[albanm]

Fixes what the portals autonomous-agent simulations exposed around approvals: 19 cards, 2 approved, 15 cancelled by the simulated person typing, 0 refused; 7 of 25 reviews timed out at stage 1.

What changed

• Simulation runner (lib-sim): a turn stopped on an approval card is handed to the person like a wait; the persona is told a card is on screen; a decision that ends on a new card holds the persona's message back. Cards carry data-approval-id for that.
• Reviewer timeout: approvalReview.stage1TimeoutMs (APPROVAL_REVIEW_STAGE1_TIMEOUT_MS), 5 s by default, 15 s in development (the dev bridge's stage 1 ran p90 4.2 s, 20 % past 5 s).
• Cancelled approvals: a card cancelled by a new message or a page action reads « Annulé », not « Refusé »; the card says « Envoyer un message annule cette demande. »
• Reviewer reason for the person: stage 2 also writes personReason in the people's language, shown on cards and reviewer-denial chips; the model keeps reading the English reason.
• Scripts pause for a person: a code_mode nested call routed to a person (or judged unsure in a chat) pauses the script through @ai-sdk/code-mode 1.0.116's signed continuations, shows the nested call's card, and resumes after the decision without re-running earlier calls. Continuations live in a new script-pauses collection (TTL 24 h, dropped with the thread). The signing key is derived from the cipher key (HKDF over CIPHER_PASSWORD's key): no new secret to deploy. Exposure and usage limits carry across a pause; each decision of parallel pending calls is kept.
• Reviewer judgement: 11 guard-eval cases from the portals runs (3 adversarial); a display-option reading for stage 2 only and a stage-1 clause flagging ambiguous targets. Full corpus on the dev bridge (Haiku, ×3): 219/225 as expected, no harmful call allowed, stage 2 on 79 % of stage-1 reviews (64 % before).
• Docs: code-mode, autonomous-agents, moderation, configuration, lib-sim README.

Why: in the simulations the approval flow, not the agent, decided most failures: the runner hid cards from the persona, reviewer timeouts turned writes into cards, cards were unreadable for a French non-technical person, and scripts could not ask a person.

Regression risks

• Code mode in a chat: tools that need a person are now callable from scripts (codeCallable with person), and an unsure nested call pauses instead of throwing. A task run keeps the old behaviour. code_mode's description changes for the model.
• Rejection inside a script: continueCodeModeApproval(approved: false) fails the whole resume in 1.0.116, so a rejection is resumed as an approval and our wrapper throws rejectedCallMessage for that call. Pinned by unit tests, including parallel pending calls; relies on the package's replay semantics (pin @ai-sdk/code-mode at 1.0.116, it is experimental_).
• Resume can fail closed: a continuation whose tool set changed (page tools on the deciding tab, an MCP listing change) or that expired is refused before anything runs; logged as code-mode-resume-refused.
• Changing CIPHER_PASSWORD now also invalidates scripts paused at that moment (on top of the stored provider keys).
• Reviewer prompt changed (stage-1 instruction, stage-2 reading, personReason in the verdict schema): measured on Haiku via the dev bridge only, not on the production moderator models. Stage 2 runs more often (+1 s median, +5 % tokens).
• New required config key approvalReview.stage1TimeoutMs (defaulted in default.js): a deployment overriding the whole config object must keep it.
• New script-pauses collection, created with its indexes by mongo.init: no upgrade script.