@sema-agent/server 7.131.0 → 7.133.0

package/dist/tool-approval.js

@@ -7,9 +7,11 @@ import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact
 import { hasBidiControls } from "./text-bidi.js";
 import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
+import { errorKindOf } from "./observability/err-text.js";
 import { recordFailOpen } from "./observability/fail-open.js";
-import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { currentParkArm, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ownerOfCheckpointScope } from "./security.js";
+import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt } from "./approval-ask-machine.js";
+import { currentParkArm, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildReplayFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, buildApprovalCompleteFrame, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { APPROVAL_ENDING_CAUSES, SETTLE_OUTCOME, causeOfAskRow } from "./approval-deny-reasons.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
@@ -18,6 +20,7 @@ import { governanceOriginOf } from "./runtime-governance.js";
 import { callGrantBindingOf, questionGrantBindingOf } from "./standing-answer-grant.js";
 import { operatorAsk } from "./operator-ask.js";
 import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
+import { refusalBody } from "./http/refusal-body.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
@@ -32,15 +35,17 @@ const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
 const DEFAULT_UNREACHED_ASK_TTL_MS = 60 * 60_000;
 const SUSPENDED_POLL_MAX_PER_TICK = 64;
 const SUSPENDED_POLL_BUDGET_MS = 5_000;
+const ADOPT_OPEN_ASKS_MAX = 1_000;
 const EDITED_DECISION_MARK_CAP_MS = 10_000;
 const DEFAULT_WINDOW_MARGIN_MS = 10_000;
 const SHUTDOWN_DRAIN_POLL_MS = 50;
 const MAX_ALLOW_SESSIONS = 4096;
 const DEFAULT_ADMIT_MAX_PER_TASK = 32;
 const DEFAULT_ADMIT_MAX_PER_OWNER = 256;
-const DEFAULT_PARK_TOMBSTONE_MAX = 2000;
-const DEFAULT_PARK_TOMBSTONE_TTL_MS = 60 * 60_000;
-const DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX = 128;
+const DEFAULT_PARK_REDEMPTION_MAX = 2000;
+const DEFAULT_PARK_REDEMPTION_TTL_MS = 60 * 60_000;
+const DEFAULT_PARK_REDEMPTION_PER_PRINCIPAL_MAX = 128;
+const PARK_REDEMPTION_ADMISSION_RETRY_AFTER_SEC = 5;
 const PARKING_RETRY_AFTER_MS = 250;
 export function approvalDecidePath(sessionId) {
     return `/v1/approvals/${encodeURIComponent(sessionId)}/decide`;
@@ -63,6 +68,22 @@ function durableRuleMaterial(material) {
     return { ruleCommand: material.command, ruleScopeRoot: material.scopeRoot ?? null };
 }
 export const NOT_PENDING_UNKNOWN_CAUSE = "unknown_or_other_replica";
+export const TOOL_APPROVAL_READ_STATES = ["pending", "decided", "parked", "void"];
+function decidedRowFacts(row) {
+    if (row.state !== "DECIDED" || (row.decision !== "approve" && row.decision !== "deny") || row.provisional || row.decidedAtMs === null)
+        return undefined;
+    return { decision: row.decision === "approve" ? "allow" : "deny", decidedAtMs: row.decidedAtMs, ...(row.decisionNote !== null ? { decisionNote: row.decisionNote } : {}) };
+}
+function buildAskRowReadProjection(row, nowMs) {
+    const frame = buildReplayFrame(row, nowMs);
+    return {
+        approvalId: row.askId,
+        ts: row.createdAtMs,
+        expiresAtMs: row.expiresAtMs,
+        ...(row.sessionId !== row.taskId ? { sessionId: row.sessionId } : {}),
+        ...(frame !== undefined ? { toolName: frame.card.toolName, frame } : {}),
+    };
+}
 export const ASK_DECISION_CONSUMER_ABSENT = "absent";
 const MAX_INFLIGHT_TERMINAL_CLAIMS = 2;
 const DURABLE_CONVERGE_BACKOFF_MS = [50, 100, 200, 400, 800, 1600];
@@ -181,11 +202,45 @@ function mandatedFromSeat(seat) {
             return false;
     }
 }
+function askRowVisibleTo(row, principal) {
+    return row !== null && (row.owner === null || row.owner === principal);
+}
+function waitingLegsReached(entry, othersReached) {
+    return (entry.adopted === true ? 0 : 1) + othersReached;
+}
+function withConsumerDisclosure(result, waitingLegs) {
+    return waitingLegs > 0 ? result : { status: result.status, body: { ...result.body, consumerState: ASK_DECISION_CONSUMER_ABSENT } };
+}
+function livePendingRowOf(e) {
+    const listFrame = e.adopted === true ? e.cardFrame : (e.cardFrame ?? e.frame);
+    const approvalCard = e.adopted === true ? e.cardFrame.approvalCard : e.frame.approvalCard;
+    return {
+        approvalId: e.approvalId,
+        toolName: e.toolName,
+        ts: e.registeredAtMs,
+        expiresAtMs: e.expiresAtMs,
+        ...(e.sessionId !== undefined ? { sessionId: e.sessionId } : {}),
+        ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
+        ...(e.governanceForced ? { governanceForced: true } : {}),
+        ...(e.mandated ? { mandated: true } : {}),
+        ...(standingAnswerHome(pendingEntryStandingAnswerFacts(e)) === "none" ? { rememberRefused: true } : {}),
+        ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
+        ...(e.origin !== undefined ? { origin: e.origin } : {}),
+        ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
+        ...(approvalCard !== undefined ? { approvalCard } : {}),
+        frame: listFrame,
+        ...(e.adopted === true ? { consumerState: ASK_DECISION_CONSUMER_ABSENT } : {}),
+    };
+}
+function canPresentWithoutDurableRow(c) {
+    return c.emitCard === undefined;
+}
 export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty string of at most ${MAX_RULE_TEXT_CHARS} characters`;
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
 export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with decision "allow" — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
+export const READ_ROOT_GRANT_NOT_ACCEPTED = 'readRootGrant is not accepted on this deployment — a read-directory grant is honored only on a single-user host-lane deployment (GET /v1/capabilities approvalReadRootGrant is false here); answer with plain decision "allow" instead';
 export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 export function parseToolApprovalResponse(body) {
@@ -310,27 +365,48 @@ export function resolveStreamApprovalGate(input) {
         return { active: false, reason: "no_park_facility" };
     return { active: true, askStore: input.backend.approvalAsk() };
 }
+export const APPROVAL_FRAME_FAMILIES = ["tool_approval", "approval_request"];
 export function createApprovalCardEmitter(sinks) {
-    return async (frame) => {
-        let accepted = false;
-        if (sinks.appendDurable) {
-            try {
-                await sinks.appendDurable(frame);
-                accepted = true;
-            }
-            catch {
-            }
+    const present = [sinks.appendDurable, sinks.writeLive].filter((w) => w !== undefined);
+    const attempt = (write, frame) => (async () => {
+        try {
+            await write(frame);
+            return true;
         }
-        if (sinks.writeLive) {
-            try {
-                await sinks.writeLive(frame);
-                accepted = true;
-            }
-            catch {
+        catch (err) {
+            defaultLogger.warn("approval_card_sink_write_failed", { frame: frame.type, approvalId: frame.approvalId, errKind: errorKindOf(err) });
+            return false;
+        }
+    })();
+    const opened = new Map();
+    return async (frame, registration) => {
+        if (frame.type === "approval_request") {
+            const results = present.map((write) => attempt(write, frame));
+            opened.set(registration, results);
+            const accepted = await new Promise((resolve) => {
+                let pending = results.length;
+                if (pending === 0)
+                    resolve(false);
+                for (const r of results) {
+                    void r.then((ok) => {
+                        if (ok)
+                            resolve(true);
+                        else if (--pending === 0)
+                            resolve(false);
+                    });
+                }
+            });
+            if (!accepted) {
+                opened.delete(registration);
+                throw new Error("approval card undeliverable — no sink accepted the frame (live stream closed and/or the durable append failed)");
             }
+            return;
         }
-        if (!accepted)
-            throw new Error("approval card undeliverable — no sink accepted the frame (live stream closed and/or the durable append failed)");
+        const results = opened.get(registration);
+        opened.delete(registration);
+        if (results === undefined)
+            return;
+        await Promise.all(present.map((write, i) => results[i].then((ok) => (ok ? attempt(write, frame) : false))));
     };
 }
 export function resolveApprovalLeg(input) {
@@ -412,6 +488,7 @@ export class ToolApprovalCoordinator {
         return this.terminalClaimsInFlightCount(askId);
     }
     pendingByAskId = new Map();
+    presentedCardWatchers = new Map();
     allowAllSessions = new Set();
     streams = new Map();
     ttlMs;
@@ -423,6 +500,7 @@ export class ToolApprovalCoordinator {
     admitByTask = new Map();
     admitByOwner = new Map();
     suspendedPollOffset = 0;
+    adoptedPollOffset = 0;
     editedDecisionsInFlight = new Map();
     storeErrorWarned = false;
     storeErrorTally = 0;
@@ -430,10 +508,10 @@ export class ToolApprovalCoordinator {
     ruleConsent;
     unattendedPolicy;
     ruleScopeRootFor;
-    parkTombstones = new Map();
-    parkTombstoneMax;
-    parkTombstoneTtlMs;
-    parkTombstonePerPrincipalMax;
+    parkRedemptions = new Map();
+    parkRedemptionMax;
+    parkRedemptionTtlMs;
+    parkRedemptionPerPrincipalMax;
     parkedRedeem;
     askAudit;
     sessionGrants;
@@ -454,9 +532,9 @@ export class ToolApprovalCoordinator {
         this.admitMaxPerOwner = opts?.admitMaxPerOwner ?? DEFAULT_ADMIT_MAX_PER_OWNER;
         this.unattendedPolicy = opts?.unattendedPolicy ?? "park";
         this.parkedRedeem = opts?.parkedRedeem;
-        this.parkTombstoneMax = opts?.parkTombstoneMax ?? DEFAULT_PARK_TOMBSTONE_MAX;
-        this.parkTombstoneTtlMs = opts?.parkTombstoneTtlMs ?? DEFAULT_PARK_TOMBSTONE_TTL_MS;
-        this.parkTombstonePerPrincipalMax = opts?.parkTombstonePerPrincipalMax ?? DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX;
+        this.parkRedemptionMax = opts?.parkRedemptionMax ?? DEFAULT_PARK_REDEMPTION_MAX;
+        this.parkRedemptionTtlMs = opts?.parkRedemptionTtlMs ?? DEFAULT_PARK_REDEMPTION_TTL_MS;
+        this.parkRedemptionPerPrincipalMax = opts?.parkRedemptionPerPrincipalMax ?? DEFAULT_PARK_REDEMPTION_PER_PRINCIPAL_MAX;
         this.askAudit = opts?.askAudit;
         this.sessionGrants = opts?.sessionGrants;
         if (opts?.deploymentListAsks !== undefined && opts.sessionGrants === undefined) {
@@ -951,75 +1029,84 @@ export class ToolApprovalCoordinator {
             }
         }
     }
-    recordParkTombstone(approvalId, tomb) {
-        const existing = this.parkTombstones.get(approvalId);
-        if (existing !== undefined) {
-            if (existing.redeemed !== undefined || existing.inflight !== undefined)
-                return;
-            if (Date.now() - existing.parkedAtMs <= this.parkTombstoneTtlMs)
-                return;
-            this.parkTombstones.delete(approvalId);
+    parkRedemptionAdmission(owner) {
+        const effectivePerPrincipalMax = Math.min(this.parkRedemptionPerPrincipalMax, this.parkRedemptionMax);
+        let inflight = 0;
+        let ownInflight = 0;
+        for (const r of this.parkRedemptions.values()) {
+            if (r.inflight === undefined)
+                continue;
+            inflight++;
+            if (r.owner === owner)
+                ownInflight++;
         }
-        const effectivePerPrincipalMax = Math.min(this.parkTombstonePerPrincipalMax, this.parkTombstoneMax);
+        if (ownInflight < effectivePerPrincipalMax && inflight < this.parkRedemptionMax)
+            return undefined;
+        defaultLogger.warn("parked approval redemption refused at admission: too many redemptions in flight", { owner: owner ?? "<none>", ownInflight, inflight });
+        return {
+            status: 429,
+            body: refusalBody({
+                errorCode: "limit.rate_exceeded",
+                message: "too many late approval answers are being applied right now — retry after the Retry-After interval",
+                facts: { retryAfterSec: PARK_REDEMPTION_ADMISSION_RETRY_AFTER_SEC },
+            }),
+        };
+    }
+    openParkRedemption(askId, owner) {
+        const opened = { owner, stampedAtMs: Date.now() };
+        this.parkRedemptions.delete(askId);
+        this.parkRedemptions.set(askId, opened);
+        return opened;
+    }
+    retainParkRedemption(askId, memo) {
         const now = Date.now();
-        let ownCount = 0;
-        let ownExpiredVictim;
-        let ownBridgeVictim;
-        let ownPlainVictim;
-        let ownEvictable;
-        let globalExpiredVictim;
-        let globalBridgeVictim;
-        for (const [k, t] of this.parkTombstones) {
-            const expired = now - t.parkedAtMs > this.parkTombstoneTtlMs;
-            if (globalExpiredVictim === undefined && expired && t.inflight === undefined)
-                globalExpiredVictim = k;
-            if (globalBridgeVictim === undefined && t.kind === "voidBridge" && t.inflight === undefined)
-                globalBridgeVictim = k;
-            if (t.owner !== tomb.owner)
+        const effectivePerPrincipalMax = Math.min(this.parkRedemptionPerPrincipalMax, this.parkRedemptionMax);
+        let receipts = 0;
+        let ownReceipts = 0;
+        let ownExpired;
+        let ownOldest;
+        let globalExpired;
+        for (const [k, r] of this.parkRedemptions) {
+            if (k === askId || r.redeemed === undefined || r.inflight !== undefined)
                 continue;
-            ownCount++;
-            if (t.inflight !== undefined)
+            receipts++;
+            const expired = now - r.stampedAtMs > this.parkRedemptionTtlMs;
+            if (globalExpired === undefined && expired)
+                globalExpired = k;
+            if (r.owner !== memo.owner)
                 continue;
-            if (ownEvictable === undefined)
-                ownEvictable = k;
-            if (ownExpiredVictim === undefined && expired)
-                ownExpiredVictim = k;
-            if (ownBridgeVictim === undefined && t.kind === "voidBridge")
-                ownBridgeVictim = k;
-            if (ownPlainVictim === undefined && t.kind === "park" && t.redeemed === undefined)
-                ownPlainVictim = k;
-        }
-        const insertingBridge = tomb.kind === "voidBridge";
-        if (ownCount >= effectivePerPrincipalMax) {
-            const victim = insertingBridge ? (ownExpiredVictim ?? ownBridgeVictim) : (ownExpiredVictim ?? ownBridgeVictim ?? ownPlainVictim ?? ownEvictable);
-            if (victim === undefined) {
-                recordFailOpen("server.approval.park-tombstone-global-cap-refused", `owner=${tomb.owner ?? "<none>"} reason=${insertingBridge ? "bridge-would-evict-redeemable" : "all-inflight"}`);
-                return;
+            ownReceipts++;
+            if (ownOldest === undefined)
+                ownOldest = k;
+            if (ownExpired === undefined && expired)
+                ownExpired = k;
+        }
+        if (ownReceipts >= effectivePerPrincipalMax) {
+            const victim = ownExpired ?? ownOldest;
+            if (victim !== undefined)
+                this.parkRedemptions.delete(victim);
+        }
+        else if (receipts >= this.parkRedemptionMax) {
+            if (globalExpired === undefined) {
+                recordFailOpen("server.approval.park-redemption-cap-refused", `owner=${memo.owner ?? "<none>"}`);
+                if (this.parkRedemptions.get(askId) === memo)
+                    this.parkRedemptions.delete(askId);
+                return false;
             }
-            this.parkTombstones.delete(victim);
+            this.parkRedemptions.delete(globalExpired);
         }
-        else if (this.parkTombstones.size >= this.parkTombstoneMax && globalExpiredVictim !== undefined) {
-            this.parkTombstones.delete(globalExpiredVictim);
-        }
-        else if (this.parkTombstones.size >= this.parkTombstoneMax && !insertingBridge && globalBridgeVictim !== undefined) {
-            this.parkTombstones.delete(globalBridgeVictim);
-        }
-        else if (this.parkTombstones.size >= this.parkTombstoneMax) {
-            recordFailOpen("server.approval.park-tombstone-global-cap-refused", `owner=${tomb.owner ?? "<none>"}${insertingBridge ? " reason=bridge-refused-at-global-cap" : ""}`);
-            return;
-        }
-        this.parkTombstones.set(approvalId, tomb);
+        memo.stampedAtMs = now;
+        return true;
     }
-    lookupParkTombstone(approvalId) {
-        const tomb = this.parkTombstones.get(approvalId);
-        if (tomb === undefined)
+    lookupParkRedemption(askId) {
+        const r = this.parkRedemptions.get(askId);
+        if (r === undefined)
             return undefined;
-        if (Date.now() - tomb.parkedAtMs > this.parkTombstoneTtlMs) {
-            if (tomb.inflight === undefined)
-                this.parkTombstones.delete(approvalId);
+        if (r.inflight === undefined && Date.now() - r.stampedAtMs > this.parkRedemptionTtlMs) {
+            this.parkRedemptions.delete(askId);
             return undefined;
         }
-        return tomb;
+        return r;
     }
     notifyExternalDecision(askId, outcome) {
         const entries = this.pendingByAskId.get(askId);
@@ -1029,7 +1116,8 @@ export class ToolApprovalCoordinator {
         let settled = 0;
         for (const entry of [...entries]) {
             entry.settle(verdictOfDecided(args));
-            settled += 1;
+            if (entry.adopted !== true)
+                settled += 1;
         }
         return { settled };
     }
@@ -1211,7 +1299,6 @@ export class ToolApprovalCoordinator {
         let askId;
         let batchId;
         const card = this.askStore ? buildApprovalCard(frame, req, req.requiresRealApproval === true) : undefined;
-        let wireApprovalId = id;
         let cardForFrame = card;
         let persistedExpiresAtMs = expiresAtMs;
         let lateEnsuredRow;
@@ -1257,7 +1344,7 @@ export class ToolApprovalCoordinator {
                     toolCallId: req.toolCallId,
                     legKey,
                     parentToolCallId: req.delegation?.parentToolCallId ?? null,
-                    cardJson: buildApprovalCardEnvelope(id, card),
+                    cardJson: buildApprovalCardEnvelope(askId, card),
                     boundInputHash: readBoundInputHash(req),
                     ...durableRuleMaterial(ruleLaneMaterial),
                     schemaVersion: 1,
@@ -1289,8 +1376,6 @@ export class ToolApprovalCoordinator {
                     return existingOrCreated.inserted ? this.landUnattendedOutcome(unattended, existingOrCreated.row) : unattended;
                 }
                 persistedExpiresAtMs = existingOrCreated.row.expiresAtMs;
-                wireApprovalId = persistedEnvelope.approvalId;
-                frame.approvalId = wireApprovalId;
                 cardForFrame = persistedEnvelope.card;
                 if (cardForFrame.governanceForced === true)
                     frame.governanceForced = true;
@@ -1359,8 +1444,8 @@ export class ToolApprovalCoordinator {
                 if (!confirmedRowExists) {
                     askId = undefined;
                     batchId = undefined;
-                    if (reachability === "unreached") {
-                        const unattended = this.unattendedOutcome({ arm: "unreached_no_row", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                    if (!aliveCtxs.some(canPresentWithoutDurableRow)) {
+                        const unattended = this.unattendedOutcome({ arm: "no_row_no_presenter", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
                         const landed = abandonRow(unattended);
                         releaseAdmission();
                         return landed ?? unattended;
@@ -1369,6 +1454,8 @@ export class ToolApprovalCoordinator {
                 }
             }
         }
+        const wireApprovalId = askId ?? id;
+        frame.approvalId = wireApprovalId;
         let done = false;
         let emitFailed = false;
         let emitSettled = false;
@@ -1427,19 +1514,24 @@ export class ToolApprovalCoordinator {
                 sig.removeEventListener("abort", fn);
             this.pending.delete(id);
             if (windowRouteUnavailable && askId !== undefined && batchId !== undefined && this.unattendedRoutesToPark) {
-                this.recordParkTombstone(wireApprovalId, { kind: "park", askId, batchId, owner: origin.owner, parkedAtMs: Date.now() });
                 parkRouted = true;
             }
+            let lastLiveRegistration = false;
             if (askId !== undefined) {
                 const siblings = this.pendingByAskId.get(askId);
                 if (siblings && selfEntry) {
                     siblings.delete(selfEntry);
-                    if (siblings.size === 0)
+                    if (siblings.size === 0) {
                         this.pendingByAskId.delete(askId);
+                        lastLiveRegistration = true;
+                    }
                 }
             }
             lastOutcome = outcome;
             lastCause = verdict.by === "system" ? verdict.cause : undefined;
+            if (lastLiveRegistration && askId !== undefined) {
+                this.notifyPresentedCardWatchers(askId, buildApprovalCompleteFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, outcome, ...(lastCause !== undefined ? { cause: lastCause } : {}), parked: parkRouted, nowMs: Date.now() }));
+            }
             releaseAdmission();
             if (selfEntry)
                 selfEntry.settledOutcome = outcome;
@@ -1511,7 +1603,7 @@ export class ToolApprovalCoordinator {
             settleFromClaimLoss(read, armCause);
         };
         const boundedClaim = (mk, label, timeoutMs, late) => {
-            const release = this.admitTerminalClaim(askId ?? wireApprovalId);
+            const release = this.admitTerminalClaim(wireApprovalId);
             if (release === undefined)
                 return undefined;
             const raw = mk();
@@ -1583,7 +1675,6 @@ export class ToolApprovalCoordinator {
                     arm.onWon(outcome);
                     return;
                 }
-                arm.onLostTruth?.(outcome.current);
                 const read = this.classifyClaimLoss(pinnedAskId, outcome.current, `claim:${arm.intent}`);
                 if (done) {
                     broadcastClaimTruth(read, arm.cause);
@@ -1673,32 +1764,23 @@ export class ToolApprovalCoordinator {
             const store = this.askStore;
             const pinnedAskId = askId;
             const pinnedBatchId = batchId;
-            const cancelLostTruth = (current) => {
-                if (current.state !== "VOID")
-                    return;
-                this.recordParkTombstone(wireApprovalId, { kind: "voidBridge", askId: pinnedAskId, batchId: pinnedBatchId, owner: origin.owner, parkedAtMs: Date.now() });
-            };
             await resolveLocalOutcome({
                 intent: "cancel",
                 cause,
                 storeLabel: "claimTerminal(cancel)",
                 claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, "cancel", { cause }), "claimTerminal(cancel)", timeoutMs, (late) => {
                     if (!late.claimed) {
-                        cancelLostTruth(late.current);
                         lateClaimLossSettle(late.current, "cancel", cause);
                         return;
                     }
                     this.settleVoidedSiblings([pinnedAskId], cause);
-                    this.recordParkTombstone(wireApprovalId, { kind: "voidBridge", askId: pinnedAskId, batchId: pinnedBatchId, owner: origin.owner, parkedAtMs: Date.now() });
                     this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, [pinnedAskId], "aborted", Date.now(), origin.taskId));
                 }),
                 onWon: () => {
                     settle({ by: "system", cause });
                     this.settleVoidedSiblings([pinnedAskId], cause);
-                    this.recordParkTombstone(wireApprovalId, { kind: "voidBridge", askId: pinnedAskId, batchId: pinnedBatchId, owner: origin.owner, parkedAtMs: Date.now() });
                     this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, [pinnedAskId], "aborted", Date.now(), origin.taskId));
                 },
-                onLostTruth: cancelLostTruth,
                 settleByIntent: () => settle({ by: "system", cause }),
             });
         };
@@ -1750,6 +1832,9 @@ export class ToolApprovalCoordinator {
             const { rememberRefused: _stale, ...cardRest } = cardForFrame;
             cardForFrame = rememberRefused ? { ...cardRest, rememberRefused: true } : cardRest;
         }
+        const cardFrame = askId !== undefined && cardForFrame !== undefined
+            ? buildApprovalRequestFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, card: cardForFrame, expiresAtMs: persistedExpiresAtMs, nowMs: Date.now(), live: frame })
+            : undefined;
         const pendingEntry = {
             settle,
             forceParkNow,
@@ -1760,6 +1845,9 @@ export class ToolApprovalCoordinator {
             ...(child ? { originTaskId: req.sourceTaskId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
             frame,
+            ...(cardFrame !== undefined ? { cardFrame } : {}),
+            approvalId: wireApprovalId,
+            registrationId: id,
             toolName: req.toolName,
             grantBinding: entryGrantBinding,
             ...(entryClasses !== undefined ? { classes: entryClasses } : {}),
@@ -1777,6 +1865,7 @@ export class ToolApprovalCoordinator {
         selfEntry = pendingEntry;
         this.pending.set(id, pendingEntry);
         if (askId !== undefined) {
+            this.releaseAdoptedRegistrations(askId);
             let siblings = this.pendingByAskId.get(askId);
             if (!siblings) {
                 siblings = new Set();
@@ -1798,9 +1887,6 @@ export class ToolApprovalCoordinator {
         });
         if (this.shutdownDraining)
             forceParkNow(APPROVAL_ENDING_CAUSES.SHUTDOWN_BEFORE_PARK);
-        const cardFrame = askId !== undefined && cardForFrame !== undefined
-            ? buildApprovalRequestFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, card: cardForFrame, expiresAtMs: persistedExpiresAtMs, nowMs: Date.now() })
-            : undefined;
         {
             const serverNowMs = Date.now();
             frame.expiresAtMs = persistedExpiresAtMs;
@@ -1808,28 +1894,37 @@ export class ToolApprovalCoordinator {
             frame.expiresInMs = Math.max(0, persistedExpiresAtMs - serverNowMs);
         }
         const emitOne = async (c) => {
-            let delivered = true;
-            try {
-                await c.emit(frame);
+            let family;
+            let send;
+            if (c.emitCard !== undefined) {
+                if (cardFrame === undefined) {
+                    defaultLogger.warn("approval card leg cannot present this ask: it has no confirmed durable identity (no approval_request frame is minted without one)", {
+                        taskId: origin.taskId,
+                        approvalId: wireApprovalId,
+                        toolName: req.toolName,
+                    });
+                    return { delivered: false };
+                }
+                family = "approval_request";
+                send = () => c.emitCard(cardFrame, id);
             }
-            catch {
-                delivered = false;
+            else {
+                family = "tool_approval";
+                send = () => c.emit(frame);
             }
-            let cardDelivered = false;
-            if (cardFrame && c.emitCard) {
-                try {
-                    await c.emitCard(cardFrame);
-                    cardDelivered = true;
-                }
-                catch {
-                }
+            try {
+                await send();
+                return { delivered: true };
+            }
+            catch (err) {
+                defaultLogger.warn("approval_card_delivery_failed", { taskId: origin.taskId, approvalId: wireApprovalId, family, errKind: errorKindOf(err) });
+                return { delivered: false };
             }
-            return { legacy: delivered, card: cardDelivered };
         };
         const openByCtx = new Map(aliveCtxs.map((c) => [c, emitOne(c)]));
         const emitAllP = (async () => {
             const results = await Promise.all(openByCtx.values());
-            const anySucceeded = reachability === "unreached" || this.hasOtherSuspendedOwner(askId, selfEntry) || results.some((r) => r.legacy || r.card);
+            const anySucceeded = reachability === "unreached" || this.hasOtherSuspendedOwner(askId, selfEntry) || results.some((r) => r.delivered);
             emitSettled = true;
             if (!anySucceeded && !done) {
                 if (this.askStore && askId !== undefined && batchId !== undefined) {
@@ -1873,15 +1968,30 @@ export class ToolApprovalCoordinator {
         for (const c of aliveCtxs) {
             void openByCtx
                 .get(c)
-                .then((delivered) => delivered.legacy
-                ? c.emit({
+                .then(({ delivered }) => {
+                if (!delivered)
+                    return undefined;
+                if (c.emitCard !== undefined) {
+                    if (cardFrame === undefined)
+                        return undefined;
+                    return c.emitCard(buildApprovalCompleteFrame({
+                        askId: cardFrame.askId,
+                        taskId: cardFrame.taskId,
+                        approvalId: wireApprovalId,
+                        outcome: lastOutcome,
+                        ...(lastCause !== undefined ? { cause: lastCause } : {}),
+                        parked: parkRouted,
+                        nowMs: Date.now(),
+                    }), id);
+                }
+                return c.emit({
                     type: "tool_approval_complete",
                     approvalId: wireApprovalId,
                     outcome: lastOutcome,
                     ...(lastCause !== undefined ? { cause: lastCause } : {}),
                     ...(parkRouted ? { parked: true } : {}),
-                })
-                : undefined)
+                });
+            })
                 .catch(() => undefined);
         }
         if (emitFailed)
@@ -1892,24 +2002,47 @@ export class ToolApprovalCoordinator {
             return this.unattendedOutcome({ arm: "emit_unsettled", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
         return shapeOutcome(settled);
     }
-    respond(id, principal, body, httpReq) {
+    respond(id, principal, body, httpReq, deployment) {
         const parsed = parseToolApprovalResponse(body);
         if (!parsed.ok)
-            return { status: 400, body: { error: parsed.error, errorCode: "request.body_shape", ...(parsed.field !== undefined ? { field: parsed.field } : {}) } };
-        const entry = this.pending.get(id);
+            return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: parsed.error, facts: { ...(parsed.field !== undefined ? { field: parsed.field } : {}) } }) };
+        if (parsed.readRootGrant !== undefined && deployment?.readRootGrantAccepted !== true) {
+            return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: READ_ROOT_GRANT_NOT_ACCEPTED }) };
+        }
+        const entry = this.liveEntryFor(id);
+        if (entry?.adopted === true)
+            return this.respondAdopted(entry, id, principal, parsed, httpReq);
         if (!entry || (entry.owner !== null && entry.owner !== principal)) {
             return this.respondLate(id, principal, parsed, httpReq);
         }
+        return this.answerRegistration(entry, id, principal, parsed, httpReq);
+    }
+    async respondAdopted(entry, id, principal, parsed, httpReq) {
+        const store = this.askStore;
+        if (!store)
+            return this.notPending();
+        const row = await this.askRowFor(store, id, "getAsk(respond-adopted)");
+        if (!askRowVisibleTo(row, principal))
+            return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
+        if (row.state !== "STREAM_PENDING")
+            return this.dispatchRowTruth(row, id, parsed, httpReq, principal);
+        return this.answerRegistration(entry, id, principal, parsed, httpReq);
+    }
+    answerRegistration(entry, id, principal, parsed, httpReq) {
         const preRule = this.precheckEditedRuleBeforeDecision(entry, parsed);
         if (preRule !== undefined)
             return preRule;
         if (parsed.value !== "deny" && policyCannotAnswer(heldAskOf(entry.requiresRealApproval === true), parsed.decidedBy)) {
-            return { status: 400, body: { error: POLICY_CANNOT_ALLOW_PERSON_ASK, errorCode: "request.body_shape" } };
+            return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: POLICY_CANNOT_ALLOW_PERSON_ASK }) };
         }
         const ruleEligibility = { eligible: true };
-        const decided = this.askStore && entry.askId !== undefined && entry.batchId !== undefined
-            ? this.respondWithCas(this.askStore, entry.askId, entry.batchId, id, entry, parsed, ruleEligibility)
-            : this.finishRespond(id, entry, parsed);
+        const store = this.askStore;
+        if (store && entry.askId !== undefined && entry.batchId !== undefined) {
+            return this.respondWithCas(store, entry.askId, entry.batchId, entry, parsed, ruleEligibility).then((cas) => cas.lost ? this.dispatchRowTruth(cas.row, id, parsed, httpReq, principal) : this.afterLiveDecision(cas.result, entry, parsed, principal, ruleEligibility));
+        }
+        return this.afterLiveDecision(this.finishRespond(entry, parsed), entry, parsed, principal, ruleEligibility);
+    }
+    afterLiveDecision(decided, entry, parsed, principal, ruleEligibility) {
         const settled = this.recordDeploymentListAnswer(decided, entry, parsed, principal, ruleEligibility);
         if (parsed.persistRule === undefined)
             return settled;
@@ -1956,11 +2089,13 @@ export class ToolApprovalCoordinator {
             return undefined;
         return {
             status: 400,
-            body: {
-                error: verdict.message,
+            body: refusalBody({
                 errorCode: "request.body_shape",
-                ...(verdict.code !== undefined ? { ruleRejectCode: verdict.code } : {}),
-            },
+                message: verdict.message,
+                facts: {
+                    ...(verdict.code !== undefined ? { ruleRejectCode: verdict.code } : {}),
+                },
+            }),
         };
     }
     editedArmEcho(persistRule, persisted) {
@@ -1971,45 +2106,156 @@ export class ToolApprovalCoordinator {
     notPending(cause) {
         return {
             status: 404,
-            body: {
-                error: "no pending tool approval for this id (settled, expired, or not on this replica)",
+            body: refusalBody({
                 errorCode: "tool_approval.not_pending",
-                ...(cause !== undefined ? { cause } : {}),
-            },
+                message: "no pending tool approval for this id (settled, expired, or not on this replica)",
+                facts: {
+                    ...(cause !== undefined ? { cause } : {}),
+                },
+            }),
         };
     }
-    respondLate(id, principal, parsed, httpReq) {
+    readApproval(id, principal) {
+        const entry = this.liveEntryFor(id);
+        if (entry?.adopted === true)
+            return this.readAdopted(entry, id, principal);
+        if (entry !== undefined && (entry.owner === null || entry.owner === principal)) {
+            const body = { state: "pending", ...livePendingRowOf(entry) };
+            return { status: 200, body };
+        }
         const store = this.askStore;
         if (!store)
             return this.notPending();
-        const tomb = this.lookupParkTombstone(id);
-        if (tomb === undefined || (tomb.owner !== null && tomb.owner !== principal)) {
+        return this.readAskRowState(store, id, principal);
+    }
+    async readAdopted(entry, id, principal) {
+        const store = this.askStore;
+        if (!store)
+            return this.notPending();
+        const row = await this.askRowFor(store, id, "getAsk(read-adopted)");
+        if (askRowVisibleTo(row, principal) && row.state === "STREAM_PENDING") {
+            const body = { state: "pending", ...livePendingRowOf(entry) };
+            return { status: 200, body };
+        }
+        return this.readStateOfRow(row, principal);
+    }
+    async readAskRowState(store, id, principal) {
+        return this.readStateOfRow(await this.askRowFor(store, id, "getAsk(read)"), principal);
+    }
+    readStateOfRow(row, principal) {
+        if (!askRowVisibleTo(row, principal))
             return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
+        const projection = buildAskRowReadProjection(row, Date.now());
+        let body;
+        switch (row.state) {
+            case "DECIDED": {
+                const decided = decidedRowFacts(row);
+                if (decided === undefined)
+                    return this.notPending();
+                body = { state: "decided", ...projection, ...decided };
+                break;
+            }
+            case "PARKING":
+            case "PARKED": {
+                const parkSession = parkSessionOf(row);
+                body = { state: "parked", ...projection, ...(parkSession !== undefined ? { decidePath: approvalDecidePath(parkSession) } : {}) };
+                break;
+            }
+            case "DENIED":
+            case "VOID": {
+                const rowCause = causeOfAskRow(row);
+                body = { state: "void", ...projection, ...(rowCause?.kind === "ending" ? { cause: rowCause.cause } : {}) };
+                break;
+            }
+            case "STREAM_PENDING":
+                return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
+            default: {
+                const unhandled = row.state;
+                defaultLogger.error("tool approval read hit an unknown ask state", { askId: row.askId, state: unhandled });
+                return this.notPending();
+            }
         }
-        return this.dispatchLateByRow(store, tomb, id, parsed, httpReq, principal);
+        return { status: 200, body };
     }
-    async dispatchLateByRow(store, tomb, id, parsed, httpReq, principal) {
-        let row;
+    respondLate(id, principal, parsed, httpReq) {
+        const store = this.askStore;
+        if (!store)
+            return this.notPending();
+        return this.dispatchLateByRow(store, id, parsed, httpReq, principal);
+    }
+    watchPresentedCards(askIds, deliver) {
+        const watcher = { deliver, askIds: new Set() };
+        for (const askId of askIds) {
+            if (!this.pendingByAskId.has(askId))
+                continue;
+            watcher.askIds.add(askId);
+            let set = this.presentedCardWatchers.get(askId);
+            if (set === undefined) {
+                set = new Set();
+                this.presentedCardWatchers.set(askId, set);
+            }
+            set.add(watcher);
+        }
+        return () => {
+            for (const askId of watcher.askIds)
+                this.dropPresentedCardWatcher(askId, watcher);
+            watcher.askIds.clear();
+        };
+    }
+    dropPresentedCardWatcher(askId, watcher) {
+        const set = this.presentedCardWatchers.get(askId);
+        if (set === undefined)
+            return;
+        set.delete(watcher);
+        if (set.size === 0)
+            this.presentedCardWatchers.delete(askId);
+    }
+    notifyPresentedCardWatchers(askId, frame) {
+        const set = this.presentedCardWatchers.get(askId);
+        if (set === undefined)
+            return;
+        this.presentedCardWatchers.delete(askId);
+        for (const watcher of set) {
+            watcher.askIds.delete(askId);
+            try {
+                watcher.deliver(frame);
+            }
+            catch (err) {
+                defaultLogger.warn("presented-card completion notice could not be written to its connection", { askId, error: err instanceof Error ? err.message : String(err) });
+            }
+        }
+    }
+    liveEntryFor(id) {
+        const local = this.pending.get(id);
+        if (local !== undefined)
+            return local.askId === undefined ? local : undefined;
+        for (const e of this.pendingByAskId.get(id) ?? [])
+            return e;
+        return undefined;
+    }
+    async dispatchLateByRow(store, id, parsed, httpReq, principal) {
+        return this.dispatchRowTruth(await this.askRowFor(store, id, "getAsk(respond-late)"), id, parsed, httpReq, principal);
+    }
+    async askRowFor(store, id, label) {
         try {
-            row = await this.withStoreDeadline(store.getAsk(tomb.askId), "getAsk(respond-late)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
+            return await this.withStoreDeadline(store.getAsk(id), label, DURABLE_CONVERGE_READ_TIMEOUT_MS);
         }
         catch (err) {
-            this.noteStoreError(err, "getAsk(respond-late)");
-            return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
+            this.noteStoreError(err, label);
+            return null;
         }
-        if (row === null)
-            return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
-        if (row.owner !== null && row.owner !== principal) {
-            defaultLogger.warn("tool approval late decision rejected: the ask row changed owner since it parked", { askId: row.askId });
+    }
+    async dispatchRowTruth(row, id, parsed, httpReq, principal) {
+        if (!askRowVisibleTo(row, principal))
             return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
-        }
-        if (tomb.redeemed !== undefined)
-            return this.replayRedeemReceipt(id, tomb, row, tomb.redeemed, parsed);
+        const receipt = this.lookupParkRedemption(row.askId);
+        if (receipt?.redeemed !== undefined)
+            return this.replayRedeemReceipt(id, receipt, row, receipt.redeemed, parsed);
         switch (row.state) {
             case "DECIDED":
                 return this.replayDecidedAsk(id, row, parsed);
             case "PARKED":
-                return this.redeemParkedAsk(id, tomb, row, parsed, httpReq, principal);
+                return this.redeemParkedAsk(id, row, parsed, httpReq, principal);
             case "PARKING": {
                 const parkSession = parkSessionOf(row);
                 return {
@@ -2036,7 +2282,7 @@ export class ToolApprovalCoordinator {
                 return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
             default: {
                 const unhandled = row.state;
-                defaultLogger.error("tool approval respond hit an unknown ask state", { askId: tomb.askId, state: unhandled });
+                defaultLogger.error("tool approval respond hit an unknown ask state", { askId: row.askId, state: unhandled });
                 return this.notPending();
             }
         }
@@ -2047,7 +2293,8 @@ export class ToolApprovalCoordinator {
         return { rulePersisted: false, ruleRefusal: "rule_lane_unavailable" };
     }
     replayDecidedAsk(id, row, parsed) {
-        if ((row.decision !== "approve" && row.decision !== "deny") || row.provisional || row.decidedAtMs === null) {
+        const decided = decidedRowFacts(row);
+        if (decided === undefined) {
             defaultLogger.error("tool approval late replay saw a DECIDED row that is not a usable human decision", {
                 askId: row.askId,
                 decision: row.decision,
@@ -2063,15 +2310,14 @@ export class ToolApprovalCoordinator {
                 approvalId: id,
                 askId: row.askId,
                 idempotent: true,
-                decision: row.decision === "approve" ? "allow" : "deny",
-                decidedAtMs: row.decidedAtMs,
-                ...(row.decisionNote !== null ? { decisionNote: row.decisionNote } : {}),
+                ...decided,
                 ...(parsed.value === "allow_session" ? { rememberApplied: false } : {}),
+                ...noteRecordedReceipt(parsed.note, noteLandedOnRow(parsed.note, row.decisionNote)),
                 ...this.lateRuleRefusal(parsed),
             },
         };
     }
-    async redeemParkedAsk(id, tomb, row, parsed, httpReq, principal) {
+    async redeemParkedAsk(id, row, parsed, httpReq, principal) {
         const redeem = this.parkedRedeem?.();
         if (redeem === undefined)
             return this.notPending();
@@ -2079,14 +2325,19 @@ export class ToolApprovalCoordinator {
             defaultLogger.error("tool approval parked row carries no gate token — nothing to redeem", { askId: row.askId });
             return this.notPending();
         }
-        if (tomb.redeemed !== undefined)
-            return this.replayRedeemReceipt(id, tomb, row, tomb.redeemed, parsed);
-        if (tomb.inflight !== undefined) {
-            const shared = await tomb.inflight;
+        const prior = this.lookupParkRedemption(row.askId);
+        if (prior?.redeemed !== undefined)
+            return this.replayRedeemReceipt(id, prior, row, prior.redeemed, parsed);
+        if (prior?.inflight !== undefined) {
+            const shared = await prior.inflight;
             if (shared.status < 200 || shared.status >= 300)
                 return shared;
-            return this.replayRedeemReceipt(id, tomb, row, { decision: shared.decision, body: shared.body, ...(shared.rule?.terminal === true ? { rule: shared.rule.body } : {}) }, parsed);
+            return this.replayRedeemReceipt(id, prior, row, { decision: shared.decision, body: shared.body, ...(shared.rule?.terminal === true ? { rule: shared.rule.body } : {}) }, parsed);
         }
+        const admission = this.parkRedemptionAdmission(row.owner);
+        if (admission !== undefined)
+            return admission;
+        const memo = this.openParkRedemption(row.askId, row.owner);
         const decision = parsed.value === "deny" ? "deny" : "approve";
         const gateToken = row.gateToken;
         const flight = (async () => {
@@ -2107,25 +2358,29 @@ export class ToolApprovalCoordinator {
             }
             catch (err) {
                 defaultLogger.error("tool approval parked redemption threw", { askId: row.askId, error: err instanceof Error ? err.message : String(err) });
-                return { status: 500, body: { error: "the parked approval could not be redeemed right now — retry", errorCode: "internal.error" }, decision };
+                return { status: 500, body: refusalBody({ errorCode: "internal.error", message: "the parked approval could not be redeemed right now — retry" }), decision };
             }
             if (res.status < 200 || res.status >= 300)
                 return { ...res, decision };
             const rule = await this.persistRuleFromRow(row, parsed);
             return { ...res, decision, ...(rule !== undefined ? { rule } : {}) };
         })();
-        tomb.inflight = flight;
+        memo.inflight = flight;
         let out;
         try {
             out = await flight;
         }
         finally {
-            tomb.inflight = undefined;
+            memo.inflight = undefined;
         }
-        if (out.status < 200 || out.status >= 300)
+        if (out.status < 200 || out.status >= 300) {
+            if (this.parkRedemptions.get(row.askId) === memo)
+                this.parkRedemptions.delete(row.askId);
             return { status: out.status, body: out.body };
+        }
         const rule = out.rule;
-        tomb.redeemed = { decision, body: out.body, ...(rule?.terminal === true ? { rule: rule.body } : {}) };
+        if (this.retainParkRedemption(row.askId, memo))
+            memo.redeemed = { decision, body: out.body, ...(rule?.terminal === true ? { rule: rule.body } : {}) };
         return {
             status: out.status,
             body: {
@@ -2216,24 +2471,24 @@ export class ToolApprovalCoordinator {
             return { ...flag(false, "rule_store_error"), terminal: false };
         }
     }
-    async replayRedeemReceipt(id, tomb, row, receipt, parsed) {
-        let rule = receipt.rule;
-        if (rule === undefined && parsed.persistRule !== undefined) {
-            const flight = tomb.ruleInflight ?? this.persistRuleFromRow(row, parsed);
-            const isOwner = tomb.ruleInflight === undefined;
+    async replayRedeemReceipt(id, memo, row, receipt, parsed) {
+        let rule = receipt.decision === "approve" ? receipt.rule : this.lateRuleRefusal(parsed);
+        if (receipt.decision === "approve" && rule === undefined && parsed.persistRule !== undefined) {
+            const flight = memo.ruleInflight ?? this.persistRuleFromRow(row, parsed);
+            const isOwner = memo.ruleInflight === undefined;
             if (isOwner)
-                tomb.ruleInflight = flight;
+                memo.ruleInflight = flight;
             let fresh;
             try {
                 fresh = await flight;
             }
             finally {
                 if (isOwner)
-                    tomb.ruleInflight = undefined;
+                    memo.ruleInflight = undefined;
             }
             rule = fresh?.body;
-            if (fresh?.terminal === true && tomb.redeemed !== undefined)
-                tomb.redeemed.rule = fresh.body;
+            if (fresh?.terminal === true && memo.redeemed !== undefined)
+                memo.redeemed.rule = fresh.body;
         }
         return {
             status: 200,
@@ -2328,7 +2583,7 @@ export class ToolApprovalCoordinator {
             return withFlag(false, "rule_store_error");
         }
     }
-    async respondWithCas(askStore, askId, batchId, id, entry, parsed, ruleEligibility) {
+    async respondWithCas(askStore, askId, batchId, entry, parsed, ruleEligibility) {
         let winnerRow;
         let ambiguousConfirmedRow;
         let noteLanded = false;
@@ -2347,7 +2602,7 @@ export class ToolApprovalCoordinator {
                 noteLanded = true;
             }
             if (!decided.ok) {
-                return this.notPending();
+                return { lost: true, row: decided.row };
             }
         }
         catch (err) {
@@ -2358,7 +2613,7 @@ export class ToolApprovalCoordinator {
                 if (row?.state === "DECIDED" && row.decision === (parsed.value === "deny" ? "deny" : "approve")) {
                     winnerRow = row;
                     ambiguousConfirmedRow = row;
-                    noteLanded = parsed.note === undefined || row.decisionNote === parsed.note;
+                    noteLanded = noteLandedOnRow(parsed.note, row.decisionNote);
                 }
             }
             catch (confirmErr) {
@@ -2367,27 +2622,27 @@ export class ToolApprovalCoordinator {
         }
         const wantAllowed = parsed.value !== "deny";
         const decidedWon = winnerRow !== undefined;
-        if (this.pending.get(id) !== entry) {
-            if (winnerRow !== undefined)
-                this.notifyExternalDecision(askId, outcomeOfDecidedRow(winnerRow));
-            const converged = decidedWon && entry.settledOutcome === (wantAllowed ? SETTLE_OUTCOME.ALLOWED : SETTLE_OUTCOME.DENIED);
+        if (entry.adopted === true && !decidedWon)
+            return { lost: false, result: this.notPending() };
+        if (this.pending.get(entry.registrationId) !== entry) {
+            const othersReached = winnerRow !== undefined ? this.notifyExternalDecision(askId, outcomeOfDecidedRow(winnerRow)).settled : 0;
+            const converged = decidedWon && (entry.adopted === true || entry.settledOutcome === (wantAllowed ? SETTLE_OUTCOME.ALLOWED : SETTLE_OUTCOME.DENIED));
             if (!converged) {
-                return this.notPending();
+                return { lost: false, result: this.notPending() };
             }
-            return this.finishRespond(id, entry, parsed, { updatedInputDelivered: false, noteRecorded: noteLanded });
+            return { lost: false, result: withConsumerDisclosure(this.finishRespond(entry, parsed, { updatedInputDelivered: false, noteRecorded: noteLanded }), waitingLegsReached(entry, othersReached)) };
         }
         const payloadIsMine = ambiguousConfirmedRow === undefined ||
             approvalPayloadFingerprint({ updatedInput: ambiguousConfirmedRow.updatedInput }) === approvalPayloadFingerprint({ updatedInput: parsed.updatedInput });
-        const result = this.finishRespond(id, entry, parsed, {
+        const result = this.finishRespond(entry, parsed, {
             noteRecorded: noteLanded,
             ...(winnerRow !== undefined ? { settleOutcome: outcomeOfDecidedRow(winnerRow), settleOutcomeIsThisRequest: ambiguousConfirmedRow === undefined } : {}),
-            ...(ambiguousConfirmedRow !== undefined ? { updatedInputDelivered: payloadIsMine } : {}),
+            ...(entry.adopted === true ? { updatedInputDelivered: false } : ambiguousConfirmedRow !== undefined ? { updatedInputDelivered: payloadIsMine } : {}),
         });
-        if (winnerRow !== undefined)
-            this.notifyExternalDecision(askId, outcomeOfDecidedRow(winnerRow));
-        return result;
+        const othersReached = winnerRow !== undefined ? this.notifyExternalDecision(askId, outcomeOfDecidedRow(winnerRow)).settled : 0;
+        return { lost: false, result: withConsumerDisclosure(result, waitingLegsReached(entry, othersReached)) };
     }
-    finishRespond(id, entry, parsed, opts) {
+    finishRespond(entry, parsed, opts) {
         let rememberApplied;
         const home = standingAnswerHome(pendingEntryStandingAnswerFacts(entry));
         let grantable;
@@ -2430,42 +2685,146 @@ export class ToolApprovalCoordinator {
         return {
             status: 200,
             body: {
-                approvalId: id,
+                approvalId: entry.approvalId,
                 delivery: "applied",
                 decision: parsed.value,
                 ...(rememberApplied !== undefined ? { rememberApplied } : {}),
                 ...(parsed.updatedInput !== undefined && allowed && updatedInputDelivered ? { updatedInputForwarded: true } : {}),
-                ...(parsed.note !== undefined ? { noteRecorded } : {}),
+                ...noteRecordedReceipt(parsed.note, noteRecorded),
             },
         };
     }
+    async adoptOpenAsks() {
+        const store = this.askStore;
+        if (!store)
+            return { adopted: 0, alreadyLive: 0, cardUnreadable: 0, capped: false };
+        let rows;
+        try {
+            rows = await this.withStoreDeadline(store.listByState("STREAM_PENDING", ADOPT_OPEN_ASKS_MAX + 1), "listByState(adopt)");
+        }
+        catch (err) {
+            throw new Error(`approval ledger adoption: could not read the approval asks that are still pending in the ask ledger (${err instanceof Error ? err.message : String(err)}) — ` +
+                "refusing to start, because serving now would hide asks that are still waiting for an answer from GET /v1/approvals. Check the database and start again.");
+        }
+        const capped = rows.length > ADOPT_OPEN_ASKS_MAX;
+        const nowMs = Date.now();
+        let adopted = 0;
+        let alreadyLive = 0;
+        let cardUnreadable = 0;
+        for (const row of capped ? rows.slice(0, ADOPT_OPEN_ASKS_MAX) : rows) {
+            if (this.pendingByAskId.has(row.askId)) {
+                alreadyLive += 1;
+                continue;
+            }
+            const replayFrame = buildReplayFrame(row, nowMs);
+            if (replayFrame === undefined) {
+                cardUnreadable += 1;
+                continue;
+            }
+            this.registerAdopted(row, replayFrame);
+            adopted += 1;
+        }
+        return { adopted, alreadyLive, cardUnreadable, capped };
+    }
+    registerAdopted(row, replayFrame) {
+        const card = replayFrame.card;
+        const registrationId = uuidv7();
+        const facts = {
+            ...(card.governanceForced === true ? { governanceForced: true } : {}),
+            ...(card.risk.requiresRealApproval ? { requiresRealApproval: true } : {}),
+            grantBinding: { kind: "unreadable" },
+            ...(card.classes !== undefined ? { classes: card.classes } : {}),
+        };
+        const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts(facts)) === "none";
+        const cardFrame = (card.rememberRefused === true) === rememberRefused
+            ? replayFrame
+            : { ...replayFrame, card: rememberRefused ? { ...card, rememberRefused: true } : (({ rememberRefused: _stale, ...rest }) => rest)(card) };
+        let done = false;
+        const leave = (ended) => {
+            if (done)
+                return;
+            done = true;
+            this.pending.delete(registrationId);
+            entry.settledOutcome = ended?.outcome ?? SETTLE_OUTCOME.EXPIRED;
+            const siblings = this.pendingByAskId.get(row.askId);
+            siblings?.delete(entry);
+            const lastRegistration = siblings !== undefined && siblings.size === 0;
+            if (lastRegistration)
+                this.pendingByAskId.delete(row.askId);
+            if (ended !== undefined && lastRegistration) {
+                this.notifyPresentedCardWatchers(row.askId, buildApprovalCompleteFrame({ askId: row.askId, taskId: row.taskId, approvalId: row.askId, outcome: ended.outcome, ...(ended.cause !== undefined ? { cause: ended.cause } : {}), parked: ended.parked, nowMs: Date.now() }));
+            }
+        };
+        const release = () => leave(undefined);
+        const entry = {
+            adopted: true,
+            cardFrame,
+            release,
+            settle: (verdict) => leave(verdict.by === "system" ? { outcome: SETTLE_OUTCOME.EXPIRED, cause: verdict.cause, parked: false } : { outcome: verdict.allowed ? SETTLE_OUTCOME.ALLOWED : SETTLE_OUTCOME.DENIED, parked: false }),
+            forceParkNow: release,
+            settleParkRoute: (cause) => leave({ outcome: SETTLE_OUTCOME.EXPIRED, cause, parked: this.unattendedRoutesToPark }),
+            owner: row.owner,
+            ...(row.sessionId !== row.taskId ? { sessionId: row.sessionId } : {}),
+            ...(card.fromSubagent === true ? { originTaskId: row.sourceTaskId } : {}),
+            toolName: card.toolName,
+            ...facts,
+            approvalId: row.askId,
+            registrationId,
+            registeredAtMs: row.createdAtMs,
+            expiresAtMs: row.expiresAtMs,
+            askId: row.askId,
+            batchId: row.batchId,
+        };
+        this.pending.set(registrationId, entry);
+        const siblings = this.pendingByAskId.get(row.askId) ?? new Set();
+        siblings.add(entry);
+        this.pendingByAskId.set(row.askId, siblings);
+    }
+    releaseAdoptedRegistrations(askId) {
+        for (const e of [...(this.pendingByAskId.get(askId) ?? [])])
+            if (e.adopted === true)
+                e.release();
+    }
+    forgetAdoptedAsk(askId) {
+        this.releaseAdoptedRegistrations(askId);
+        if (this.pendingByAskId.has(askId))
+            return;
+        const watchers = this.presentedCardWatchers.get(askId);
+        if (watchers === undefined)
+            return;
+        this.presentedCardWatchers.delete(askId);
+        for (const watcher of watchers)
+            watcher.askIds.delete(askId);
+    }
+    followAdoptedOwner(askId, owner) {
+        for (const e of this.pendingByAskId.get(askId) ?? [])
+            if (e.adopted === true)
+                e.owner = owner;
+    }
+    waitingRegistrationCount(askId) {
+        let n = 0;
+        for (const e of this.pendingByAskId.get(askId) ?? [])
+            if (e.adopted !== true)
+                n += 1;
+        return n;
+    }
     listLivePending(scope) {
         const rows = [];
-        for (const [id, e] of this.pending) {
-            if (scope !== undefined && e.owner !== scope)
+        const owner = scope === undefined ? undefined : ownerOfCheckpointScope(scope);
+        const seen = new Set();
+        for (const e of this.pending.values()) {
+            if (owner !== undefined && e.owner !== owner)
                 continue;
-            rows.push({
-                approvalId: id,
-                toolName: e.toolName,
-                ts: e.registeredAtMs,
-                expiresAtMs: e.expiresAtMs,
-                ...(e.sessionId !== undefined ? { sessionId: e.sessionId } : {}),
-                ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
-                ...(e.governanceForced ? { governanceForced: true } : {}),
-                ...(e.mandated ? { mandated: true } : {}),
-                ...(standingAnswerHome(pendingEntryStandingAnswerFacts(e)) === "none" ? { rememberRefused: true } : {}),
-                ...(e.mandate !== undefined ? { mandate: e.mandate } : {}),
-                ...(e.origin !== undefined ? { origin: e.origin } : {}),
-                ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
-                ...(e.frame.approvalCard !== undefined ? { approvalCard: e.frame.approvalCard } : {}),
-                frame: e.frame.approvalId === id ? e.frame : { ...e.frame, approvalId: id },
-            });
+            if (seen.has(e.approvalId))
+                continue;
+            seen.add(e.approvalId);
+            rows.push(livePendingRowOf(e));
         }
         return rows;
     }
     hasLivePendingFrom(originTaskId) {
         for (const e of this.pending.values())
-            if (e.originTaskId === originTaskId)
+            if (e.originTaskId === originTaskId && e.adopted !== true)
                 return true;
         return false;
     }
@@ -2473,27 +2832,42 @@ export class ToolApprovalCoordinator {
         const store = this.askStore;
         if (!store)
             return { polled: 0, settled: 0, backlog: 0, truncated: false };
-        const candidates = [];
+        const waiting = [];
+        const adopted = [];
         const seen = new Set();
         for (const entry of this.pending.values()) {
-            if (entry.suspended === true && entry.askId !== undefined && entry.settledOutcome === undefined && !seen.has(entry.askId)) {
-                seen.add(entry.askId);
-                candidates.push(entry.askId);
-            }
-        }
-        const start = candidates.length > 0 ? this.suspendedPollOffset % candidates.length : 0;
-        const ordered = [...candidates.slice(start), ...candidates.slice(0, start)];
+            if (entry.askId === undefined || entry.settledOutcome !== undefined || seen.has(entry.askId))
+                continue;
+            if (entry.suspended === true)
+                waiting.push(entry.askId);
+            else if (entry.adopted === true)
+                adopted.push(entry.askId);
+            else
+                continue;
+            seen.add(entry.askId);
+        }
+        const waitingStart = waiting.length > 0 ? this.suspendedPollOffset % waiting.length : 0;
+        const adoptedStart = adopted.length > 0 ? this.adoptedPollOffset % adopted.length : 0;
+        const ordered = [
+            ...[...waiting.slice(waitingStart), ...waiting.slice(0, waitingStart)].map((askId) => ({ askId, tier: "waiting" })),
+            ...[...adopted.slice(adoptedStart), ...adopted.slice(0, adoptedStart)].map((askId) => ({ askId, tier: "adopted" })),
+        ];
         const deadlineMs = Date.now() + SUSPENDED_POLL_BUDGET_MS;
         let settled = 0;
         let polled = 0;
+        let polledWaiting = 0;
+        let polledAdopted = 0;
         let truncated = false;
-        for (const askId of ordered) {
+        for (const { askId, tier } of ordered) {
             if (polled >= SUSPENDED_POLL_MAX_PER_TICK || Date.now() >= deadlineMs) {
                 truncated = true;
                 break;
             }
             polled++;
-            this.suspendedPollOffset = start + polled;
+            if (tier === "waiting")
+                this.suspendedPollOffset = waitingStart + ++polledWaiting;
+            else
+                this.adoptedPollOffset = adoptedStart + ++polledAdopted;
             let row;
             try {
                 row = await this.withStoreDeadline(store.getAsk(askId), "getAsk(poll-suspended)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
@@ -2502,20 +2876,26 @@ export class ToolApprovalCoordinator {
                 this.noteStoreError(err, "getAsk(poll-suspended)");
                 continue;
             }
-            if (row === null || row.state === "STREAM_PENDING")
+            if (row === null) {
+                this.forgetAdoptedAsk(askId);
+                continue;
+            }
+            if (row.state === "STREAM_PENDING") {
+                this.followAdoptedOwner(askId, row.owner);
                 continue;
+            }
             if (this.editedDecisionInFlight(askId))
                 continue;
             const rowCause = causeOfAskRow(row);
             if (rowCause?.kind === "ending") {
-                const before = this.pendingByAskId.get(askId)?.size ?? 0;
+                const before = this.waitingRegistrationCount(askId);
                 this.settleVoidedSiblings([askId], rowCause.cause);
                 settled += before;
                 continue;
             }
             const outcome = replayTerminalAskRow(row);
             if (outcome === "unavailable") {
-                const before = this.pendingByAskId.get(askId)?.size ?? 0;
+                const before = this.waitingRegistrationCount(askId);
                 const parkCause = (rowCause?.kind === "park_trigger" ? rowCause.cause : undefined) ?? (Date.now() >= row.expiresAtMs ? APPROVAL_ENDING_CAUSES.TTL_EXPIRED : APPROVAL_ENDING_CAUSES.SHUTDOWN_BEFORE_PARK);
                 this.settleSameAskIdParkRoute(askId, parkCause);
                 settled += before;
@@ -2524,7 +2904,7 @@ export class ToolApprovalCoordinator {
             const delivered = this.notifyExternalDecision(askId, outcome).settled;
             settled += delivered;
         }
-        const backlog = Math.max(0, candidates.length - polled);
+        const backlog = Math.max(0, waiting.length + adopted.length - polled);
         if (truncated) {
             defaultLogger.warn("approval_suspended_poll_truncated", {
                 polled,
@@ -2533,6 +2913,7 @@ export class ToolApprovalCoordinator {
                 maxPerTick: SUSPENDED_POLL_MAX_PER_TICK,
                 budgetMs: SUSPENDED_POLL_BUDGET_MS,
                 resumeFromOffset: this.suspendedPollOffset,
+                resumeAdoptedFromOffset: this.adoptedPollOffset,
             });
         }
         return { polled, settled, backlog, truncated };
@@ -2582,8 +2963,11 @@ export class ToolApprovalCoordinator {
     sessionAllowedCount() {
         return this.allowAllSessions.size;
     }
-    parkTombstoneCount() {
-        return this.parkTombstones.size;
+    presentedCardWatcherCount() {
+        return this.presentedCardWatchers.size;
+    }
+    parkRedemptionCount() {
+        return this.parkRedemptions.size;
     }
 }
 //# sourceMappingURL=tool-approval.js.map