fix: bind approvals to prompt turns

crates/maestro-daemon/src/session.rs

@@ -1791,7 +1791,17 @@ fn start_acp_permission_pump(acp: &Arc<AcpSession>, events: Arc<Mutex<AcpEventSt
         return;
     };
     tokio::spawn(async move {
-        while let Some(PermissionRequest { request, response }) = requests.recv().await {
+        while let Some(PermissionRequest {
+            turn,
+            request,
+            response,
+        }) = requests.recv().await
+        {
+            let mut events = events.lock().await;
+            if events.projection.active_turn() != Some(turn) {
+                let _ = response.send(maestro_acp::schema::RequestPermissionOutcome::Cancelled);
+                continue;
+            }
             let nonce = Uuid::new_v4().to_string();
             let data = match serde_json::to_value(&request) {
                 Ok(value) => value,
@@ -1800,7 +1810,6 @@ fn start_acp_permission_pump(acp: &Arc<AcpSession>, events: Arc<Mutex<AcpEventSt
                     continue;
                 }
             };
-            let mut events = events.lock().await;
             // ACP requests serialize through its connection. Keep the newest
             // one authoritative if an adapter nonetheless overlaps them.
             cancel_pending_approvals(&mut events);