalId} edited args were NOT forwarded (ack.updatedInputForwarded=false) — the tool runs on the ORIGINAL input`);
             surfaceEditNotForwarded();
         }
-        if (note !== undefined && ack !== undefined && ack.noteRecorded !== true) {
+        if (note !== undefined && applied !== undefined && applied.noteRecorded !== true) {
             hostLog('debug', `liveToolApprovalWire: ${approvalId} decision note was sent but not persisted ` +
-                `(ack.noteRecorded=${String(ack.noteRecorded)}) — decision stood; the audit note did not land on the ask row`);
+                `(ack.noteRecorded=${String(applied.noteRecorded)}) — decision stood; the audit note did not land on the ask row`);
         }
-        const denyAttribution = decision === 'deny'
-            ? {
-                ...(attributionDropped ? { denyAttributionDropped: true } : {}),
-                ...(attributionRenamed ? { denyAttributionRenamed: true } : {}),
-                ...(denySettledByForWire !== undefined ? { denySettledBy: denySettledByForWire } : {}),
-                ...(denyReasonSnapshot !== undefined && denyReasonSnapshot.trim() !== ''
-                    ? { denyReason: denyReasonSnapshot }
-                    : {}),
-            }
-            : {};
-        return ack !== undefined ? { decision, ack, ...denyAttribution } : { decision, ...denyAttribution };
+        if (replayed !== undefined) {
+            hostLog('debug', `liveToolApprovalWire: respond(${decision}) for ${approvalId} answered with a replay — the approval was already decided (${replayed.decision}); ` +
+                'this answer was not delivered, reporting the earlier decision');
+            return { kind: 'decided', lane: 'respond', decision: replayed.decision, ack: replayed };
+        }
+        const deny = decision === 'deny' ? denyFactsOf(denySettledByForWire, denyReasonSnapshot, attributionDropped, attributionRenamed) : undefined;
+        return { kind: 'decided', lane: 'respond', decision, ...(ack !== undefined ? { ack } : {}), ...(deny !== undefined ? { deny } : {}) };
     }
     catch (e) {
-        const respondRefusal = readToolApprovalRespondRefusal(e);
-        const attributionRefusal = denyAttributionRefusalFromError(e, lastSendCarriedAttribution);
+        const r = resolutionOfDecisionFailure(e, { lane: 'respond', route: 'live_respond', attributionCarried: lastSendCarriedAttribution });
+        const refusal = r.kind === 'unsettled' ? r.refusal : undefined;
         hostLog('debug', `liveToolApprovalWire: respond(${decision}) failed for ${approvalId} ` +
-            `(status=${respondRefusal?.status ?? 'none'} errorCode=${logSafeErrorCode(respondRefusal?.errorCode)} ` +
-            `messageLen=${respondRefusal?.message?.length ?? 0}) — engine self-settles (TTL/abort); ` +
-            'the refusal text is handed back on outcome.respondRefusal for the host to surface');
-        return {
-            decision: 'unresolved',
-            ...(respondRefusal !== undefined ? { respondRefusal } : {}),
-            ...(attributionRefusal !== null ? { denyAttributionRefusal: attributionRefusal } : {}),
-        };
+            `(status=${refusal?.status ?? 'none'} errorCode=${logSafeErrorCode(refusal?.errorCode)} ` +
+            `messageLen=${refusal?.message?.length ?? 0}) — engine self-settles (TTL/abort); ` +
+            'the refusal reading is handed back on resolution.refusal for the host to surface');
+        return r;
     }
 }