@@ -25,7 +25,7 @@ The inbox door's `process_label` / `step_label` now read the new columns first.
 
 **Read security.** Every new value is either a column of the request the row's readers can already read, or a name the approvals door already serves those readers for that request: `pending_approver_names`, and the timeline's names. The names come from the same resolver, under the same system read. The generic data door serves both objects only to the callers the approvals door would serve.
 
-**Rows written before this release are filled at boot.** A new boot-time pass runs on `kernel:ready`, after the action-slot repair. It fills the new columns on rows that hold null, writing only into null columns, so it never overwrites a value a live writer stored. Every row it fills keeps its own `updated_at`: the write passes the stored value back under `preserveAudit`, so the request lists, which sort on `updated_at`, keep their order. The action-slot repair's writes keep it the same way. Where `plugin-audit` is composed, the first boot after the upgrade writes one system audit entry per row it fills. A second boot writes nothing.
+**Rows written before this release are filled at boot.** A new boot-time pass runs on `kernel:ready`, after the action-slot repair. It fills the new columns on rows that hold null. Each request is re-read just before it is written, and the write names only the columns that are still null on that re-read row. Whom a request waits on is written only while the request is still pending on the slate its names were read for. A value a live writer stored, such as the boot sweep or another node, is therefore kept. The only window left is the single engine call between the re-read and the write. Every row it fills keeps its own `updated_at`: the write passes the stored value back under `preserveAudit`, so the request lists, which sort on `updated_at`, keep their order. The action-slot repair's writes keep it the same way. Where `plugin-audit` is composed, the first boot after the upgrade writes one system entry in the audit log and one in the record's activity timeline for each row it fills. A second boot writes nothing.
 
 - On every request, the flow and step labels come from the chain the approvals door serves: the authored labels the config snapshot carries, else the humanized machine name. The list and the inbox therefore show the same label for the same row, and no request is left blank.
 - On a pending request, whom it waits on is filled.
 
@@ -28,7 +28,10 @@
  *  (f) an empty authored label is stored as the humanized machine name, never
  *      `''`, at open;
  *  (g) every row a boot fills keeps its own `updated_at` exactly — the request
- *      lists sort on it, and a derived display column is not an edit.
+ *      lists sort on it, and a derived display column is not an edit;
+ *  (h) a live write landing between a page's read and its row writes — a
+ *      recall, an SLA-style slate change — is kept exactly as it left the row,
+ *      and the rest of the page is still filled with its stamps kept.
  */
 
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
@@ -199,21 +202,27 @@ describe('#23889 — the boot-time display-label backfill', () => {
 
   it('(c) never overwrites a column a live writer filled; an orphaned action keeps a null pointer and its own step name', async () => {
     await engine.update('sys_approval_request', { id: 'areq_open', process_label: 'Live label' }, { context: SYSTEM } as any);
+    // A second pending request on the same page, so one labeller call per page
+    // and one per row give different calls.
+    await engine.insert('sys_approval_request', legacyRequest('open2', {
+      status: 'pending', pending_approvers: 'u_mail', node_config_json: JSON.stringify({ approvers: [] }),
+    }), { context: SYSTEM } as any);
     // An action whose step label and acting-as label a writer already stored,
     // different from what its request would give: the fill copies only its
     // null pointer columns and leaves both labels as stored.
     await engine.update('sys_approval_action', {
       id: 'a_vote', step_label: 'Recorded step', acted_as_label: 'Recorded name',
     }, { context: SYSTEM } as any);
     const svc = new ApprovalService({ engine: engine as any, logger: quiet as any });
-    // The labeller is asked once per page, never once per row: here one request
-    // page (the pending slate) and one action page (two acted_as slots).
+    // The labeller is asked once per page, never once per row: one request page
+    // (two pending slates) and one action page.
     const source = slotLabelSourceOf(svc);
     const asked: string[][] = [];
     const counting = { slotLabels: (slots: readonly string[]) => { asked.push([...slots]); return source.slotLabels(slots); } };
     const out = await backfillApprovalDisplayLabels(engine as any, counting);
-    expect(asked).toEqual([['u_alice', 'position:legal'], ['position:legal']]);
-    expect(out.requestsFilled).toBe(2);
+    expect(asked).toEqual([['u_alice', 'position:legal', 'u_mail'], ['position:legal']]);
+    expect(out.requestsFilled).toBe(3);
+    expect((await row('sys_approval_request', 'areq_open2')).pending_approver_labels).toBe('Mia Mail');
 
     expect((await row('sys_approval_request', 'areq_open')).process_label).toBe('Live label');
     expect(await row('sys_approval_action', 'a_vote')).toMatchObject({
@@ -320,4 +329,57 @@ describe('#23889 — the boot-time display-label backfill', () => {
       expect(await row('sys_approval_action', id), id).toMatchObject({ object_name: 'crm_deal', updated_at: BACKDATED });
     }
   });
+
+  it('(h) a live write between the page read and the row writes is kept as it left the row', async () => {
+    // Two more pending requests on the page: one a sweep recalls, one it moves to another slate.
+    await engine.insert('sys_approval_request', legacyRequest('recalled', {
+      status: 'pending', pending_approvers: 'u_alice', node_config_json: JSON.stringify({ approvers: [] }),
+    }), { context: SYSTEM } as any);
+    await engine.insert('sys_approval_request', legacyRequest('moved', {
+      status: 'pending', pending_approvers: 'u_alice', node_config_json: JSON.stringify({ approvers: [] }),
+    }), { context: SYSTEM } as any);
+    for (const id of ['areq_done', 'areq_open', 'areq_recalled', 'areq_moved']) await backdate('sys_approval_request', id);
+
+    const svc = new ApprovalService({ engine: engine as any, logger: quiet as any });
+    const source = slotLabelSourceOf(svc);
+    let left: Record<string, any> | undefined;
+    // The labeller is asked once the request page has been read and before any
+    // of its rows is written — the window. The live writes land there, as the
+    // sweep's do: plain system writes that stamp now.
+    const racing = {
+      slotLabels: async (slots: readonly string[]) => {
+        if (!left) {
+          await engine.update('sys_approval_request', {
+            id: 'areq_recalled', status: 'recalled', pending_approvers: null, pending_approver_labels: null,
+            completed_at: '2026-10-01T00:00:00.000Z',
+          }, { context: SYSTEM } as any);
+          await engine.update('sys_approval_request', {
+            id: 'areq_moved', pending_approvers: 'u_mail', pending_approver_labels: 'Mia Mail',
+          }, { context: SYSTEM } as any);
+          left = {
+            recalled: await row('sys_approval_request', 'areq_recalled'),
+            moved: await row('sys_approval_request', 'areq_moved'),
+          };
+        }
+        return source.slotLabels(slots);
+      },
+    };
+    await backfillApprovalDisplayLabels(engine as any, racing);
+
+    const pick = (r: any) => ({
+      status: r.status, pending_approvers: r.pending_approvers,
+      pending_approver_labels: r.pending_approver_labels, updated_at: r.updated_at,
+    });
+    expect(left!.recalled.updated_at).not.toBe(BACKDATED);
+    expect(pick(await row('sys_approval_request', 'areq_recalled'))).toEqual(pick(left!.recalled));
+    expect(pick(await row('sys_approval_request', 'areq_moved'))).toEqual(pick(left!.moved));
+    // Their null label columns are still filled, under the stamp the live write left.
+    expect((await row('sys_approval_request', 'areq_recalled')).process_label).toBe('Deal Review');
+
+    // The untouched rows on the page are filled, their stamps kept.
+    expect(await row('sys_approval_request', 'areq_open')).toMatchObject({
+      pending_approver_labels: 'Alice, position:legal', updated_at: BACKDATED,
+    });
+    expect(await row('sys_approval_request', 'areq_done')).toMatchObject({ process_label: 'Deal Review', updated_at: BACKDATED });
+  });
 });
@@ -36,17 +36,25 @@
  *
  * ## Each row keeps its `updated_at`
  *
- * Every write passes the read row's `updated_at` back under `preserveAudit`
- * ({@link PRESERVING_CONTEXT}), so a filled request keeps its place in the
- * lists that sort on it. Where `plugin-audit` is composed, each filled row still
- * gets one system audit entry for the write.
+ * Every write passes the row's `updated_at` back under `preserveAudit`
+ * ({@link PRESERVING_CONTEXT}) — on a request, the value the row holds when it
+ * is re-read just before the write — so a filled request keeps its place in
+ * the lists that sort on it. A row with no stored `updated_at` takes the write's
+ * instant: no update can keep it null. Where `plugin-audit` is composed, the
+ * write still records one system entry in the audit log and one in the record's
+ * activity timeline for each row it fills.
  *
  * ## Idempotent, null-only, and run at every boot
  *
- * Each write names only columns that were null on the row it read, so the
- * pass can never overwrite what a live writer wrote, and a second run over an
- * unchanged database writes nothing (`display-label-backfill.integration.test.ts`
- * asserts both). A label the labeller could not produce — a failed `sys_user`
+ * Each write names only columns that are null on the row as it stands just
+ * before the write: a request is re-read by id first, and its waiting-on is
+ * written only while it is still pending on the slate the names were read for.
+ * So a value a live writer stored before that re-read is never overwritten;
+ * what remains is the one engine call between the re-read and the write, the
+ * window `plugin-audit`'s comment-parent-pair backfill accepts. No live writer
+ * updates an action row, so the action pass writes from its page read. A
+ * second run over an unchanged database writes nothing
+ * (`display-label-backfill.integration.test.ts` asserts both). A label the labeller could not produce — a failed `sys_user`
  * read, which `slotLabels` reports as null rather than freezing a raw address
  * — stays null and is retried on the next boot. Both walks are seek walks over
  * the predicate "a display column is null", so a row this pass fills leaves the
@@ -99,6 +107,12 @@ const SYSTEM_CONTEXT = { isSystem: true, positions: [], permissions: [] };
 const PRESERVING_CONTEXT = { ...SYSTEM_CONTEXT, preserveAudit: true };
 const PAGE = 500;
 
+/** What the request pass reads — on the page, and again on the row just before its write. */
+const REQUEST_FIELDS = [
+  'id', 'status', 'process_name', 'current_step', 'node_config_json', 'pending_approvers',
+  'process_label', 'current_step_label', 'pending_approver_labels', 'updated_at',
+];
+
 /** The read row's own `updated_at`, to hand back on the write. */
 function keptStamp(row: Record<string, unknown>): Record<string, unknown> {
   return row.updated_at !== undefined && row.updated_at !== null ? { updated_at: row.updated_at } : {};
@@ -140,10 +154,7 @@ export async function backfillApprovalDisplayLabels(
   const requests = keysetWalk<Record<string, unknown>>(
     (q) => engine.find('sys_approval_request', {
       ...q,
-      fields: [
-        'id', 'status', 'process_name', 'current_step', 'node_config_json', 'pending_approvers',
-        'process_label', 'current_step_label', 'pending_approver_labels', 'updated_at',
-      ],
+      fields: REQUEST_FIELDS,
       context: SYSTEM_CONTEXT,
     }) as Promise<Record<string, unknown>[]>,
     {
@@ -162,22 +173,43 @@ export async function backfillApprovalDisplayLabels(
       .filter((row) => row.status === 'pending' && !nonEmpty(row.pending_approver_labels))
       .flatMap((row) => slateOf(row.pending_approvers));
     const named = await pageLabels(labels, waitingOnSlots);
-    for (const row of rows) {
-      const id = nonEmpty(row.id);
+    for (const paged of rows) {
+      const id = nonEmpty(paged.id);
       if (!id) continue;
+      // The page is a snapshot; live writers keep writing pending requests while
+      // this pass runs — the boot SLA / dead-run sweep this plugin starts itself
+      // (not awaited), and every other node. So the row is RE-READ by id
+      // immediately before its write, and the patch is computed from that row:
+      // only columns still null there, the stamp it holds now, and the
+      // waiting-on only for the slate the names were read for. That narrows the
+      // read-then-write race to the one engine call, as `plugin-audit`'s
+      // comment-parent-pair backfill does. ⛔ No conditional `where` on the
+      // update: that would put the write on the predicate path.
+      const reread = ((await engine.find('sys_approval_request', {
+        where: { id }, fields: REQUEST_FIELDS, limit: 1, context: SYSTEM_CONTEXT,
+      })) as Record<string, unknown>[])[0];
+      if (!reread) continue;
       const patch: Record<string, unknown> = {};
-      const chain = requestDisplayLabels(row);
-      if (!nonEmpty(row.process_label) && chain.process_label) patch.process_label = chain.process_label;
-      if (!nonEmpty(row.current_step_label) && chain.current_step_label) {
+      const chain = requestDisplayLabels(reread);
+      if (!nonEmpty(reread.process_label) && chain.process_label) patch.process_label = chain.process_label;
+      if (!nonEmpty(reread.current_step_label) && chain.current_step_label) {
         patch.current_step_label = chain.current_step_label;
       }
-      if (row.status === 'pending' && !nonEmpty(row.pending_approver_labels)) {
-        const slate = slateOf(row.pending_approvers);
+      // Whom it waits on: only while it is still pending on the very slate the
+      // page's names were read for. A slate that moved was moved by a live
+      // writer, which wrote that slate's own labels (or cleared them).
+      if (
+        reread.status === 'pending'
+        && !nonEmpty(reread.pending_approver_labels)
+        && paged.status === 'pending'
+        && reread.pending_approvers === paged.pending_approvers
+      ) {
+        const slate = slateOf(reread.pending_approvers);
         const waitingOn = slate.length ? slateLabelOf(slate.map((slot) => named.get(slot) ?? null)) : null;
         if (waitingOn) patch.pending_approver_labels = waitingOn;
       }
       if (!Object.keys(patch).length) continue;
-      await engine.update('sys_approval_request', { id, ...patch, ...keptStamp(row) }, { context: PRESERVING_CONTEXT });
+      await engine.update('sys_approval_request', { id, ...patch, ...keptStamp(reread) }, { context: PRESERVING_CONTEXT });
       requestsFilled++;
     }
   }