chore(changeset): plugin-approvals refuses a node on an unreadable approver directory, plugin-sharing pages its queue reads

Also states the request row the legacy-decide pin reads as present, which the
test-layer type-check ledger counts.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Utp6CXqXpuVf14Mqo1pznh

Author: claude

.changeset/29604-approver-directory-refusal-queue-paging.md

@@ -0,0 +1,19 @@
+---
+'@objectstack/plugin-approvals': patch
+'@objectstack/plugin-sharing': patch
+---
+
+fix(plugin-approvals)!: an approval node refuses to open when a team, position or queue approver's directory read fails, and the ownership-queue reads page to completion
+
+Clause-②: yes (narrowing) — an approval node whose `team`, `position` or `queue` approver (static, or an `expression` approver with `resolveAs` `team` / `position`) cannot be expanded because a directory read failed no longer opens: under every `onEmptyApprovers` policy (`admin_rescue`, `auto_approve`, `fail`, `fallback`, the `fallbackApprovers` slate included) it now fails the node with a retryable `APPROVER_DIRECTORY_UNREADABLE:` error naming the read, where it used to open on the rest of the slate, on the fallback slate or on the administrators, or auto-approve. Every other input answers as before.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped: the approval node config, the approver types and the ownership-queue contract keep their shapes. What moves is the answer a node gives while a directory table cannot be read, and nothing at rest records that answer, so there is nothing for a migration to rewrite. -->
+
+**BREAKING** accept-set narrowing at the approval node (`@objectstack/plugin-approvals`): a failed directory read behind a `team`, `position` or `queue` approver refuses the node instead of opening it on a slate that is missing people (ADR-0142 D6 as amended, ruling record 6599731698 on #29604).
+
+- **Before.** A `team` or `position` approver whose `sys_team_member`, `sys_user_position` or `sys_member` read failed kept its `type:value` literal slot, which nobody can act on, and logged the failure. A `queue` approver whose expansion threw answered "expanded to nobody" and added no slot. Either way the node went on as if those people did not exist: beside other approvers it opened on them alone, and on an otherwise empty slate the node's `onEmptyApprovers` policy acted, opening on the `fallbackApprovers` or the organization's administrators, or auto-approving.
+- **Now.** The node does not open and writes no request, approver or action row. It fails with an `ApproverDirectoryUnreadableError` whose message starts `APPROVER_DIRECTORY_UNREADABLE:`, names the approver, the organization and the read that failed (a failure of the cross-organization read filter is named as that filter's read), and is retryable: the flow node's failure is a runtime one, so the run can be resumed once the directory can be read. A `fallbackApprovers` slate whose own `team` or `position` read fails refuses the same way. `department` / `business_unit`, `org_membership_level` and `manager` approvers are not named by the ruling and answer exactly as before.
+- **Unchanged.** A decision on a request opened before the approver snapshot existed still re-reads its slate on the old path, which keeps the literal slot on a failed read, because the decision has already been recorded when that read happens.
+
+`@objectstack/plugin-sharing`: the ownership-queue service reads its `sys_queue` and `sys_queue_member` rows by id, page after page, to the end, where it read one page of 10,000 rows and answered on it. A queue's 10,001st member, an organization's 10,001st queue and the queues naming a recipient past that bound are now found. A read that fails partway answers as a failed read did before (that read contributes nobody, logged once), never with the pages it had read.

packages/plugins/plugin-approvals/src/approval-service.test.ts

@@ -4330,7 +4330,7 @@ describe('ApprovalService — a team, position or queue approver whose directory
     const req = await svc.openNodeRequest(
       node([{ type: 'user', value: 'u2' }, { type: 'team', value: 't_ops' }], { behavior: 'unanimous' }), CTX,
     ) as any;
-    const row = engine._tables['sys_approval_request'].find((r: any) => r.id === req.id);
+    const row = engine._tables['sys_approval_request'].find((r: any) => r.id === req.id)!;
     const config = JSON.parse(row.node_config_json);
     delete config.__approverGroups;
     row.node_config_json = JSON.stringify(config);