docs: the hive has no approval queue

config-changes.md (was approvals.md) describes config PRs, the meta flake
and helper events; the approval queue, its kinds, the withdraw path, the
job-queue dispatch and ApprovalResolved go. Every other page drops the
approvals table, endpoints, event, tool group, hivectl verbs, dashboard
section and the loose-end/cancel kind, and links to the renamed page.

docs/turn-loop/mcp.md

@@ -24,8 +24,8 @@ for what reaches a subagent's own `--mcp-config` and what doesn't.
 
 Tool groups (`HIVE_TOOL_GROUPS`) gate tool access. The default
 preset (`AGENT_DEFAULT`) includes `messaging`, `meta`, `inbox`, and
-`execution`. Privileged groups (`lifecycle`, `approvals`)
-are opt-in via the P3RM1SS10NS tab.
+`execution`. The privileged `lifecycle` group
+is opt-in via the P3RM1SS10NS tab.
 
 ## Core tools (always available)
 
@@ -61,14 +61,10 @@ are opt-in via the P3RM1SS10NS tab.
   Transient pings (sentinel id 0) have nothing to ack and show no marker.
 
 **System messages** (from sender `system`): the broker delivers
-`hive_sh4re::manager::HelperEvent` (three variants: `ApprovalResolved`,
-`ContainerCrash`, `NeedsUpdate` — declared, but no call site
-constructs it) as regular inbox messages (same `recv`
-path; body is a JSON object with an `event` discriminant field).
-`ApprovalResolved` goes to whichever agent actually submitted the
-approval (`Coordinator::notify_submitter`, looked up from the
-authenticated socket caller at submit time; a row with no
-recorded submitter falls back to the manager, `ruth`).
+`hive_sh4re::manager::HelperEvent` (two variants: `ContainerCrash`,
+`NeedsUpdate` — declared, but no call site constructs it) as regular
+inbox messages (same `recv` path; body is a JSON object with an `event`
+discriminant field).
 `ContainerCrash` always goes to `ruth` (`Coordinator::notify_manager`,
 hardcoded — `hive-c0re/src/workers/crash_watch.rs`). Lifecycle
 transitions the job-queue scheduler or crash watcher drive directly —
@@ -84,15 +80,11 @@ at_unix_timestamp?)`.
 - `get_loose_ends()` — list this agent's own open threads: pending
   reminders, open todos pushed by an in-container subsystem (matrix,
   bash, forge, or any user-configured MCP server), an undelivered-inbox
-  count, and unread matrix notifications; `approval` rows only appear
-  when the caller is the manager (`ruth`) — sub-agents don't submit
-  approvals. Always the caller's own rows. Full per-variant wire shape in
+  count, and unread matrix notifications. Always the caller's own rows. Full per-variant wire shape in
   [`docs/process/conventions.md` § Loose-ends wire
   shape](../process/conventions.md#loose-ends-wire-shape).
-- `cancel_loose_end` — hard-delete a `reminder`, cancel a pending
-  `approval` row, or clear a `todo` row (loose-ends-v2). Agents may
-  only cancel rows they own; the `approval` kind is further restricted
-  to the root agent (`ruth`) server-side.
+- `cancel_loose_end` — hard-delete a `reminder` or clear a `todo` row
+  (loose-ends-v2). Agents may only cancel rows they own.
 - `remind` — schedule a reminder in this agent's own inbox. Large
   payloads spill to `/agents/<self>/state/reminders/`. Pending count
   capped at 50 per agent (`HIVE_REMIND_MAX_PENDING_PER_AGENT`).
@@ -144,11 +136,9 @@ hive_name?, swarm_name?, matrix_accounts? }`. `matrix_accounts` is a
   (claude or ACP, via `hive-runtime`) as background tasks, shipped
   default-on like bash execution; no tool group gates it. See
   [`docs/tools/subagent.md`](../tools/subagent.md).
-- **Lifecycle + config** (`lifecycle`, `approvals`) — `approvals`
-  gates `cancel_loose_end`'s approval-cancel arm server-side;
-  `lifecycle` gates nothing.
+- **Lifecycle + config** (`lifecycle`) — gates nothing.
   Config changes go through a forge PR on `agent-configs/<name>` — see
-  [`docs/agent-lifecycle/approvals.md`](../agent-lifecycle/approvals.md).
+  [`docs/agent-lifecycle/config-changes.md`](../agent-lifecycle/config-changes.md).
 - **Forge repos** (`forge`) — gates nothing.
 - **Web egress** (`web_tools`) — enables Claude's built-in `WebFetch`
   and `WebSearch` tools (not MCP tools; added directly to the