@@ -0,0 +1,10 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(rest): the approvals request list's refusal of a non-string `status` says what the parameter takes, instead of quoting `[object Object]`
+
+Clause-②: no — the same requests are refused with the same status and envelope; only the message for a non-string `status` changes
+Metadata-protocol: none
+
+`GET /api/v1/approvals/requests?status[$ne]=pending` (a `status` the query parser turns into an object) was refused with `"[object Object]"` quoted as if it were the value sent. It is now refused with `The "status" query parameter must be one status, or several separated by commas, given as plain text. Allowed values: pending, approved, rejected, recalled, returned, cancelled.` Still `400 VALIDATION_ERROR` in the nested envelope, and the approval service is still not asked. The approvals docs page now lists all six request statuses (`cancelled` was missing).
@@ -737,8 +737,9 @@ On finalization the request row gets `status: 'approved'` (or `'rejected'`),
 mirrored to the same value, and the record unlocks. The parked run resumes down
 the `approve` or `reject` branch.
 
-Statuses in full: `pending`, `approved`, `rejected`, `recalled`, `returned` —
-the `APPROVAL_STATUSES` constant in `@objectstack/spec/contracts`, which is also
+Statuses in full: `pending`, `approved`, `rejected`, `recalled`, `returned`,
+`cancelled` (the platform voided the request, for example because its record was
+deleted; `cancel_reason` on the row says why) — the `APPROVAL_STATUSES` constant in `@objectstack/spec/contracts`, which is also
 what `sys_approval_request.status` offers and what `ApprovalStatus` is derived
 from. If you add a status there, this line is a fourth copy that nothing updates
 for you.
 
@@ -108,10 +108,18 @@ function readApprovalStatusFilter(
 ): { status: ApprovalStatus | ApprovalStatus[] | undefined } | { refusal: string } {
     if (raw === undefined) return { status: undefined };
     const allowed: readonly string[] = APPROVAL_STATUSES;
-    const entries = typeof raw === 'string' ? raw.split(',').map((s) => s.trim()) : [];
-    const unknown = typeof raw === 'string'
-        ? entries.filter((s) => !allowed.includes(s))
-        : [String(raw)];
+    // [#30525] A value the query parser built into something other than a
+    // string (`?status[$ne]=pending` arrives as an object) has no entry to
+    // name: quoting `String(raw)` printed `"[object Object]"`. Say what shape
+    // the parameter takes instead. Same 400, same envelope, service not asked.
+    if (typeof raw !== 'string') {
+        return {
+            refusal: 'The "status" query parameter must be one status, or several separated by '
+                + `commas, given as plain text. Allowed values: ${allowed.join(', ')}.`,
+        };
+    }
+    const entries = raw.split(',').map((s) => s.trim());
+    const unknown = entries.filter((s) => !allowed.includes(s));
     if (unknown.length > 0) {
         const named = [...new Set(unknown)].map((s) => `"${s}"`).join(', ');
         return {
 
@@ -164,7 +164,17 @@ describe('#29880 §1 — a status value outside the declared set is refused', ()
         const answer = await drive({ status: { $ne: 'pending' } });
         expect(answer.status).toBe(400);
         expect(answer.body?.error?.code).toBe('VALIDATION_ERROR');
+        expect(answer.body?.data).toBeUndefined();
         expect(approvals.listRequests).not.toHaveBeenCalled();
+        expect(approvals.countRequests).not.toHaveBeenCalled();
+        // [#30525] The message says what shape the parameter takes and lists
+        // the allowed values; it never quotes the parser's object as a value.
+        const message = String(answer.body?.error?.message);
+        expect(message).toBe(
+            'The "status" query parameter must be one status, or several separated by commas, '
+            + `given as plain text. Allowed values: ${APPROVAL_STATUSES.join(', ')}.`,
+        );
+        expect(message).not.toContain('[object Object]');
     });
 
     it('the name and arity gates still answer first', async () => {