Expand description
Approval-mode guards, applied after register_all when the VM is
created with ExecMode::Approval. Mutating builtins stay registered
but each call is gated by its sequence index: an operation whose index
is in the approved set runs against the original inner function;
otherwise the call raises an approval request carrying the operation
descriptor so the tool-mode resume machinery can suspend and collect a
decision. A per-VM counter assigns the index and advances on every
gated call, so successive resumes admit one more operation each.