The /approvals page's "Approve all" / "Cancel all" (G-BASKET P9).

One person, one gesture, N cards — each decided through resolve_card exactly as a single click would be, so D1 holds (a person answers every card) and nothing about ownership, expiry or execution routing is re-implemented. Each card succeeds or fails on its own: one that expired or was answered elsewhere while the modal was open reports its own 404/410 and never sinks the rest. Stamped web_ui_bulk so the audit can tell one action for N cards from N clicks.