approvals: manager can withdraw pending approvals (closes #250)

hive-c0re/src/questions.rs

@@ -18,6 +18,7 @@
 
 use std::sync::Arc;
 
+use crate::approvals::kind_to_str;
 use crate::coordinator::Coordinator;
 use crate::limits;
 use crate::manager_server::spawn_question_watchdog;
@@ -179,6 +180,35 @@ pub fn handle_cancel_loose_end(
             tracing::info!(%id, %canceller, %owner, "reminder cancelled");
             Ok(())
         }
+        hive_sh4re::CancelLooseEndKind::Approval => {
+            // Manager-only: only the agent that can submit approvals
+            // is allowed to withdraw them. Sub-agents would have no
+            // pending approvals of their own to cancel anyway.
+            if canceller != hive_sh4re::MANAGER_AGENT {
+                return Err(
+                    "cancel_loose_end: only the manager can cancel approval rows".to_owned(),
+                );
+            }
+            let approval = coord
+                .approvals
+                .mark_cancelled(id, canceller)
+                .map_err(|e| format!("{e:#}"))?;
+            tracing::info!(%id, %canceller, agent = %approval.agent, "approval cancelled");
+            let sha_short = approval
+                .fetched_sha
+                .as_deref()
+                .map(|s| s[..s.len().min(12)].to_owned());
+            coord.emit_approval_resolved(
+                approval.id,
+                &approval.agent,
+                kind_to_str(approval.kind),
+                sha_short,
+                "cancelled",
+                approval.note,
+                approval.description,
+            );
+            Ok(())
+        }
     }
 }