@sema-agent/server 7.150.0 → 7.152.0

package/dist/tool-approval.js

@@ -1,21 +1,21 @@
 import { readApprovalCard } from "./approval-content-kind.js";
-import { heldAskOf, liveHostSource, readDecider, retiredDecisionKeyFacts, POLICY_CANNOT_ALLOW_PERSON_ASK } from "./host-decision.js";
+import { liveHostSource } from "./host-decision.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
+import { uuidv7, classifyAsk, foldArbitrationRow, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
-import { CARD_RULE_FORM_OF_MATCH, cardRuleFormOf } from "./permission-rule-vocab.js";
+import { cardBindingOf, readCardRuleOffers } from "./card-rule-offers.js";
+import { displayRuleOfferText } from "./plugins/checkpoint-store-face.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { seatText } from "./trace/exit-seat.js";
+import { humanFacingArgs } from "./human-facing-args.js";
 import { hasBidiControls } from "./text-bidi.js";
-import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
-import { errorKindOf } from "./observability/err-text.js";
 import { createHitlOpenRace, deliverHitlNotice } from "./hitl-delivery.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { ownerOfCheckpointScope } from "./security.js";
 import { keyAdmits, ownerCellOf, recoveredSubject } from "./owner-faces.js";
-import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt, readBoundInputHash } from "./approval-ask-machine.js";
-import { askDemandsAPerson, storedPersonDemandRecord, currentParkArm, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, adoptStoredLiveFacts, buildApprovalRequestFrame, buildReplayFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readAskReasons, readClosedWordSeat, buildApprovalCompleteFrame, readRuleOfferList, } from "./approval-card.js";
+import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, readBoundInputHash } from "./approval-ask-machine.js";
+import { askDemandsAPerson, storedPersonDemandRecord, currentParkArm, buildApprovalCard, buildApprovalCardEnvelope, adoptStoredLiveFacts, buildApprovalRequestFrame, buildReplayFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readAskReasons, readClosedWordSeat, buildApprovalCompleteFrame, storedCardDemandsAPerson } from "./approval-card.js";
 import { askRowCarriesOwner, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { APPROVAL_ENDING_CAUSES, SETTLE_OUTCOME, askRowEndingCause, askRowParkTrigger } from "./approval-deny-reasons.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
@@ -25,10 +25,9 @@ import { agreedGrantBinding, grantBindingOf } from "./standing-answer-grant.js";
 import { operatorAsk } from "./operator-ask.js";
 import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 import { refusalBody } from "./http/refusal-body.js";
-import { withoutSettlementEvidence } from "./gate-settlement.js";
 import { extensionRequesterOf } from "./trace/extension-call-face.js";
+import { boundedRotation } from "./bounded-rotation.js";
 const defaultLogger = createLogger();
-const MAX_APPROVAL_ARGS_BYTES = 16384;
 const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
 const DEFAULT_UNREACHED_ASK_TTL_MS = 60 * 60_000;
 const SUSPENDED_POLL_MAX_PER_TICK = 64;
@@ -41,10 +40,8 @@ export const MAX_ALLOW_SESSIONS = 4096;
 const DEFAULT_ADMIT_MAX_PER_TASK = 32;
 const DEFAULT_ADMIT_MAX_PER_OWNER = 256;
 const DEFAULT_PARK_REDEMPTION_MAX = 2000;
-const DEFAULT_PARK_REDEMPTION_TTL_MS = 60 * 60_000;
 const DEFAULT_PARK_REDEMPTION_PER_PRINCIPAL_MAX = 128;
 const PARK_REDEMPTION_ADMISSION_RETRY_AFTER_SEC = 5;
-const PARKING_RETRY_AFTER_MS = 250;
 export function approvalDecidePath(sessionId) {
     return `/v1/approvals/${encodeURIComponent(sessionId)}/decide`;
 }
@@ -68,11 +65,12 @@ function durableRuleMaterial(material) {
     return { ruleCommand: material.command, ruleScopeRoot: material.scopeRoot ?? null };
 }
 export const NOT_PENDING_UNKNOWN_CAUSE = "unknown_or_other_replica";
+export const ASK_NOT_FOUND_UNDER_TASK = "no such approval ask under this task (never existed, belongs to another task, or is not yours)";
 export const TOOL_APPROVAL_READ_STATES = ["pending", "decided", "parked", "void"];
-function decidedRowFacts(row) {
+export function decidedRowFacts(row) {
     if (row.state !== "DECIDED" || (row.decision !== "approve" && row.decision !== "deny") || row.provisional || row.decidedAtMs === null)
         return undefined;
-    return { decision: row.decision === "approve" ? "allow" : "deny", decidedAtMs: row.decidedAtMs, ...(row.decisionNote !== null ? { decisionNote: row.decisionNote } : {}) };
+    return { decision: row.decision, decidedAtMs: row.decidedAtMs, ...(row.decisionNote !== null ? { decisionNote: row.decisionNote } : {}) };
 }
 function buildAskRowReadProjection(row, nowMs) {
     const frame = buildReplayFrame(row, nowMs);
@@ -85,6 +83,22 @@ function buildAskRowReadProjection(row, nowMs) {
     };
 }
 export const ASK_DECISION_CONSUMER_ABSENT = "absent";
+function standingParkedDecision(gate, row, idempotencyKey) {
+    if (gate?.kind !== "decided")
+        return undefined;
+    const decision = gate.decision;
+    if (row.decision === decision && row.decidedAtMs !== null && row.decidedAtMs >= gate.decidedAtMs) {
+        return {
+            kind: "standing",
+            decision,
+            decidedAtMs: row.decidedAtMs,
+            ...(row.decisionNote !== null ? { decisionNote: row.decisionNote } : {}),
+            ...(row.decisionActor !== null ? { actor: row.decisionActor } : {}),
+            byThisRequest: idempotencyKey !== undefined && row.idempotencyKey === idempotencyKey,
+        };
+    }
+    return { kind: "standing", decision, decidedAtMs: gate.decidedAtMs, ...(gate.decisionNote !== undefined ? { decisionNote: gate.decisionNote } : {}), byThisRequest: false };
+}
 const MAX_INFLIGHT_TERMINAL_CLAIMS = 2;
 const DURABLE_CONVERGE_BACKOFF_MS = [50, 100, 200, 400, 800, 1600];
 export const DURABLE_CONVERGE_READ_TIMEOUT_MS = 2_000;
@@ -247,23 +261,11 @@ function mandatedFromSeat(seat) {
             return false;
     }
 }
-function askRowVisibleTo(row, principal) {
-    return row !== null && askOwnerAdmitsAnswer(row.owner, principal);
-}
-function askOwnerAdmitsAnswer(owner, principal) {
-    return keyAdmits("ask.answer", { subject: recoveredSubject(principal), operator: false }, ownerCellOf(owner));
-}
-function receiptAnswersNow(redeemedGeneration, openGenerationNow) {
-    return redeemedGeneration === undefined || openGenerationNow === undefined || openGenerationNow <= redeemedGeneration;
-}
-function waitingLegsReached(entry, othersReached) {
-    return (entry.adopted === true ? 0 : 1) + othersReached;
-}
-function withConsumerDisclosure(result, waitingLegs) {
-    return waitingLegs > 0 ? result : { status: result.status, body: { ...result.body, consumerState: ASK_DECISION_CONSUMER_ABSENT } };
+function askRowVisibleUnder(row, taskId, principal) {
+    return row !== null && row.taskId === taskId && keyAdmits("ask.answer", { subject: recoveredSubject(principal), operator: false }, ownerCellOf(row.owner));
 }
 function livePendingRowOf(e) {
-    const listFrame = e.adopted === true ? e.cardFrame : (e.cardFrame ?? e.frame);
+    const listFrame = e.cardFrame;
     const approvalCard = e.adopted === true ? e.cardFrame.card.approvalCard : e.frame.approvalCard;
     return {
         approvalId: e.approvalId,
@@ -277,8 +279,8 @@ function livePendingRowOf(e) {
         ...(liveSessionAnswer(pendingEntryStandingAnswerFacts(e), e).home === "none" ? { rememberRefused: true } : {}),
         ...(listFrame.mandate !== undefined ? { mandate: listFrame.mandate } : {}),
         ...(listFrame.origin !== undefined ? { origin: listFrame.origin } : {}),
-        ...(listFrame.type === "approval_request" && listFrame.liveFactsUnknown === true ? { liveFactsUnknown: true } : {}),
-        ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
+        ...(listFrame.liveFactsUnknown === true ? { liveFactsUnknown: true } : {}),
+        ...(e.sourceSessionId !== undefined ? { fromSubagent: true, sourceSessionId: e.sourceSessionId } : {}),
         ...(approvalCard !== undefined ? { approvalCard } : {}),
         frame: listFrame,
         ...(e.adopted === true ? { consumerState: ASK_DECISION_CONSUMER_ABSENT } : {}),
@@ -286,102 +288,185 @@ function livePendingRowOf(e) {
 }
 const _legFamiliesAreFrameFamilies = true;
 void _legFamiliesAreFrameFamilies;
-function canPresentWithoutDurableRow(c) {
-    return c.family === "tool_approval";
-}
 export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty string of at most ${MAX_RULE_TEXT_CHARS} characters`;
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
-export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with decision "allow" — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
-export const READ_ROOT_GRANT_NOT_ACCEPTED = 'readRootGrant is not accepted on this deployment — a read-directory grant is honored only on a single-user host-lane deployment (GET /v1/capabilities approvalReadRootGrant is false here); answer with plain decision "allow" instead';
+export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with a plain allow-this-call decision (not a deny, not a session allow) — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
+export const READ_ROOT_GRANT_NOT_ACCEPTED = 'readRootGrant is not accepted on this deployment — a read-directory grant is honored only on a single-user host-lane deployment (GET /v1/capabilities approvalReadRootGrant is false here); answer with a plain allow-this-call decision instead';
 export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
+export const READ_ROOT_GRANT_LIVE_ONLY = "readRootGrant can only be honored while the card is live (an engine leg is waiting on it); this ask is parked, so the directory could not be added — answer it again without readRootGrant";
+export function readReadRootGrantSlot(raw, plainApprove) {
+    if (raw === undefined)
+        return { ok: true };
+    if (!plainApprove)
+        return { ok: false, error: READ_ROOT_GRANT_ALLOW_ONLY };
+    if (typeof raw !== "string" || raw === "" || raw.length > READ_ROOT_CANDIDATE_DIR_MAX)
+        return { ok: false, error: READ_ROOT_GRANT_SHAPE };
+    return { ok: true, grant: raw };
+}
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
-export function parseToolApprovalResponse(body) {
-    const retired = retiredDecisionKeyFacts(body);
-    const parsed = parseToolApprovalFields(body, retired);
-    return parsed.ok || retired === undefined ? parsed : { ...parsed, ...retired.extra };
+export function readPersistRuleSlot(raw, decision) {
+    if (decision === "deny" || raw === undefined)
+        return { ok: true };
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return { ok: false, error: "persistRule must be an object" };
+    if (raw.scope !== undefined)
+        return { ok: false, error: PERSIST_RULE_SCOPE_REFUSED };
+    const rule = raw.rule;
+    const edited = raw.edited;
+    const batchIdx = raw.batchOfferIndex;
+    if (batchIdx !== undefined) {
+        if (rule !== undefined || edited !== undefined)
+            return { ok: false, error: PERSIST_RULE_BATCH_EXCLUSIVE_ERROR };
+        if (typeof batchIdx !== "number" || !Number.isInteger(batchIdx) || batchIdx < 0)
+            return { ok: false, error: PERSIST_RULE_BATCH_INDEX_ERROR };
+        return { ok: true, slot: { kind: "batch", batchOfferIndex: batchIdx } };
+    }
+    if (typeof rule !== "string" || rule === "" || rule.length > MAX_RULE_TEXT_CHARS)
+        return { ok: false, error: PERSIST_RULE_TEXT_ERROR };
+    if (edited !== undefined && typeof edited !== "boolean")
+        return { ok: false, error: PERSIST_RULE_EDITED_FLAG_ERROR };
+    return { ok: true, slot: { kind: "text", rule, edited: edited === true } };
 }
-function parseToolApprovalFields(body, retired) {
-    if (body === null || typeof body !== "object" || Array.isArray(body))
-        return { ok: false, error: "body must be an object" };
-    const d = body.decision;
-    if (d === "allow" || d === "allow_session" || d === "deny") {
-        const u = body.updatedInput;
-        if (body.scope !== undefined)
-            return { ok: false, error: PERSIST_RULE_SCOPE_REFUSED };
-        const pr = body.persistRule;
-        let persistRule;
-        if (d !== "deny" && pr !== undefined) {
-            if (pr === null || typeof pr !== "object" || Array.isArray(pr))
-                return { ok: false, error: "persistRule must be an object" };
-            if (pr.scope !== undefined)
-                return { ok: false, error: PERSIST_RULE_SCOPE_REFUSED };
-            const rule = pr.rule;
-            const edited = pr.edited;
-            const batchIdx = pr.batchOfferIndex;
-            if (batchIdx !== undefined) {
-                if (rule !== undefined || edited !== undefined)
-                    return { ok: false, error: PERSIST_RULE_BATCH_EXCLUSIVE_ERROR };
-                if (typeof batchIdx !== "number" || !Number.isInteger(batchIdx) || batchIdx < 0) {
-                    return { ok: false, error: PERSIST_RULE_BATCH_INDEX_ERROR };
-                }
-                persistRule = { kind: "batch", batchOfferIndex: batchIdx };
-            }
-            else {
-                if (typeof rule !== "string" || rule === "" || rule.length > MAX_RULE_TEXT_CHARS) {
-                    return { ok: false, error: PERSIST_RULE_TEXT_ERROR };
-                }
-                if (edited !== undefined && typeof edited !== "boolean")
-                    return { ok: false, error: PERSIST_RULE_EDITED_FLAG_ERROR };
-                persistRule = { kind: "text", rule, edited: edited === true };
-            }
+function withheldForCredentialShape(command, where) {
+    if (!ruleMaterialCarriesCredentialShape(command))
+        return undefined;
+    defaultLogger.warn("approval rule material withheld: the adjudicated command carries credential-shaped bytes", { where, commandChars: command.length });
+    return { kind: "absent", refusal: "rule_material_absent" };
+}
+export function readCardRuleRecordOfAskRow(row, owner) {
+    const envelope = readStoredCardEnvelope(row.cardJson);
+    if (envelope === undefined)
+        return { kind: "absent", refusal: "rule_material_absent" };
+    if (envelope.card.governanceForced === true)
+        return { kind: "absent", refusal: "rule_governance_forced" };
+    if (owner === null)
+        return { kind: "absent", refusal: "rule_lane_unavailable" };
+    if (!askRowCarriesOwner(row, owner))
+        return { kind: "absent", refusal: "rule_material_absent" };
+    const command = row.ruleCommand;
+    if (command === null)
+        return { kind: "absent", refusal: "rule_material_absent" };
+    return withheldForCredentialShape(command, "ask_row") ?? {
+        kind: "record",
+        record: {
+            owner,
+            toolName: envelope.card.toolName,
+            command,
+            offers: envelope.card.ruleOffers ?? [],
+            ...(row.toolCallId !== "" ? { toolCallId: row.toolCallId } : {}),
+            ...(row.boundInputHash !== null ? { boundInputHash: row.boundInputHash } : {}),
+            ...(row.ruleScopeRoot !== null ? { scopeRoot: row.ruleScopeRoot } : {}),
+        },
+    };
+}
+export function cardRuleOffersOfAskRow(row) {
+    return readStoredCardEnvelope(row.cardJson)?.card.ruleOffers;
+}
+export function readCardRuleRecordOfParkRow(pa, facts) {
+    if (facts.governanceForced)
+        return { kind: "absent", refusal: "rule_governance_forced" };
+    if (facts.owner === null)
+        return { kind: "absent", refusal: "rule_lane_unavailable" };
+    const offers = readCardRuleOffers(pa.ruleOffers, pa.toolName);
+    if (offers === undefined)
+        return { kind: "absent", refusal: "rule_material_absent" };
+    const command = cardBindingOf(pa.args, offers);
+    if (command === undefined)
+        return { kind: "absent", refusal: "rule_material_absent" };
+    return withheldForCredentialShape(command, "park_row") ?? {
+        kind: "record",
+        record: {
+            owner: facts.owner,
+            toolName: pa.toolName,
+            command,
+            offers,
+            ...(typeof pa.toolCallId === "string" && pa.toolCallId !== "" ? { toolCallId: pa.toolCallId } : {}),
+            ...(typeof pa.boundInputHash === "string" && pa.boundInputHash !== "" ? { boundInputHash: pa.boundInputHash } : {}),
+            ...(facts.scopeRoot !== null ? { scopeRoot: facts.scopeRoot } : {}),
+        },
+    };
+}
+export async function redeemCardRule(lane, reading, slot, ctx) {
+    const refuse = (ruleRefusal) => ({ rulePersisted: false, ruleRefusal });
+    if (reading.kind === "absent" && reading.refusal === "rule_governance_forced")
+        return refuse("rule_governance_forced");
+    if (lane === undefined)
+        return refuse("rule_lane_unavailable");
+    if (reading.kind === "absent")
+        return refuse(reading.refusal);
+    if (!ctx.eligible)
+        return refuse("rule_store_error");
+    if (ctx.inputWasEdited)
+        return refuse("rule_input_edited");
+    const r = reading.record;
+    const common = {
+        principal: r.owner,
+        toolName: r.toolName,
+        command: r.command,
+        ...(r.toolCallId !== undefined ? { toolCallId: r.toolCallId } : {}),
+        ...(r.boundInputHash !== undefined ? { boundInputHash: r.boundInputHash } : {}),
+        ...(r.scopeRoot !== undefined ? { scope: { kind: "project", root: r.scopeRoot } } : {}),
+    };
+    let redemption;
+    if (slot.kind === "batch") {
+        const offer = r.offers[slot.batchOfferIndex];
+        if (offer === undefined || offer.kind !== "batch")
+            return refuse("rule_not_offered");
+        redemption = { kind: "batch", offer };
+    }
+    else if (slot.edited) {
+        redemption = { kind: "edited", text: slot.rule };
+    }
+    else {
+        const hits = r.offers.filter((o) => o.kind === "single" && (o.rule === slot.rule || displayRuleOfferText(o.rule, false) === slot.rule));
+        if (hits.length !== 1)
+            return refuse("rule_not_offered");
+        redemption = { kind: "offered", ruleText: hits[0].rule };
+    }
+    try {
+        const persisted = await lane.persistCardRule({ ...common, redemption });
+        if (!persisted.ok) {
+            defaultLogger.warn("permission rule was not persisted after an approval", { reason: persisted.reason, arm: redemption.kind, ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}) });
+            return refuse(persisted.reason);
         }
-        const rawNote = body.note;
-        let note;
-        if (rawNote !== undefined) {
-            if (typeof rawNote !== "string" || rawNote.length > MAX_DECISION_NOTE_CHARS) {
-                return { ok: false, error: `note must be a string of at most ${MAX_DECISION_NOTE_CHARS} characters` };
-            }
-            note = rawNote;
-        }
-        if (retired !== undefined)
-            return { ok: false, error: retired.error };
-        const deciderReading = readDecider(body, false);
-        let decider;
-        switch (deciderReading.kind) {
-            case "outside_closed_set":
-                return { ok: false, error: deciderReading.message };
-            case "accepted":
-                decider = deciderReading.decider;
-                break;
-            default: {
-                const unreachable = deciderReading;
-                throw new Error(`unhandled decider reading: ${JSON.stringify(unreachable)}`);
-            }
+        if (persisted.kind === "batch" && slot.kind === "batch") {
+            return {
+                rulePersisted: true,
+                persistedRules: persisted.rules,
+                ...(persisted.members !== undefined ? { persistedRuleAnchors: persisted.members.map((m) => ({ offerIndex: slot.batchOfferIndex, memberIndex: m.memberIndex, rule: m.rule })) } : {}),
+            };
         }
-        const rawGrant = body.readRootGrant;
-        if (rawGrant !== undefined && d !== "allow")
-            return { ok: false, error: READ_ROOT_GRANT_ALLOW_ONLY };
-        if (rawGrant !== undefined && (typeof rawGrant !== "string" || rawGrant === "" || rawGrant.length > READ_ROOT_CANDIDATE_DIR_MAX))
-            return { ok: false, error: READ_ROOT_GRANT_SHAPE };
-        const readRootGrant = rawGrant;
-        return {
-            ok: true,
-            value: d,
-            ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
-            ...(persistRule !== undefined ? { persistRule } : {}),
-            ...(note !== undefined ? { note } : {}),
-            decider,
-            ...(readRootGrant !== undefined ? { readRootGrant } : {}),
-        };
+        return { rulePersisted: true, ...(slot.kind === "text" && slot.edited && persisted.kind === "single" ? { persistedRule: persisted.rule } : {}) };
+    }
+    catch (err) {
+        defaultLogger.warn("permission rule store call failed — the approval stands, the rule was not persisted", { where: "persistCardRule", arm: redemption.kind, err: err instanceof Error ? err.message : String(err) });
+        return refuse("rule_store_error");
     }
-    return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
+}
+const heldLegEntries = new WeakMap();
+export function askDecisionRecordOf(write) {
+    return {
+        decision: write.decision,
+        ...(write.actor !== undefined ? { decisionActor: write.actor } : {}),
+        decisionNote: write.note ?? null,
+        idempotencyKey: write.idempotencyKey ?? null,
+        ...liveHostSource(write.decider),
+    };
+}
+function liveDecideInputOf(write) {
+    return { ...askDecisionRecordOf(write), ...(write.decision === "approve" && write.updatedInput !== undefined ? { updatedInput: write.updatedInput } : {}) };
 }
 export function buildUnattendedPolicyRefusal(reason) {
     return { allow: false, settledBy: POLICY_REFUSAL_DECISION.settledBy, reason };
 }
 function unattendedRefusalReason(site) {
+    if (site.arm === "card_protocol_absent") {
+        return ("UNATTENDED_APPROVAL_POLICY=deny: this worker presents no approval cards — it has no durable approval ledger (no store backend, or no park " +
+            "facility), so no approval card is shown to anyone, and an approval request no one can answer is refused here instead of being parked " +
+            `for a person (arm: ${site.arm}).`);
+    }
     if (site.arm === "frame_family_undeclared") {
         return (`UNATTENDED_APPROVAL_POLICY=deny: this run has no live approval channel — the client that started it did not declare the "${site.family}" ` +
             "approval frame family (settings.approvalFrameFamilies), so no approval card is shown to it, and an approval request no one can answer " +
@@ -393,37 +478,34 @@ function unattendedRefusalReason(site) {
 function isChildAsk(req) {
     return req.fromSubagent === true;
 }
-export function approverFacingArgs(args) {
-    return boundArgs(args).args;
+export function approverFacingArgs(args, card) {
+    return boundArgs(args, card).args;
 }
-function boundArgs(args) {
-    const redacted = redactDeep(args);
-    let hasBidi = false;
+function boundArgs(args, card) {
+    const shown = humanFacingArgs(args, card);
+    if (shown.kind === "omitted" && shown.bytes === null)
+        return { omitted: true, hasBidi: false };
+    let hasBidi;
     try {
         hasBidi = hasBidiControls(JSON.stringify(args));
-        const text = JSON.stringify(redacted);
-        if (Buffer.byteLength(text, "utf8") > MAX_APPROVAL_ARGS_BYTES)
-            return { omitted: true, hasBidi };
     }
     catch {
         return { omitted: true, hasBidi: false };
     }
-    return { args: redacted, omitted: false, hasBidi };
+    return shown.kind === "whole" ? { args: shown.value, omitted: false, hasBidi } : { omitted: true, hasBidi };
 }
 export function resolveStreamApprovalGate(input) {
     if (!input.toolApprovalEnabled)
         return { active: false, reason: "no_tool_approval" };
-    if (!input.streamApprovalEnabled)
-        return { active: false, reason: "protocol_disabled" };
     if (!input.backend)
         return { active: false, reason: "no_backend" };
     if (input.checkpointStore === undefined)
         return { active: false, reason: "no_park_facility" };
     return { active: true, askStore: input.backend.approvalAsk(), checkpointStore: input.checkpointStore };
 }
-export const APPROVAL_FRAME_FAMILIES = ["tool_approval", "approval_request"];
+export const APPROVAL_FRAME_FAMILIES = ["approval_request"];
 export function presentedApprovalFrameFamily(streamApprovalOn) {
-    return streamApprovalOn ? "approval_request" : "tool_approval";
+    return streamApprovalOn ? "approval_request" : undefined;
 }
 const APPROVAL_FRAME_FAMILIES_FIELD = "settings.approvalFrameFamilies";
 const APPROVAL_FRAME_FAMILY_WORDS = APPROVAL_FRAME_FAMILIES.map((w) => `"${w}"`).join(" | ");
@@ -470,6 +552,8 @@ export function resolveApprovalLeg(input) {
     if (input.windowMs === 0 || tightDeadline)
         return { active, unattended: { arm: "window_zero" } };
     const family = presentedApprovalFrameFamily(active);
+    if (family === undefined)
+        return { active, unattended: { arm: "card_protocol_absent" } };
     if (!input.declaredFamilies.has(family))
         return { active, unattended: { arm: "frame_family_undeclared", family } };
     return {
@@ -511,18 +595,16 @@ function settleArgsOfDecided(outcome) {
         ...(!outcome.allow && outcome.reason !== undefined ? { denyReason: outcome.reason } : {}),
     };
 }
-function verdictOfDecided(args) {
+function verdictOfDecided(args, readRootGrant) {
     return {
         by: "human",
         allowed: args.allowed,
         ...(args.updatedInput !== undefined ? { updatedInput: args.updatedInput } : {}),
         ...(args.source !== undefined ? { hostSource: args.source } : {}),
         ...(args.denyReason !== undefined ? { denyReason: args.denyReason } : {}),
+        ...(args.allowed && readRootGrant !== undefined ? { readRootGrant } : {}),
     };
 }
-function settleArgsOf(outcome) {
-    return outcome === "unavailable" ? "unavailable" : settleArgsOfDecided(outcome);
-}
 export class ToolApprovalCoordinator {
     als = new AsyncLocalStorage();
     pending = new Map();
@@ -562,8 +644,8 @@ export class ToolApprovalCoordinator {
     admitMaxPerOwner;
     admitByTask = new Map();
     admitByOwner = new Map();
-    suspendedPollOffset = 0;
-    adoptedPollOffset = 0;
+    suspendedPollCursor = { offset: 0 };
+    adoptedPollCursor = { offset: 0 };
     editedDecisionsInFlight = new Map();
     storeErrorWarned = false;
     storeErrorTally = 0;
@@ -573,7 +655,6 @@ export class ToolApprovalCoordinator {
     ruleScopeRootFor;
     parkRedemptions = new Map();
     parkRedemptionMax;
-    parkRedemptionTtlMs;
     parkRedemptionPerPrincipalMax;
     parkedRedeem;
     parkedGate;
@@ -585,28 +666,27 @@ export class ToolApprovalCoordinator {
     parkCommits;
     parksAwaitingCommit = new Set();
     constructor(opts) {
-        this.ruleConsent = opts?.ruleConsent;
-        this.ruleScopeRootFor = opts?.ruleScopeRootFor;
-        this.governanceAskMarks = opts?.governanceAskMarks;
-        this.ttlMs = opts?.ttlMs ?? DEFAULT_APPROVAL_TTL_MS;
-        this.unreachedTtlMs = opts?.unreachedTtlMs ?? DEFAULT_UNREACHED_ASK_TTL_MS;
-        this.askStore = opts?.askStore;
-        this.windowMarginMs = opts?.windowMarginMs ?? DEFAULT_WINDOW_MARGIN_MS;
-        this.admitMaxPerTask = opts?.admitMaxPerTask ?? DEFAULT_ADMIT_MAX_PER_TASK;
-        this.admitMaxPerOwner = opts?.admitMaxPerOwner ?? DEFAULT_ADMIT_MAX_PER_OWNER;
-        this.unattendedPolicy = opts?.unattendedPolicy ?? "park";
-        this.parkedRedeem = opts?.parkedRedeem;
-        this.parkedGate = opts?.parkedGate;
-        this.parkRedemptionMax = opts?.parkRedemptionMax ?? DEFAULT_PARK_REDEMPTION_MAX;
-        this.parkRedemptionTtlMs = opts?.parkRedemptionTtlMs ?? DEFAULT_PARK_REDEMPTION_TTL_MS;
-        this.parkRedemptionPerPrincipalMax = opts?.parkRedemptionPerPrincipalMax ?? DEFAULT_PARK_REDEMPTION_PER_PRINCIPAL_MAX;
-        this.askAudit = opts?.askAudit;
-        this.sessionGrants = opts?.sessionGrants;
-        if (opts?.deploymentListAsks !== undefined && opts.sessionGrants === undefined) {
+        this.ruleConsent = opts.ruleConsent;
+        this.ruleScopeRootFor = opts.ruleScopeRootFor;
+        this.governanceAskMarks = opts.governanceAskMarks;
+        this.ttlMs = opts.ttlMs ?? DEFAULT_APPROVAL_TTL_MS;
+        this.unreachedTtlMs = opts.unreachedTtlMs ?? DEFAULT_UNREACHED_ASK_TTL_MS;
+        this.askStore = opts.askStore;
+        this.windowMarginMs = opts.windowMarginMs ?? DEFAULT_WINDOW_MARGIN_MS;
+        this.admitMaxPerTask = opts.admitMaxPerTask ?? DEFAULT_ADMIT_MAX_PER_TASK;
+        this.admitMaxPerOwner = opts.admitMaxPerOwner ?? DEFAULT_ADMIT_MAX_PER_OWNER;
+        this.unattendedPolicy = opts.unattendedPolicy ?? "park";
+        this.parkedRedeem = opts.parkedRedeem;
+        this.parkedGate = opts.parkedGate;
+        this.parkRedemptionMax = opts.parkRedemptionMax ?? DEFAULT_PARK_REDEMPTION_MAX;
+        this.parkRedemptionPerPrincipalMax = opts.parkRedemptionPerPrincipalMax ?? DEFAULT_PARK_REDEMPTION_PER_PRINCIPAL_MAX;
+        this.askAudit = opts.askAudit;
+        this.sessionGrants = opts.sessionGrants;
+        if (opts.deploymentListAsks !== undefined && opts.sessionGrants === undefined) {
             throw new Error("ToolApprovalCoordinator: deploymentListAsks needs sessionGrants — the deployment list's standing answers live in the session exemption store");
         }
-        this.deploymentListAsks = opts?.deploymentListAsks;
-        this.parkCommits = opts?.parkCommits;
+        this.deploymentListAsks = opts.deploymentListAsks;
+        this.parkCommits = opts.parkCommits;
         this.parkCommits?.onParkCommitted((calls) => this.noteParkCommitted(calls));
     }
     unattendedOutcome(site) {
@@ -652,9 +732,9 @@ export class ToolApprovalCoordinator {
         return this.unattendedOutcome(site.arm === "frame_family_undeclared" ? { arm: site.arm, family: site.family, ...facts } : { arm: site.arm, ...facts });
     }
     async landUnattendedOutcome(outcome, row) {
-        const store = this.askStore;
-        if (outcome === "unavailable" || !store)
+        if (outcome === "unavailable")
             return outcome;
+        const store = this.askStore;
         const dispatch = (res, where) => {
             if (res.claimed) {
                 this.settleSameAskIdParkRoute(row.askId, APPROVAL_ENDING_CAUSES.UNDELIVERABLE);
@@ -678,8 +758,6 @@ export class ToolApprovalCoordinator {
         return read?.kind === "decided" ? read.outcome : outcome;
     }
     admit(taskId, owner) {
-        if (!this.askStore)
-            return () => undefined;
         const ownerKey = JSON.stringify(["owner", owner]);
         const taskCount = this.admitByTask.get(taskId) ?? 0;
         const ownerCount = this.admitByOwner.get(ownerKey) ?? 0;
@@ -738,103 +816,6 @@ export class ToolApprovalCoordinator {
             return a === b;
         return a.length === b.length && a.every((d, i) => d.segment === b[i].segment && d.reason === b[i].reason);
     }
-    static ruleOfferTextsOverSize(offer) {
-        const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
-        if (offer.kind === "single")
-            return over(offer.rule) || over(offer.command);
-        return offer.rules.some((r) => {
-            switch (r.kind) {
-                case "command":
-                    return over(r.rule) || over(r.command);
-                case "directoryRead":
-                    return over(r.rule) || over(r.directory);
-                default:
-                    throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
-            }
-        });
-    }
-    static ruleOfferDerivedFactsAgree(offer, cardTool) {
-        const derive = (rule) => {
-            const p = parseRuleText(rule, "allow");
-            return "rule" in p ? p.rule : undefined;
-        };
-        if (offer.kind === "single") {
-            const d = derive(offer.rule);
-            return d !== undefined && d.rule === offer.rule && d.match === offer.match && d.command === offer.command && ToolApprovalCoordinator.singleOfferBelongsOnCard(d.match, d.tool, cardTool);
-        }
-        return offer.rules.every((m) => {
-            const d = derive(m.rule);
-            if (d === undefined || d.rule !== m.rule)
-                return false;
-            switch (m.kind) {
-                case "command":
-                    return d.tool === "Bash" && d.match === m.match && d.command === m.command;
-                case "directoryRead":
-                    return d.tool === "Read" && d.match === "subpath" && d.command === m.directory;
-                default:
-                    throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(m)}`);
-            }
-        });
-    }
-    static singleOfferBelongsOnCard(match, ruleTool, cardTool) {
-        const form = CARD_RULE_FORM_OF_MATCH[match];
-        return ruleTool === cardTool && form !== undefined && form === cardRuleFormOf(cardTool);
-    }
-    static boundRuleOfferTexts(offers, cardTool) {
-        const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
-        const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
-        const out = [];
-        for (const { offer } of readRuleOfferList(offers)) {
-            if (ToolApprovalCoordinator.ruleOfferTextsOverSize(offer))
-                return undefined;
-            if (!ToolApprovalCoordinator.ruleOfferDerivedFactsAgree(offer, cardTool)) {
-                defaultLogger.warn("rule_offer_dropped_derived_facts_disagree", {
-                    kind: offer.kind,
-                    note: "an offer's kind/match/command/directory seats do not agree with what the shared validator derives from its rule text, or it is not this card's tool / card form — dropped whole so the card never shows one grant while redeeming another (core/dist skew or forged material?)",
-                });
-                continue;
-            }
-            switch (offer.kind) {
-                case "single":
-                    out.push({ kind: "single", rule: offer.rule, match: offer.match, command: offer.command });
-                    break;
-                case "batch": {
-                    const rules = [];
-                    for (const r of offer.rules) {
-                        switch (r.kind) {
-                            case "command":
-                                rules.push({ kind: "command", rule: r.rule, match: r.match, command: r.command, segment: clipSegment(r.segment) });
-                                break;
-                            case "directoryRead":
-                                rules.push({ kind: "directoryRead", rule: r.rule, directory: r.directory, segment: clipSegment(r.segment) });
-                                break;
-                            default:
-                                throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
-                        }
-                    }
-                    out.push({
-                        kind: "batch",
-                        rules,
-                        uncoveredSegments: offer.uncoveredSegments,
-                        ...(offer.uncoveredDetail !== undefined ? { uncoveredDetail: offer.uncoveredDetail.map((d) => ({ segment: clipSegment(d.segment), reason: d.reason })) } : {}),
-                    });
-                    break;
-                }
-                default:
-                    throw new Error(`unknown rule-offer kind: ${JSON.stringify(offer)}`);
-            }
-        }
-        return out;
-    }
-    static cardBindingOf(args, offers) {
-        const valueOffers = offers.filter((o) => o.kind === "single" && CARD_RULE_FORM_OF_MATCH[o.match] !== "command");
-        if (valueOffers.length > 0)
-            return valueOffers.length === 1 && offers.length === 1 ? valueOffers[0].command : undefined;
-        if (args === null || typeof args !== "object" || Array.isArray(args))
-            return undefined;
-        const command = args.command;
-        return typeof command === "string" && command !== "" ? command : undefined;
-    }
     buildRuleLaneMaterial(req, owner, governanceForced, sessionId) {
         if (this.ruleConsent === undefined)
             return undefined;
@@ -842,14 +823,10 @@ export class ToolApprovalCoordinator {
             return undefined;
         if (owner === null)
             return undefined;
-        const rawOffers = req.ruleOffers;
-        if (!Array.isArray(rawOffers) || rawOffers.length === 0)
-            return undefined;
-        const capped = rawOffers.length > MAX_RULE_OFFERS ? rawOffers.slice(0, MAX_RULE_OFFERS) : rawOffers;
-        const offers = ToolApprovalCoordinator.boundRuleOfferTexts(capped, req.toolName);
+        const offers = readCardRuleOffers(req.ruleOffers, req.toolName);
         if (offers === undefined)
             return undefined;
-        const command = ToolApprovalCoordinator.cardBindingOf(req.args, offers);
+        const command = cardBindingOf(req.args, offers);
         if (command === undefined)
             return undefined;
         const boundInputHash = readBoundInputHash(req);
@@ -1016,8 +993,6 @@ export class ToolApprovalCoordinator {
         };
     };
     async sessionGrantUncontestedByRow(origin, req) {
-        if (!this.askStore)
-            return true;
         const call = { taskId: origin.taskId, legKey: origin.legKey, toolCallId: req.toolCallId, sourceSessionId: req.sourceSessionId ?? origin.taskId };
         try {
             const rows = await this.withStoreDeadline(this.askStore.listByCall(call), "listByCall(session-grant-provenance)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
@@ -1029,7 +1004,7 @@ export class ToolApprovalCoordinator {
         }
     }
     async probeRowWhileYielding(askId, budgetMs) {
-        if (!this.askStore || budgetMs <= 0)
+        if (budgetMs <= 0)
             return { kind: "none" };
         const release = this.admitTerminalClaim(askId);
         if (release === undefined)
@@ -1067,8 +1042,6 @@ export class ToolApprovalCoordinator {
         return { kind: "decided", outcome: replayedOutcome };
     }
     hasOtherSuspendedOwner(askId, self) {
-        if (askId === undefined)
-            return false;
         for (const e of this.pendingByAskId.get(askId) ?? []) {
             if (e !== self && e.suspended === true && e.settledOutcome === undefined)
                 return true;
@@ -1107,8 +1080,6 @@ export class ToolApprovalCoordinator {
         let inflight = 0;
         let ownInflight = 0;
         for (const r of this.parkRedemptions.values()) {
-            if (r.inflight === undefined)
-                continue;
             inflight++;
             if (r.owner === owner)
                 ownInflight++;
@@ -1126,80 +1097,86 @@ export class ToolApprovalCoordinator {
         };
     }
     openParkRedemption(askId, owner) {
-        const opened = { owner, stampedAtMs: Date.now() };
-        this.parkRedemptions.delete(askId);
+        const opened = { owner };
         this.parkRedemptions.set(askId, opened);
         return opened;
     }
-    retainParkRedemption(askId, memo) {
-        const now = Date.now();
-        const effectivePerPrincipalMax = Math.min(this.parkRedemptionPerPrincipalMax, this.parkRedemptionMax);
-        let receipts = 0;
-        let ownReceipts = 0;
-        let ownExpired;
-        let ownOldest;
-        let globalExpired;
-        for (const [k, r] of this.parkRedemptions) {
-            if (k === askId || r.redeemed === undefined || r.inflight !== undefined)
-                continue;
-            receipts++;
-            const expired = now - r.stampedAtMs > this.parkRedemptionTtlMs;
-            if (globalExpired === undefined && expired)
-                globalExpired = k;
-            if (r.owner !== memo.owner)
-                continue;
-            ownReceipts++;
-            if (ownOldest === undefined)
-                ownOldest = k;
-            if (ownExpired === undefined && expired)
-                ownExpired = k;
-        }
-        if (ownReceipts >= effectivePerPrincipalMax) {
-            const victim = ownExpired ?? ownOldest;
-            if (victim !== undefined)
-                this.parkRedemptions.delete(victim);
-        }
-        else if (receipts >= this.parkRedemptionMax) {
-            if (globalExpired === undefined) {
-                recordFailOpen("server.approval.park-redemption-cap-refused", `owner=${memo.owner ?? "<none>"}`);
-                if (this.parkRedemptions.get(askId) === memo)
-                    this.parkRedemptions.delete(askId);
-                return false;
-            }
-            this.parkRedemptions.delete(globalExpired);
-        }
-        memo.stampedAtMs = now;
-        return true;
-    }
     lookupParkRedemption(askId) {
-        const r = this.parkRedemptions.get(askId);
-        if (r === undefined)
-            return undefined;
-        if (r.inflight === undefined && Date.now() - r.stampedAtMs > this.parkRedemptionTtlMs) {
-            this.parkRedemptions.delete(askId);
-            return undefined;
-        }
-        return r;
+        return this.parkRedemptions.get(askId);
     }
-    notifyExternalDecision(askId, outcome) {
+    notifyExternalDecision(askId, outcome, readRootGrant) {
         const entries = this.pendingByAskId.get(askId);
         if (!entries)
             return { settled: 0 };
         const args = settleArgsOfDecided(outcome);
         let settled = 0;
         for (const entry of [...entries]) {
-            entry.settle(verdictOfDecided(args));
+            entry.settle(verdictOfDecided(args, readRootGrant));
             if (entry.adopted !== true)
                 settled += 1;
         }
         return { settled };
     }
+    holdLiveLeg(askId) {
+        const hold = { askId };
+        const entry = this.pendingByAskId.get(askId)?.values().next().value;
+        if (entry !== undefined)
+            heldLegEntries.set(hold, entry);
+        return hold;
+    }
+    askDemandsAPerson(row, held) {
+        return storedCardDemandsAPerson(row.cardJson) || (held.askId === row.askId && heldLegEntries.get(held)?.requiresRealApproval === true);
+    }
+    async settleLiveDecision(row, held, judgedOwner, principal, extras) {
+        const leg = held.askId === row.askId ? heldLegEntries.get(held) : undefined;
+        const answer = extras.remember === "session" && leg !== undefined ? liveSessionAnswer(pendingEntryStandingAnswerFacts(leg), leg) : undefined;
+        let rememberApplied = extras.remember === "session" ? false : undefined;
+        if (leg !== undefined && answer?.home === "seat") {
+            const grantKey = sessionAllowKey(judgedOwner, answer.seat, sessionAllowCategory(leg.toolName), leg.grantBinding);
+            if (this.allowAllSessions.size >= MAX_ALLOW_SESSIONS) {
+                const oldest = this.allowAllSessions.values().next().value;
+                if (oldest !== undefined)
+                    this.allowAllSessions.delete(oldest);
+            }
+            this.allowAllSessions.add(grantKey);
+            rememberApplied = true;
+        }
+        else if (answer?.home === "none" && answer.occupantUnreadable) {
+            defaultLogger.warn("session_grant_refused_occupant_unreadable", { sessionId: leg?.sessionId, toolName: leg?.toolName });
+        }
+        const { settled } = this.notifyExternalDecision(row.askId, outcomeOfDecidedRow(row), extras.readRootGrant);
+        const grants = this.sessionGrants;
+        if (leg !== undefined && answer?.home === "server_store" && grants !== undefined) {
+            try {
+                await this.withStoreDeadline(grants.grant(answer.sessionId, leg.toolName, principal ?? judgedOwner), "sessionGrants.grant(deployment-list)", DURABLE_CALL_TIMEOUT_MS);
+                rememberApplied = true;
+                defaultLogger.info("approval_exemption_granted", { sessionId: answer.sessionId, toolName: leg.toolName, grantedBy: principal ?? judgedOwner });
+            }
+            catch (err) {
+                defaultLogger.warn("approval_exemption_grant_failed", { sessionId: answer.sessionId, toolName: leg.toolName, error: String(err).slice(0, 200) });
+            }
+        }
+        const rule = extras.persistRule !== undefined && row.decision === "approve"
+            ? await redeemCardRule(this.ruleConsent, readCardRuleRecordOfAskRow(row, judgedOwner), extras.persistRule, { inputWasEdited: extras.inputWasEdited, eligible: true })
+            : undefined;
+        return { settled, ...(rememberApplied !== undefined ? { rememberApplied } : {}), ...(rule !== undefined ? { rule } : {}) };
+    }
+    precheckEditedRuleOfAskRow(row, judgedOwner, persistRule, inputWasEdited) {
+        if (persistRule.kind !== "text" || !persistRule.edited || inputWasEdited || this.ruleConsent === undefined)
+            return undefined;
+        const reading = readCardRuleRecordOfAskRow(row, judgedOwner);
+        if (reading.kind !== "record")
+            return undefined;
+        const verdict = precheckCardRuleText(persistRule.rule, reading.record.command);
+        if (verdict === undefined || verdict.ok)
+            return undefined;
+        return { message: verdict.message, ...(verdict.code !== undefined ? { ruleRejectCode: verdict.code } : {}) };
+    }
     emitRevokeTo(ctxs, frame) {
         if (frame.askIds.length === 0)
             return;
         for (const c of ctxs)
-            if (c.family === "approval_request")
-                void deliverHitlNotice(c.transport, frame);
+            void deliverHitlNotice(c.transport, frame);
     }
     emitRevoke(frame, target) {
         const targets = new Set();
@@ -1293,7 +1270,7 @@ export class ToolApprovalCoordinator {
         const aliveCtxs = ctxs.filter((c) => !c.abortSignal?.aborted);
         const reachability = aliveCtxs.length === 0 ? "unreached" : "reachable";
         if (reachability === "unreached") {
-            if (!this.unattendedRoutesToPark || !this.askStore) {
+            if (!this.unattendedRoutesToPark) {
                 return this.unattendedOutcome({ arm: "no_live_target", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
             }
         }
@@ -1311,19 +1288,18 @@ export class ToolApprovalCoordinator {
         const id = uuidv7();
         const child = isChildAsk(req);
         const carrierLeg = child ? undefined : aliveCtxs.find((c) => c.taskId === origin.taskId);
-        const bounded = boundArgs(req.args);
         let effectiveGovernanceForced = governanceForced;
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
         const mandateWord = readClosedWordSeat(req, "mandate");
         const noRulingCause = readClosedWordSeat(req, "classifierNoRuling");
         const grantAbsence = readClosedWordSeat(req, "boundGrantAbsence");
         const cardWord = readApprovalCard(req.approvalCard);
+        const bounded = boundArgs(req.args, cardWord);
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
         const askReasonsOfReq = readAskReasons(req);
-        const requester = extensionRequesterOf(req.requestedBy, "tool_approval");
+        const requester = extensionRequesterOf(req.requestedBy, "approval_request");
         const frame = {
-            type: "tool_approval",
             approvalId: id,
             toolName: req.toolName,
             ...(typeof req.toolCallId === "string" && req.toolCallId !== "" ? { toolCallId: req.toolCallId } : {}),
@@ -1371,9 +1347,12 @@ export class ToolApprovalCoordinator {
         const windowBudgetMs = reachability === "unreached" ? this.unreachedTtlMs : this.ttlMs;
         const effectiveWindowMs = effectiveAskWindowMs(windowBudgetMs, this.windowMarginMs, origin.legDeadlineMonotonic, performance.now());
         const expiresAtMs = Math.ceil(Date.now() + effectiveWindowMs);
-        let askId;
-        let batchId;
-        const card = this.askStore ? buildApprovalCard(frame, req, askDemandsAPerson(req, undefined)) : undefined;
+        const sourceSessionId = req.sourceSessionId ?? origin.taskId;
+        const runId = origin.taskId;
+        const legKey = origin.legKey;
+        const askId = deriveAskId(sourceSessionId, runId, legKey, req);
+        let batchId = this.batchIdFor(askId, sourceSessionId, runId, legKey);
+        const card = buildApprovalCard(frame, req, askDemandsAPerson(req, undefined));
         let cardForFrame = card;
         let persistedExpiresAtMs = expiresAtMs;
         let factsOfRecord;
@@ -1384,11 +1363,10 @@ export class ToolApprovalCoordinator {
         let abandonedAs;
         const attemptCreatedAtMs = Date.now();
         const finishAbandonedRow = (orphan) => {
-            const store = this.askStore;
-            if (!store || abandonedAs === undefined)
+            if (abandonedAs === undefined)
                 return undefined;
             if (abandonedAs === "void") {
-                void store
+                void this.askStore
                     .transitionAsk(orphan.askId, "STREAM_PENDING", "VOID", { updatedAtMs: Date.now() })
                     .catch((err) => this.noteStoreError(err, "transitionAsk(abandon-late-ensure)"));
                 return undefined;
@@ -1405,142 +1383,131 @@ export class ToolApprovalCoordinator {
                 ? this.unattendedOutcome({ arm: "replayed_parked", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability })
                 : replayed;
         };
-        if (this.askStore && card) {
-            const sourceSessionId = req.sourceSessionId ?? origin.taskId;
-            const runId = origin.taskId;
-            const legKey = origin.legKey;
-            askId = deriveAskId(sourceSessionId, runId, legKey, req);
-            batchId = this.batchIdFor(askId, sourceSessionId, runId, legKey);
-            try {
-                const existingOrCreated = await this.withStoreDeadline(this.askStore.ensureAsk({
-                    askId,
-                    taskId: origin.taskId,
-                    sourceSessionId,
-                    sessionId: origin.sessionId ?? origin.taskId,
-                    owner: origin.owner,
-                    executionLane: origin.executionLane,
-                    batchId,
-                    toolCallId: req.toolCallId,
-                    legKey,
-                    parentToolCallId: req.delegation?.parentToolCallId ?? null,
-                    cardJson: buildApprovalCardEnvelope(askId, card, frame),
-                    boundInputHash: readBoundInputHash(req),
-                    ...durableRuleMaterial(ruleLaneMaterial),
-                    schemaVersion: 1,
-                    expiresAtMs,
-                    createdAtMs: attemptCreatedAtMs,
-                }), "ensureAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
-                    if (late.row.state !== "STREAM_PENDING") {
-                        lateTerminalRow = late.row;
-                        this.dispatchClaimTruth(late.row.askId, this.classifyClaimLoss(late.row.askId, projectAskTerminalClaimTruth(late.row), "late:ensureAsk"), APPROVAL_ENDING_CAUSES.UNDELIVERABLE);
-                        return;
-                    }
-                    lateEnsuredRow = late.inserted ? { askId: late.row.askId, batchId: late.row.batchId } : undefined;
-                    if (lateEnsuredRow !== undefined)
-                        void finishAbandonedRow(lateEnsuredRow);
-                });
-                batchId = existingOrCreated.row.batchId;
-                if (existingOrCreated.row.state !== "STREAM_PENDING") {
-                    releaseAdmission();
-                    return replayTerminalRow(existingOrCreated.row);
-                }
-                const persistedEnvelope = readStoredCardEnvelope(existingOrCreated.row.cardJson);
-                const maxMintableWindowMs = Math.max(effectiveWindowMs, this.unreachedTtlMs);
-                const sanePersistedDeadline = Number.isFinite(existingOrCreated.row.expiresAtMs) && existingOrCreated.row.expiresAtMs <= Date.now() + maxMintableWindowMs + DURABLE_CALL_TIMEOUT_MS;
-                if (persistedEnvelope === undefined || !sanePersistedDeadline) {
-                    this.noteStoreError(new Error(`persisted approval row is unusable (envelopeOk=${persistedEnvelope !== undefined}, deadlineOk=${sanePersistedDeadline}, ` +
-                        `origin=${existingOrCreated.inserted ? "row-this-call-just-inserted" : "row-hit-idempotently"})`), "ensureAsk(persisted-row-unusable)");
-                    releaseAdmission();
-                    const unattended = this.unattendedOutcome({ arm: "persisted_row_unusable", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
-                    return existingOrCreated.inserted ? this.landUnattendedOutcome(unattended, existingOrCreated.row) : unattended;
-                }
-                persistedExpiresAtMs = existingOrCreated.row.expiresAtMs;
-                entryExecutionLane = existingOrCreated.row.executionLane;
-                cardForFrame = persistedEnvelope.card;
-                recordCard = persistedEnvelope.card;
-                factsOfRecord = existingOrCreated.inserted ? undefined : persistedEnvelope.liveFacts;
-                if (factsOfRecord !== undefined)
-                    adoptStoredLiveFacts(frame, factsOfRecord);
-                if (cardForFrame.governanceForced === true)
-                    frame.governanceForced = true;
-                else
-                    delete frame.governanceForced;
-                if (cardForFrame.allowRuleShadowed !== undefined)
-                    frame.allowRuleShadowed = cardForFrame.allowRuleShadowed;
-                else
-                    delete frame.allowRuleShadowed;
-                if (cardForFrame.inputHasBidi === true)
-                    frame.inputHasBidi = true;
-                else
-                    delete frame.inputHasBidi;
-                if (cardForFrame.denialLimitFallback !== undefined)
-                    frame.denialLimitFallback = cardForFrame.denialLimitFallback;
-                else
-                    delete frame.denialLimitFallback;
-                if (cardForFrame.governanceForced === true && !effectiveGovernanceForced) {
-                    effectiveGovernanceForced = true;
-                    ruleLaneMaterial = undefined;
-                    delete frame.ruleOffers;
-                    if (cardForFrame.ruleOffers !== undefined) {
-                        const { ruleOffers: _dropped, ...rest } = cardForFrame;
-                        cardForFrame = rest;
-                    }
+        try {
+            const existingOrCreated = await this.withStoreDeadline(this.askStore.ensureAsk({
+                askId,
+                taskId: origin.taskId,
+                sourceSessionId,
+                sessionId: origin.sessionId ?? origin.taskId,
+                owner: origin.owner,
+                executionLane: origin.executionLane,
+                batchId,
+                toolCallId: req.toolCallId,
+                legKey,
+                parentToolCallId: req.delegation?.parentToolCallId ?? null,
+                cardJson: buildApprovalCardEnvelope(askId, card, frame),
+                boundInputHash: readBoundInputHash(req),
+                ...durableRuleMaterial(ruleLaneMaterial),
+                schemaVersion: 1,
+                expiresAtMs,
+                createdAtMs: attemptCreatedAtMs,
+            }), "ensureAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
+                if (late.row.state !== "STREAM_PENDING") {
+                    lateTerminalRow = late.row;
+                    this.dispatchClaimTruth(late.row.askId, this.classifyClaimLoss(late.row.askId, projectAskTerminalClaimTruth(late.row), "late:ensureAsk"), APPROVAL_ENDING_CAUSES.UNDELIVERABLE);
+                    return;
                 }
-                if (ruleLaneMaterial !== undefined && !ToolApprovalCoordinator.ruleOffersEqual(cardForFrame.ruleOffers, ruleLaneMaterial.offers)) {
-                    this.noteStoreError(new Error("persisted approval row offers a different ruleOffers set than this leg — withdrawing the rule lane for this delivery"), "ensureAsk(rule-offers-drift)");
-                    ruleLaneMaterial = undefined;
-                    delete frame.ruleOffers;
-                    if (cardForFrame.ruleOffers !== undefined) {
-                        const { ruleOffers: _drifted, ...rest } = cardForFrame;
-                        cardForFrame = rest;
-                    }
+                lateEnsuredRow = late.inserted ? { askId: late.row.askId, batchId: late.row.batchId } : undefined;
+                if (lateEnsuredRow !== undefined)
+                    void finishAbandonedRow(lateEnsuredRow);
+            });
+            batchId = existingOrCreated.row.batchId;
+            if (existingOrCreated.row.state !== "STREAM_PENDING") {
+                releaseAdmission();
+                return replayTerminalRow(existingOrCreated.row);
+            }
+            const persistedEnvelope = readStoredCardEnvelope(existingOrCreated.row.cardJson);
+            const maxMintableWindowMs = Math.max(effectiveWindowMs, this.unreachedTtlMs);
+            const sanePersistedDeadline = Number.isFinite(existingOrCreated.row.expiresAtMs) && existingOrCreated.row.expiresAtMs <= Date.now() + maxMintableWindowMs + DURABLE_CALL_TIMEOUT_MS;
+            if (persistedEnvelope === undefined || !sanePersistedDeadline) {
+                this.noteStoreError(new Error(`persisted approval row is unusable (envelopeOk=${persistedEnvelope !== undefined}, deadlineOk=${sanePersistedDeadline}, ` +
+                    `origin=${existingOrCreated.inserted ? "row-this-call-just-inserted" : "row-hit-idempotently"})`), "ensureAsk(persisted-row-unusable)");
+                releaseAdmission();
+                const unattended = this.unattendedOutcome({ arm: "persisted_row_unusable", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                return existingOrCreated.inserted ? this.landUnattendedOutcome(unattended, existingOrCreated.row) : unattended;
+            }
+            persistedExpiresAtMs = existingOrCreated.row.expiresAtMs;
+            entryExecutionLane = existingOrCreated.row.executionLane;
+            cardForFrame = persistedEnvelope.card;
+            recordCard = persistedEnvelope.card;
+            factsOfRecord = existingOrCreated.inserted ? undefined : persistedEnvelope.liveFacts;
+            if (factsOfRecord !== undefined)
+                adoptStoredLiveFacts(frame, factsOfRecord);
+            if (cardForFrame.governanceForced === true)
+                frame.governanceForced = true;
+            else
+                delete frame.governanceForced;
+            if (cardForFrame.allowRuleShadowed !== undefined)
+                frame.allowRuleShadowed = cardForFrame.allowRuleShadowed;
+            else
+                delete frame.allowRuleShadowed;
+            if (cardForFrame.inputHasBidi === true)
+                frame.inputHasBidi = true;
+            else
+                delete frame.inputHasBidi;
+            if (cardForFrame.denialLimitFallback !== undefined)
+                frame.denialLimitFallback = cardForFrame.denialLimitFallback;
+            else
+                delete frame.denialLimitFallback;
+            if (cardForFrame.governanceForced === true && !effectiveGovernanceForced) {
+                effectiveGovernanceForced = true;
+                ruleLaneMaterial = undefined;
+                delete frame.ruleOffers;
+                if (cardForFrame.ruleOffers !== undefined) {
+                    const { ruleOffers: _dropped, ...rest } = cardForFrame;
+                    cardForFrame = rest;
                 }
             }
-            catch (err) {
-                this.noteStoreError(err, "ensureAsk");
-                let confirmedRowExists = false;
-                let indeterminate = true;
-                for (let attempt = 0; attempt <= DURABLE_CONVERGE_BACKOFF_MS.length; attempt++) {
-                    try {
-                        const confirmedRow = await this.withStoreDeadline(this.askStore.getAsk(askId), "getAsk(ensureAsk-confirm)");
-                        confirmedRowExists = confirmedRow !== null;
-                        if (confirmedRow !== null)
-                            batchId = confirmedRow.batchId;
-                        if (confirmedRow !== null)
-                            recordCard = storedPersonDemandRecord(confirmedRow.cardJson);
-                        indeterminate = false;
-                        break;
-                    }
-                    catch (readErr) {
-                        this.noteStoreError(readErr, "getAsk(ensureAsk-confirm)");
-                        if (attempt < DURABLE_CONVERGE_BACKOFF_MS.length)
-                            await new Promise((r) => setTimeout(r, DURABLE_CONVERGE_BACKOFF_MS[attempt]).unref?.());
-                    }
-                }
-                if (lateTerminalRow !== undefined) {
-                    releaseAdmission();
-                    return replayTerminalRow(lateTerminalRow);
+            if (ruleLaneMaterial !== undefined && !ToolApprovalCoordinator.ruleOffersEqual(cardForFrame.ruleOffers, ruleLaneMaterial.offers)) {
+                this.noteStoreError(new Error("persisted approval row offers a different ruleOffers set than this leg — withdrawing the rule lane for this delivery"), "ensureAsk(rule-offers-drift)");
+                ruleLaneMaterial = undefined;
+                delete frame.ruleOffers;
+                if (cardForFrame.ruleOffers !== undefined) {
+                    const { ruleOffers: _drifted, ...rest } = cardForFrame;
+                    cardForFrame = rest;
                 }
-                if (indeterminate) {
-                    const unattended = this.unattendedOutcome({ arm: "ensure_indeterminate", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
-                    const landed = abandonRow(unattended);
-                    releaseAdmission();
-                    return landed ?? unattended;
+            }
+        }
+        catch (err) {
+            this.noteStoreError(err, "ensureAsk");
+            let confirmedRowExists = false;
+            let indeterminate = true;
+            for (let attempt = 0; attempt <= DURABLE_CONVERGE_BACKOFF_MS.length; attempt++) {
+                try {
+                    const confirmedRow = await this.withStoreDeadline(this.askStore.getAsk(askId), "getAsk(ensureAsk-confirm)");
+                    confirmedRowExists = confirmedRow !== null;
+                    if (confirmedRow !== null)
+                        batchId = confirmedRow.batchId;
+                    if (confirmedRow !== null)
+                        recordCard = storedPersonDemandRecord(confirmedRow.cardJson);
+                    indeterminate = false;
+                    break;
                 }
-                if (!confirmedRowExists) {
-                    askId = undefined;
-                    batchId = undefined;
-                    if (!aliveCtxs.some(canPresentWithoutDurableRow)) {
-                        const unattended = this.unattendedOutcome({ arm: "no_row_no_presenter", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
-                        const landed = abandonRow(unattended);
-                        releaseAdmission();
-                        return landed ?? unattended;
-                    }
-                    void abandonRow(undefined);
+                catch (readErr) {
+                    this.noteStoreError(readErr, "getAsk(ensureAsk-confirm)");
+                    if (attempt < DURABLE_CONVERGE_BACKOFF_MS.length)
+                        await new Promise((r) => setTimeout(r, DURABLE_CONVERGE_BACKOFF_MS[attempt]).unref?.());
                 }
             }
+            if (lateTerminalRow !== undefined) {
+                releaseAdmission();
+                return replayTerminalRow(lateTerminalRow);
+            }
+            if (indeterminate) {
+                const unattended = this.unattendedOutcome({ arm: "ensure_indeterminate", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                const landed = abandonRow(unattended);
+                releaseAdmission();
+                return landed ?? unattended;
+            }
+            if (!confirmedRowExists) {
+                const unattended = this.unattendedOutcome({ arm: "no_row_no_presenter", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                const landed = abandonRow(unattended);
+                releaseAdmission();
+                return landed ?? unattended;
+            }
         }
-        const wireApprovalId = askId ?? id;
+        const wireApprovalId = askId;
+        const rowCard = cardForFrame;
         frame.approvalId = wireApprovalId;
         let done = false;
         let emitFailed = false;
@@ -1600,27 +1567,23 @@ export class ToolApprovalCoordinator {
             for (const [sig, fn] of abortListeners)
                 sig.removeEventListener("abort", fn);
             this.pending.delete(id);
-            if (windowRouteUnavailable && askId !== undefined && batchId !== undefined && this.unattendedRoutesToPark) {
+            if (windowRouteUnavailable && this.unattendedRoutesToPark) {
                 parkRouted = true;
             }
             let lastLiveRegistration = false;
-            if (askId !== undefined) {
-                const siblings = this.pendingByAskId.get(askId);
-                if (siblings && selfEntry) {
-                    siblings.delete(selfEntry);
-                    if (siblings.size === 0) {
-                        this.pendingByAskId.delete(askId);
-                        lastLiveRegistration = true;
-                    }
+            const siblings = this.pendingByAskId.get(askId);
+            if (siblings && selfEntry) {
+                siblings.delete(selfEntry);
+                if (siblings.size === 0) {
+                    this.pendingByAskId.delete(askId);
+                    lastLiveRegistration = true;
                 }
             }
             lastOutcome = outcome;
             lastCause = verdict.by === "system" ? verdict.cause : undefined;
-            if (askId !== undefined) {
-                completeFrame = buildApprovalCompleteFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, outcome, ...(lastCause !== undefined ? { cause: lastCause } : {}), parked: parkRouted, nowMs: Date.now() });
-                if (lastLiveRegistration)
-                    this.notifyPresentedCardWatchers(askId, completeFrame);
-            }
+            completeFrame = buildApprovalCompleteFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, outcome, ...(lastCause !== undefined ? { cause: lastCause } : {}), parked: parkRouted, nowMs: Date.now() });
+            if (lastLiveRegistration)
+                this.notifyPresentedCardWatchers(askId, completeFrame);
             releaseAdmission();
             if (selfEntry)
                 selfEntry.settledOutcome = outcome;
@@ -1652,8 +1615,6 @@ export class ToolApprovalCoordinator {
             resolveAllowed({ allowed, ...(allowed && updatedInput !== undefined ? { updatedInput } : {}), ...(allowed && readRootGrant !== undefined ? { readRootGrant } : {}) });
         };
         const broadcastClaimTruth = (read, armCause) => {
-            if (askId === undefined)
-                return;
             this.dispatchClaimTruth(askId, read, armCause);
         };
         const settleFromClaimLoss = (read, armCause) => {
@@ -1682,8 +1643,6 @@ export class ToolApprovalCoordinator {
             }
         };
         const lateClaimLossSettle = (current, intent, armCause) => {
-            if (askId === undefined)
-                return;
             const read = this.classifyClaimLoss(askId, current, `late:${intent}`);
             if (done) {
                 broadcastClaimTruth(read, armCause);
@@ -1700,10 +1659,6 @@ export class ToolApprovalCoordinator {
             return this.withStoreDeadline(raw, label, timeoutMs, late);
         };
         const resolveLocalOutcome = async (arm) => {
-            if (askId === undefined) {
-                arm.settleByIntent();
-                return;
-            }
             const pinnedAskId = askId;
             let lastLoss;
             const ladderStartedAt = Date.now();
@@ -1799,10 +1754,6 @@ export class ToolApprovalCoordinator {
         };
         const windowExpired = (hostSelfReport, cause) => {
             void (async () => {
-                if (!this.askStore || askId === undefined || batchId === undefined) {
-                    settleParkRouteIfUnsettled(hostSelfReport, cause);
-                    return;
-                }
                 const store = this.askStore;
                 const pinnedAskId = askId;
                 const pinnedBatchId = batchId;
@@ -1833,19 +1784,11 @@ export class ToolApprovalCoordinator {
         const forceParkNow = (cause) => {
             if (done)
                 return;
-            if (!this.askStore || askId === undefined || batchId === undefined) {
-                settleParkRouteIfUnsettled(undefined, cause);
-                return;
-            }
             windowExpired(undefined, cause);
         };
-        timer = setTimeout(() => windowExpired("timeout", APPROVAL_ENDING_CAUSES.TTL_EXPIRED), this.askStore ? Math.max(0, persistedExpiresAtMs - Date.now()) : effectiveWindowMs);
+        timer = setTimeout(() => windowExpired("timeout", APPROVAL_ENDING_CAUSES.TTL_EXPIRED), Math.max(0, persistedExpiresAtMs - Date.now()));
         timer.unref?.();
         const runCancel = async (cause) => {
-            if (!this.askStore || askId === undefined || batchId === undefined) {
-                settle({ by: "system", cause });
-                return;
-            }
             if (this.hasOtherSuspendedOwner(askId, selfEntry)) {
                 settle({ by: "system", cause });
                 return;
@@ -1907,31 +1850,27 @@ export class ToolApprovalCoordinator {
         const legGrantBinding = grantBindingOf(req);
         const entryGrantBinding = factsOfRecord === undefined ? legGrantBinding : agreedGrantBinding(legGrantBinding, grantBindingOf(factsOfRecord));
         const entryMandated = req.mandated === true || factsOfRecord?.mandated === true;
-        const entryDemandsAPerson = askDemandsAPerson(req, recordCard) || [...(askId !== undefined ? (this.pendingByAskId.get(askId) ?? []) : [])].some((s) => s.requiresRealApproval === true);
-        cardForFrame = projectDecisionFacts(pendingEntryStandingAnswerFacts({
+        const entryDemandsAPerson = askDemandsAPerson(req, recordCard) || [...(this.pendingByAskId.get(askId) ?? [])].some((s) => s.requiresRealApproval === true);
+        const presentedCard = projectDecisionFacts(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(entryDemandsAPerson ? { requiresRealApproval: true } : {}),
             ...(entryMandated ? { mandated: true } : {}),
             grantBinding: entryGrantBinding,
             classes: entryClasses,
             ...(entryDeploymentListQuestion ? { deploymentListQuestion: true } : {}),
-        }), origin, frame, cardForFrame);
-        const cardFrame = askId !== undefined && cardForFrame !== undefined
-            ? buildApprovalRequestFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, card: cardForFrame, expiresAtMs: persistedExpiresAtMs, nowMs: Date.now(), live: frame })
-            : undefined;
+        }), origin, frame, rowCard);
+        const cardFrame = buildApprovalRequestFrame({ askId: wireApprovalId, taskId: origin.taskId, approvalId: wireApprovalId, card: presentedCard, expiresAtMs: persistedExpiresAtMs, nowMs: Date.now(), live: frame });
         const pendingEntry = {
             settle,
             forceParkNow,
             settleParkRoute: (cause) => settleParkRouteIfUnsettled(undefined, cause),
-            owner: origin.owner,
-            ownerReadSeq: this.rowReadSeq,
             ...(primary ? { ctxTaskId: primary.taskId, originCtx: primary } : {}),
             ...(reachability === "unreached" ? { suspended: true } : {}),
-            ...(child ? { originTaskId: req.sourceSessionId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
+            ...(child ? { sourceSessionId: req.sourceSessionId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
             ...(origin.incarnation !== undefined ? { incarnation: origin.incarnation } : {}),
             frame,
-            ...(cardFrame !== undefined ? { cardFrame } : {}),
+            cardFrame,
             approvalId: wireApprovalId,
             registrationId: id,
             toolName: req.toolName,
@@ -1941,31 +1880,29 @@ export class ToolApprovalCoordinator {
             registeredAtMs: Date.now(),
             expiresAtMs: persistedExpiresAtMs,
             executionLane: entryExecutionLane,
-            ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(entryDemandsAPerson ? { requiresRealApproval: true } : {}),
             ...(entryMandated ? { mandated: true } : {}),
-            ...(askId !== undefined && batchId !== undefined ? { askId, batchId } : {}),
+            askId,
+            batchId,
         };
         selfEntry = pendingEntry;
         this.pending.set(id, pendingEntry);
-        if (askId !== undefined) {
-            this.releaseAdoptedRegistrations(askId);
-            let siblings = this.pendingByAskId.get(askId);
-            if (!siblings) {
-                siblings = new Set();
-                this.pendingByAskId.set(askId, siblings);
-            }
-            siblings.add(pendingEntry);
-            if (entryDemandsAPerson) {
-                for (const s of siblings) {
-                    if (s.requiresRealApproval === true)
-                        continue;
-                    s.requiresRealApproval = true;
-                    const card = projectDecisionFacts(pendingEntryStandingAnswerFacts(s), s, s.frame, s.cardFrame?.card);
-                    if (s.cardFrame !== undefined && card !== undefined && card !== s.cardFrame.card)
-                        s.cardFrame = { ...s.cardFrame, card };
-                }
+        this.releaseAdoptedRegistrations(askId);
+        let siblings = this.pendingByAskId.get(askId);
+        if (!siblings) {
+            siblings = new Set();
+            this.pendingByAskId.set(askId, siblings);
+        }
+        siblings.add(pendingEntry);
+        if (entryDemandsAPerson) {
+            for (const s of siblings) {
+                if (s.requiresRealApproval === true)
+                    continue;
+                s.requiresRealApproval = true;
+                const card = projectDecisionFacts(pendingEntryStandingAnswerFacts(s), s, s.frame, s.cardFrame?.card);
+                if (s.cardFrame !== undefined && card !== undefined && card !== s.cardFrame.card)
+                    s.cardFrame = { ...s.cardFrame, card };
             }
         }
         this.askAudit?.recordAsk({
@@ -1988,73 +1925,49 @@ export class ToolApprovalCoordinator {
             frame.serverNowMs = serverNowMs;
             frame.expiresInMs = Math.max(0, persistedExpiresAtMs - serverNowMs);
         }
-        const cardCtxs = aliveCtxs.filter((c) => c.family === "approval_request");
-        const legacyCtxs = aliveCtxs.filter((c) => c.family === "tool_approval");
-        if (cardFrame === undefined && cardCtxs.length > 0) {
-            defaultLogger.warn("approval card leg cannot present this ask: it has no confirmed durable identity (no approval_request frame is minted without one)", {
-                taskId: origin.taskId,
-                approvalId: wireApprovalId,
-                toolName: req.toolName,
-            });
-        }
-        const cardRace = cardFrame !== undefined && cardCtxs.length > 0
-            ? createHitlOpenRace({ targets: cardCtxs.map((c) => ({ transport: c.transport, frame: cardFrame })), settled: allowedP })
-            : undefined;
-        const legacyRace = legacyCtxs.length > 0 ? createHitlOpenRace({ targets: legacyCtxs.map((c) => ({ transport: c.transport, frame })), settled: allowedP }) : undefined;
-        if (cardRace !== undefined && cardFrame !== undefined)
+        const cardCtxs = aliveCtxs;
+        const cardRace = cardCtxs.length > 0 ? createHitlOpenRace({ targets: cardCtxs.map((c) => ({ transport: c.transport, frame: cardFrame })), settled: allowedP }) : undefined;
+        if (cardRace !== undefined)
             cardCtxs.forEach((c, i) => this.notePresentedCardRegistration(cardFrame.askId, c.transport, cardRace.acceptedLive(i)));
         const emitAllP = (async () => {
-            const landings = await Promise.all([cardRace?.landing, legacyRace?.landing]);
-            const anySucceeded = reachability === "unreached" || this.hasOtherSuspendedOwner(askId, selfEntry) || landings.includes("delivered");
+            const landing = await cardRace?.landing;
+            const anySucceeded = reachability === "unreached" || this.hasOtherSuspendedOwner(askId, selfEntry) || landing === "delivered";
             emitSettled = true;
             if (!anySucceeded && !done) {
-                if (this.askStore && askId !== undefined && batchId !== undefined) {
-                    const store = this.askStore;
-                    const pinnedAskId = askId;
-                    const pinnedBatchId = batchId;
-                    const settleUnreachable = () => {
-                        if (done)
-                            return;
-                        emitFailed = true;
-                        settle({ by: "system", cause: APPROVAL_ENDING_CAUSES.BROADCAST_LOST });
-                    };
-                    await resolveLocalOutcome({
-                        intent: "unreachable",
-                        cause: APPROVAL_ENDING_CAUSES.BROADCAST_LOST,
-                        storeLabel: "claimTerminal(emit-failed)",
-                        claim: (timeoutMs) => boundedClaim(() => settleByPolicy(store, { askId: pinnedAskId, batchId: pinnedBatchId }, this.unattendedPolicy, APPROVAL_ENDING_CAUSES.BROADCAST_LOST), "claimTerminal(emit-failed)", timeoutMs, (late) => {
-                            if (!late.claimed) {
-                                lateClaimLossSettle(late.current, "unreachable", APPROVAL_ENDING_CAUSES.BROADCAST_LOST);
-                                return;
-                            }
-                            this.settleSameAskIdParkRoute(pinnedAskId, APPROVAL_ENDING_CAUSES.BROADCAST_LOST);
-                            this.settleVoidedSiblings(late.voidedSiblings, APPROVAL_ENDING_CAUSES.BATCH_SIBLING_WITHDRAWN);
-                        }),
-                        onWon: (res) => {
-                            settleUnreachable();
-                            this.settleSameAskIdParkRoute(pinnedAskId, APPROVAL_ENDING_CAUSES.BROADCAST_LOST);
-                            this.settleVoidedSiblings(res.voidedSiblings, APPROVAL_ENDING_CAUSES.BATCH_SIBLING_WITHDRAWN);
-                        },
-                        settleByIntent: settleUnreachable,
-                    });
-                }
-                else if (!done) {
+                const store = this.askStore;
+                const pinnedAskId = askId;
+                const pinnedBatchId = batchId;
+                const settleUnreachable = () => {
+                    if (done)
+                        return;
                     emitFailed = true;
                     settle({ by: "system", cause: APPROVAL_ENDING_CAUSES.BROADCAST_LOST });
-                }
+                };
+                await resolveLocalOutcome({
+                    intent: "unreachable",
+                    cause: APPROVAL_ENDING_CAUSES.BROADCAST_LOST,
+                    storeLabel: "claimTerminal(emit-failed)",
+                    claim: (timeoutMs) => boundedClaim(() => settleByPolicy(store, { askId: pinnedAskId, batchId: pinnedBatchId }, this.unattendedPolicy, APPROVAL_ENDING_CAUSES.BROADCAST_LOST), "claimTerminal(emit-failed)", timeoutMs, (late) => {
+                        if (!late.claimed) {
+                            lateClaimLossSettle(late.current, "unreachable", APPROVAL_ENDING_CAUSES.BROADCAST_LOST);
+                            return;
+                        }
+                        this.settleSameAskIdParkRoute(pinnedAskId, APPROVAL_ENDING_CAUSES.BROADCAST_LOST);
+                        this.settleVoidedSiblings(late.voidedSiblings, APPROVAL_ENDING_CAUSES.BATCH_SIBLING_WITHDRAWN);
+                    }),
+                    onWon: (res) => {
+                        settleUnreachable();
+                        this.settleSameAskIdParkRoute(pinnedAskId, APPROVAL_ENDING_CAUSES.BROADCAST_LOST);
+                        this.settleVoidedSiblings(res.voidedSiblings, APPROVAL_ENDING_CAUSES.BATCH_SIBLING_WITHDRAWN);
+                    },
+                    settleByIntent: settleUnreachable,
+                });
             }
         })();
         await Promise.race([emitAllP, allowedP]);
         const settled = await allowedP;
         if (cardRace !== undefined && completeFrame !== undefined)
             cardRace.close(completeFrame);
-        legacyRace?.close({
-            type: "tool_approval_complete",
-            approvalId: wireApprovalId,
-            outcome: lastOutcome,
-            ...(lastCause !== undefined ? { cause: lastCause } : {}),
-            ...(parkRouted ? { parked: true } : {}),
-        });
         if (emitFailed)
             return this.unattendedOutcome({ arm: "emit_failed", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
         if (windowRouteUnavailable)
@@ -2063,110 +1976,6 @@ export class ToolApprovalCoordinator {
             return this.unattendedOutcome({ arm: "emit_unsettled", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
         return shapeOutcome(settled);
     }
-    respond(id, principal, body, httpReq, deployment) {
-        const parsed = parseToolApprovalResponse(body);
-        if (!parsed.ok)
-            return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: parsed.error, facts: { ...(parsed.field !== undefined ? { field: parsed.field } : {}) } }) };
-        if (parsed.readRootGrant !== undefined && deployment?.readRootGrantAccepted !== true) {
-            return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: READ_ROOT_GRANT_NOT_ACCEPTED }) };
-        }
-        const entry = this.liveEntryFor(id);
-        if (entry?.adopted === true)
-            return this.respondByRow(entry, id, principal, parsed, httpReq);
-        if (entry !== undefined && askOwnerAdmitsAnswer(entry.owner, principal))
-            return this.answerRegistration(entry, entry.owner, id, principal, parsed, httpReq);
-        if (entry !== undefined && this.registrationHasRow(entry))
-            return this.respondByRow(entry, id, principal, parsed, httpReq);
-        return this.respondLate(id, principal, parsed, httpReq);
-    }
-    registrationHasRow(entry) {
-        return this.askStore !== undefined && entry.askId !== undefined;
-    }
-    async respondByRow(entry, id, principal, parsed, httpReq) {
-        const store = this.askStore;
-        if (!store)
-            return this.askNotVisible();
-        const row = await this.askRowFollowingOwner(store, id, "getAsk(respond-by-row)");
-        if (!askRowVisibleTo(row, principal))
-            return this.askNotVisible();
-        if (row.state !== "STREAM_PENDING")
-            return this.dispatchRowTruth(row, id, parsed, httpReq, principal);
-        return this.answerRegistration(entry, row.owner, id, principal, parsed, httpReq);
-    }
-    answerRegistration(entry, judgedOwner, id, principal, parsed, httpReq) {
-        const preRule = this.precheckEditedRuleBeforeDecision(entry, judgedOwner, parsed);
-        if (preRule !== undefined)
-            return preRule;
-        if (parsed.value !== "deny" && policyCannotAnswer(heldAskOf(entry.requiresRealApproval === true), parsed.decider.decidedBy)) {
-            return { status: 400, body: refusalBody({ errorCode: "request.body_shape", message: POLICY_CANNOT_ALLOW_PERSON_ASK }) };
-        }
-        const ruleEligibility = { eligible: true };
-        const store = this.askStore;
-        if (store && entry.askId !== undefined && entry.batchId !== undefined) {
-            return this.respondWithCas(store, entry.askId, entry.batchId, judgedOwner, entry, parsed, ruleEligibility).then((cas) => cas.lost ? this.dispatchRowTruth(cas.row, id, parsed, httpReq, principal) : this.afterLiveDecision(cas.result, entry, judgedOwner, parsed, principal, ruleEligibility));
-        }
-        return this.afterLiveDecision(this.finishRespond(entry, judgedOwner, parsed), entry, judgedOwner, parsed, principal, ruleEligibility);
-    }
-    afterLiveDecision(decided, entry, judgedOwner, parsed, principal, ruleEligibility) {
-        const settled = this.recordDeploymentListAnswer(decided, entry, judgedOwner, parsed, principal, ruleEligibility);
-        if (parsed.persistRule === undefined)
-            return settled;
-        return this.persistRuleAfterDecision(settled, entry, judgedOwner, parsed.persistRule, parsed.updatedInput !== undefined, ruleEligibility);
-    }
-    recordDeploymentListAnswer(decided, entry, judgedOwner, parsed, principal, eligibility) {
-        const store = this.sessionGrants;
-        const answer = liveSessionAnswer(pendingEntryStandingAnswerFacts(entry), entry);
-        if (parsed.value !== "allow_session" || answer.home !== "server_store" || store === undefined)
-            return decided;
-        const sessionId = answer.sessionId;
-        return (async () => {
-            const result = await decided;
-            if (result.status !== 200)
-                return result;
-            if (!eligibility.eligible)
-                return { ...result, body: { ...result.body, rememberApplied: false } };
-            let rememberApplied = false;
-            try {
-                await this.withStoreDeadline(store.grant(sessionId, entry.toolName, principal ?? judgedOwner), "sessionGrants.grant(deployment-list)", DURABLE_CALL_TIMEOUT_MS);
-                rememberApplied = true;
-                defaultLogger.info("approval_exemption_granted", { sessionId, toolName: entry.toolName, grantedBy: principal ?? judgedOwner });
-            }
-            catch (err) {
-                defaultLogger.warn("approval_exemption_grant_failed", { sessionId, toolName: entry.toolName, error: String(err).slice(0, 200) });
-            }
-            return { ...result, body: { ...result.body, rememberApplied } };
-        })();
-    }
-    precheckEditedRuleBeforeDecision(entry, judgedOwner, parsed) {
-        const persistRule = parsed.persistRule;
-        if (persistRule === undefined || persistRule.kind !== "text" || !persistRule.edited)
-            return undefined;
-        if (parsed.updatedInput !== undefined)
-            return undefined;
-        if (entry.governanceForced === true)
-            return undefined;
-        const command = entry.ruleLane?.command;
-        if (this.ruleConsent === undefined || command === undefined || judgedOwner === null)
-            return undefined;
-        const verdict = precheckCardRuleText(persistRule.rule, command);
-        if (verdict === undefined || verdict.ok)
-            return undefined;
-        return {
-            status: 400,
-            body: refusalBody({
-                errorCode: "request.body_shape",
-                message: verdict.message,
-                facts: {
-                    ...(verdict.code !== undefined ? { ruleRejectCode: verdict.code } : {}),
-                },
-            }),
-        };
-    }
-    editedArmEcho(persistRule, persisted) {
-        if (persistRule.kind !== "text" || !persistRule.edited || !persisted.ok || persisted.kind !== "single")
-            return {};
-        return { persistedRule: persisted.rule };
-    }
     notPending(cause) {
         return {
             status: 404,
@@ -2180,34 +1989,24 @@ export class ToolApprovalCoordinator {
         };
     }
     askNotVisible() {
-        return { status: 404, body: refusalBody({ errorCode: "not_found.ask", message: "no such approval ask (never existed, no longer kept, or not yours)" }) };
+        return { status: 404, body: refusalBody({ errorCode: "not_found.ask", message: ASK_NOT_FOUND_UNDER_TASK }) };
     }
-    readApproval(id, principal) {
-        const entry = this.liveEntryFor(id);
-        if (entry !== undefined && this.registrationHasRow(entry))
-            return this.readByRow(entry, id, principal);
-        if (entry !== undefined && askOwnerAdmitsAnswer(entry.owner, principal)) {
-            const body = { state: "pending", ...livePendingRowOf(entry) };
-            return { status: 200, body };
-        }
-        const store = this.askStore;
-        if (!store)
-            return this.askNotVisible();
-        return this.readAskRowState(store, id, principal);
+    readAsk(taskId, askId, principal) {
+        const entry = this.liveEntryFor(askId);
+        if (entry !== undefined)
+            return this.readByRow(entry, taskId, askId, principal);
+        return this.readAskRowState(taskId, askId, principal);
     }
-    async readByRow(entry, id, principal) {
-        const store = this.askStore;
-        if (!store)
-            return this.askNotVisible();
-        const row = await this.askRowFollowingOwner(store, id, "getAsk(read-by-row)");
-        if (askRowVisibleTo(row, principal) && row.state === "STREAM_PENDING") {
+    async readByRow(entry, taskId, askId, principal) {
+        const row = await this.askRowFor(this.askStore, askId, "getAsk(read-by-row)");
+        if (askRowVisibleUnder(row, taskId, principal) && row.state === "STREAM_PENDING") {
             const body = { state: "pending", ...livePendingRowOf(entry) };
             return { status: 200, body };
         }
-        return this.readStateOfRow(row, principal);
+        return this.readStateOfRow(row, taskId, principal);
     }
-    async readAskRowState(store, id, principal) {
-        return this.readStateOfRow(await this.askRowFor(store, id, "getAsk(read)"), principal);
+    async readAskRowState(taskId, askId, principal) {
+        return this.readStateOfRow(await this.askRowFor(this.askStore, askId, "getAsk(read)"), taskId, principal);
     }
     async readParkedGate(row) {
         const gate = this.parkedGate;
@@ -2221,12 +2020,8 @@ export class ToolApprovalCoordinator {
             return undefined;
         }
     }
-    async openGateGeneration(row) {
-        const gate = await this.readParkedGate(row);
-        return gate?.kind === "open" ? gate.generation : undefined;
-    }
-    async readStateOfRow(row, principal) {
-        if (!askRowVisibleTo(row, principal))
+    async readStateOfRow(row, taskId, principal) {
+        if (!askRowVisibleUnder(row, taskId, principal))
             return this.askNotVisible();
         const projection = buildAskRowReadProjection(row, Date.now());
         let body;
@@ -2286,12 +2081,6 @@ export class ToolApprovalCoordinator {
         }
         return { status: 200, body };
     }
-    respondLate(id, principal, parsed, httpReq) {
-        const store = this.askStore;
-        if (!store)
-            return this.askNotVisible();
-        return this.dispatchLateByRow(store, id, parsed, httpReq, principal);
-    }
     watchPresentedCards(askIds, deliver, connection) {
         const watcher = { deliver, connection, askIds: new Set(), registrationsOnConnection: new Map() };
         for (const askId of askIds) {
@@ -2356,16 +2145,10 @@ export class ToolApprovalCoordinator {
         }
     }
     liveEntryFor(id) {
-        const local = this.pending.get(id);
-        if (local !== undefined)
-            return local.askId === undefined ? local : undefined;
         for (const e of this.pendingByAskId.get(id) ?? [])
             return e;
         return undefined;
     }
-    async dispatchLateByRow(store, id, parsed, httpReq, principal) {
-        return this.dispatchRowTruth(await this.askRowFor(store, id, "getAsk(respond-late)"), id, parsed, httpReq, principal);
-    }
     async askRowFor(store, id, label) {
         try {
             return await this.withStoreDeadline(store.getAsk(id), label, DURABLE_CONVERGE_READ_TIMEOUT_MS);
@@ -2375,106 +2158,12 @@ export class ToolApprovalCoordinator {
             return null;
         }
     }
-    async askRowFollowingOwner(store, id, label) {
-        const readSeq = this.nextRowReadSeq();
-        const row = await this.askRowFor(store, id, label);
-        if (row?.state === "STREAM_PENDING")
-            this.followRowOwner(row.askId, row.owner, readSeq);
-        return row;
-    }
-    async dispatchRowTruth(row, id, parsed, httpReq, principal) {
-        if (!askRowVisibleTo(row, principal))
-            return this.askNotVisible();
-        switch (row.state) {
-            case "DECIDED":
-                return this.replayDecidedAsk(id, row, parsed);
-            case "PARKED":
-                return this.redeemParkedAsk(id, row, parsed, httpReq, principal);
-            case "PARKING": {
-                const parkSession = parkSessionOf(row);
-                return {
-                    status: 202,
-                    body: {
-                        approvalId: id,
-                        askId: row.askId,
-                        reason: "parking_in_progress",
-                        message: parkSession !== undefined
-                            ? "parking in progress — not applied; retry after retryAfterMs or answer through decidePath"
-                            : "parking in progress — not applied; retry after retryAfterMs or answer through the parent session's durable decide",
-                        retryAfterMs: PARKING_RETRY_AFTER_MS,
-                        ...(parkSession !== undefined ? { decidePath: approvalDecidePath(parkSession) } : {}),
-                        ...this.lateRuleRefusal(parsed),
-                    },
-                };
-            }
-            case "DENIED":
-            case "VOID": {
-                return this.notPending(askRowEndingCause(row));
-            }
-            case "STREAM_PENDING":
-                return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
-            default: {
-                const unhandled = row.state;
-                defaultLogger.error("tool approval respond hit an unknown ask state", { askId: row.askId, state: unhandled });
-                return this.notPending();
-            }
-        }
-    }
-    lateRuleRefusal(parsed) {
-        if (parsed.persistRule === undefined)
-            return {};
-        return { rulePersisted: false, ruleRefusal: "rule_lane_unavailable" };
-    }
-    replayDecidedAsk(id, row, parsed) {
-        const decided = decidedRowFacts(row);
-        if (decided === undefined) {
-            defaultLogger.error("tool approval late replay saw a DECIDED row that is not a usable human decision", {
-                askId: row.askId,
-                decision: row.decision,
-                provisional: row.provisional,
-                decidedAtMs: row.decidedAtMs,
-            });
-            return this.notPending();
-        }
-        this.notifyExternalDecision(row.askId, outcomeOfDecidedRow(row));
-        return {
-            status: 200,
-            body: {
-                approvalId: id,
-                askId: row.askId,
-                idempotent: true,
-                ...decided,
-                ...noteRecordedReceipt(parsed.note, noteLandedOnRow(parsed.note, row.decisionNote)),
-                ...this.lateRuleRefusal(parsed),
-            },
-        };
-    }
-    async redeemParkedAsk(id, row, parsed, httpReq, principal) {
-        const redeem = this.parkedRedeem?.();
-        if (redeem === undefined)
-            return this.notPending();
-        if (row.gateToken === null) {
-            defaultLogger.error("tool approval parked row carries no gate token — nothing to redeem", { askId: row.askId });
-            return this.notPending();
-        }
-        const openGenerationNow = this.lookupParkRedemption(row.askId) !== undefined ? await this.openGateGeneration(row) : undefined;
-        const prior = this.lookupParkRedemption(row.askId);
-        if (prior?.redeemed !== undefined && receiptAnswersNow(prior.redeemed.gateGeneration, openGenerationNow))
-            return this.replayRedeemReceipt(id, prior, row, prior.redeemed, parsed);
-        if (prior?.inflight !== undefined) {
-            const shared = await prior.inflight;
-            if (shared.status < 200 || shared.status >= 300)
-                return shared;
-            if (!receiptAnswersNow(shared.gateGeneration, openGenerationNow))
-                return this.redeemParkedAsk(id, row, parsed, httpReq, principal);
-            return this.replayRedeemReceipt(id, prior, row, { decision: shared.decision, body: shared.body, gateGeneration: shared.gateGeneration, ...(shared.rule?.terminal === true ? { rule: shared.rule.body } : {}) }, parsed);
-        }
+    async runParkedFlight(redeem, store, row, gateToken, request) {
+        const decision = request.write.decision;
         const admission = this.parkRedemptionAdmission(row.owner);
         if (admission !== undefined)
-            return admission;
+            return { ...admission, body: admission.body, decision };
         const memo = this.openParkRedemption(row.askId, row.owner);
-        const decision = parsed.value === "deny" ? "deny" : "approve";
-        const gateToken = row.gateToken;
         const flight = (async () => {
             let res;
             try {
@@ -2484,12 +2173,14 @@ export class ToolApprovalCoordinator {
                     gateBoundCallId: row.gateBoundCallId,
                     gateBoundInputHash: row.gateBoundInputHash,
                     decision,
-                    ...(parsed.note !== undefined ? { note: parsed.note } : {}),
-                    decider: parsed.decider,
-                    ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
-                    ...(parsed.value === "allow_session" ? { remember: "session" } : {}),
-                    ...(principal !== undefined ? { principal } : {}),
-                    ...(httpReq !== undefined ? { httpReq } : {}),
+                    ...(request.write.note !== undefined ? { note: request.write.note } : {}),
+                    decider: request.write.decider,
+                    ...(request.updatedInput !== undefined && decision === "approve" ? { updatedInput: request.updatedInput } : {}),
+                    ...(request.remember !== undefined ? { remember: request.remember } : {}),
+                    ...(request.persistRule !== undefined ? { persistRule: request.persistRule } : {}),
+                    ...(request.principal !== undefined ? { principal: request.principal } : {}),
+                    operator: request.operator,
+                    ...(request.httpReq !== undefined ? { httpReq: request.httpReq } : {}),
                 });
             }
             catch (err) {
@@ -2498,353 +2189,109 @@ export class ToolApprovalCoordinator {
             }
             if (res.status < 200 || res.status >= 300)
                 return { ...res, decision };
-            const rule = await this.persistRuleFromRow(row, parsed);
-            return { ...res, decision, ...(rule !== undefined ? { rule } : {}) };
+            const recorded = await this.recordParkedOutcome(store, row, request.write);
+            return { ...res, decision, ...(recorded !== undefined ? { recorded } : {}) };
         })();
         memo.inflight = flight;
-        let out;
         try {
-            out = await flight;
+            return await flight;
         }
         finally {
-            memo.inflight = undefined;
-        }
-        if (out.status < 200 || out.status >= 300) {
             if (this.parkRedemptions.get(row.askId) === memo)
                 this.parkRedemptions.delete(row.askId);
-            return { status: out.status, body: out.body };
         }
-        const rule = out.rule;
-        if (this.retainParkRedemption(row.askId, memo))
-            memo.redeemed = { decision, body: out.body, gateGeneration: out.gateGeneration, ...(rule?.terminal === true ? { rule: rule.body } : {}) };
-        return {
-            status: out.status,
-            body: {
-                ...out.body,
-                approvalId: id,
-                askId: row.askId,
-                accepted: "parked_redeemed",
-                ...(parsed.value === "allow_session" ? { rememberApplied: out.rememberApplied === true } : {}),
-                ...(rule?.body ?? {}),
-            },
-        };
     }
-    async persistRuleFromRow(row, parsed) {
-        const persistRule = parsed.persistRule;
-        if (persistRule === undefined)
-            return undefined;
-        const flag = (rulePersisted, ruleRefusal, echo) => ({
-            body: { rulePersisted, ...(ruleRefusal !== undefined ? { ruleRefusal } : {}), ...(echo ?? {}) },
-            terminal: true,
-        });
-        const lane = this.ruleConsent;
-        if (lane === undefined || row.owner === null)
-            return flag(false, "rule_lane_unavailable");
-        const owner = row.owner;
-        const envelope = readStoredCardEnvelope(row.cardJson);
-        if (envelope === undefined)
-            return flag(false, "rule_material_absent");
-        const card = envelope.card;
-        if (card.governanceForced === true)
-            return flag(false, "rule_governance_forced");
-        const command = row.ruleCommand;
-        if (command === null)
-            return flag(false, "rule_material_absent");
-        if (parsed.updatedInput !== undefined)
-            return flag(false, "rule_input_edited");
-        const offers = card.ruleOffers ?? [];
-        const scope = row.ruleScopeRoot !== null ? { kind: "project", root: row.ruleScopeRoot } : undefined;
-        const common = {
-            principal: owner,
-            toolName: card.toolName,
-            command,
-            ...(row.toolCallId !== "" ? { toolCallId: row.toolCallId } : {}),
-            ...(row.boundInputHash !== null ? { boundInputHash: row.boundInputHash } : {}),
-            ...(scope !== undefined ? { scope } : {}),
-        };
+    async recordParkedOutcome(store, row, write) {
         try {
-            if (persistRule.kind === "batch") {
-                const offer = offers[persistRule.batchOfferIndex];
-                if (offer === undefined || offer.kind !== "batch")
-                    return flag(false, "rule_not_offered");
-                const persisted = await lane.persistCardRule({ ...common, redemption: { kind: "batch", offer } });
-                if (!persisted.ok) {
-                    defaultLogger.warn("permission rule batch was not persisted after a parked late decision", {
-                        askId: row.askId,
-                        reason: persisted.reason,
-                        ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}),
-                    });
-                    return flag(false, persisted.reason);
-                }
-                return flag(true, undefined, persisted.kind === "batch"
-                    ? {
-                        persistedRules: persisted.rules,
-                        ...(persisted.members !== undefined
-                            ? { persistedRuleAnchors: persisted.members.map((m) => ({ offerIndex: persistRule.batchOfferIndex, memberIndex: m.memberIndex, rule: m.rule })) }
-                            : {}),
-                    }
-                    : {});
-            }
-            const ruleText = persistRule.rule;
-            if (!persistRule.edited && !offers.some((o) => o.kind === "single" && o.rule === ruleText))
-                return flag(false, "rule_not_offered");
-            const persisted = await lane.persistCardRule({
-                ...common,
-                redemption: persistRule.edited ? { kind: "edited", text: ruleText } : { kind: "offered", ruleText },
-            });
-            if (!persisted.ok) {
-                defaultLogger.warn("permission rule was not persisted after a parked late decision", {
-                    askId: row.askId,
-                    reason: persisted.reason,
-                    ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}),
-                });
-                return flag(false, persisted.reason);
-            }
-            return flag(true, undefined, persistRule.edited && persisted.kind === "single" ? { persistedRule: persisted.rule } : {});
+            const out = await this.writeAskDecision(store, row.askId, { kind: "parked" }, row.owner, write);
+            if (out.ok)
+                return out.row;
+            recordFailOpen("server.approval.parked-decision-not-recorded", `askId=${row.askId} reason=${out.reason}`);
+            return undefined;
         }
         catch (err) {
-            this.noteStoreError(err, "persistCardRule(parked-late)");
-            return { ...flag(false, "rule_store_error"), terminal: false };
-        }
-    }
-    async replayRedeemReceipt(id, memo, row, receipt, parsed) {
-        let rule = receipt.decision === "approve" ? receipt.rule : this.lateRuleRefusal(parsed);
-        if (receipt.decision === "approve" && rule === undefined && parsed.persistRule !== undefined) {
-            const flight = memo.ruleInflight ?? this.persistRuleFromRow(row, parsed);
-            const isOwner = memo.ruleInflight === undefined;
-            if (isOwner)
-                memo.ruleInflight = flight;
-            let fresh;
-            try {
-                fresh = await flight;
-            }
-            finally {
-                if (isOwner)
-                    memo.ruleInflight = undefined;
-            }
-            rule = fresh?.body;
-            if (fresh?.terminal === true && memo.redeemed !== undefined)
-                memo.redeemed.rule = fresh.body;
+            this.noteStoreError(err, "recordParkedDecision");
+            recordFailOpen("server.approval.parked-decision-not-recorded", `askId=${row.askId} reason=store_error`);
+            return undefined;
         }
-        const sameDecision = (parsed.value === "deny") === (receipt.decision === "deny");
-        return {
-            status: 200,
-            body: {
-                ...(sameDecision ? receipt.body : withoutSettlementEvidence(receipt.body)),
-                approvalId: id,
-                askId: row.askId,
-                accepted: "parked_redeemed",
-                idempotent: true,
-                decision: receipt.decision === "approve" ? "allow" : "deny",
-                ...(rule ?? {}),
-            },
-        };
     }
-    async persistRuleAfterDecision(settled, entry, judgedOwner, persistRule, inputWasEdited, ruleEligibility) {
-        const result = await settled;
-        if (result.status !== 200)
-            return result;
-        const lane = this.ruleConsent;
-        const material = entry.ruleLane;
-        const owner = judgedOwner;
-        const withFlag = (rulePersisted, ruleRefusal, echo) => ({
-            status: result.status,
-            body: { ...result.body, rulePersisted, ...(ruleRefusal !== undefined ? { ruleRefusal } : {}), ...(echo ?? {}) },
-        });
-        if (entry.governanceForced === true)
-            return withFlag(false, "rule_governance_forced");
-        if (lane === undefined || material === undefined || owner === null)
-            return withFlag(false, "rule_lane_unavailable");
-        if (!ruleEligibility.eligible)
-            return withFlag(false, "rule_store_error");
-        if (inputWasEdited)
-            return withFlag(false, "rule_input_edited");
-        if (ruleMaterialCarriesCredentialShape(material.command)) {
-            defaultLogger.warn("approval rule material withheld on the live leg: the adjudicated command carries credential-shaped bytes", { commandChars: material.command.length });
-            return withFlag(false, "rule_material_absent");
-        }
-        if (persistRule.kind === "batch") {
-            const offer = material.offers[persistRule.batchOfferIndex];
-            if (offer === undefined || offer.kind !== "batch")
-                return withFlag(false, "rule_not_offered");
-            try {
-                const persisted = await lane.persistCardRule({
-                    principal: owner,
-                    toolName: entry.toolName,
-                    command: material.command,
-                    redemption: { kind: "batch", offer },
-                    ...(material.toolCallId !== undefined ? { toolCallId: material.toolCallId } : {}),
-                    ...(material.boundInputHash !== undefined ? { boundInputHash: material.boundInputHash } : {}),
-                    ...(material.scopeRoot !== undefined ? { scope: { kind: "project", root: material.scopeRoot } } : {}),
-                });
-                if (!persisted.ok) {
-                    defaultLogger.warn("permission rule batch was not persisted after an approval", { reason: persisted.reason, ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}) });
-                    return withFlag(false, persisted.reason);
-                }
-                return withFlag(true, undefined, persisted.kind === "batch"
-                    ? {
-                        persistedRules: persisted.rules,
-                        ...(persisted.members !== undefined
-                            ? { persistedRuleAnchors: persisted.members.map((m) => ({ offerIndex: persistRule.batchOfferIndex, memberIndex: m.memberIndex, rule: m.rule })) }
-                            : {}),
-                    }
-                    : {});
-            }
-            catch (err) {
-                this.noteStoreError(err, "persistCardRule(batch)");
-                return withFlag(false, "rule_store_error");
+    async decideParkedAsk(store, row, request, idempotencyKey) {
+        for (;;) {
+            const gate = await this.readParkedGate(row);
+            const current = await this.askRowFor(store, row.askId, "getAsk(parked-decision)");
+            if (current === null || current.state !== "PARKED" || !askRowCarriesOwner(current, row.owner))
+                return { kind: "gone" };
+            const inflight = this.lookupParkRedemption(row.askId)?.inflight;
+            if (inflight !== undefined) {
+                await inflight;
+                continue;
             }
+            const standing = standingParkedDecision(gate, current, idempotencyKey);
+            if (standing !== undefined)
+                return standing;
+            if (request.write.decision === "approve" && request.policyMayNotApprove === true)
+                return { kind: "policy_refused" };
+            const redeem = this.parkedRedeem?.();
+            if (redeem === undefined || row.gateToken === null) {
+                if (row.gateToken === null)
+                    defaultLogger.error("tool approval parked row carries no gate token — nothing to redeem", { askId: row.askId });
+                return { kind: "gate_only" };
+            }
+            const out = await this.runParkedFlight(redeem, store, current, row.gateToken, request);
+            if (out.status === 200)
+                return { kind: "accepted", body: out.body, ...(out.recorded !== undefined ? { recorded: out.recorded } : {}), ...(out.rememberApplied !== undefined ? { rememberApplied: out.rememberApplied } : {}), ...(out.rule !== undefined ? { rule: out.rule } : {}) };
+            if ((await this.readParkedGate(row))?.kind === "decided")
+                continue;
+            return { kind: "refused", status: out.status, body: out.body };
         }
-        const ruleText = persistRule.rule;
-        if (!persistRule.edited && !material.offers.some((o) => o.kind === "single" && o.rule === ruleText))
-            return withFlag(false, "rule_not_offered");
+    }
+    async readParkedAskOfGate(sourceSessionId, binding) {
+        const store = this.askStore;
         try {
-            const persisted = await lane.persistCardRule({
-                principal: owner,
-                toolName: entry.toolName,
-                command: material.command,
-                redemption: persistRule.edited ? { kind: "edited", text: ruleText } : { kind: "offered", ruleText },
-                ...(material.toolCallId !== undefined ? { toolCallId: material.toolCallId } : {}),
-                ...(material.boundInputHash !== undefined ? { boundInputHash: material.boundInputHash } : {}),
-                ...(material.scopeRoot !== undefined ? { scope: { kind: "project", root: material.scopeRoot } } : {}),
-            });
-            if (!persisted.ok) {
-                defaultLogger.warn("permission rule was not persisted after an approval", { reason: persisted.reason, ...(persisted.detail !== undefined ? { detail: redactSecrets(persisted.detail) } : {}) });
-                return withFlag(false, persisted.reason);
+            const rows = await this.withStoreDeadline(store.listAsksAtGate(sourceSessionId, binding), "listAsksAtGate");
+            const atGate = [];
+            for (const row of rows) {
+                if (row.state !== "PARKED") {
+                    atGate.push(row);
+                    continue;
+                }
+                const gate = await this.readParkedGate(row);
+                if (gate === undefined)
+                    return { kind: "unreadable" };
+                if (gate.kind === "open")
+                    atGate.push(row);
             }
-            return withFlag(true, undefined, this.editedArmEcho(persistRule, persisted));
+            if (atGate.length === 0)
+                return { kind: "none" };
+            return atGate.length === 1 ? { kind: "row", row: atGate[0] } : { kind: "unreadable" };
         }
         catch (err) {
-            this.noteStoreError(err, "persistCardRule");
-            return withFlag(false, "rule_store_error");
+            this.noteStoreError(err, "listAsksAtGate");
+            return { kind: "unreadable" };
         }
     }
-    async respondWithCas(askStore, askId, batchId, owner, entry, parsed, ruleEligibility) {
-        let winnerRow;
-        let ambiguousConfirmedRow;
-        let noteLanded = false;
-        try {
-            const decided = await this.withStoreDeadline(askStore.decideAsk(askId, batchId, owner, {
-                decision: parsed.value === "deny" ? "deny" : "approve",
-                ...(parsed.note !== undefined ? { decisionNote: parsed.note } : {}),
-                ...(parsed.value !== "deny" && parsed.updatedInput !== undefined ? { updatedInput: parsed.updatedInput } : {}),
-                ...liveHostSource(parsed.decider),
-            }), "decideAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
-                if (late.ok)
+    writeAskDecision(store, askId, form, owner, write) {
+        switch (form.kind) {
+            case "live":
+                return this.withStoreDeadline(store.decideAsk(askId, form.batchId, owner, liveDecideInputOf(write)), "decideAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
+                    if (!late.ok)
+                        return;
+                    if (decidedRowFacts(late.row) === undefined) {
+                        defaultLogger.error("ask decision landed after its deadline on a row that is not an authoritative human decision — not settled", { askId, state: late.row.state, provisional: late.row.provisional });
+                        return;
+                    }
                     this.notifyExternalDecision(askId, outcomeOfDecidedRow(late.row));
-            });
-            if (decided.ok) {
-                winnerRow = decided.row;
-                noteLanded = true;
-            }
-            if (!decided.ok) {
-                return { lost: true, row: decided.row };
-            }
-        }
-        catch (err) {
-            this.noteStoreError(err, "decideAsk");
-            ruleEligibility.eligible = false;
-            try {
-                const confirmSeq = this.nextRowReadSeq();
-                const row = await this.withStoreDeadline(askStore.getAsk(askId), "getAsk(decideAsk-confirm)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
-                if (row?.state === "STREAM_PENDING")
-                    this.followRowOwner(askId, row.owner, confirmSeq);
-                if (row === null || !askRowCarriesOwner(row, owner))
-                    return { lost: true, row: null };
-                if (row.state === "DECIDED" && row.decision === (parsed.value === "deny" ? "deny" : "approve")) {
-                    winnerRow = row;
-                    ambiguousConfirmedRow = row;
-                    noteLanded = noteLandedOnRow(parsed.note, row.decisionNote);
-                }
-                else if (row.state !== "STREAM_PENDING") {
-                    return { lost: true, row };
-                }
-            }
-            catch (confirmErr) {
-                this.noteStoreError(confirmErr, "getAsk(decideAsk-confirm)");
-                return {
-                    lost: false,
-                    result: {
-                        status: 500,
-                        body: refusalBody({
-                            errorCode: "internal.error",
-                            message: "the approval store failed while recording this answer and could not be read back, so whether the answer was recorded is unknown — retry: a retry returns the recorded answer if it was recorded, or records it if it was not",
-                        }),
-                    },
-                };
-            }
-        }
-        const wantAllowed = parsed.value !== "deny";
-        const decidedWon = winnerRow !== undefined;
-        if (entry.adopted === true && !decidedWon)
-            return { lost: false, result: this.notPending() };
-        if (this.pending.get(entry.registrationId) !== entry) {
-            const othersReached = winnerRow !== undefined ? this.notifyExternalDecision(askId, outcomeOfDecidedRow(winnerRow)).settled : 0;
-            const converged = decidedWon && (entry.adopted === true || entry.settledOutcome === (wantAllowed ? SETTLE_OUTCOME.ALLOWED : SETTLE_OUTCOME.DENIED));
-            if (!converged) {
-                return { lost: false, result: this.notPending() };
-            }
-            return { lost: false, result: withConsumerDisclosure(this.finishRespond(entry, owner, parsed, { updatedInputDelivered: false, noteRecorded: noteLanded }), waitingLegsReached(entry, othersReached)) };
-        }
-        const payloadIsMine = ambiguousConfirmedRow === undefined ||
-            approvalPayloadFingerprint({ updatedInput: ambiguousConfirmedRow.updatedInput }) === approvalPayloadFingerprint({ updatedInput: parsed.updatedInput });
-        const result = this.finishRespond(entry, owner, parsed, {
-            noteRecorded: noteLanded,
-            ...(winnerRow !== undefined ? { settleOutcome: outcomeOfDecidedRow(winnerRow), settleOutcomeIsThisRequest: ambiguousConfirmedRow === undefined } : {}),
-            ...(entry.adopted === true ? { updatedInputDelivered: false } : ambiguousConfirmedRow !== undefined ? { updatedInputDelivered: payloadIsMine } : {}),
-        });
-        const othersReached = winnerRow !== undefined ? this.notifyExternalDecision(askId, outcomeOfDecidedRow(winnerRow)).settled : 0;
-        return { lost: false, result: withConsumerDisclosure(result, waitingLegsReached(entry, othersReached)) };
-    }
-    finishRespond(entry, judgedOwner, parsed, opts) {
-        let rememberApplied;
-        if (parsed.value === "allow_session") {
-            const answer = liveSessionAnswer(pendingEntryStandingAnswerFacts(entry), entry);
-            rememberApplied = answer.home === "seat";
-            if (answer.home === "seat") {
-                const grantKey = sessionAllowKey(judgedOwner, answer.seat, sessionAllowCategory(entry.toolName), entry.grantBinding);
-                if (this.allowAllSessions.size >= MAX_ALLOW_SESSIONS) {
-                    const oldest = this.allowAllSessions.values().next().value;
-                    if (oldest !== undefined)
-                        this.allowAllSessions.delete(oldest);
-                }
-                this.allowAllSessions.add(grantKey);
-            }
-            else if (answer.home === "none" && answer.occupantUnreadable) {
-                defaultLogger.warn("session_grant_refused_occupant_unreadable", { sessionId: entry.sessionId, toolName: entry.toolName });
+                });
+            case "parked":
+                return this.withStoreDeadline(store.recordParkedDecision(askId, owner, askDecisionRecordOf(write)), "recordParkedDecision", DURABLE_CALL_TIMEOUT_MS);
+            default: {
+                const unhandled = form;
+                throw new Error(`writeAskDecision: unhandled form ${JSON.stringify(unhandled)}`);
             }
         }
-        const allowed = parsed.value !== "deny";
-        const settleArgs = opts?.settleOutcome !== undefined
-            ? settleArgsOfDecided(opts.settleOutcome)
-            : { allowed, updatedInput: parsed.updatedInput, source: liveHostSource(parsed.decider), ...(!allowed && parsed.note !== undefined ? { denyReason: parsed.note } : {}) };
-        const readRootGrant = opts?.settleOutcome === undefined || opts.settleOutcomeIsThisRequest === true ? parsed.readRootGrant : undefined;
-        entry.settle({
-            by: "human",
-            allowed: settleArgs.allowed,
-            updatedInput: settleArgs.updatedInput,
-            ...(settleArgs.source !== undefined ? { hostSource: settleArgs.source } : {}),
-            ...(settleArgs.denyReason !== undefined ? { denyReason: settleArgs.denyReason } : {}),
-            ...(readRootGrant !== undefined ? { readRootGrant } : {}),
-        });
-        const updatedInputDelivered = opts?.updatedInputDelivered ?? true;
-        const noteRecorded = opts?.noteRecorded ?? false;
-        return {
-            status: 200,
-            body: {
-                approvalId: entry.approvalId,
-                delivery: "applied",
-                decision: parsed.value,
-                ...(rememberApplied !== undefined ? { rememberApplied } : {}),
-                ...(parsed.updatedInput !== undefined && allowed && updatedInputDelivered ? { updatedInputForwarded: true } : {}),
-                ...noteRecordedReceipt(parsed.note, noteRecorded),
-            },
-        };
     }
     async adoptOpenAsks() {
         const store = this.askStore;
-        if (!store)
-            return { adopted: 0, alreadyLive: 0, cardUnreadable: 0, capped: false };
         let rows;
         try {
             rows = await this.withStoreDeadline(store.listByState("STREAM_PENDING", ADOPT_OPEN_ASKS_MAX + 1), "listByState(adopt)");
@@ -2912,11 +2359,9 @@ export class ToolApprovalCoordinator {
             settle: (verdict) => leave(verdict.by === "system" ? { outcome: SETTLE_OUTCOME.EXPIRED, cause: verdict.cause, parked: false } : { outcome: verdict.allowed ? SETTLE_OUTCOME.ALLOWED : SETTLE_OUTCOME.DENIED, parked: false }),
             forceParkNow: release,
             settleParkRoute: (cause) => leave({ outcome: SETTLE_OUTCOME.EXPIRED, cause, parked: this.unattendedRoutesToPark }),
-            owner: row.owner,
-            ownerReadSeq: this.rowReadSeq,
             executionLane: row.executionLane,
             ...leg,
-            ...(card.fromSubagent === true ? { originTaskId: row.sourceSessionId } : {}),
+            ...(card.fromSubagent === true ? { sourceSessionId: row.sourceSessionId } : {}),
             toolName: card.toolName,
             ...facts,
             approvalId: row.askId,
@@ -2947,43 +2392,6 @@ export class ToolApprovalCoordinator {
         for (const watcher of watchers)
             watcher.askIds.delete(askId);
     }
-    followRowOwner(askId, owner, readSeq) {
-        for (const e of this.pendingByAskId.get(askId) ?? []) {
-            if (e.ownerReadSeq >= readSeq)
-                continue;
-            e.owner = owner;
-            e.ownerReadSeq = readSeq;
-        }
-    }
-    rowReadSeq = 0;
-    nextRowReadSeq() {
-        this.rowReadSeq += 1;
-        return this.rowReadSeq;
-    }
-    async followRowOwners() {
-        const store = this.askStore;
-        const out = { read: 0, followed: 0, unreadable: 0 };
-        if (!store)
-            return out;
-        for (const askId of [...this.pendingByAskId.keys()]) {
-            out.read += 1;
-            const readSeq = this.nextRowReadSeq();
-            let row;
-            try {
-                row = await this.withStoreDeadline(store.getAsk(askId), "getAsk(follow-row-owners)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
-            }
-            catch (err) {
-                this.noteStoreError(err, "getAsk(follow-row-owners)");
-                out.unreadable += 1;
-                continue;
-            }
-            if (row?.state !== "STREAM_PENDING")
-                continue;
-            this.followRowOwner(askId, row.owner, readSeq);
-            out.followed += 1;
-        }
-        return out;
-    }
     waitingRegistrationCount(askId) {
         let n = 0;
         for (const e of this.pendingByAskId.get(askId) ?? [])
@@ -3001,9 +2409,7 @@ export class ToolApprovalCoordinator {
         const store = this.askStore;
         const ids = [...candidates.keys()];
         const listed = await Promise.all([...candidates.values()].map(async (entry) => {
-            if (store === undefined || !this.registrationHasRow(entry))
-                return inScope(entry.owner);
-            const ask = await this.askRowFollowingOwner(store, entry.askId, "getAsk(list-live)");
+            const ask = await this.askRowFor(store, entry.askId, "getAsk(list-live)");
             return ask?.state === "STREAM_PENDING" && inScope(ask.owner);
         }));
         const rows = [];
@@ -3030,13 +2436,11 @@ export class ToolApprovalCoordinator {
     }
     async pollSuspendedDecisions() {
         const store = this.askStore;
-        if (!store)
-            return { polled: 0, settled: 0, backlog: 0, truncated: false };
         const waiting = [];
         const adopted = [];
         const seen = new Set();
         for (const entry of this.pending.values()) {
-            if (entry.askId === undefined || entry.settledOutcome !== undefined || seen.has(entry.askId))
+            if (entry.settledOutcome !== undefined || seen.has(entry.askId))
                 continue;
             if (entry.suspended === true)
                 waiting.push(entry.askId);
@@ -3046,53 +2450,33 @@ export class ToolApprovalCoordinator {
                 continue;
             seen.add(entry.askId);
         }
-        const waitingStart = waiting.length > 0 ? this.suspendedPollOffset % waiting.length : 0;
-        const adoptedStart = adopted.length > 0 ? this.adoptedPollOffset % adopted.length : 0;
-        const ordered = [
-            ...[...waiting.slice(waitingStart), ...waiting.slice(0, waitingStart)].map((askId) => ({ askId, tier: "waiting" })),
-            ...[...adopted.slice(adoptedStart), ...adopted.slice(0, adoptedStart)].map((askId) => ({ askId, tier: "adopted" })),
-        ];
-        const deadlineMs = Date.now() + SUSPENDED_POLL_BUDGET_MS;
         let settled = 0;
-        let polled = 0;
-        let polledWaiting = 0;
-        let polledAdopted = 0;
-        let truncated = false;
-        for (const { askId, tier } of ordered) {
-            if (polled >= SUSPENDED_POLL_MAX_PER_TICK || Date.now() >= deadlineMs) {
-                truncated = true;
-                break;
-            }
-            polled++;
-            if (tier === "waiting")
-                this.suspendedPollOffset = waitingStart + ++polledWaiting;
-            else
-                this.adoptedPollOffset = adoptedStart + ++polledAdopted;
+        const { visited: polled, truncated } = await boundedRotation([
+            { items: waiting, cursor: this.suspendedPollCursor },
+            { items: adopted, cursor: this.adoptedPollCursor },
+        ], { maxPerTick: SUSPENDED_POLL_MAX_PER_TICK, budgetMs: SUSPENDED_POLL_BUDGET_MS }, async (askId) => {
             let row;
-            const readSeq = this.nextRowReadSeq();
             try {
                 row = await this.withStoreDeadline(store.getAsk(askId), "getAsk(poll-suspended)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
             }
             catch (err) {
                 this.noteStoreError(err, "getAsk(poll-suspended)");
-                continue;
+                return;
             }
             if (row === null) {
                 this.forgetAdoptedAsk(askId);
-                continue;
-            }
-            if (row.state === "STREAM_PENDING") {
-                this.followRowOwner(askId, row.owner, readSeq);
-                continue;
+                return;
             }
+            if (row.state === "STREAM_PENDING")
+                return;
             if (this.editedDecisionInFlight(askId))
-                continue;
+                return;
             const endingCause = askRowEndingCause(row);
             if (endingCause !== undefined) {
                 const before = this.waitingRegistrationCount(askId);
                 this.settleVoidedSiblings([askId], endingCause);
                 settled += before;
-                continue;
+                return;
             }
             const outcome = replayTerminalAskRow(row);
             if (outcome === "unavailable") {
@@ -3100,11 +2484,11 @@ export class ToolApprovalCoordinator {
                 const parkCause = askRowParkTrigger(row) ?? (Date.now() >= row.expiresAtMs ? APPROVAL_ENDING_CAUSES.TTL_EXPIRED : APPROVAL_ENDING_CAUSES.SHUTDOWN_BEFORE_PARK);
                 this.settleSameAskIdParkRoute(askId, parkCause);
                 settled += before;
-                continue;
+                return;
             }
             const delivered = this.notifyExternalDecision(askId, outcome).settled;
             settled += delivered;
-        }
+        });
         const backlog = Math.max(0, waiting.length + adopted.length - polled);
         if (truncated) {
             defaultLogger.warn("approval_suspended_poll_truncated", {
@@ -3113,8 +2497,8 @@ export class ToolApprovalCoordinator {
                 backlog,
                 maxPerTick: SUSPENDED_POLL_MAX_PER_TICK,
                 budgetMs: SUSPENDED_POLL_BUDGET_MS,
-                resumeFromOffset: this.suspendedPollOffset,
-                resumeAdoptedFromOffset: this.adoptedPollOffset,
+                resumeFromOffset: this.suspendedPollCursor.offset,
+                resumeAdoptedFromOffset: this.adoptedPollCursor.offset,
             });
         }
         return { polled, settled, backlog, truncated };