[ymote]

Fixes the flaky app_chat::tests::the_panel_opens_a_sharing_context_and_sends_person_turns_there. Beside the approvals tests it fails every time:

panicked at crates/shell/src/app_chat/tests.rs:416:5:
assertion `left == right` failed
  left: Null
 right: "org-example-asktest-22a12f90"

Cause

The cause is shared global state. approvals::tests::the_relay_gets_decisions_made_before_it_was_installed began with approvals::init_memory(), which replaces the shell's process-wide approvals with empty ones. The app_chat test allows its app, then reads agents::line(), which gives a peer_slug only while the app is allowed. When the reset landed between those two steps, the consent was gone. The same approvals test also installed its RecordingRelay into the shared approvals, where it would take other tests' decisions (the real-kernel tests route theirs through the shared relay).

Fix

• The relay seam (approval_requested, set_relay, bus_requested) is now methods on Approvals.
• The free functions call those methods on the shell's approvals, so callers and behaviour are unchanged.
• The test builds Approvals::memory() and never touches the shared approvals. No other approvals test did.

Evidence

All runs were on the Linux build host, using the shell test binary built at main (cc59e67) and at this branch.

Run	main	this branch
app_chat::tests::the_panel_opens_a_sharing_context_and_sends_person_turns_there approvals::, 50×	50 of 50 failed, all at tests.rs:416 with left: Null	0 of 50
app_chat:: approvals::, 50×	8 of 50 failed	0 of 50
Whole octosense-shell --lib suite with the real kernel, 30×	this test failed twice	never

The other failures in the whole-suite runs are not this flake. They are the catalog-test flake that #293 fixes, the Linux-only a_program_reached_through_a_link_outside_its_roots_starts (ETXTBSY), and real_kernel_an_app_agents_turn_calls_news_list_through_the_shells_relay, which failed once on main and not on this branch.

🤖 Generated with Claude Code

[ymote]

Merged in a merge train; local CI (Mac with rom toolchain + --linux-host) passed on the train head 72e5d55, which contains this PR.

• tools/ci-local.sh --only all --linux-host, started 2026-10-02T14:00:45: passed. Desktop, phone and apps passed on the Mac; apps services, kernel-security and linux-host / sandbox passed on the Linux build host. Its rom.yml steps were skipped on the Linux host, and the train doesn't trigger rom.yml.
• tools/ci-local.sh --only all on the Mac with the rom toolchain (JDK 17, Android SDK, node 24), started 2026-10-02T14:51:21: 42/42 steps passed, none skipped.

The train was #291, #293, #297, #294, #298, #295, #296, #299, #300 and #292, on main f6678b5. After the last merge, main 301be0c has the tested head's tree.