[aft-alfonso]

Allowing a whole folder from a permission card (allow_scope) used to leave sibling asks for paths inside that folder waiting for their own answers. In the specimen, two parallel reads were filed 8 ms apart, and allowing the folder on the first card left the second card waiting. Now, once a folder grant is stored, AFT withdraws every other live ask it truly covers: same session, same scope (owner, ref and epoch), same kind of access, and a path inside the folder. The withdrawn card leaves the phone, and its waiting call runs under the stored grant.

If the user answered a covered card at the same moment, Cingulate's withdraw returns the settled record and that answer stands. Asks for other folders, other access kinds, other sessions or other scope epochs stay pending. One info log line per withdrawn ask names the covering ask, and logs only a hash of the folder path.

Withdraw vectors come from Cingulate tool-permission-v1 (04b7cbd). Tests: covered sibling settled and withdrawn; uncovered cases stay pending; the withdraw race keeps the recorded denial; the log line. The tests pick each consent request by file name, because parallel requests arrive in either order. 135 consent tests pass three times in a row on Linux; Windows target check passes.

---

Summary by cubic

Allowing a folder grant (allow_scope) now settles and withdraws other open asks for paths inside that folder (same session, scope, and operation), so sibling cards no longer wait for a second answer. Asks for other folders, operations, sessions, or scope epochs stay pending. If a covered ask settled at the same moment, its recorded outcome stands. Each withdrawn ask logs one info line naming its covering ask, with only a hashed path.

^{Written for commit b7145fd. Summary will update on new commits.}