The principal to RESTORE on resume — never the reviewer who approved.
A human decision must not transfer the decider's authority into the
resumed run, and an automated run must resume as the automation it
started as. Persisted, so its shape is versioned by validation:
#validateResumeTarget rejects the pre-principal ApprovalActor form
rather than coercing it (a schedule.fire run stored role:'operator',
and reading that back as a human would grant exactly the authority
this type exists to withhold).
Trusted host topology used to resume a run after Durable Object eviction.