fix(approvals): the #3424 override reaches a pending request only — refuse override-recall of a returned request (#12775)

[os-sales]

Fixes#12775

Ruling of record (verbatim, untranslated)

Maintainer, 2026-09-02, via the director seat (12775#issuecomment-5504841854), replying to the decision batch whose item for this card recommended 「(ii),附条件:实施 PR 的 changeset 把这条收窄写成显式行为变更;回退 (i)」:

「14324 等我发版,其他同意」

Read as (ii): the audit reading is unobtainable and counts as zero; the 2026-08-29 ruling stands — B: re-scope the status-blind override short-circuit in recall to pending so the gate, the prose and the viewer flag agree at one point; A remains the fallback; the changeset declares the narrowing as an explicit behaviour change so one revert restores it; one pin on the narrowing (returned + override actor ⇒ refused) with the reverse check; #12716 (landed as PR #12791) is unaffected. The card's own facet block (the shape agreed on 2026-08-29):

「推荐:B,附硬前置条件 —— 落地前先从审计留痕读出「是否真有 override actor 在 returned 上撤回过」。读数为零才动手;非零则当场改判 A,⛔ 不许带着非零读数硬做。回退:A。」

The hard precondition is discharged by ruling (ii): no audit reading was attempted and no audit instrument was built.

What changed

ApprovalService.recall (packages/plugins/plugin-approvals/src/approval-service.ts): the #3424 override short-circuit is now conditioned on raw.status === 'pending' — spelled exactly as attachViewers computes viewer.can_override — so on returned an override actor is judged as any other non-submitter and gets the existing refusal (message prefix FORBIDDEN: + the operation catalog's approval_recall_not_submitter sentence; over REST, handleApprovalError maps that prefix to 403 + code FORBIDDEN). No new error code, no new envelope shape, no new export. The comment block above the gate (the old #3424 / #11993 text, whose sentence "the GATE is untouched" is no longer true) is rewritten to state the pending-only scope and this card; the recall doc block gains the same statement. The developer half of the refusal (the logger.warn line, level unchanged) now also names the status it refused on — its text carries no tracker id (check:doc-authoring).

• Submitter's own recall on pending and on returned (ADR-0044 revise window): untouched.
• Override actor's recall on pending (the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 stuck-record rescue, lock release included): untouched.
• The isOverrideActor doc block ("may always act on a PENDING request … or recall it") is now true without an edit; attachViewers and sys-approval-request.object.ts are not touched.

Design note — system context.isOverrideActor's first arm is context.isSystem, so the same expression also scopes a system caller's override to pending. A machine caller keeps a path on returned by naming the submitter as actorId (resolveActor returns a system caller's explicit actor), which is the ADR-0044 semantics. No in-repo caller invokes recall under a system context (packages/rest/src/rest-server.ts is the only call site, with the request's own context); the #13568 record-delete path cancels, it does not recall. Flagged in the report's open questions as a note, not a blocker — spelling the gate as the viewer flag is what the ruling asked for.

Premise verification (on origin/mainfed4fa409, before any edit)

• P1 holds — recall admitted pending and returned, and the gate if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && …) passed an override actor regardless of raw.status (:2904).
• P2 holds — attachViewers computed can_override: row.status === 'pending' && this.isOverrideActor(...) (:5195); the isOverrideActor doc block said PENDING (:938).
• P3 holds — approval_recall's visible (PR fix(plugin-approvals): show approval_recall for the #3424 admin override (#12716) #12791) ORs record.viewer.can_override, pending-only through the flag; no UI path offered override-recall on returned.
• P4 holds — no packages/spec change needed.
• P5 holds — no pin asserted an override actor can recall a returned request. Every existing admin-recall pin (approval-service.test.ts, admin-exemption-retired.test.ts, recall-refusal-user-copy.test.ts) opens a pending request; approval-revise.test.ts:357 already asserted the non-submitter refusal on returned for a non-admin. Nothing to reverse or register.

Hypotheses

• H1 holds — one condition change at the gate; the override caller on returned falls into the existing refusal branch with its existing catalog sentence, developer message and wire prefix.
• H2 partially refuted — the service branch throws a plain Error whose message starts with FORBIDDEN:; the ADR-0112 envelope (code: 'FORBIDDEN', HTTP 403) is minted at the REST seam by handleApprovalError (rest-server.ts:11477, regex ^FORBIDDEN), the same way every approvals refusal reaches the wire. The pins assert the prefix the mapping keys on (the service-seam half of the contract) and the catalog sentence; a REST-level live-emission pin for that row is outside this card's file surface and is recorded as an out-of-scope finding (see below). No code minted, nothing under packages/spec touched.
• H3 holds — returned → unlocked and the submitter's revise-window recall pins in approval-revise.test.ts stay green (24/24 file, 662/662 package).
• H4 holds — approve / reject / reassign are pending-only at their endpoints (decideNode, loadPendingRow); all four override levers are now pending-only and the isOverrideActor doc block is true without edits.

Pins (packages/plugins/plugin-approvals/src/approval-revise.test.ts, new describe block driving the REAL automation engine and the REAL record-lock hook)

1. The narrowing — platform admin AND tenant admin (ADR-0095 posture) on a genuinely returned row: viewer.can_override is false, recall rejects with an Error whose message matches ^FORBIDDEN: and equals FORBIDDEN: + BUILTIN_OPERATION_MESSAGES.en.approval_recall_not_submitter; afterwards the status is still returned, no recall action row exists, the record is still unlocked (the refusal touched no lock), the run status is unchanged and not cancelled, and the submitter can still resubmit (round 2 opens).
2. Reverse check — the same platform admin on the same request while pending: can_override is true, the record is locked, recall lands (recalled, resumed: true, recall action row, lock released).
3. Reverse check, tenant admin — admitted on pending too (the narrowing is about status, not posture).
4. Submitter's ADR-0044 recall on returned — lands, resumed: false, run cancelled.
5. Control — a non-submitter without the override on returned is refused exactly as before, and the override actor's refusal is byte-identical to it (no new refusal shape).

Changeset

.changeset/approval-override-recall-pending-only.md — @objectstack/plugin-approvals: patch. Level reason: no exported symbol is added, removed or changed (measured: git diff -U0 fed4fa409...HEAD | grep export matches only the export class ApprovalService hunk-context lines). The body states the narrowing as an explicit behaviour change in plain words (override-recall of a returned request is now refused; only pending requests are override-recallable; the submitter's revise-window recall is unchanged; why), per the ruling's condition. No major / breaking declaration, so no ADR-0087 marker is owed (check:adr-0087-registration green).

Clause-② declaration (from the ACTUAL diff)

Yes — accept-set narrowing on a live endpoint (POST /api/v1/approvals/requests/:id/recall: an override actor on a returned request was admitted, is now refused with 403 FORBIDDEN). Export surface: unchanged (git diff -U0 fed4fa409...HEAD | grep export → hunk-context lines only). needs:contract-review hangs on this PR and on #12775.

Ablation (on the committed tree, HEAD 971c8cabf)

Mutation: const overrideAdmits = raw.status === 'pending' → const overrideAdmits = true /* ABLATION-12775: status-blind */ (line-neutral). On disk: injected=1 removed_needle_remaining=0. Run: Tests 2 failed | 22 passed (24) — pins 1 (platform admin: expected null to be an instance of Error) and 5 (Cannot read properties of null (reading 'message') on the admin refusal) red, pins 2–4 green — direction: red, as predicted. Restore: git checkout HEAD -- ABSOLUTE_PATH inside a trap … EXIT INT TERM; proven by git hash-object equal to the HEAD blob (fed51d81…), git diff HEAD empty, marker count 0. No dist/ is involved (the suite imports ./approval-service.js from source), so ablation-dist-preflight does not apply.

Verification on the final head 9da369ffe (after merging origin/main310dd01a0; merge-tree clean against 7286dd58e)

All exits captured before any pipe; verdict lines quoted from the tools.

• pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 → Test Files 36 passed (36) / Tests 662 passed (662)
• pnpm --filter @objectstack/plugin-approvals typecheck → check:test-typecheck: OK — @objectstack/plugin-approvals's test layer compiles … 8 file(s) / 324 error(s) / 27 pinned signature(s) (test layer unchanged at 324; tsc --noEmit covers src/** minus tests, the test layer is covered by tsconfig.test.json via check:test-typecheck)
• pnpm check:system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.
• pnpm check:doc-authoring → sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s) … no growth, no burn-down unrecorded.
• pnpm check:engine-double-contract → OK — 753 pinned, 134 in the DEBT ledger, 3 exempt.
• pnpm check:objectql-double-limit → baseline key set verified against 310dd01: no files added.
• pnpm check:nul-bytes → OK (scanned 7949 text file(s) … no raw ASCII control bytes).

Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, from the merge base; 61 commands) run in five lock-serialised batches on 971c8cabf/9f08922f6 (the doc-authoring fix landed as 9f08922f6; the merge and census regeneration after it touched no gate input other than the census page, which is re-verified above):

• Green (55): adr-0087-registration, changeset-no-major, ci-filter-parity, comment-mask-adoption, cross-package-test-inputs (both spellings), doc-frontmatter, doc-route-spelling, docs-section-name, empty-changeset, keyed-text-bounds, plugin-teardown-shape, section-landing-index, shard-attestation, system-context-census, tenant-audit-census, undeclared-dep-imports, docs-audit affected-docs + drift-comment, pm half-states (both spellings), release-rehearsal-clone self-test, lint doc-formula-expressions + doc-security-posture, spec docs / empty-state / liveness / skill-examples (after building the @objectstack/client-react closure — first run was PREREQUISITE NOT MET) / strictness-ledger / variant-docs / yaml-examples, changeset-gate-self-tests, corpus-claim-drift, doc-anchors, doc-authoring (red on the first run: a tracker id in the new log string — fixed in 9f08922f6), docs-audit-scope, docs-redirects, docs-single-h1, engine-double-contract, i18n-stale-fill, logger-receiver-detach, merge-driver, objectql-double-limit, objectui-changeset, page-declaration-shape, published-files, published-readme-links, query-options-erasure, react-page-adapter-contract, role-word, skill-identifier-liveness, slot-lookup, test-source-alias, type-check-coverage, type-source-resolution, vendor-version-stamps, where-matcher, nul-bytes.
• NOT MEASURED (4, prerequisite unmet in this worktree, none reads this diff's files as inputs; CI runs them with the prerequisite): check-test-completeness (exit 3: PREREQUISITE NOT MET — this gate grades a saved turbo run test log), check:dual-build-cjs-loads (exit 3: PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/), check:i18n (exit 1: PREREQUISITE NOT MET — the workspace CLI is not built), check:type-check-debt (exit 3: PREREQUISITE NOT MET — --re-measure cannot run: 20 workspace dependenc(ies) … have no built type entry point).

Adjacent mechanical fix: content/docs/permissions/system-context.mdx row 42 re-anchored by the gate's own --fix (pnpm gen:system-context-census) — first for this branch's +20-line hunk (971c8cabf), then again on the merged tree after origin/main brought #14542's hunk in the same file (9da369ffe, the os-regen deferral discharged as its own commit per scripts/pm/os-regen-merge.sh). No row content changed.

Out of scope

• packages/rest's handleApprovalErrorFORBIDDEN → 403 row has no live-emission pin in rest-approvals-wire-codes.test.ts (that file pins THROTTLED, READ_BACK_FAILED and the template-generated 500s). Filed as a finding, see the report comment on [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775. approvals: ten service endpoints return request: fresh! — a non-null assertion that is false whenever the read-back is org-filtered out, shipping { "request": null } with HTTP 200 #12769 and approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716 remain untouched by this PR.
• Open PR docs(spec,approvals): ApprovalEscalation.timeoutHours names its clock — calendar (wall-clock) hours #14542's region (slaDueAt JSDoc, :600-630) was not touched; it has since landed on main and merged cleanly here.

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via ApprovalService (symbol, a top-level class))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b97d874264945f7494d12240ee5eb67c744ac46 — the merge of head 9da369ffe1d114b4d1684977fe4ca579336365f7 into base 7286dd58e806ed321cbdfc23a1c455db8f80b1ad, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b97d874264945f7494d12240ee5eb67c744ac46 && git checkout 5b97d874264945f7494d12240ee5eb67c744ac46
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7286dd58e806ed321cbdfc23a1c455db8f80b1ad 9da369ffe1d114b4d1684977fe4ca579336365f7 && git checkout -B drift-repro 7286dd58e806ed321cbdfc23a1c455db8f80b1ad && git merge --no-ff 9da369ffe1d114b4d1684977fe4ca579336365f7
node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 9da369ffe

• Card: [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set narrowing: an override actor's recall of a returned request now answers 403 FORBIDDEN): in-seat isolated fable review, round 1 PASS at 9da369ffe (12775#issuecomment-5509840670; transcript verified 60/60 claude-fable-5-1; verdict adopted verbatim, zero blocking findings). Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS. Ruling of record for the change itself: (ii)/B via 12775#issuecomment-5504841854, the changeset declaring the narrowing explicitly per its condition.
• Carriers: needs:contract-review removed from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 and from this PR in the same stroke, both read back; node scripts/pm/check-clause2-carriers.mjs --pair 14571 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 4 files, all inside the fence — approval-service.ts (recall gate + comment + doc block + developer log text), approval-revise.test.ts (five pins), the patch changeset, and the census page content/docs/permissions/system-context.mdx (row 42 re-anchored by the gate's own regeneration, no row text changed). Export delta: none (git diff -U0 origin/main...HEAD | grep export → nothing). No packages/spec, no content/docs/releases/, attachViewers and the slaDueAt region byte-identical to main; log level unchanged (warn).
• CI on 9da369ffe: every check green — Test Core (1/6)success at 12:58:15Z (job 100250298692) and the aggregate Test Coresuccess; Lint & Repo Gatessuccess at 13:01:40Z (job 100250223401); TypeScript Type Check and the four Type Check · jobs, Build Core, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformance, Check Changeset (re-run after the label change, success 12:54:36Z), Governed Surface Queue Guard, Spec property liveness, the single-writer and same-issue guards all success.
• Action: draft → ready and auto-merge enabled at 13:02:57Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775, then files one grouped follow-up finding for the review's §5 notes 1–2 (the tenant-admin lock-release assertion; the packages/spec contract docstring at contracts/approval-service.ts:712, routed to the spec seat). rest: the approvals FORBIDDEN → 403 wire-code row (handleApprovalError) has no live-emission pin — every authorisation refusal rides it, and only the service-side prefix is pinned #14573 (the REST FORBIDDEN → 403 live-emission pin) stays with triage.

---

Generated by Claude Code

[os-sales]

Fixes#12775

Ruling of record (verbatim, untranslated)

Maintainer, 2026-09-02, via the director seat (12775#issuecomment-5504841854), replying to the decision batch whose item for this card recommended 「(ii),附条件:实施 PR 的 changeset 把这条收窄写成显式行为变更;回退 (i)」:

「14324 等我发版,其他同意」

Read as (ii): the audit reading is unobtainable and counts as zero; the 2026-08-29 ruling stands — B: re-scope the status-blind override short-circuit in recall to pending so the gate, the prose and the viewer flag agree at one point; A remains the fallback; the changeset declares the narrowing as an explicit behaviour change so one revert restores it; one pin on the narrowing (returned + override actor ⇒ refused) with the reverse check; #12716 (landed as PR #12791) is unaffected. The card's own facet block (the shape agreed on 2026-08-29):

「推荐:B,附硬前置条件 —— 落地前先从审计留痕读出「是否真有 override actor 在 returned 上撤回过」。读数为零才动手;非零则当场改判 A,⛔ 不许带着非零读数硬做。回退:A。」

The hard precondition is discharged by ruling (ii): no audit reading was attempted and no audit instrument was built.

What changed

ApprovalService.recall (packages/plugins/plugin-approvals/src/approval-service.ts): the #3424 override short-circuit is now conditioned on raw.status === 'pending' — spelled exactly as attachViewers computes viewer.can_override — so on returned an override actor is judged as any other non-submitter and gets the existing refusal (message prefix FORBIDDEN: + the operation catalog's approval_recall_not_submitter sentence; over REST, handleApprovalError maps that prefix to 403 + code FORBIDDEN). No new error code, no new envelope shape, no new export. The comment block above the gate (the old #3424 / #11993 text, whose sentence "the GATE is untouched" is no longer true) is rewritten to state the pending-only scope and this card; the recall doc block gains the same statement. The developer half of the refusal (the logger.warn line, level unchanged) now also names the status it refused on — its text carries no tracker id (check:doc-authoring).

• Submitter's own recall on pending and on returned (ADR-0044 revise window): untouched.
• Override actor's recall on pending (the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 stuck-record rescue, lock release included): untouched.
• The isOverrideActor doc block ("may always act on a PENDING request … or recall it") is now true without an edit; attachViewers and sys-approval-request.object.ts are not touched.

Design note — system context.isOverrideActor's first arm is context.isSystem, so the same expression also scopes a system caller's override to pending. A machine caller keeps a path on returned by naming the submitter as actorId (resolveActor returns a system caller's explicit actor), which is the ADR-0044 semantics. No in-repo caller invokes recall under a system context (packages/rest/src/rest-server.ts is the only call site, with the request's own context); the #13568 record-delete path cancels, it does not recall. Flagged in the report's open questions as a note, not a blocker — spelling the gate as the viewer flag is what the ruling asked for.

Premise verification (on origin/mainfed4fa409, before any edit)

• P1 holds — recall admitted pending and returned, and the gate if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && …) passed an override actor regardless of raw.status (:2904).
• P2 holds — attachViewers computed can_override: row.status === 'pending' && this.isOverrideActor(...) (:5195); the isOverrideActor doc block said PENDING (:938).
• P3 holds — approval_recall's visible (PR fix(plugin-approvals): show approval_recall for the #3424 admin override (#12716) #12791) ORs record.viewer.can_override, pending-only through the flag; no UI path offered override-recall on returned.
• P4 holds — no packages/spec change needed.
• P5 holds — no pin asserted an override actor can recall a returned request. Every existing admin-recall pin (approval-service.test.ts, admin-exemption-retired.test.ts, recall-refusal-user-copy.test.ts) opens a pending request; approval-revise.test.ts:357 already asserted the non-submitter refusal on returned for a non-admin. Nothing to reverse or register.

Hypotheses

• H1 holds — one condition change at the gate; the override caller on returned falls into the existing refusal branch with its existing catalog sentence, developer message and wire prefix.
• H2 partially refuted — the service branch throws a plain Error whose message starts with FORBIDDEN:; the ADR-0112 envelope (code: 'FORBIDDEN', HTTP 403) is minted at the REST seam by handleApprovalError (rest-server.ts:11477, regex ^FORBIDDEN), the same way every approvals refusal reaches the wire. The pins assert the prefix the mapping keys on (the service-seam half of the contract) and the catalog sentence; a REST-level live-emission pin for that row is outside this card's file surface and is recorded as an out-of-scope finding (see below). No code minted, nothing under packages/spec touched.
• H3 holds — returned → unlocked and the submitter's revise-window recall pins in approval-revise.test.ts stay green (24/24 file, 662/662 package).
• H4 holds — approve / reject / reassign are pending-only at their endpoints (decideNode, loadPendingRow); all four override levers are now pending-only and the isOverrideActor doc block is true without edits.

Pins (packages/plugins/plugin-approvals/src/approval-revise.test.ts, new describe block driving the REAL automation engine and the REAL record-lock hook)

1. The narrowing — platform admin AND tenant admin (ADR-0095 posture) on a genuinely returned row: viewer.can_override is false, recall rejects with an Error whose message matches ^FORBIDDEN: and equals FORBIDDEN: + BUILTIN_OPERATION_MESSAGES.en.approval_recall_not_submitter; afterwards the status is still returned, no recall action row exists, the record is still unlocked (the refusal touched no lock), the run status is unchanged and not cancelled, and the submitter can still resubmit (round 2 opens).
2. Reverse check — the same platform admin on the same request while pending: can_override is true, the record is locked, recall lands (recalled, resumed: true, recall action row, lock released).
3. Reverse check, tenant admin — admitted on pending too (the narrowing is about status, not posture).
4. Submitter's ADR-0044 recall on returned — lands, resumed: false, run cancelled.
5. Control — a non-submitter without the override on returned is refused exactly as before, and the override actor's refusal is byte-identical to it (no new refusal shape).

Changeset

.changeset/approval-override-recall-pending-only.md — @objectstack/plugin-approvals: patch. Level reason: no exported symbol is added, removed or changed (measured: git diff -U0 fed4fa409...HEAD | grep export matches only the export class ApprovalService hunk-context lines). The body states the narrowing as an explicit behaviour change in plain words (override-recall of a returned request is now refused; only pending requests are override-recallable; the submitter's revise-window recall is unchanged; why), per the ruling's condition. No major / breaking declaration, so no ADR-0087 marker is owed (check:adr-0087-registration green).

Clause-② declaration (from the ACTUAL diff)

Yes — accept-set narrowing on a live endpoint (POST /api/v1/approvals/requests/:id/recall: an override actor on a returned request was admitted, is now refused with 403 FORBIDDEN). Export surface: unchanged (git diff -U0 fed4fa409...HEAD | grep export → hunk-context lines only). needs:contract-review hangs on this PR and on #12775.

Ablation (on the committed tree, HEAD 971c8cabf)

Mutation: const overrideAdmits = raw.status === 'pending' → const overrideAdmits = true /* ABLATION-12775: status-blind */ (line-neutral). On disk: injected=1 removed_needle_remaining=0. Run: Tests 2 failed | 22 passed (24) — pins 1 (platform admin: expected null to be an instance of Error) and 5 (Cannot read properties of null (reading 'message') on the admin refusal) red, pins 2–4 green — direction: red, as predicted. Restore: git checkout HEAD -- ABSOLUTE_PATH inside a trap … EXIT INT TERM; proven by git hash-object equal to the HEAD blob (fed51d81…), git diff HEAD empty, marker count 0. No dist/ is involved (the suite imports ./approval-service.js from source), so ablation-dist-preflight does not apply.

Verification on the final head 9da369ffe (after merging origin/main310dd01a0; merge-tree clean against 7286dd58e)

All exits captured before any pipe; verdict lines quoted from the tools.

• pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 → Test Files 36 passed (36) / Tests 662 passed (662)
• pnpm --filter @objectstack/plugin-approvals typecheck → check:test-typecheck: OK — @objectstack/plugin-approvals's test layer compiles … 8 file(s) / 324 error(s) / 27 pinned signature(s) (test layer unchanged at 324; tsc --noEmit covers src/** minus tests, the test layer is covered by tsconfig.test.json via check:test-typecheck)
• pnpm check:system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.
• pnpm check:doc-authoring → sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s) … no growth, no burn-down unrecorded.
• pnpm check:engine-double-contract → OK — 753 pinned, 134 in the DEBT ledger, 3 exempt.
• pnpm check:objectql-double-limit → baseline key set verified against 310dd01: no files added.
• pnpm check:nul-bytes → OK (scanned 7949 text file(s) … no raw ASCII control bytes).

Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, from the merge base; 61 commands) run in five lock-serialised batches on 971c8cabf/9f08922f6 (the doc-authoring fix landed as 9f08922f6; the merge and census regeneration after it touched no gate input other than the census page, which is re-verified above):

• Green (55): adr-0087-registration, changeset-no-major, ci-filter-parity, comment-mask-adoption, cross-package-test-inputs (both spellings), doc-frontmatter, doc-route-spelling, docs-section-name, empty-changeset, keyed-text-bounds, plugin-teardown-shape, section-landing-index, shard-attestation, system-context-census, tenant-audit-census, undeclared-dep-imports, docs-audit affected-docs + drift-comment, pm half-states (both spellings), release-rehearsal-clone self-test, lint doc-formula-expressions + doc-security-posture, spec docs / empty-state / liveness / skill-examples (after building the @objectstack/client-react closure — first run was PREREQUISITE NOT MET) / strictness-ledger / variant-docs / yaml-examples, changeset-gate-self-tests, corpus-claim-drift, doc-anchors, doc-authoring (red on the first run: a tracker id in the new log string — fixed in 9f08922f6), docs-audit-scope, docs-redirects, docs-single-h1, engine-double-contract, i18n-stale-fill, logger-receiver-detach, merge-driver, objectql-double-limit, objectui-changeset, page-declaration-shape, published-files, published-readme-links, query-options-erasure, react-page-adapter-contract, role-word, skill-identifier-liveness, slot-lookup, test-source-alias, type-check-coverage, type-source-resolution, vendor-version-stamps, where-matcher, nul-bytes.
• NOT MEASURED (4, prerequisite unmet in this worktree, none reads this diff's files as inputs; CI runs them with the prerequisite): check-test-completeness (exit 3: PREREQUISITE NOT MET — this gate grades a saved turbo run test log), check:dual-build-cjs-loads (exit 3: PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/), check:i18n (exit 1: PREREQUISITE NOT MET — the workspace CLI is not built), check:type-check-debt (exit 3: PREREQUISITE NOT MET — --re-measure cannot run: 20 workspace dependenc(ies) … have no built type entry point).

Adjacent mechanical fix: content/docs/permissions/system-context.mdx row 42 re-anchored by the gate's own --fix (pnpm gen:system-context-census) — first for this branch's +20-line hunk (971c8cabf), then again on the merged tree after origin/main brought #14542's hunk in the same file (9da369ffe, the os-regen deferral discharged as its own commit per scripts/pm/os-regen-merge.sh). No row content changed.

Out of scope

• packages/rest's handleApprovalErrorFORBIDDEN → 403 row has no live-emission pin in rest-approvals-wire-codes.test.ts (that file pins THROTTLED, READ_BACK_FAILED and the template-generated 500s). Filed as a finding, see the report comment on [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775. approvals: ten service endpoints return request: fresh! — a non-null assertion that is false whenever the read-back is org-filtered out, shipping { "request": null } with HTTP 200 #12769 and approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716 remain untouched by this PR.
• Open PR docs(spec,approvals): ApprovalEscalation.timeoutHours names its clock — calendar (wall-clock) hours #14542's region (slaDueAt JSDoc, :600-630) was not touched; it has since landed on main and merged cleanly here.

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via ApprovalService (symbol, a top-level class))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b97d874264945f7494d12240ee5eb67c744ac46 — the merge of head 9da369ffe1d114b4d1684977fe4ca579336365f7 into base 7286dd58e806ed321cbdfc23a1c455db8f80b1ad, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b97d874264945f7494d12240ee5eb67c744ac46 && git checkout 5b97d874264945f7494d12240ee5eb67c744ac46
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7286dd58e806ed321cbdfc23a1c455db8f80b1ad 9da369ffe1d114b4d1684977fe4ca579336365f7 && git checkout -B drift-repro 7286dd58e806ed321cbdfc23a1c455db8f80b1ad && git merge --no-ff 9da369ffe1d114b4d1684977fe4ca579336365f7
node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 9da369ffe

• Card: [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set narrowing: an override actor's recall of a returned request now answers 403 FORBIDDEN): in-seat isolated fable review, round 1 PASS at 9da369ffe (12775#issuecomment-5509840670; transcript verified 60/60 claude-fable-5-1; verdict adopted verbatim, zero blocking findings). Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS. Ruling of record for the change itself: (ii)/B via 12775#issuecomment-5504841854, the changeset declaring the narrowing explicitly per its condition.
• Carriers: needs:contract-review removed from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 and from this PR in the same stroke, both read back; node scripts/pm/check-clause2-carriers.mjs --pair 14571 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 4 files, all inside the fence — approval-service.ts (recall gate + comment + doc block + developer log text), approval-revise.test.ts (five pins), the patch changeset, and the census page content/docs/permissions/system-context.mdx (row 42 re-anchored by the gate's own regeneration, no row text changed). Export delta: none (git diff -U0 origin/main...HEAD | grep export → nothing). No packages/spec, no content/docs/releases/, attachViewers and the slaDueAt region byte-identical to main; log level unchanged (warn).
• CI on 9da369ffe: every check green — Test Core (1/6)success at 12:58:15Z (job 100250298692) and the aggregate Test Coresuccess; Lint & Repo Gatessuccess at 13:01:40Z (job 100250223401); TypeScript Type Check and the four Type Check · jobs, Build Core, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformance, Check Changeset (re-run after the label change, success 12:54:36Z), Governed Surface Queue Guard, Spec property liveness, the single-writer and same-issue guards all success.
• Action: draft → ready and auto-merge enabled at 13:02:57Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775, then files one grouped follow-up finding for the review's §5 notes 1–2 (the tenant-admin lock-release assertion; the packages/spec contract docstring at contracts/approval-service.ts:712, routed to the spec seat). rest: the approvals FORBIDDEN → 403 wire-code row (handleApprovalError) has no live-emission pin — every authorisation refusal rides it, and only the service-side prefix is pinned #14573 (the REST FORBIDDEN → 403 live-emission pin) stays with triage.

---

Generated by Claude Code

[os-sales]

Fixes#12775

Ruling of record (verbatim, untranslated)

Maintainer, 2026-09-02, via the director seat (12775#issuecomment-5504841854), replying to the decision batch whose item for this card recommended 「(ii),附条件:实施 PR 的 changeset 把这条收窄写成显式行为变更;回退 (i)」:

「14324 等我发版,其他同意」

Read as (ii): the audit reading is unobtainable and counts as zero; the 2026-08-29 ruling stands — B: re-scope the status-blind override short-circuit in recall to pending so the gate, the prose and the viewer flag agree at one point; A remains the fallback; the changeset declares the narrowing as an explicit behaviour change so one revert restores it; one pin on the narrowing (returned + override actor ⇒ refused) with the reverse check; #12716 (landed as PR #12791) is unaffected. The card's own facet block (the shape agreed on 2026-08-29):

「推荐:B,附硬前置条件 —— 落地前先从审计留痕读出「是否真有 override actor 在 returned 上撤回过」。读数为零才动手;非零则当场改判 A,⛔ 不许带着非零读数硬做。回退:A。」

The hard precondition is discharged by ruling (ii): no audit reading was attempted and no audit instrument was built.

What changed

ApprovalService.recall (packages/plugins/plugin-approvals/src/approval-service.ts): the #3424 override short-circuit is now conditioned on raw.status === 'pending' — spelled exactly as attachViewers computes viewer.can_override — so on returned an override actor is judged as any other non-submitter and gets the existing refusal (message prefix FORBIDDEN: + the operation catalog's approval_recall_not_submitter sentence; over REST, handleApprovalError maps that prefix to 403 + code FORBIDDEN). No new error code, no new envelope shape, no new export. The comment block above the gate (the old #3424 / #11993 text, whose sentence "the GATE is untouched" is no longer true) is rewritten to state the pending-only scope and this card; the recall doc block gains the same statement. The developer half of the refusal (the logger.warn line, level unchanged) now also names the status it refused on — its text carries no tracker id (check:doc-authoring).

• Submitter's own recall on pending and on returned (ADR-0044 revise window): untouched.
• Override actor's recall on pending (the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 stuck-record rescue, lock release included): untouched.
• The isOverrideActor doc block ("may always act on a PENDING request … or recall it") is now true without an edit; attachViewers and sys-approval-request.object.ts are not touched.

Design note — system context.isOverrideActor's first arm is context.isSystem, so the same expression also scopes a system caller's override to pending. A machine caller keeps a path on returned by naming the submitter as actorId (resolveActor returns a system caller's explicit actor), which is the ADR-0044 semantics. No in-repo caller invokes recall under a system context (packages/rest/src/rest-server.ts is the only call site, with the request's own context); the #13568 record-delete path cancels, it does not recall. Flagged in the report's open questions as a note, not a blocker — spelling the gate as the viewer flag is what the ruling asked for.

Premise verification (on origin/mainfed4fa409, before any edit)

• P1 holds — recall admitted pending and returned, and the gate if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && …) passed an override actor regardless of raw.status (:2904).
• P2 holds — attachViewers computed can_override: row.status === 'pending' && this.isOverrideActor(...) (:5195); the isOverrideActor doc block said PENDING (:938).
• P3 holds — approval_recall's visible (PR fix(plugin-approvals): show approval_recall for the #3424 admin override (#12716) #12791) ORs record.viewer.can_override, pending-only through the flag; no UI path offered override-recall on returned.
• P4 holds — no packages/spec change needed.
• P5 holds — no pin asserted an override actor can recall a returned request. Every existing admin-recall pin (approval-service.test.ts, admin-exemption-retired.test.ts, recall-refusal-user-copy.test.ts) opens a pending request; approval-revise.test.ts:357 already asserted the non-submitter refusal on returned for a non-admin. Nothing to reverse or register.

Hypotheses

• H1 holds — one condition change at the gate; the override caller on returned falls into the existing refusal branch with its existing catalog sentence, developer message and wire prefix.
• H2 partially refuted — the service branch throws a plain Error whose message starts with FORBIDDEN:; the ADR-0112 envelope (code: 'FORBIDDEN', HTTP 403) is minted at the REST seam by handleApprovalError (rest-server.ts:11477, regex ^FORBIDDEN), the same way every approvals refusal reaches the wire. The pins assert the prefix the mapping keys on (the service-seam half of the contract) and the catalog sentence; a REST-level live-emission pin for that row is outside this card's file surface and is recorded as an out-of-scope finding (see below). No code minted, nothing under packages/spec touched.
• H3 holds — returned → unlocked and the submitter's revise-window recall pins in approval-revise.test.ts stay green (24/24 file, 662/662 package).
• H4 holds — approve / reject / reassign are pending-only at their endpoints (decideNode, loadPendingRow); all four override levers are now pending-only and the isOverrideActor doc block is true without edits.

Pins (packages/plugins/plugin-approvals/src/approval-revise.test.ts, new describe block driving the REAL automation engine and the REAL record-lock hook)

1. The narrowing — platform admin AND tenant admin (ADR-0095 posture) on a genuinely returned row: viewer.can_override is false, recall rejects with an Error whose message matches ^FORBIDDEN: and equals FORBIDDEN: + BUILTIN_OPERATION_MESSAGES.en.approval_recall_not_submitter; afterwards the status is still returned, no recall action row exists, the record is still unlocked (the refusal touched no lock), the run status is unchanged and not cancelled, and the submitter can still resubmit (round 2 opens).
2. Reverse check — the same platform admin on the same request while pending: can_override is true, the record is locked, recall lands (recalled, resumed: true, recall action row, lock released).
3. Reverse check, tenant admin — admitted on pending too (the narrowing is about status, not posture).
4. Submitter's ADR-0044 recall on returned — lands, resumed: false, run cancelled.
5. Control — a non-submitter without the override on returned is refused exactly as before, and the override actor's refusal is byte-identical to it (no new refusal shape).

Changeset

.changeset/approval-override-recall-pending-only.md — @objectstack/plugin-approvals: patch. Level reason: no exported symbol is added, removed or changed (measured: git diff -U0 fed4fa409...HEAD | grep export matches only the export class ApprovalService hunk-context lines). The body states the narrowing as an explicit behaviour change in plain words (override-recall of a returned request is now refused; only pending requests are override-recallable; the submitter's revise-window recall is unchanged; why), per the ruling's condition. No major / breaking declaration, so no ADR-0087 marker is owed (check:adr-0087-registration green).

Clause-② declaration (from the ACTUAL diff)

Yes — accept-set narrowing on a live endpoint (POST /api/v1/approvals/requests/:id/recall: an override actor on a returned request was admitted, is now refused with 403 FORBIDDEN). Export surface: unchanged (git diff -U0 fed4fa409...HEAD | grep export → hunk-context lines only). needs:contract-review hangs on this PR and on #12775.

Ablation (on the committed tree, HEAD 971c8cabf)

Mutation: const overrideAdmits = raw.status === 'pending' → const overrideAdmits = true /* ABLATION-12775: status-blind */ (line-neutral). On disk: injected=1 removed_needle_remaining=0. Run: Tests 2 failed | 22 passed (24) — pins 1 (platform admin: expected null to be an instance of Error) and 5 (Cannot read properties of null (reading 'message') on the admin refusal) red, pins 2–4 green — direction: red, as predicted. Restore: git checkout HEAD -- ABSOLUTE_PATH inside a trap … EXIT INT TERM; proven by git hash-object equal to the HEAD blob (fed51d81…), git diff HEAD empty, marker count 0. No dist/ is involved (the suite imports ./approval-service.js from source), so ablation-dist-preflight does not apply.

Verification on the final head 9da369ffe (after merging origin/main310dd01a0; merge-tree clean against 7286dd58e)

All exits captured before any pipe; verdict lines quoted from the tools.

• pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 → Test Files 36 passed (36) / Tests 662 passed (662)
• pnpm --filter @objectstack/plugin-approvals typecheck → check:test-typecheck: OK — @objectstack/plugin-approvals's test layer compiles … 8 file(s) / 324 error(s) / 27 pinned signature(s) (test layer unchanged at 324; tsc --noEmit covers src/** minus tests, the test layer is covered by tsconfig.test.json via check:test-typecheck)
• pnpm check:system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.
• pnpm check:doc-authoring → sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s) … no growth, no burn-down unrecorded.
• pnpm check:engine-double-contract → OK — 753 pinned, 134 in the DEBT ledger, 3 exempt.
• pnpm check:objectql-double-limit → baseline key set verified against 310dd01: no files added.
• pnpm check:nul-bytes → OK (scanned 7949 text file(s) … no raw ASCII control bytes).

Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, from the merge base; 61 commands) run in five lock-serialised batches on 971c8cabf/9f08922f6 (the doc-authoring fix landed as 9f08922f6; the merge and census regeneration after it touched no gate input other than the census page, which is re-verified above):

• Green (55): adr-0087-registration, changeset-no-major, ci-filter-parity, comment-mask-adoption, cross-package-test-inputs (both spellings), doc-frontmatter, doc-route-spelling, docs-section-name, empty-changeset, keyed-text-bounds, plugin-teardown-shape, section-landing-index, shard-attestation, system-context-census, tenant-audit-census, undeclared-dep-imports, docs-audit affected-docs + drift-comment, pm half-states (both spellings), release-rehearsal-clone self-test, lint doc-formula-expressions + doc-security-posture, spec docs / empty-state / liveness / skill-examples (after building the @objectstack/client-react closure — first run was PREREQUISITE NOT MET) / strictness-ledger / variant-docs / yaml-examples, changeset-gate-self-tests, corpus-claim-drift, doc-anchors, doc-authoring (red on the first run: a tracker id in the new log string — fixed in 9f08922f6), docs-audit-scope, docs-redirects, docs-single-h1, engine-double-contract, i18n-stale-fill, logger-receiver-detach, merge-driver, objectql-double-limit, objectui-changeset, page-declaration-shape, published-files, published-readme-links, query-options-erasure, react-page-adapter-contract, role-word, skill-identifier-liveness, slot-lookup, test-source-alias, type-check-coverage, type-source-resolution, vendor-version-stamps, where-matcher, nul-bytes.
• NOT MEASURED (4, prerequisite unmet in this worktree, none reads this diff's files as inputs; CI runs them with the prerequisite): check-test-completeness (exit 3: PREREQUISITE NOT MET — this gate grades a saved turbo run test log), check:dual-build-cjs-loads (exit 3: PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/), check:i18n (exit 1: PREREQUISITE NOT MET — the workspace CLI is not built), check:type-check-debt (exit 3: PREREQUISITE NOT MET — --re-measure cannot run: 20 workspace dependenc(ies) … have no built type entry point).

Adjacent mechanical fix: content/docs/permissions/system-context.mdx row 42 re-anchored by the gate's own --fix (pnpm gen:system-context-census) — first for this branch's +20-line hunk (971c8cabf), then again on the merged tree after origin/main brought #14542's hunk in the same file (9da369ffe, the os-regen deferral discharged as its own commit per scripts/pm/os-regen-merge.sh). No row content changed.

Out of scope

• packages/rest's handleApprovalErrorFORBIDDEN → 403 row has no live-emission pin in rest-approvals-wire-codes.test.ts (that file pins THROTTLED, READ_BACK_FAILED and the template-generated 500s). Filed as a finding, see the report comment on [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775. approvals: ten service endpoints return request: fresh! — a non-null assertion that is false whenever the read-back is org-filtered out, shipping { "request": null } with HTTP 200 #12769 and approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716 remain untouched by this PR.
• Open PR docs(spec,approvals): ApprovalEscalation.timeoutHours names its clock — calendar (wall-clock) hours #14542's region (slaDueAt JSDoc, :600-630) was not touched; it has since landed on main and merged cleanly here.

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via ApprovalService (symbol, a top-level class))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b97d874264945f7494d12240ee5eb67c744ac46 — the merge of head 9da369ffe1d114b4d1684977fe4ca579336365f7 into base 7286dd58e806ed321cbdfc23a1c455db8f80b1ad, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b97d874264945f7494d12240ee5eb67c744ac46 && git checkout 5b97d874264945f7494d12240ee5eb67c744ac46
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7286dd58e806ed321cbdfc23a1c455db8f80b1ad 9da369ffe1d114b4d1684977fe4ca579336365f7 && git checkout -B drift-repro 7286dd58e806ed321cbdfc23a1c455db8f80b1ad && git merge --no-ff 9da369ffe1d114b4d1684977fe4ca579336365f7
node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 9da369ffe

• Card: [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set narrowing: an override actor's recall of a returned request now answers 403 FORBIDDEN): in-seat isolated fable review, round 1 PASS at 9da369ffe (12775#issuecomment-5509840670; transcript verified 60/60 claude-fable-5-1; verdict adopted verbatim, zero blocking findings). Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS. Ruling of record for the change itself: (ii)/B via 12775#issuecomment-5504841854, the changeset declaring the narrowing explicitly per its condition.
• Carriers: needs:contract-review removed from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 and from this PR in the same stroke, both read back; node scripts/pm/check-clause2-carriers.mjs --pair 14571 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 4 files, all inside the fence — approval-service.ts (recall gate + comment + doc block + developer log text), approval-revise.test.ts (five pins), the patch changeset, and the census page content/docs/permissions/system-context.mdx (row 42 re-anchored by the gate's own regeneration, no row text changed). Export delta: none (git diff -U0 origin/main...HEAD | grep export → nothing). No packages/spec, no content/docs/releases/, attachViewers and the slaDueAt region byte-identical to main; log level unchanged (warn).
• CI on 9da369ffe: every check green — Test Core (1/6)success at 12:58:15Z (job 100250298692) and the aggregate Test Coresuccess; Lint & Repo Gatessuccess at 13:01:40Z (job 100250223401); TypeScript Type Check and the four Type Check · jobs, Build Core, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformance, Check Changeset (re-run after the label change, success 12:54:36Z), Governed Surface Queue Guard, Spec property liveness, the single-writer and same-issue guards all success.
• Action: draft → ready and auto-merge enabled at 13:02:57Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775, then files one grouped follow-up finding for the review's §5 notes 1–2 (the tenant-admin lock-release assertion; the packages/spec contract docstring at contracts/approval-service.ts:712, routed to the spec seat). rest: the approvals FORBIDDEN → 403 wire-code row (handleApprovalError) has no live-emission pin — every authorisation refusal rides it, and only the service-side prefix is pinned #14573 (the REST FORBIDDEN → 403 live-emission pin) stays with triage.

---

Generated by Claude Code

[os-sales]

Fixes#12775

Ruling of record (verbatim, untranslated)

Maintainer, 2026-09-02, via the director seat (12775#issuecomment-5504841854), replying to the decision batch whose item for this card recommended 「(ii),附条件:实施 PR 的 changeset 把这条收窄写成显式行为变更;回退 (i)」:

「14324 等我发版,其他同意」

Read as (ii): the audit reading is unobtainable and counts as zero; the 2026-08-29 ruling stands — B: re-scope the status-blind override short-circuit in recall to pending so the gate, the prose and the viewer flag agree at one point; A remains the fallback; the changeset declares the narrowing as an explicit behaviour change so one revert restores it; one pin on the narrowing (returned + override actor ⇒ refused) with the reverse check; #12716 (landed as PR #12791) is unaffected. The card's own facet block (the shape agreed on 2026-08-29):

「推荐:B,附硬前置条件 —— 落地前先从审计留痕读出「是否真有 override actor 在 returned 上撤回过」。读数为零才动手;非零则当场改判 A,⛔ 不许带着非零读数硬做。回退:A。」

The hard precondition is discharged by ruling (ii): no audit reading was attempted and no audit instrument was built.

What changed

ApprovalService.recall (packages/plugins/plugin-approvals/src/approval-service.ts): the #3424 override short-circuit is now conditioned on raw.status === 'pending' — spelled exactly as attachViewers computes viewer.can_override — so on returned an override actor is judged as any other non-submitter and gets the existing refusal (message prefix FORBIDDEN: + the operation catalog's approval_recall_not_submitter sentence; over REST, handleApprovalError maps that prefix to 403 + code FORBIDDEN). No new error code, no new envelope shape, no new export. The comment block above the gate (the old #3424 / #11993 text, whose sentence "the GATE is untouched" is no longer true) is rewritten to state the pending-only scope and this card; the recall doc block gains the same statement. The developer half of the refusal (the logger.warn line, level unchanged) now also names the status it refused on — its text carries no tracker id (check:doc-authoring).

• Submitter's own recall on pending and on returned (ADR-0044 revise window): untouched.
• Override actor's recall on pending (the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 stuck-record rescue, lock release included): untouched.
• The isOverrideActor doc block ("may always act on a PENDING request … or recall it") is now true without an edit; attachViewers and sys-approval-request.object.ts are not touched.

Design note — system context.isOverrideActor's first arm is context.isSystem, so the same expression also scopes a system caller's override to pending. A machine caller keeps a path on returned by naming the submitter as actorId (resolveActor returns a system caller's explicit actor), which is the ADR-0044 semantics. No in-repo caller invokes recall under a system context (packages/rest/src/rest-server.ts is the only call site, with the request's own context); the #13568 record-delete path cancels, it does not recall. Flagged in the report's open questions as a note, not a blocker — spelling the gate as the viewer flag is what the ruling asked for.

Premise verification (on origin/mainfed4fa409, before any edit)

• P1 holds — recall admitted pending and returned, and the gate if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && …) passed an override actor regardless of raw.status (:2904).
• P2 holds — attachViewers computed can_override: row.status === 'pending' && this.isOverrideActor(...) (:5195); the isOverrideActor doc block said PENDING (:938).
• P3 holds — approval_recall's visible (PR fix(plugin-approvals): show approval_recall for the #3424 admin override (#12716) #12791) ORs record.viewer.can_override, pending-only through the flag; no UI path offered override-recall on returned.
• P4 holds — no packages/spec change needed.
• P5 holds — no pin asserted an override actor can recall a returned request. Every existing admin-recall pin (approval-service.test.ts, admin-exemption-retired.test.ts, recall-refusal-user-copy.test.ts) opens a pending request; approval-revise.test.ts:357 already asserted the non-submitter refusal on returned for a non-admin. Nothing to reverse or register.

Hypotheses

• H1 holds — one condition change at the gate; the override caller on returned falls into the existing refusal branch with its existing catalog sentence, developer message and wire prefix.
• H2 partially refuted — the service branch throws a plain Error whose message starts with FORBIDDEN:; the ADR-0112 envelope (code: 'FORBIDDEN', HTTP 403) is minted at the REST seam by handleApprovalError (rest-server.ts:11477, regex ^FORBIDDEN), the same way every approvals refusal reaches the wire. The pins assert the prefix the mapping keys on (the service-seam half of the contract) and the catalog sentence; a REST-level live-emission pin for that row is outside this card's file surface and is recorded as an out-of-scope finding (see below). No code minted, nothing under packages/spec touched.
• H3 holds — returned → unlocked and the submitter's revise-window recall pins in approval-revise.test.ts stay green (24/24 file, 662/662 package).
• H4 holds — approve / reject / reassign are pending-only at their endpoints (decideNode, loadPendingRow); all four override levers are now pending-only and the isOverrideActor doc block is true without edits.

Pins (packages/plugins/plugin-approvals/src/approval-revise.test.ts, new describe block driving the REAL automation engine and the REAL record-lock hook)

1. The narrowing — platform admin AND tenant admin (ADR-0095 posture) on a genuinely returned row: viewer.can_override is false, recall rejects with an Error whose message matches ^FORBIDDEN: and equals FORBIDDEN: + BUILTIN_OPERATION_MESSAGES.en.approval_recall_not_submitter; afterwards the status is still returned, no recall action row exists, the record is still unlocked (the refusal touched no lock), the run status is unchanged and not cancelled, and the submitter can still resubmit (round 2 opens).
2. Reverse check — the same platform admin on the same request while pending: can_override is true, the record is locked, recall lands (recalled, resumed: true, recall action row, lock released).
3. Reverse check, tenant admin — admitted on pending too (the narrowing is about status, not posture).
4. Submitter's ADR-0044 recall on returned — lands, resumed: false, run cancelled.
5. Control — a non-submitter without the override on returned is refused exactly as before, and the override actor's refusal is byte-identical to it (no new refusal shape).

Changeset

.changeset/approval-override-recall-pending-only.md — @objectstack/plugin-approvals: patch. Level reason: no exported symbol is added, removed or changed (measured: git diff -U0 fed4fa409...HEAD | grep export matches only the export class ApprovalService hunk-context lines). The body states the narrowing as an explicit behaviour change in plain words (override-recall of a returned request is now refused; only pending requests are override-recallable; the submitter's revise-window recall is unchanged; why), per the ruling's condition. No major / breaking declaration, so no ADR-0087 marker is owed (check:adr-0087-registration green).

Clause-② declaration (from the ACTUAL diff)

Yes — accept-set narrowing on a live endpoint (POST /api/v1/approvals/requests/:id/recall: an override actor on a returned request was admitted, is now refused with 403 FORBIDDEN). Export surface: unchanged (git diff -U0 fed4fa409...HEAD | grep export → hunk-context lines only). needs:contract-review hangs on this PR and on #12775.

Ablation (on the committed tree, HEAD 971c8cabf)

Mutation: const overrideAdmits = raw.status === 'pending' → const overrideAdmits = true /* ABLATION-12775: status-blind */ (line-neutral). On disk: injected=1 removed_needle_remaining=0. Run: Tests 2 failed | 22 passed (24) — pins 1 (platform admin: expected null to be an instance of Error) and 5 (Cannot read properties of null (reading 'message') on the admin refusal) red, pins 2–4 green — direction: red, as predicted. Restore: git checkout HEAD -- ABSOLUTE_PATH inside a trap … EXIT INT TERM; proven by git hash-object equal to the HEAD blob (fed51d81…), git diff HEAD empty, marker count 0. No dist/ is involved (the suite imports ./approval-service.js from source), so ablation-dist-preflight does not apply.

Verification on the final head 9da369ffe (after merging origin/main310dd01a0; merge-tree clean against 7286dd58e)

All exits captured before any pipe; verdict lines quoted from the tools.

• pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 → Test Files 36 passed (36) / Tests 662 passed (662)
• pnpm --filter @objectstack/plugin-approvals typecheck → check:test-typecheck: OK — @objectstack/plugin-approvals's test layer compiles … 8 file(s) / 324 error(s) / 27 pinned signature(s) (test layer unchanged at 324; tsc --noEmit covers src/** minus tests, the test layer is covered by tsconfig.test.json via check:test-typecheck)
• pnpm check:system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.
• pnpm check:doc-authoring → sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s) … no growth, no burn-down unrecorded.
• pnpm check:engine-double-contract → OK — 753 pinned, 134 in the DEBT ledger, 3 exempt.
• pnpm check:objectql-double-limit → baseline key set verified against 310dd01: no files added.
• pnpm check:nul-bytes → OK (scanned 7949 text file(s) … no raw ASCII control bytes).

Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, from the merge base; 61 commands) run in five lock-serialised batches on 971c8cabf/9f08922f6 (the doc-authoring fix landed as 9f08922f6; the merge and census regeneration after it touched no gate input other than the census page, which is re-verified above):

• Green (55): adr-0087-registration, changeset-no-major, ci-filter-parity, comment-mask-adoption, cross-package-test-inputs (both spellings), doc-frontmatter, doc-route-spelling, docs-section-name, empty-changeset, keyed-text-bounds, plugin-teardown-shape, section-landing-index, shard-attestation, system-context-census, tenant-audit-census, undeclared-dep-imports, docs-audit affected-docs + drift-comment, pm half-states (both spellings), release-rehearsal-clone self-test, lint doc-formula-expressions + doc-security-posture, spec docs / empty-state / liveness / skill-examples (after building the @objectstack/client-react closure — first run was PREREQUISITE NOT MET) / strictness-ledger / variant-docs / yaml-examples, changeset-gate-self-tests, corpus-claim-drift, doc-anchors, doc-authoring (red on the first run: a tracker id in the new log string — fixed in 9f08922f6), docs-audit-scope, docs-redirects, docs-single-h1, engine-double-contract, i18n-stale-fill, logger-receiver-detach, merge-driver, objectql-double-limit, objectui-changeset, page-declaration-shape, published-files, published-readme-links, query-options-erasure, react-page-adapter-contract, role-word, skill-identifier-liveness, slot-lookup, test-source-alias, type-check-coverage, type-source-resolution, vendor-version-stamps, where-matcher, nul-bytes.
• NOT MEASURED (4, prerequisite unmet in this worktree, none reads this diff's files as inputs; CI runs them with the prerequisite): check-test-completeness (exit 3: PREREQUISITE NOT MET — this gate grades a saved turbo run test log), check:dual-build-cjs-loads (exit 3: PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/), check:i18n (exit 1: PREREQUISITE NOT MET — the workspace CLI is not built), check:type-check-debt (exit 3: PREREQUISITE NOT MET — --re-measure cannot run: 20 workspace dependenc(ies) … have no built type entry point).

Adjacent mechanical fix: content/docs/permissions/system-context.mdx row 42 re-anchored by the gate's own --fix (pnpm gen:system-context-census) — first for this branch's +20-line hunk (971c8cabf), then again on the merged tree after origin/main brought #14542's hunk in the same file (9da369ffe, the os-regen deferral discharged as its own commit per scripts/pm/os-regen-merge.sh). No row content changed.

Out of scope

• packages/rest's handleApprovalErrorFORBIDDEN → 403 row has no live-emission pin in rest-approvals-wire-codes.test.ts (that file pins THROTTLED, READ_BACK_FAILED and the template-generated 500s). Filed as a finding, see the report comment on [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775. approvals: ten service endpoints return request: fresh! — a non-null assertion that is false whenever the read-back is org-filtered out, shipping { "request": null } with HTTP 200 #12769 and approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716 remain untouched by this PR.
• Open PR docs(spec,approvals): ApprovalEscalation.timeoutHours names its clock — calendar (wall-clock) hours #14542's region (slaDueAt JSDoc, :600-630) was not touched; it has since landed on main and merged cleanly here.

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via ApprovalService (symbol, a top-level class))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b97d874264945f7494d12240ee5eb67c744ac46 — the merge of head 9da369ffe1d114b4d1684977fe4ca579336365f7 into base 7286dd58e806ed321cbdfc23a1c455db8f80b1ad, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b97d874264945f7494d12240ee5eb67c744ac46 && git checkout 5b97d874264945f7494d12240ee5eb67c744ac46
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7286dd58e806ed321cbdfc23a1c455db8f80b1ad 9da369ffe1d114b4d1684977fe4ca579336365f7 && git checkout -B drift-repro 7286dd58e806ed321cbdfc23a1c455db8f80b1ad && git merge --no-ff 9da369ffe1d114b4d1684977fe4ca579336365f7
node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 9da369ffe

• Card: [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set narrowing: an override actor's recall of a returned request now answers 403 FORBIDDEN): in-seat isolated fable review, round 1 PASS at 9da369ffe (12775#issuecomment-5509840670; transcript verified 60/60 claude-fable-5-1; verdict adopted verbatim, zero blocking findings). Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS. Ruling of record for the change itself: (ii)/B via 12775#issuecomment-5504841854, the changeset declaring the narrowing explicitly per its condition.
• Carriers: needs:contract-review removed from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 and from this PR in the same stroke, both read back; node scripts/pm/check-clause2-carriers.mjs --pair 14571 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 4 files, all inside the fence — approval-service.ts (recall gate + comment + doc block + developer log text), approval-revise.test.ts (five pins), the patch changeset, and the census page content/docs/permissions/system-context.mdx (row 42 re-anchored by the gate's own regeneration, no row text changed). Export delta: none (git diff -U0 origin/main...HEAD | grep export → nothing). No packages/spec, no content/docs/releases/, attachViewers and the slaDueAt region byte-identical to main; log level unchanged (warn).
• CI on 9da369ffe: every check green — Test Core (1/6)success at 12:58:15Z (job 100250298692) and the aggregate Test Coresuccess; Lint & Repo Gatessuccess at 13:01:40Z (job 100250223401); TypeScript Type Check and the four Type Check · jobs, Build Core, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformance, Check Changeset (re-run after the label change, success 12:54:36Z), Governed Surface Queue Guard, Spec property liveness, the single-writer and same-issue guards all success.
• Action: draft → ready and auto-merge enabled at 13:02:57Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775, then files one grouped follow-up finding for the review's §5 notes 1–2 (the tenant-admin lock-release assertion; the packages/spec contract docstring at contracts/approval-service.ts:712, routed to the spec seat). rest: the approvals FORBIDDEN → 403 wire-code row (handleApprovalError) has no live-emission pin — every authorisation refusal rides it, and only the service-side prefix is pinned #14573 (the REST FORBIDDEN → 403 live-emission pin) stays with triage.

---

Generated by Claude Code

[os-sales]

Fixes#12775

Ruling of record (verbatim, untranslated)

Maintainer, 2026-09-02, via the director seat (12775#issuecomment-5504841854), replying to the decision batch whose item for this card recommended 「(ii),附条件:实施 PR 的 changeset 把这条收窄写成显式行为变更;回退 (i)」:

「14324 等我发版,其他同意」

Read as (ii): the audit reading is unobtainable and counts as zero; the 2026-08-29 ruling stands — B: re-scope the status-blind override short-circuit in recall to pending so the gate, the prose and the viewer flag agree at one point; A remains the fallback; the changeset declares the narrowing as an explicit behaviour change so one revert restores it; one pin on the narrowing (returned + override actor ⇒ refused) with the reverse check; #12716 (landed as PR #12791) is unaffected. The card's own facet block (the shape agreed on 2026-08-29):

「推荐:B,附硬前置条件 —— 落地前先从审计留痕读出「是否真有 override actor 在 returned 上撤回过」。读数为零才动手;非零则当场改判 A,⛔ 不许带着非零读数硬做。回退:A。」

The hard precondition is discharged by ruling (ii): no audit reading was attempted and no audit instrument was built.

What changed

ApprovalService.recall (packages/plugins/plugin-approvals/src/approval-service.ts): the #3424 override short-circuit is now conditioned on raw.status === 'pending' — spelled exactly as attachViewers computes viewer.can_override — so on returned an override actor is judged as any other non-submitter and gets the existing refusal (message prefix FORBIDDEN: + the operation catalog's approval_recall_not_submitter sentence; over REST, handleApprovalError maps that prefix to 403 + code FORBIDDEN). No new error code, no new envelope shape, no new export. The comment block above the gate (the old #3424 / #11993 text, whose sentence "the GATE is untouched" is no longer true) is rewritten to state the pending-only scope and this card; the recall doc block gains the same statement. The developer half of the refusal (the logger.warn line, level unchanged) now also names the status it refused on — its text carries no tracker id (check:doc-authoring).

• Submitter's own recall on pending and on returned (ADR-0044 revise window): untouched.
• Override actor's recall on pending (the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 stuck-record rescue, lock release included): untouched.
• The isOverrideActor doc block ("may always act on a PENDING request … or recall it") is now true without an edit; attachViewers and sys-approval-request.object.ts are not touched.

Design note — system context.isOverrideActor's first arm is context.isSystem, so the same expression also scopes a system caller's override to pending. A machine caller keeps a path on returned by naming the submitter as actorId (resolveActor returns a system caller's explicit actor), which is the ADR-0044 semantics. No in-repo caller invokes recall under a system context (packages/rest/src/rest-server.ts is the only call site, with the request's own context); the #13568 record-delete path cancels, it does not recall. Flagged in the report's open questions as a note, not a blocker — spelling the gate as the viewer flag is what the ruling asked for.

Premise verification (on origin/mainfed4fa409, before any edit)

• P1 holds — recall admitted pending and returned, and the gate if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && …) passed an override actor regardless of raw.status (:2904).
• P2 holds — attachViewers computed can_override: row.status === 'pending' && this.isOverrideActor(...) (:5195); the isOverrideActor doc block said PENDING (:938).
• P3 holds — approval_recall's visible (PR fix(plugin-approvals): show approval_recall for the #3424 admin override (#12716) #12791) ORs record.viewer.can_override, pending-only through the flag; no UI path offered override-recall on returned.
• P4 holds — no packages/spec change needed.
• P5 holds — no pin asserted an override actor can recall a returned request. Every existing admin-recall pin (approval-service.test.ts, admin-exemption-retired.test.ts, recall-refusal-user-copy.test.ts) opens a pending request; approval-revise.test.ts:357 already asserted the non-submitter refusal on returned for a non-admin. Nothing to reverse or register.

Hypotheses

• H1 holds — one condition change at the gate; the override caller on returned falls into the existing refusal branch with its existing catalog sentence, developer message and wire prefix.
• H2 partially refuted — the service branch throws a plain Error whose message starts with FORBIDDEN:; the ADR-0112 envelope (code: 'FORBIDDEN', HTTP 403) is minted at the REST seam by handleApprovalError (rest-server.ts:11477, regex ^FORBIDDEN), the same way every approvals refusal reaches the wire. The pins assert the prefix the mapping keys on (the service-seam half of the contract) and the catalog sentence; a REST-level live-emission pin for that row is outside this card's file surface and is recorded as an out-of-scope finding (see below). No code minted, nothing under packages/spec touched.
• H3 holds — returned → unlocked and the submitter's revise-window recall pins in approval-revise.test.ts stay green (24/24 file, 662/662 package).
• H4 holds — approve / reject / reassign are pending-only at their endpoints (decideNode, loadPendingRow); all four override levers are now pending-only and the isOverrideActor doc block is true without edits.

Pins (packages/plugins/plugin-approvals/src/approval-revise.test.ts, new describe block driving the REAL automation engine and the REAL record-lock hook)

1. The narrowing — platform admin AND tenant admin (ADR-0095 posture) on a genuinely returned row: viewer.can_override is false, recall rejects with an Error whose message matches ^FORBIDDEN: and equals FORBIDDEN: + BUILTIN_OPERATION_MESSAGES.en.approval_recall_not_submitter; afterwards the status is still returned, no recall action row exists, the record is still unlocked (the refusal touched no lock), the run status is unchanged and not cancelled, and the submitter can still resubmit (round 2 opens).
2. Reverse check — the same platform admin on the same request while pending: can_override is true, the record is locked, recall lands (recalled, resumed: true, recall action row, lock released).
3. Reverse check, tenant admin — admitted on pending too (the narrowing is about status, not posture).
4. Submitter's ADR-0044 recall on returned — lands, resumed: false, run cancelled.
5. Control — a non-submitter without the override on returned is refused exactly as before, and the override actor's refusal is byte-identical to it (no new refusal shape).

Changeset

.changeset/approval-override-recall-pending-only.md — @objectstack/plugin-approvals: patch. Level reason: no exported symbol is added, removed or changed (measured: git diff -U0 fed4fa409...HEAD | grep export matches only the export class ApprovalService hunk-context lines). The body states the narrowing as an explicit behaviour change in plain words (override-recall of a returned request is now refused; only pending requests are override-recallable; the submitter's revise-window recall is unchanged; why), per the ruling's condition. No major / breaking declaration, so no ADR-0087 marker is owed (check:adr-0087-registration green).

Clause-② declaration (from the ACTUAL diff)

Yes — accept-set narrowing on a live endpoint (POST /api/v1/approvals/requests/:id/recall: an override actor on a returned request was admitted, is now refused with 403 FORBIDDEN). Export surface: unchanged (git diff -U0 fed4fa409...HEAD | grep export → hunk-context lines only). needs:contract-review hangs on this PR and on #12775.

Ablation (on the committed tree, HEAD 971c8cabf)

Mutation: const overrideAdmits = raw.status === 'pending' → const overrideAdmits = true /* ABLATION-12775: status-blind */ (line-neutral). On disk: injected=1 removed_needle_remaining=0. Run: Tests 2 failed | 22 passed (24) — pins 1 (platform admin: expected null to be an instance of Error) and 5 (Cannot read properties of null (reading 'message') on the admin refusal) red, pins 2–4 green — direction: red, as predicted. Restore: git checkout HEAD -- ABSOLUTE_PATH inside a trap … EXIT INT TERM; proven by git hash-object equal to the HEAD blob (fed51d81…), git diff HEAD empty, marker count 0. No dist/ is involved (the suite imports ./approval-service.js from source), so ablation-dist-preflight does not apply.

Verification on the final head 9da369ffe (after merging origin/main310dd01a0; merge-tree clean against 7286dd58e)

All exits captured before any pipe; verdict lines quoted from the tools.

• pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 → Test Files 36 passed (36) / Tests 662 passed (662)
• pnpm --filter @objectstack/plugin-approvals typecheck → check:test-typecheck: OK — @objectstack/plugin-approvals's test layer compiles … 8 file(s) / 324 error(s) / 27 pinned signature(s) (test layer unchanged at 324; tsc --noEmit covers src/** minus tests, the test layer is covered by tsconfig.test.json via check:test-typecheck)
• pnpm check:system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.
• pnpm check:doc-authoring → sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s) … no growth, no burn-down unrecorded.
• pnpm check:engine-double-contract → OK — 753 pinned, 134 in the DEBT ledger, 3 exempt.
• pnpm check:objectql-double-limit → baseline key set verified against 310dd01: no files added.
• pnpm check:nul-bytes → OK (scanned 7949 text file(s) … no raw ASCII control bytes).

Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, from the merge base; 61 commands) run in five lock-serialised batches on 971c8cabf/9f08922f6 (the doc-authoring fix landed as 9f08922f6; the merge and census regeneration after it touched no gate input other than the census page, which is re-verified above):

• Green (55): adr-0087-registration, changeset-no-major, ci-filter-parity, comment-mask-adoption, cross-package-test-inputs (both spellings), doc-frontmatter, doc-route-spelling, docs-section-name, empty-changeset, keyed-text-bounds, plugin-teardown-shape, section-landing-index, shard-attestation, system-context-census, tenant-audit-census, undeclared-dep-imports, docs-audit affected-docs + drift-comment, pm half-states (both spellings), release-rehearsal-clone self-test, lint doc-formula-expressions + doc-security-posture, spec docs / empty-state / liveness / skill-examples (after building the @objectstack/client-react closure — first run was PREREQUISITE NOT MET) / strictness-ledger / variant-docs / yaml-examples, changeset-gate-self-tests, corpus-claim-drift, doc-anchors, doc-authoring (red on the first run: a tracker id in the new log string — fixed in 9f08922f6), docs-audit-scope, docs-redirects, docs-single-h1, engine-double-contract, i18n-stale-fill, logger-receiver-detach, merge-driver, objectql-double-limit, objectui-changeset, page-declaration-shape, published-files, published-readme-links, query-options-erasure, react-page-adapter-contract, role-word, skill-identifier-liveness, slot-lookup, test-source-alias, type-check-coverage, type-source-resolution, vendor-version-stamps, where-matcher, nul-bytes.
• NOT MEASURED (4, prerequisite unmet in this worktree, none reads this diff's files as inputs; CI runs them with the prerequisite): check-test-completeness (exit 3: PREREQUISITE NOT MET — this gate grades a saved turbo run test log), check:dual-build-cjs-loads (exit 3: PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/), check:i18n (exit 1: PREREQUISITE NOT MET — the workspace CLI is not built), check:type-check-debt (exit 3: PREREQUISITE NOT MET — --re-measure cannot run: 20 workspace dependenc(ies) … have no built type entry point).

Adjacent mechanical fix: content/docs/permissions/system-context.mdx row 42 re-anchored by the gate's own --fix (pnpm gen:system-context-census) — first for this branch's +20-line hunk (971c8cabf), then again on the merged tree after origin/main brought #14542's hunk in the same file (9da369ffe, the os-regen deferral discharged as its own commit per scripts/pm/os-regen-merge.sh). No row content changed.

Out of scope

• packages/rest's handleApprovalErrorFORBIDDEN → 403 row has no live-emission pin in rest-approvals-wire-codes.test.ts (that file pins THROTTLED, READ_BACK_FAILED and the template-generated 500s). Filed as a finding, see the report comment on [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775. approvals: ten service endpoints return request: fresh! — a non-null assertion that is false whenever the read-back is org-filtered out, shipping { "request": null } with HTTP 200 #12769 and approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716 remain untouched by this PR.
• Open PR docs(spec,approvals): ApprovalEscalation.timeoutHours names its clock — calendar (wall-clock) hours #14542's region (slaDueAt JSDoc, :600-630) was not touched; it has since landed on main and merged cleanly here.

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via ApprovalService (symbol, a top-level class))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b97d874264945f7494d12240ee5eb67c744ac46 — the merge of head 9da369ffe1d114b4d1684977fe4ca579336365f7 into base 7286dd58e806ed321cbdfc23a1c455db8f80b1ad, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b97d874264945f7494d12240ee5eb67c744ac46 && git checkout 5b97d874264945f7494d12240ee5eb67c744ac46
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7286dd58e806ed321cbdfc23a1c455db8f80b1ad 9da369ffe1d114b4d1684977fe4ca579336365f7 && git checkout -B drift-repro 7286dd58e806ed321cbdfc23a1c455db8f80b1ad && git merge --no-ff 9da369ffe1d114b4d1684977fe4ca579336365f7
node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 9da369ffe

• Card: [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set narrowing: an override actor's recall of a returned request now answers 403 FORBIDDEN): in-seat isolated fable review, round 1 PASS at 9da369ffe (12775#issuecomment-5509840670; transcript verified 60/60 claude-fable-5-1; verdict adopted verbatim, zero blocking findings). Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS. Ruling of record for the change itself: (ii)/B via 12775#issuecomment-5504841854, the changeset declaring the narrowing explicitly per its condition.
• Carriers: needs:contract-review removed from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 and from this PR in the same stroke, both read back; node scripts/pm/check-clause2-carriers.mjs --pair 14571 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 4 files, all inside the fence — approval-service.ts (recall gate + comment + doc block + developer log text), approval-revise.test.ts (five pins), the patch changeset, and the census page content/docs/permissions/system-context.mdx (row 42 re-anchored by the gate's own regeneration, no row text changed). Export delta: none (git diff -U0 origin/main...HEAD | grep export → nothing). No packages/spec, no content/docs/releases/, attachViewers and the slaDueAt region byte-identical to main; log level unchanged (warn).
• CI on 9da369ffe: every check green — Test Core (1/6)success at 12:58:15Z (job 100250298692) and the aggregate Test Coresuccess; Lint & Repo Gatessuccess at 13:01:40Z (job 100250223401); TypeScript Type Check and the four Type Check · jobs, Build Core, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformance, Check Changeset (re-run after the label change, success 12:54:36Z), Governed Surface Queue Guard, Spec property liveness, the single-writer and same-issue guards all success.
• Action: draft → ready and auto-merge enabled at 13:02:57Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775, then files one grouped follow-up finding for the review's §5 notes 1–2 (the tenant-admin lock-release assertion; the packages/spec contract docstring at contracts/approval-service.ts:712, routed to the spec seat). rest: the approvals FORBIDDEN → 403 wire-code row (handleApprovalError) has no live-emission pin — every authorisation refusal rides it, and only the service-side prefix is pinned #14573 (the REST FORBIDDEN → 403 live-emission pin) stays with triage.

---

Generated by Claude Code

[os-sales]

Fixes#12775

Ruling of record (verbatim, untranslated)

Maintainer, 2026-09-02, via the director seat (12775#issuecomment-5504841854), replying to the decision batch whose item for this card recommended 「(ii),附条件:实施 PR 的 changeset 把这条收窄写成显式行为变更;回退 (i)」:

「14324 等我发版,其他同意」

Read as (ii): the audit reading is unobtainable and counts as zero; the 2026-08-29 ruling stands — B: re-scope the status-blind override short-circuit in recall to pending so the gate, the prose and the viewer flag agree at one point; A remains the fallback; the changeset declares the narrowing as an explicit behaviour change so one revert restores it; one pin on the narrowing (returned + override actor ⇒ refused) with the reverse check; #12716 (landed as PR #12791) is unaffected. The card's own facet block (the shape agreed on 2026-08-29):

「推荐:B,附硬前置条件 —— 落地前先从审计留痕读出「是否真有 override actor 在 returned 上撤回过」。读数为零才动手;非零则当场改判 A,⛔ 不许带着非零读数硬做。回退:A。」

The hard precondition is discharged by ruling (ii): no audit reading was attempted and no audit instrument was built.

What changed

ApprovalService.recall (packages/plugins/plugin-approvals/src/approval-service.ts): the #3424 override short-circuit is now conditioned on raw.status === 'pending' — spelled exactly as attachViewers computes viewer.can_override — so on returned an override actor is judged as any other non-submitter and gets the existing refusal (message prefix FORBIDDEN: + the operation catalog's approval_recall_not_submitter sentence; over REST, handleApprovalError maps that prefix to 403 + code FORBIDDEN). No new error code, no new envelope shape, no new export. The comment block above the gate (the old #3424 / #11993 text, whose sentence "the GATE is untouched" is no longer true) is rewritten to state the pending-only scope and this card; the recall doc block gains the same statement. The developer half of the refusal (the logger.warn line, level unchanged) now also names the status it refused on — its text carries no tracker id (check:doc-authoring).

• Submitter's own recall on pending and on returned (ADR-0044 revise window): untouched.
• Override actor's recall on pending (the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 stuck-record rescue, lock release included): untouched.
• The isOverrideActor doc block ("may always act on a PENDING request … or recall it") is now true without an edit; attachViewers and sys-approval-request.object.ts are not touched.

Design note — system context.isOverrideActor's first arm is context.isSystem, so the same expression also scopes a system caller's override to pending. A machine caller keeps a path on returned by naming the submitter as actorId (resolveActor returns a system caller's explicit actor), which is the ADR-0044 semantics. No in-repo caller invokes recall under a system context (packages/rest/src/rest-server.ts is the only call site, with the request's own context); the #13568 record-delete path cancels, it does not recall. Flagged in the report's open questions as a note, not a blocker — spelling the gate as the viewer flag is what the ruling asked for.

Premise verification (on origin/mainfed4fa409, before any edit)

• P1 holds — recall admitted pending and returned, and the gate if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && …) passed an override actor regardless of raw.status (:2904).
• P2 holds — attachViewers computed can_override: row.status === 'pending' && this.isOverrideActor(...) (:5195); the isOverrideActor doc block said PENDING (:938).
• P3 holds — approval_recall's visible (PR fix(plugin-approvals): show approval_recall for the #3424 admin override (#12716) #12791) ORs record.viewer.can_override, pending-only through the flag; no UI path offered override-recall on returned.
• P4 holds — no packages/spec change needed.
• P5 holds — no pin asserted an override actor can recall a returned request. Every existing admin-recall pin (approval-service.test.ts, admin-exemption-retired.test.ts, recall-refusal-user-copy.test.ts) opens a pending request; approval-revise.test.ts:357 already asserted the non-submitter refusal on returned for a non-admin. Nothing to reverse or register.

Hypotheses

• H1 holds — one condition change at the gate; the override caller on returned falls into the existing refusal branch with its existing catalog sentence, developer message and wire prefix.
• H2 partially refuted — the service branch throws a plain Error whose message starts with FORBIDDEN:; the ADR-0112 envelope (code: 'FORBIDDEN', HTTP 403) is minted at the REST seam by handleApprovalError (rest-server.ts:11477, regex ^FORBIDDEN), the same way every approvals refusal reaches the wire. The pins assert the prefix the mapping keys on (the service-seam half of the contract) and the catalog sentence; a REST-level live-emission pin for that row is outside this card's file surface and is recorded as an out-of-scope finding (see below). No code minted, nothing under packages/spec touched.
• H3 holds — returned → unlocked and the submitter's revise-window recall pins in approval-revise.test.ts stay green (24/24 file, 662/662 package).
• H4 holds — approve / reject / reassign are pending-only at their endpoints (decideNode, loadPendingRow); all four override levers are now pending-only and the isOverrideActor doc block is true without edits.

Pins (packages/plugins/plugin-approvals/src/approval-revise.test.ts, new describe block driving the REAL automation engine and the REAL record-lock hook)

1. The narrowing — platform admin AND tenant admin (ADR-0095 posture) on a genuinely returned row: viewer.can_override is false, recall rejects with an Error whose message matches ^FORBIDDEN: and equals FORBIDDEN: + BUILTIN_OPERATION_MESSAGES.en.approval_recall_not_submitter; afterwards the status is still returned, no recall action row exists, the record is still unlocked (the refusal touched no lock), the run status is unchanged and not cancelled, and the submitter can still resubmit (round 2 opens).
2. Reverse check — the same platform admin on the same request while pending: can_override is true, the record is locked, recall lands (recalled, resumed: true, recall action row, lock released).
3. Reverse check, tenant admin — admitted on pending too (the narrowing is about status, not posture).
4. Submitter's ADR-0044 recall on returned — lands, resumed: false, run cancelled.
5. Control — a non-submitter without the override on returned is refused exactly as before, and the override actor's refusal is byte-identical to it (no new refusal shape).

Changeset

.changeset/approval-override-recall-pending-only.md — @objectstack/plugin-approvals: patch. Level reason: no exported symbol is added, removed or changed (measured: git diff -U0 fed4fa409...HEAD | grep export matches only the export class ApprovalService hunk-context lines). The body states the narrowing as an explicit behaviour change in plain words (override-recall of a returned request is now refused; only pending requests are override-recallable; the submitter's revise-window recall is unchanged; why), per the ruling's condition. No major / breaking declaration, so no ADR-0087 marker is owed (check:adr-0087-registration green).

Clause-② declaration (from the ACTUAL diff)

Yes — accept-set narrowing on a live endpoint (POST /api/v1/approvals/requests/:id/recall: an override actor on a returned request was admitted, is now refused with 403 FORBIDDEN). Export surface: unchanged (git diff -U0 fed4fa409...HEAD | grep export → hunk-context lines only). needs:contract-review hangs on this PR and on #12775.

Ablation (on the committed tree, HEAD 971c8cabf)

Mutation: const overrideAdmits = raw.status === 'pending' → const overrideAdmits = true /* ABLATION-12775: status-blind */ (line-neutral). On disk: injected=1 removed_needle_remaining=0. Run: Tests 2 failed | 22 passed (24) — pins 1 (platform admin: expected null to be an instance of Error) and 5 (Cannot read properties of null (reading 'message') on the admin refusal) red, pins 2–4 green — direction: red, as predicted. Restore: git checkout HEAD -- ABSOLUTE_PATH inside a trap … EXIT INT TERM; proven by git hash-object equal to the HEAD blob (fed51d81…), git diff HEAD empty, marker count 0. No dist/ is involved (the suite imports ./approval-service.js from source), so ablation-dist-preflight does not apply.

Verification on the final head 9da369ffe (after merging origin/main310dd01a0; merge-tree clean against 7286dd58e)

All exits captured before any pipe; verdict lines quoted from the tools.

• pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 → Test Files 36 passed (36) / Tests 662 passed (662)
• pnpm --filter @objectstack/plugin-approvals typecheck → check:test-typecheck: OK — @objectstack/plugin-approvals's test layer compiles … 8 file(s) / 324 error(s) / 27 pinned signature(s) (test layer unchanged at 324; tsc --noEmit covers src/** minus tests, the test layer is covered by tsconfig.test.json via check:test-typecheck)
• pnpm check:system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.
• pnpm check:doc-authoring → sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s) … no growth, no burn-down unrecorded.
• pnpm check:engine-double-contract → OK — 753 pinned, 134 in the DEBT ledger, 3 exempt.
• pnpm check:objectql-double-limit → baseline key set verified against 310dd01: no files added.
• pnpm check:nul-bytes → OK (scanned 7949 text file(s) … no raw ASCII control bytes).

Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, from the merge base; 61 commands) run in five lock-serialised batches on 971c8cabf/9f08922f6 (the doc-authoring fix landed as 9f08922f6; the merge and census regeneration after it touched no gate input other than the census page, which is re-verified above):

• Green (55): adr-0087-registration, changeset-no-major, ci-filter-parity, comment-mask-adoption, cross-package-test-inputs (both spellings), doc-frontmatter, doc-route-spelling, docs-section-name, empty-changeset, keyed-text-bounds, plugin-teardown-shape, section-landing-index, shard-attestation, system-context-census, tenant-audit-census, undeclared-dep-imports, docs-audit affected-docs + drift-comment, pm half-states (both spellings), release-rehearsal-clone self-test, lint doc-formula-expressions + doc-security-posture, spec docs / empty-state / liveness / skill-examples (after building the @objectstack/client-react closure — first run was PREREQUISITE NOT MET) / strictness-ledger / variant-docs / yaml-examples, changeset-gate-self-tests, corpus-claim-drift, doc-anchors, doc-authoring (red on the first run: a tracker id in the new log string — fixed in 9f08922f6), docs-audit-scope, docs-redirects, docs-single-h1, engine-double-contract, i18n-stale-fill, logger-receiver-detach, merge-driver, objectql-double-limit, objectui-changeset, page-declaration-shape, published-files, published-readme-links, query-options-erasure, react-page-adapter-contract, role-word, skill-identifier-liveness, slot-lookup, test-source-alias, type-check-coverage, type-source-resolution, vendor-version-stamps, where-matcher, nul-bytes.
• NOT MEASURED (4, prerequisite unmet in this worktree, none reads this diff's files as inputs; CI runs them with the prerequisite): check-test-completeness (exit 3: PREREQUISITE NOT MET — this gate grades a saved turbo run test log), check:dual-build-cjs-loads (exit 3: PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/), check:i18n (exit 1: PREREQUISITE NOT MET — the workspace CLI is not built), check:type-check-debt (exit 3: PREREQUISITE NOT MET — --re-measure cannot run: 20 workspace dependenc(ies) … have no built type entry point).

Adjacent mechanical fix: content/docs/permissions/system-context.mdx row 42 re-anchored by the gate's own --fix (pnpm gen:system-context-census) — first for this branch's +20-line hunk (971c8cabf), then again on the merged tree after origin/main brought #14542's hunk in the same file (9da369ffe, the os-regen deferral discharged as its own commit per scripts/pm/os-regen-merge.sh). No row content changed.

Out of scope

• packages/rest's handleApprovalErrorFORBIDDEN → 403 row has no live-emission pin in rest-approvals-wire-codes.test.ts (that file pins THROTTLED, READ_BACK_FAILED and the template-generated 500s). Filed as a finding, see the report comment on [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775. approvals: ten service endpoints return request: fresh! — a non-null assertion that is false whenever the read-back is org-filtered out, shipping { "request": null } with HTTP 200 #12769 and approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716 remain untouched by this PR.
• Open PR docs(spec,approvals): ApprovalEscalation.timeoutHours names its clock — calendar (wall-clock) hours #14542's region (slaDueAt JSDoc, :600-630) was not touched; it has since landed on main and merged cleanly here.

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via ApprovalService (symbol, a top-level class))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b97d874264945f7494d12240ee5eb67c744ac46 — the merge of head 9da369ffe1d114b4d1684977fe4ca579336365f7 into base 7286dd58e806ed321cbdfc23a1c455db8f80b1ad, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b97d874264945f7494d12240ee5eb67c744ac46 && git checkout 5b97d874264945f7494d12240ee5eb67c744ac46
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7286dd58e806ed321cbdfc23a1c455db8f80b1ad 9da369ffe1d114b4d1684977fe4ca579336365f7 && git checkout -B drift-repro 7286dd58e806ed321cbdfc23a1c455db8f80b1ad && git merge --no-ff 9da369ffe1d114b4d1684977fe4ca579336365f7
node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 9da369ffe

• Card: [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set narrowing: an override actor's recall of a returned request now answers 403 FORBIDDEN): in-seat isolated fable review, round 1 PASS at 9da369ffe (12775#issuecomment-5509840670; transcript verified 60/60 claude-fable-5-1; verdict adopted verbatim, zero blocking findings). Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS. Ruling of record for the change itself: (ii)/B via 12775#issuecomment-5504841854, the changeset declaring the narrowing explicitly per its condition.
• Carriers: needs:contract-review removed from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 and from this PR in the same stroke, both read back; node scripts/pm/check-clause2-carriers.mjs --pair 14571 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 4 files, all inside the fence — approval-service.ts (recall gate + comment + doc block + developer log text), approval-revise.test.ts (five pins), the patch changeset, and the census page content/docs/permissions/system-context.mdx (row 42 re-anchored by the gate's own regeneration, no row text changed). Export delta: none (git diff -U0 origin/main...HEAD | grep export → nothing). No packages/spec, no content/docs/releases/, attachViewers and the slaDueAt region byte-identical to main; log level unchanged (warn).
• CI on 9da369ffe: every check green — Test Core (1/6)success at 12:58:15Z (job 100250298692) and the aggregate Test Coresuccess; Lint & Repo Gatessuccess at 13:01:40Z (job 100250223401); TypeScript Type Check and the four Type Check · jobs, Build Core, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformance, Check Changeset (re-run after the label change, success 12:54:36Z), Governed Surface Queue Guard, Spec property liveness, the single-writer and same-issue guards all success.
• Action: draft → ready and auto-merge enabled at 13:02:57Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775, then files one grouped follow-up finding for the review's §5 notes 1–2 (the tenant-admin lock-release assertion; the packages/spec contract docstring at contracts/approval-service.ts:712, routed to the spec seat). rest: the approvals FORBIDDEN → 403 wire-code row (handleApprovalError) has no live-emission pin — every authorisation refusal rides it, and only the service-side prefix is pinned #14573 (the REST FORBIDDEN → 403 live-emission pin) stays with triage.

---

Generated by Claude Code

[os-sales]

Fixes#12775

Ruling of record (verbatim, untranslated)

Maintainer, 2026-09-02, via the director seat (12775#issuecomment-5504841854), replying to the decision batch whose item for this card recommended 「(ii),附条件:实施 PR 的 changeset 把这条收窄写成显式行为变更;回退 (i)」:

「14324 等我发版,其他同意」

Read as (ii): the audit reading is unobtainable and counts as zero; the 2026-08-29 ruling stands — B: re-scope the status-blind override short-circuit in recall to pending so the gate, the prose and the viewer flag agree at one point; A remains the fallback; the changeset declares the narrowing as an explicit behaviour change so one revert restores it; one pin on the narrowing (returned + override actor ⇒ refused) with the reverse check; #12716 (landed as PR #12791) is unaffected. The card's own facet block (the shape agreed on 2026-08-29):

「推荐:B,附硬前置条件 —— 落地前先从审计留痕读出「是否真有 override actor 在 returned 上撤回过」。读数为零才动手;非零则当场改判 A,⛔ 不许带着非零读数硬做。回退:A。」

The hard precondition is discharged by ruling (ii): no audit reading was attempted and no audit instrument was built.

What changed

ApprovalService.recall (packages/plugins/plugin-approvals/src/approval-service.ts): the #3424 override short-circuit is now conditioned on raw.status === 'pending' — spelled exactly as attachViewers computes viewer.can_override — so on returned an override actor is judged as any other non-submitter and gets the existing refusal (message prefix FORBIDDEN: + the operation catalog's approval_recall_not_submitter sentence; over REST, handleApprovalError maps that prefix to 403 + code FORBIDDEN). No new error code, no new envelope shape, no new export. The comment block above the gate (the old #3424 / #11993 text, whose sentence "the GATE is untouched" is no longer true) is rewritten to state the pending-only scope and this card; the recall doc block gains the same statement. The developer half of the refusal (the logger.warn line, level unchanged) now also names the status it refused on — its text carries no tracker id (check:doc-authoring).

• Submitter's own recall on pending and on returned (ADR-0044 revise window): untouched.
• Override actor's recall on pending (the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 stuck-record rescue, lock release included): untouched.
• The isOverrideActor doc block ("may always act on a PENDING request … or recall it") is now true without an edit; attachViewers and sys-approval-request.object.ts are not touched.

Design note — system context.isOverrideActor's first arm is context.isSystem, so the same expression also scopes a system caller's override to pending. A machine caller keeps a path on returned by naming the submitter as actorId (resolveActor returns a system caller's explicit actor), which is the ADR-0044 semantics. No in-repo caller invokes recall under a system context (packages/rest/src/rest-server.ts is the only call site, with the request's own context); the #13568 record-delete path cancels, it does not recall. Flagged in the report's open questions as a note, not a blocker — spelling the gate as the viewer flag is what the ruling asked for.

Premise verification (on origin/mainfed4fa409, before any edit)

• P1 holds — recall admitted pending and returned, and the gate if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && …) passed an override actor regardless of raw.status (:2904).
• P2 holds — attachViewers computed can_override: row.status === 'pending' && this.isOverrideActor(...) (:5195); the isOverrideActor doc block said PENDING (:938).
• P3 holds — approval_recall's visible (PR fix(plugin-approvals): show approval_recall for the #3424 admin override (#12716) #12791) ORs record.viewer.can_override, pending-only through the flag; no UI path offered override-recall on returned.
• P4 holds — no packages/spec change needed.
• P5 holds — no pin asserted an override actor can recall a returned request. Every existing admin-recall pin (approval-service.test.ts, admin-exemption-retired.test.ts, recall-refusal-user-copy.test.ts) opens a pending request; approval-revise.test.ts:357 already asserted the non-submitter refusal on returned for a non-admin. Nothing to reverse or register.

Hypotheses

• H1 holds — one condition change at the gate; the override caller on returned falls into the existing refusal branch with its existing catalog sentence, developer message and wire prefix.
• H2 partially refuted — the service branch throws a plain Error whose message starts with FORBIDDEN:; the ADR-0112 envelope (code: 'FORBIDDEN', HTTP 403) is minted at the REST seam by handleApprovalError (rest-server.ts:11477, regex ^FORBIDDEN), the same way every approvals refusal reaches the wire. The pins assert the prefix the mapping keys on (the service-seam half of the contract) and the catalog sentence; a REST-level live-emission pin for that row is outside this card's file surface and is recorded as an out-of-scope finding (see below). No code minted, nothing under packages/spec touched.
• H3 holds — returned → unlocked and the submitter's revise-window recall pins in approval-revise.test.ts stay green (24/24 file, 662/662 package).
• H4 holds — approve / reject / reassign are pending-only at their endpoints (decideNode, loadPendingRow); all four override levers are now pending-only and the isOverrideActor doc block is true without edits.

Pins (packages/plugins/plugin-approvals/src/approval-revise.test.ts, new describe block driving the REAL automation engine and the REAL record-lock hook)

1. The narrowing — platform admin AND tenant admin (ADR-0095 posture) on a genuinely returned row: viewer.can_override is false, recall rejects with an Error whose message matches ^FORBIDDEN: and equals FORBIDDEN: + BUILTIN_OPERATION_MESSAGES.en.approval_recall_not_submitter; afterwards the status is still returned, no recall action row exists, the record is still unlocked (the refusal touched no lock), the run status is unchanged and not cancelled, and the submitter can still resubmit (round 2 opens).
2. Reverse check — the same platform admin on the same request while pending: can_override is true, the record is locked, recall lands (recalled, resumed: true, recall action row, lock released).
3. Reverse check, tenant admin — admitted on pending too (the narrowing is about status, not posture).
4. Submitter's ADR-0044 recall on returned — lands, resumed: false, run cancelled.
5. Control — a non-submitter without the override on returned is refused exactly as before, and the override actor's refusal is byte-identical to it (no new refusal shape).

Changeset

.changeset/approval-override-recall-pending-only.md — @objectstack/plugin-approvals: patch. Level reason: no exported symbol is added, removed or changed (measured: git diff -U0 fed4fa409...HEAD | grep export matches only the export class ApprovalService hunk-context lines). The body states the narrowing as an explicit behaviour change in plain words (override-recall of a returned request is now refused; only pending requests are override-recallable; the submitter's revise-window recall is unchanged; why), per the ruling's condition. No major / breaking declaration, so no ADR-0087 marker is owed (check:adr-0087-registration green).

Clause-② declaration (from the ACTUAL diff)

Yes — accept-set narrowing on a live endpoint (POST /api/v1/approvals/requests/:id/recall: an override actor on a returned request was admitted, is now refused with 403 FORBIDDEN). Export surface: unchanged (git diff -U0 fed4fa409...HEAD | grep export → hunk-context lines only). needs:contract-review hangs on this PR and on #12775.

Ablation (on the committed tree, HEAD 971c8cabf)

Mutation: const overrideAdmits = raw.status === 'pending' → const overrideAdmits = true /* ABLATION-12775: status-blind */ (line-neutral). On disk: injected=1 removed_needle_remaining=0. Run: Tests 2 failed | 22 passed (24) — pins 1 (platform admin: expected null to be an instance of Error) and 5 (Cannot read properties of null (reading 'message') on the admin refusal) red, pins 2–4 green — direction: red, as predicted. Restore: git checkout HEAD -- ABSOLUTE_PATH inside a trap … EXIT INT TERM; proven by git hash-object equal to the HEAD blob (fed51d81…), git diff HEAD empty, marker count 0. No dist/ is involved (the suite imports ./approval-service.js from source), so ablation-dist-preflight does not apply.

Verification on the final head 9da369ffe (after merging origin/main310dd01a0; merge-tree clean against 7286dd58e)

All exits captured before any pipe; verdict lines quoted from the tools.

• pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 → Test Files 36 passed (36) / Tests 662 passed (662)
• pnpm --filter @objectstack/plugin-approvals typecheck → check:test-typecheck: OK — @objectstack/plugin-approvals's test layer compiles … 8 file(s) / 324 error(s) / 27 pinned signature(s) (test layer unchanged at 324; tsc --noEmit covers src/** minus tests, the test layer is covered by tsconfig.test.json via check:test-typecheck)
• pnpm check:system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.
• pnpm check:doc-authoring → sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s) … no growth, no burn-down unrecorded.
• pnpm check:engine-double-contract → OK — 753 pinned, 134 in the DEBT ledger, 3 exempt.
• pnpm check:objectql-double-limit → baseline key set verified against 310dd01: no files added.
• pnpm check:nul-bytes → OK (scanned 7949 text file(s) … no raw ASCII control bytes).

Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, from the merge base; 61 commands) run in five lock-serialised batches on 971c8cabf/9f08922f6 (the doc-authoring fix landed as 9f08922f6; the merge and census regeneration after it touched no gate input other than the census page, which is re-verified above):

• Green (55): adr-0087-registration, changeset-no-major, ci-filter-parity, comment-mask-adoption, cross-package-test-inputs (both spellings), doc-frontmatter, doc-route-spelling, docs-section-name, empty-changeset, keyed-text-bounds, plugin-teardown-shape, section-landing-index, shard-attestation, system-context-census, tenant-audit-census, undeclared-dep-imports, docs-audit affected-docs + drift-comment, pm half-states (both spellings), release-rehearsal-clone self-test, lint doc-formula-expressions + doc-security-posture, spec docs / empty-state / liveness / skill-examples (after building the @objectstack/client-react closure — first run was PREREQUISITE NOT MET) / strictness-ledger / variant-docs / yaml-examples, changeset-gate-self-tests, corpus-claim-drift, doc-anchors, doc-authoring (red on the first run: a tracker id in the new log string — fixed in 9f08922f6), docs-audit-scope, docs-redirects, docs-single-h1, engine-double-contract, i18n-stale-fill, logger-receiver-detach, merge-driver, objectql-double-limit, objectui-changeset, page-declaration-shape, published-files, published-readme-links, query-options-erasure, react-page-adapter-contract, role-word, skill-identifier-liveness, slot-lookup, test-source-alias, type-check-coverage, type-source-resolution, vendor-version-stamps, where-matcher, nul-bytes.
• NOT MEASURED (4, prerequisite unmet in this worktree, none reads this diff's files as inputs; CI runs them with the prerequisite): check-test-completeness (exit 3: PREREQUISITE NOT MET — this gate grades a saved turbo run test log), check:dual-build-cjs-loads (exit 3: PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/), check:i18n (exit 1: PREREQUISITE NOT MET — the workspace CLI is not built), check:type-check-debt (exit 3: PREREQUISITE NOT MET — --re-measure cannot run: 20 workspace dependenc(ies) … have no built type entry point).

Adjacent mechanical fix: content/docs/permissions/system-context.mdx row 42 re-anchored by the gate's own --fix (pnpm gen:system-context-census) — first for this branch's +20-line hunk (971c8cabf), then again on the merged tree after origin/main brought #14542's hunk in the same file (9da369ffe, the os-regen deferral discharged as its own commit per scripts/pm/os-regen-merge.sh). No row content changed.

Out of scope

• packages/rest's handleApprovalErrorFORBIDDEN → 403 row has no live-emission pin in rest-approvals-wire-codes.test.ts (that file pins THROTTLED, READ_BACK_FAILED and the template-generated 500s). Filed as a finding, see the report comment on [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775. approvals: ten service endpoints return request: fresh! — a non-null assertion that is false whenever the read-back is org-filtered out, shipping { "request": null } with HTTP 200 #12769 and approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716 remain untouched by this PR.
• Open PR docs(spec,approvals): ApprovalEscalation.timeoutHours names its clock — calendar (wall-clock) hours #14542's region (slaDueAt JSDoc, :600-630) was not touched; it has since landed on main and merged cleanly here.

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via ApprovalService (symbol, a top-level class))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b97d874264945f7494d12240ee5eb67c744ac46 — the merge of head 9da369ffe1d114b4d1684977fe4ca579336365f7 into base 7286dd58e806ed321cbdfc23a1c455db8f80b1ad, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b97d874264945f7494d12240ee5eb67c744ac46 && git checkout 5b97d874264945f7494d12240ee5eb67c744ac46
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7286dd58e806ed321cbdfc23a1c455db8f80b1ad 9da369ffe1d114b4d1684977fe4ca579336365f7 && git checkout -B drift-repro 7286dd58e806ed321cbdfc23a1c455db8f80b1ad && git merge --no-ff 9da369ffe1d114b4d1684977fe4ca579336365f7
node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 9da369ffe

• Card: [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set narrowing: an override actor's recall of a returned request now answers 403 FORBIDDEN): in-seat isolated fable review, round 1 PASS at 9da369ffe (12775#issuecomment-5509840670; transcript verified 60/60 claude-fable-5-1; verdict adopted verbatim, zero blocking findings). Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS. Ruling of record for the change itself: (ii)/B via 12775#issuecomment-5504841854, the changeset declaring the narrowing explicitly per its condition.
• Carriers: needs:contract-review removed from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 and from this PR in the same stroke, both read back; node scripts/pm/check-clause2-carriers.mjs --pair 14571 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 4 files, all inside the fence — approval-service.ts (recall gate + comment + doc block + developer log text), approval-revise.test.ts (five pins), the patch changeset, and the census page content/docs/permissions/system-context.mdx (row 42 re-anchored by the gate's own regeneration, no row text changed). Export delta: none (git diff -U0 origin/main...HEAD | grep export → nothing). No packages/spec, no content/docs/releases/, attachViewers and the slaDueAt region byte-identical to main; log level unchanged (warn).
• CI on 9da369ffe: every check green — Test Core (1/6)success at 12:58:15Z (job 100250298692) and the aggregate Test Coresuccess; Lint & Repo Gatessuccess at 13:01:40Z (job 100250223401); TypeScript Type Check and the four Type Check · jobs, Build Core, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformance, Check Changeset (re-run after the label change, success 12:54:36Z), Governed Surface Queue Guard, Spec property liveness, the single-writer and same-issue guards all success.
• Action: draft → ready and auto-merge enabled at 13:02:57Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775, then files one grouped follow-up finding for the review's §5 notes 1–2 (the tenant-admin lock-release assertion; the packages/spec contract docstring at contracts/approval-service.ts:712, routed to the spec seat). rest: the approvals FORBIDDEN → 403 wire-code row (handleApprovalError) has no live-emission pin — every authorisation refusal rides it, and only the service-side prefix is pinned #14573 (the REST FORBIDDEN → 403 live-emission pin) stays with triage.

---

Generated by Claude Code

[os-sales]

Fixes#12775

Ruling of record (verbatim, untranslated)

Maintainer, 2026-09-02, via the director seat (12775#issuecomment-5504841854), replying to the decision batch whose item for this card recommended 「(ii),附条件:实施 PR 的 changeset 把这条收窄写成显式行为变更;回退 (i)」:

「14324 等我发版,其他同意」

Read as (ii): the audit reading is unobtainable and counts as zero; the 2026-08-29 ruling stands — B: re-scope the status-blind override short-circuit in recall to pending so the gate, the prose and the viewer flag agree at one point; A remains the fallback; the changeset declares the narrowing as an explicit behaviour change so one revert restores it; one pin on the narrowing (returned + override actor ⇒ refused) with the reverse check; #12716 (landed as PR #12791) is unaffected. The card's own facet block (the shape agreed on 2026-08-29):

「推荐:B,附硬前置条件 —— 落地前先从审计留痕读出「是否真有 override actor 在 returned 上撤回过」。读数为零才动手;非零则当场改判 A,⛔ 不许带着非零读数硬做。回退:A。」

The hard precondition is discharged by ruling (ii): no audit reading was attempted and no audit instrument was built.

What changed

ApprovalService.recall (packages/plugins/plugin-approvals/src/approval-service.ts): the #3424 override short-circuit is now conditioned on raw.status === 'pending' — spelled exactly as attachViewers computes viewer.can_override — so on returned an override actor is judged as any other non-submitter and gets the existing refusal (message prefix FORBIDDEN: + the operation catalog's approval_recall_not_submitter sentence; over REST, handleApprovalError maps that prefix to 403 + code FORBIDDEN). No new error code, no new envelope shape, no new export. The comment block above the gate (the old #3424 / #11993 text, whose sentence "the GATE is untouched" is no longer true) is rewritten to state the pending-only scope and this card; the recall doc block gains the same statement. The developer half of the refusal (the logger.warn line, level unchanged) now also names the status it refused on — its text carries no tracker id (check:doc-authoring).

• Submitter's own recall on pending and on returned (ADR-0044 revise window): untouched.
• Override actor's recall on pending (the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 stuck-record rescue, lock release included): untouched.
• The isOverrideActor doc block ("may always act on a PENDING request … or recall it") is now true without an edit; attachViewers and sys-approval-request.object.ts are not touched.

Design note — system context.isOverrideActor's first arm is context.isSystem, so the same expression also scopes a system caller's override to pending. A machine caller keeps a path on returned by naming the submitter as actorId (resolveActor returns a system caller's explicit actor), which is the ADR-0044 semantics. No in-repo caller invokes recall under a system context (packages/rest/src/rest-server.ts is the only call site, with the request's own context); the #13568 record-delete path cancels, it does not recall. Flagged in the report's open questions as a note, not a blocker — spelling the gate as the viewer flag is what the ruling asked for.

Premise verification (on origin/mainfed4fa409, before any edit)

• P1 holds — recall admitted pending and returned, and the gate if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && …) passed an override actor regardless of raw.status (:2904).
• P2 holds — attachViewers computed can_override: row.status === 'pending' && this.isOverrideActor(...) (:5195); the isOverrideActor doc block said PENDING (:938).
• P3 holds — approval_recall's visible (PR fix(plugin-approvals): show approval_recall for the #3424 admin override (#12716) #12791) ORs record.viewer.can_override, pending-only through the flag; no UI path offered override-recall on returned.
• P4 holds — no packages/spec change needed.
• P5 holds — no pin asserted an override actor can recall a returned request. Every existing admin-recall pin (approval-service.test.ts, admin-exemption-retired.test.ts, recall-refusal-user-copy.test.ts) opens a pending request; approval-revise.test.ts:357 already asserted the non-submitter refusal on returned for a non-admin. Nothing to reverse or register.

Hypotheses

• H1 holds — one condition change at the gate; the override caller on returned falls into the existing refusal branch with its existing catalog sentence, developer message and wire prefix.
• H2 partially refuted — the service branch throws a plain Error whose message starts with FORBIDDEN:; the ADR-0112 envelope (code: 'FORBIDDEN', HTTP 403) is minted at the REST seam by handleApprovalError (rest-server.ts:11477, regex ^FORBIDDEN), the same way every approvals refusal reaches the wire. The pins assert the prefix the mapping keys on (the service-seam half of the contract) and the catalog sentence; a REST-level live-emission pin for that row is outside this card's file surface and is recorded as an out-of-scope finding (see below). No code minted, nothing under packages/spec touched.
• H3 holds — returned → unlocked and the submitter's revise-window recall pins in approval-revise.test.ts stay green (24/24 file, 662/662 package).
• H4 holds — approve / reject / reassign are pending-only at their endpoints (decideNode, loadPendingRow); all four override levers are now pending-only and the isOverrideActor doc block is true without edits.

Pins (packages/plugins/plugin-approvals/src/approval-revise.test.ts, new describe block driving the REAL automation engine and the REAL record-lock hook)

1. The narrowing — platform admin AND tenant admin (ADR-0095 posture) on a genuinely returned row: viewer.can_override is false, recall rejects with an Error whose message matches ^FORBIDDEN: and equals FORBIDDEN: + BUILTIN_OPERATION_MESSAGES.en.approval_recall_not_submitter; afterwards the status is still returned, no recall action row exists, the record is still unlocked (the refusal touched no lock), the run status is unchanged and not cancelled, and the submitter can still resubmit (round 2 opens).
2. Reverse check — the same platform admin on the same request while pending: can_override is true, the record is locked, recall lands (recalled, resumed: true, recall action row, lock released).
3. Reverse check, tenant admin — admitted on pending too (the narrowing is about status, not posture).
4. Submitter's ADR-0044 recall on returned — lands, resumed: false, run cancelled.
5. Control — a non-submitter without the override on returned is refused exactly as before, and the override actor's refusal is byte-identical to it (no new refusal shape).

Changeset

.changeset/approval-override-recall-pending-only.md — @objectstack/plugin-approvals: patch. Level reason: no exported symbol is added, removed or changed (measured: git diff -U0 fed4fa409...HEAD | grep export matches only the export class ApprovalService hunk-context lines). The body states the narrowing as an explicit behaviour change in plain words (override-recall of a returned request is now refused; only pending requests are override-recallable; the submitter's revise-window recall is unchanged; why), per the ruling's condition. No major / breaking declaration, so no ADR-0087 marker is owed (check:adr-0087-registration green).

Clause-② declaration (from the ACTUAL diff)

Yes — accept-set narrowing on a live endpoint (POST /api/v1/approvals/requests/:id/recall: an override actor on a returned request was admitted, is now refused with 403 FORBIDDEN). Export surface: unchanged (git diff -U0 fed4fa409...HEAD | grep export → hunk-context lines only). needs:contract-review hangs on this PR and on #12775.

Ablation (on the committed tree, HEAD 971c8cabf)

Mutation: const overrideAdmits = raw.status === 'pending' → const overrideAdmits = true /* ABLATION-12775: status-blind */ (line-neutral). On disk: injected=1 removed_needle_remaining=0. Run: Tests 2 failed | 22 passed (24) — pins 1 (platform admin: expected null to be an instance of Error) and 5 (Cannot read properties of null (reading 'message') on the admin refusal) red, pins 2–4 green — direction: red, as predicted. Restore: git checkout HEAD -- ABSOLUTE_PATH inside a trap … EXIT INT TERM; proven by git hash-object equal to the HEAD blob (fed51d81…), git diff HEAD empty, marker count 0. No dist/ is involved (the suite imports ./approval-service.js from source), so ablation-dist-preflight does not apply.

Verification on the final head 9da369ffe (after merging origin/main310dd01a0; merge-tree clean against 7286dd58e)

All exits captured before any pipe; verdict lines quoted from the tools.

• pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 → Test Files 36 passed (36) / Tests 662 passed (662)
• pnpm --filter @objectstack/plugin-approvals typecheck → check:test-typecheck: OK — @objectstack/plugin-approvals's test layer compiles … 8 file(s) / 324 error(s) / 27 pinned signature(s) (test layer unchanged at 324; tsc --noEmit covers src/** minus tests, the test layer is covered by tsconfig.test.json via check:test-typecheck)
• pnpm check:system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.
• pnpm check:doc-authoring → sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s) … no growth, no burn-down unrecorded.
• pnpm check:engine-double-contract → OK — 753 pinned, 134 in the DEBT ledger, 3 exempt.
• pnpm check:objectql-double-limit → baseline key set verified against 310dd01: no files added.
• pnpm check:nul-bytes → OK (scanned 7949 text file(s) … no raw ASCII control bytes).

Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, from the merge base; 61 commands) run in five lock-serialised batches on 971c8cabf/9f08922f6 (the doc-authoring fix landed as 9f08922f6; the merge and census regeneration after it touched no gate input other than the census page, which is re-verified above):

• Green (55): adr-0087-registration, changeset-no-major, ci-filter-parity, comment-mask-adoption, cross-package-test-inputs (both spellings), doc-frontmatter, doc-route-spelling, docs-section-name, empty-changeset, keyed-text-bounds, plugin-teardown-shape, section-landing-index, shard-attestation, system-context-census, tenant-audit-census, undeclared-dep-imports, docs-audit affected-docs + drift-comment, pm half-states (both spellings), release-rehearsal-clone self-test, lint doc-formula-expressions + doc-security-posture, spec docs / empty-state / liveness / skill-examples (after building the @objectstack/client-react closure — first run was PREREQUISITE NOT MET) / strictness-ledger / variant-docs / yaml-examples, changeset-gate-self-tests, corpus-claim-drift, doc-anchors, doc-authoring (red on the first run: a tracker id in the new log string — fixed in 9f08922f6), docs-audit-scope, docs-redirects, docs-single-h1, engine-double-contract, i18n-stale-fill, logger-receiver-detach, merge-driver, objectql-double-limit, objectui-changeset, page-declaration-shape, published-files, published-readme-links, query-options-erasure, react-page-adapter-contract, role-word, skill-identifier-liveness, slot-lookup, test-source-alias, type-check-coverage, type-source-resolution, vendor-version-stamps, where-matcher, nul-bytes.
• NOT MEASURED (4, prerequisite unmet in this worktree, none reads this diff's files as inputs; CI runs them with the prerequisite): check-test-completeness (exit 3: PREREQUISITE NOT MET — this gate grades a saved turbo run test log), check:dual-build-cjs-loads (exit 3: PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/), check:i18n (exit 1: PREREQUISITE NOT MET — the workspace CLI is not built), check:type-check-debt (exit 3: PREREQUISITE NOT MET — --re-measure cannot run: 20 workspace dependenc(ies) … have no built type entry point).

Adjacent mechanical fix: content/docs/permissions/system-context.mdx row 42 re-anchored by the gate's own --fix (pnpm gen:system-context-census) — first for this branch's +20-line hunk (971c8cabf), then again on the merged tree after origin/main brought #14542's hunk in the same file (9da369ffe, the os-regen deferral discharged as its own commit per scripts/pm/os-regen-merge.sh). No row content changed.

Out of scope

• packages/rest's handleApprovalErrorFORBIDDEN → 403 row has no live-emission pin in rest-approvals-wire-codes.test.ts (that file pins THROTTLED, READ_BACK_FAILED and the template-generated 500s). Filed as a finding, see the report comment on [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775. approvals: ten service endpoints return request: fresh! — a non-null assertion that is false whenever the read-back is org-filtered out, shipping { "request": null } with HTTP 200 #12769 and approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716 remain untouched by this PR.
• Open PR docs(spec,approvals): ApprovalEscalation.timeoutHours names its clock — calendar (wall-clock) hours #14542's region (slaDueAt JSDoc, :600-630) was not touched; it has since landed on main and merged cleanly here.

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals, touching 1 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via ApprovalService (symbol, a top-level class))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b97d874264945f7494d12240ee5eb67c744ac46 — the merge of head 9da369ffe1d114b4d1684977fe4ca579336365f7 into base 7286dd58e806ed321cbdfc23a1c455db8f80b1ad, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b97d874264945f7494d12240ee5eb67c744ac46 && git checkout 5b97d874264945f7494d12240ee5eb67c744ac46
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7286dd58e806ed321cbdfc23a1c455db8f80b1ad 9da369ffe1d114b4d1684977fe4ca579336365f7 && git checkout -B drift-repro 7286dd58e806ed321cbdfc23a1c455db8f80b1ad && git merge --no-ff 9da369ffe1d114b4d1684977fe4ca579336365f7
node scripts/docs-audit/affected-docs.mjs --json 7286dd58e806ed321cbdfc23a1c455db8f80b1ad

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7286dd58e806ed321cbdfc23a1c455db8f80b1ad → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 9da369ffe

• Card: [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set narrowing: an override actor's recall of a returned request now answers 403 FORBIDDEN): in-seat isolated fable review, round 1 PASS at 9da369ffe (12775#issuecomment-5509840670; transcript verified 60/60 claude-fable-5-1; verdict adopted verbatim, zero blocking findings). Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS. Ruling of record for the change itself: (ii)/B via 12775#issuecomment-5504841854, the changeset declaring the narrowing explicitly per its condition.
• Carriers: needs:contract-review removed from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775 and from this PR in the same stroke, both read back; node scripts/pm/check-clause2-carriers.mjs --pair 14571 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 4 files, all inside the fence — approval-service.ts (recall gate + comment + doc block + developer log text), approval-revise.test.ts (five pins), the patch changeset, and the census page content/docs/permissions/system-context.mdx (row 42 re-anchored by the gate's own regeneration, no row text changed). Export delta: none (git diff -U0 origin/main...HEAD | grep export → nothing). No packages/spec, no content/docs/releases/, attachViewers and the slaDueAt region byte-identical to main; log level unchanged (warn).
• CI on 9da369ffe: every check green — Test Core (1/6)success at 12:58:15Z (job 100250298692) and the aggregate Test Coresuccess; Lint & Repo Gatessuccess at 13:01:40Z (job 100250223401); TypeScript Type Check and the four Type Check · jobs, Build Core, Build Docs, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformance, Check Changeset (re-run after the label change, success 12:54:36Z), Governed Surface Queue Guard, Spec property liveness, the single-writer and same-issue guards all success.
• Action: draft → ready and auto-merge enabled at 13:02:57Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from [Decision] Override-recall of a returned approval: an ADR-0044 side effect to retire, or a capability to keep? The gate, the prose and the viewer flag disagree three ways #12775, then files one grouped follow-up finding for the review's §5 notes 1–2 (the tenant-admin lock-release assertion; the packages/spec contract docstring at contracts/approval-service.ts:712, routed to the spec seat). rest: the approvals FORBIDDEN → 403 wire-code row (handleApprovalError) has no live-emission pin — every authorisation refusal rides it, and only the service-side prefix is pinned #14573 (the REST FORBIDDEN → 403 live-emission pin) stays with triage.

---

Generated by Claude Code