Stop PWA notification pile-up and surface blocked sub-agents

[leoncheng57]

The report

Screenshots showed macOS Notification Center piled with "Needs approval to run bash" cards from the PWA — most already answered in the app — and a new requirement: a sub-agent blocked on a permission ask must be surfaced, while a sub-agent that merely finishes must not.

Three causes, three fixes

1. One replaceable OS notification slot per session

The push/notification tag was the record id, so every ask in a busy session piled its own card into the notification center, and Web Push cannot retract a shown notification — replacement via a shared tag is its only correction. notificationTag() keys the tag by session (record id only for sessionless records): a later ask overwrites the stale one, the parked escalation overwrites the ask it escalates, the eventual idle overwrites whatever is left. The server computes the tag once and stamps it on both the push payload and notification.recorded, so the service worker and an open tab can never disagree about identity. Collapsing is presentation only: the per-record dedupe still governs sound/speech.

2. Auto-approve survives a restart

The flag was memory-only (decision #11 "volatile"), so service:install at 14:01 today silently flipped this very directory back to ask mode and pushed one permission ask per tool call until it was re-toggled at 14:04 — the exact burst in the screenshots, and it would recur on every deploy. Flags now persist to .state/auto-approve.json (AUTO_APPROVE_STATE_FILE, mode 0600): restored on boot with pending-ask reconciliation (asks that arrived while the BFF was down get answered too), corrupt file fails closed to everything-off, an explicit toggle always wins over the startup load. Persisting an instruction the user already gave through the authenticated UI is not an escalation.

3. A blocked sub-agent is surfaced; a finished one is not

permission is now the one child event that takes the delivery path — a child stopped on an unanswered ask is stalled work nobody else can unblock, and suppressing it meant a delegated task sat frozen while the inbox swore nothing needed anyone. Its parked escalation follows the same policy (the lineage skip in scheduleParked is removed). A child ask in an auto-approved directory is still suppressed as auto-permissions — it was answered before anyone was blocked. Child idle/error/question stay suppressed: "subagent", recorded-only.

Coverage

• Unit: child ask delivered / auto-approved child ask suppressed / other child kinds unchanged / child parked escalation / notificationTag identity / tag on push payload + recorded event / persistence round-trip incl. boot reconciliation, corrupt-file fail-closed, explicit-toggle-wins / client collapse under shared tag with per-record sound preserved.
• E2E: smoke.api lineage test rewritten to the new policy (asks from any lineage delivered; child idle recorded as filterable noise); mock's /test/mobile/idle gained a directory param for lineage-correct fixtures; AUTO_APPROVE_STATE_FILE wired into the per-run state-file set (guard test enforces it).
• The media spec's exact global speech-sequence assertion is relaxed to own only its phrases: one tab hears every directory by design, and parallel spec files now legitimately deliver child asks.

AGENTS.md decisions #10a, #11, #24 updated to match.

Verification

• npm run typecheck clean; npm test 1184 passed.
• Full Playwright suite: 365 passed, 1 skipped.

Note for after merge: existing stale cards in macOS Notification Center predate the tag change and need one manual clear; new notifications collapse from then on.