plugin-approvals: a request whose stamped flow package withdrew must not read another package's flow of that name (ADR-0150 D8 row R7, follow-up of #31696) #32647

epic:#31527#1 · os-bill · session_01Utp6CYAGCZcafN5hk3uj4u

Filing gate: ④ coordination node: a follow-up child of #31696 (epic #31527 child B, flow family), owed by its PR #32507 and filed at the epic seat's request (contract review 6819101430, should-fix 2; red-line read 6819109315). ⛔ Not a claim.
Business reason: an approval request belongs to the flow of the package it was opened on (ADR-0150 D4, D8 row R7). When that package is uninstalled and another package still ships a flow of the same name, the request is answered from the other package's flow: its send-back edge check, its route and steps, its resubmit window and its queue package are read from a flow that never ran it. Not doing it leaves an approver acting on a request against the wrong flow's graph after an uninstall.
Reader: the next domain:server seat, from the epic seat's queue once #32507 has landed; the epic seat reviews it against the epic's red lines.
Dedupe (open AND closed): process_package withdrawn (1 hit: #31696, the parent), process_package (2: #31696, #31684 closed, the R7 column's card; neither on point).
class: d · type: Feature
Grade: p2 (proposed; the seat grades). Same answer as main today, so nothing regresses; a narrowing with its own declaration.

维护者速读

审批单记下了打开它的包（process_package）。如果这个包后来卸载了，而另一个包还发同名 flow，审批单现在会按裸名读到另一个包的 flow。这张卡把它改成：记下的包不再持有这个名字时，按它的运行去读，读不到就拒绝并列出持有者，不再拿别人的 flow。

What to build

plugin-approvals reads a request's flow through requestFlowSlot (approval-service.ts, PR #32507): the stamped package's slot, else the slot its run's key is filed under (exactly one), else the bare getFlow. While the name is shared, a stamp naming a package that holds no slot falls to the run, else to the bare read's 409 naming every holder: correct. Once the stamped package withdraws and ONE other package holds the name, the bare read serves that other package's flow (measured at the engine in review 6819101430). Make a request whose stamped package holds no slot of its flow name never read another package's slot by the bare name: read through its run, else refuse naming the holders (or answer as a flow that is gone, as deleted-flow-decision-refusal.test.ts does for a deleted flow; the seat picks which).

Surface

• Expected file surface: packages/plugins/plugin-approvals/src/approval-service.ts (requestFlowSlot, requestFlow, requestFlowKey).
• Clause-②: yes (narrowing): a request whose stamped package withdrew, of a name one other package holds, moves from that package's flow to the run's flow or a refusal. Declare FROM → TO per door (send-back, the request read's flow_route / flow_steps, resubmit, the queue package).
• First-party callers in that position: to be measured (an uninstall with open requests, then another package's same-named flow).

Acceptance — the epic's three red lines

• Resolution never loosens. No read of another package's flow for a request stamped with a package.
• Ambiguity is reported, never guessed. A refusal names every holder.
• Independently releasable. One-holder answers unchanged with CONTROL pins; the moved answers declared FROM → TO and pinned on a booted stack (install, open, uninstall, install another namespace's same-named flow).

Parent: #31696.