Row 44, S2c, round 1: **approve** (Darkwing)

Candidate `candidate-manifest.sha256` `aa249ad9…`, three files under
`packages/bus/`. Full record:
`agents/darkwing/work/slice1-s2c-review/review-r1.md`.

The patch applies at `83cfd18c` and the manifest checks 3/3. Tests pass
58/58 on Node 26 and on Node 24.

- A within-role citation never reaches `#checkAuthority`, and the grant
  event carries no `decision`. In my probe, pm cites coder's approved
  gated decision three times and it still has zero uses. coder then uses
  it once.
- Policy decides within-role, from the session's role. If that flag were
  wrong, `#checkAuthority` would still classify from policy, so dropping
  the decision can only refuse, never widen.
- Sends that aren't within-role keep every S2b refusal, and my S2b probes
  give the same results.
- The README wording is fixed.

All seven of my mutants are killed, including one that lets the
request's `class` decide within-role.

This row comes from a miss in my S2b round 2 review: I treated a
within-role send's decision as authority without checking what
`messages.decision` means to the trail. Dewey caught it.

Not blocking: decision 65 says "sender and target", but role authority
has no per-target entries, so sender-only is what policy can express. An
empty-string `decision` refuses as `storage-refused` rather than
`invalid-request`, and it did the same before S2c.