Class ApprovalService

File an approval on behalf of an AUTOMATED principal — the trusted entry for platform bridges (suspension reconcile, agent host) that have no person behind them.

This entry gates on the principal's vouched kind, not on CAN_CREATE. A role projection cannot stand in for that gate: an automated principal projects onto the least-privileged role precisely so it can never decide, and viewer is not in CAN_CREATE.

There is deliberately NO principal-taking claim/decide/delegate. Filing a request is trusted platform work; deciding one is a human judgement, and an automated principal approving its own request is the separation-of-duties hole this whole model exists to close.

Triage fan-out: apply ONE decision to up to MAX_APPROVAL_BATCH_DECIDE records, each through the EXISTING decide() — per-record CAS, SoD, audit, and resume semantics untouched; the one-decision-per-suspension model is not widened. Partial success is the contract: each record's outcome (or typed failure) is reported in the envelope, never as a thrown error. Only record-INDEPENDENT failures reject the whole batch: the caller's role, malformed ids, the cap, and a malformed decision.

Sequential, not Promise.all — preserves audit ordering and avoids hammering the store's CAS with concurrent writes (D1/DO contention); a batch is a reviewer clicking once, not a throughput path.

CAS-transitions a stale open record (pending/claimed/escalated, bound to a suspension its step has since moved past) straight to 'rejected'. Deliberately bypasses decide(): a rejection decision resumes the run with declined semantics via #resume(), and a stale record must die WITHOUT touching a run that is already suspended at a DIFFERENT (current) fingerprint — this method never calls #resume(). 'rejected' (not 'approved') is the deliberate terminal choice: connectorGrantsForLeg (grants.ts) reads ONLY status: 'approved' records when deriving a leg's grants, so a superseded record is excluded by its STATUS alone, not merely by its stale fingerprint — it can never mint even if a future change loosened the fingerprint check.

router.ts does not route it. The in-repo reconcile path calls supersedeStaleAsPrincipal instead (host-kit/approval-bridge.ts); this is the host-facing ApprovalActor form of the same transition, exported through ./approval-api for hosts that file and un-file approvals under an actor. It remains public for those hosts even though no in-repo production path calls it. Authorized like create() (CAN_CREATE, not CAN_REVIEW): superseding is the "un-file" half of the same filing operation, not a reviewer decision.

Returns null — mirroring the store's own CAS contract, rather than throwing — when the record is unknown or already left the OPEN set (a real decision won the race): the caller backs off instead of treating a lost race as an error, the same "null = lost a race, skip quietly" contract sweepSLA uses for its own store-level CAS.

Supersede on behalf of an AUTOMATED principal — the reconcile bridge's half of createAsPrincipal, and authorized the same way.

Superseding is bookkeeping, not a decision: the record's suspension fingerprint no longer matches the run, so it can never be resumed and is closed to stop it shadowing the fresh filing. It is deliberately not reachable through decide, so this does not give automation a decision.