feat(operator-queue): approvals get a "Something else" answer (#3242)

[vybe]

Fixes #3242 — first of the chain #3242 → #3243 → #3247 (ask contract), with #3246 alongside. Base is dev. Draft until the chain is in (operator, 2026-10-05).

What

An approval is no longer a closed menu. A person can answer "Something else" and type an instruction; the agent reads back one reserved decision and the instruction.

• Sink (services/operator_queue_choices.py, services/ask_service.py): the reserved literal (something else) is checked before membership. On an approval with a non-blank instruction it is accepted; blank → 422 instruction_required; on any other ask type → 422 reserved_value; on a gate / platform-minted approval → 422 not_off_menu. Every other unoffered string is still refused (bug: POST /api/operator-queue/{id}/respond accepts any string as an approval decision — no layer checks response ∈ options #2376 stays closed). An ask that lists the literal as its own option is refused at raise (invalid_options). response_text is bounded at 4000 on both routes.
• Agent contract: one sentence in both authored copies of the platform prompt and in the agent guide, sentinel-pinned; ask_operator, get_my_ask and respond_to_operator_queue descriptions name the value; the respond tool returns a structured refusal beside error; the resume message explains the value above the data block.
• Screens (utils/operatorQueue.js, QueueCard.vue, QueueItemDetail.vue, MobileAdmin.vue, PortalAsks.vue, ResolvedCard.vue): a "Something else" chip after the agent's options. On desktop and in the Workspace, typing with no pick selects it and the button reads "Send instruction"; Enter never sends an auto-selected state. Ended asks show "Something else" with the instruction, never the raw literal.
• Gate approvals: the chip is hidden on every surface. The Workspace projection and the operator list / item projections carry one boolean, decided_by_options, from the same backend predicate; the gate- id prefix is only the fallback.
• Docs: requirements §26, the operating-room and mobile-admin flows, the backend catalog line, and the user-docs sentences this change made false.

Rulings carried (orchestrator, on the operator's behalf — plan file)

• T1 literal (something else), one constant per language with a parity test · T2 instruction required · T3 chip + auto-select on typing, "Send instruction" · T4 approvals without options unchanged · T5 no new MCP parameter · T6 no schema change · T7 /m decomposition (refactor: decompose oversized Vue views (Settings 3061 lines, MobileAdmin, Agents, AgentDetail, ...) #1030) not bundled.
• T8 deviates from the plan's recommendation (operator, 2026-10-05): no surface shows a chip that always fails, so the Workspace is told which approvals are decided by their options, and the review fix extended the same boolean to the operator projections.

Review + security

/review (claude-fable-5-1, report-only): MERGEABLE AFTER FIXES. One sink holds on every route tried; the four named 422s come from both writers; gates are closed on every route; the new specs assert the body that is sent (reverting the rules turns 17 new tests red). Fixed in ad85e9f6 (C1: a source-text pin of the old Send rule was red; I1), 10dc0480 (I2 read-back contract tests, I4, I5, I6, I7, I12 learnings fragment), 210fc6b4 (I3: one predicate on both sinks). /cso --diff: nothing supported.

Tests

Reported by the builder on the fix tip: frontend npm run test:unit 265 files / 4653 tests passed; pytest on the five affected suites 307 passed; mcp-server 687 passed, tsc --noEmit clean. Not run here: the full Python unit island (CI) and any live tier.

Before merge

• PR feat(workspace): Discuss and Dismiss on asks (abilityai/trinity-enterprise#747, #748) #3181 (Discuss + Dismiss): this branch adds one conflict, in the get_my_ask description in src/mcp-server/src/tools/operator_queue.ts. Keep both: this branch's reserved-value lines, then feat(workspace): Discuss and Dismiss on asks (abilityai/trinity-enterprise#747, #748) #3181's disposition line. Merge order is the operator's call.
• docs/user-docs/sharing-and-access/mobile-admin.md carries new feature prose ahead of the usual user-docs step; the other three user-docs edits correct sentences this change made false.
• No schema change, no migration.
• PR fix(operator-queue): platform alerts are conditions — one pending row per subject (#3246, part 1) #3255 (platform alerts, same session): conflicts with this branch in docs/memory/feature-flows/operating-room.md, QueueCard.vue and QueueItemDetail.vue. Keep both intents; whichever lands second resolves.

Handoffs

• Agents write long, compound asks — teach atomic asks in the ask_operator contract and cap option count/length #3243 (next in the stack): the option cap never counts the reserved literal; refuse an agent option that reads as the platform chip's label.
• After feat(workspace): Discuss and Dismiss on asks (abilityai/trinity-enterprise#747, #748) #3181 and this both land: the discussed-approval "send as answer" path should use the reserved value for approvals (follow-up issue).
• A Playwright e2e pinning the real POST body for the chip; refactor: decompose oversized Vue views (Settings 3061 lines, MobileAdmin, Agents, AgentDetail, ...) #1030 (/m decomposition) stays open.

🤖 Generated with Claude Code

[trinity-ability]

merge-train: batch validated on train/20261006-1038 (#3270)