@@ -0,0 +1,17 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec): an approval node refuses `excludeSubmitter: true` beside `onEmptyApprovers: 'auto_approve'`
+
+Clause-②: no (narrowing)
+Metadata-protocol: narrowed
+Ruling-ref: 6386627950
+
+An approval node's `excludeSubmitter: true` removes the request's submitter from the slate its `approvers` resolve to. When that leaves nobody, the request takes the node's `onEmptyApprovers` route, and under `'auto_approve'` that route approves the request with no one deciding: a submitter who is the only approver would get their own request approved, the one outcome the option exists to prevent. The approval node config now refuses the pair at the parse, with one issue at `onEmptyApprovers` naming both keys, so `os validate`, `compile`, `defineStack`, the flow build judge and the metadata save door all refuse it before it is deployed. Choose a policy that never passes the request instead: `'admin_rescue'` (the default, which opens the request on the organization's administrators), `'fail'`, or `'fallback'` with a `fallbackApprovers` list naming who decides.
+
+- **Narrows nothing a released version accepted.** `excludeSubmitter` is new in this same release (its own changeset declares it), and no published `@objectstack/spec` carries it, so no package source or stored approval node written against a released version can hold the pair.
+- **Only `true` arms it.** `onEmptyApprovers: 'auto_approve'` beside `excludeSubmitter: false`, or with the key omitted, parses as before and keeps its meaning. Every other policy parses beside `excludeSubmitter: true`.
+- **The approval engine is unchanged.** Removing the submitter at run time is still to come; this change makes the contract refuse the one combination that would let an emptied slate pass.
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves for an upgrading consumer: the refused pair needs `excludeSubmitter`, a key added in this same release and absent from every published `@objectstack/spec` (the latest on npm, 18.1.0, carries no `excludeSubmitter` anywhere in its tarball), and no producer in this repository writes it, so no stored row or package source written against a released version holds the pair and there is nothing for `objectstack migrate meta` to rewrite. No spec key, authorable spelling or stored shape is removed, renamed or re-shaped, and the remedy for an author who writes the pair is a choice among three policies, not a mechanical rewrite. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
@@ -69,7 +69,7 @@ const result = ApprovalDecision.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **approvers** | `{ type: Enum<'manager' \| 'position' \| 'department' \| 'team' \| 'field' \| 'expression' \| …>; value?: string; resolveAs?: Enum<'user' \| 'department' \| 'position' \| 'team'>; group?: string; … }[]` | ✅ | Allowed approvers for this node |
-| **excludeSubmitter** | `boolean` | optional | [PLANNED — not yet enforced] Segregation of duties for this step: when true, the request's submitter (the user whose action started the flow run, recorded on the approval request as `submitter_id`) is removed from the slate `approvers` resolves to, whatever approver type produced them. If that leaves nobody, the request takes the node's `onEmptyApprovers` route (`admin_rescue` by default, or `fallbackApprovers` under `'fallback'`) and never passes silently, and the approval record shows that the exclusion changed the route. Omitted or false (the default), the slate stays as resolved. The approval engine does not read this key yet, so today the submitter is NOT removed: keep any guard you rely on (an `expression` approver or a validation rule) until it does. |
+| **excludeSubmitter** | `boolean` | optional | [PLANNED — not yet enforced] Segregation of duties for this step: when true, the request's submitter (the user whose action started the flow run, recorded on the approval request as `submitter_id`) is removed from the slate `approvers` resolves to, whatever approver type produced them. If that leaves nobody, the request takes the node's `onEmptyApprovers` route (`admin_rescue` by default, or `fallbackApprovers` under `'fallback'`) and never passes silently, and the approval record shows that the exclusion changed the route. `onEmptyApprovers: 'auto_approve'` is refused beside `excludeSubmitter: true`, because it would approve exactly the request this option exists to stop; choose `'admin_rescue'`, `'fail'` or `'fallback'`. Omitted or false (the default), the slate stays as resolved. The approval engine does not read this key yet, so today the submitter is NOT removed: keep any guard you rely on (an `expression` approver or a validation rule) until it does. |
 | **behavior** | `Enum<'first_response' \| 'unanimous' \| 'quorum' \| 'per_group'>` | optional (default: `"first_response"`) | How to combine multiple approvers |
 | **minApprovals** | `integer` | optional | Approvals required — total (quorum) or per group (per_group). Omitted ⇒ all resolvable approvers for quorum, 1 per group for per_group |
 | **lockRecord** | `boolean` | optional (default: `true`) | Lock the record from editing while pending |
 
@@ -26,9 +26,19 @@
  *   `additionalProperties: false`.
  * - §5 THE STATUS: the describe opens with the `[PLANNED` marker (the runtime
  *   half has not landed, so the key is declared and not yet read) and names
- *   the two subjects an author needs — `submitter_id` (who is removed) and
- *   `onEmptyApprovers` (where an emptied slate goes). The prose itself is not
- *   pinned.
+ *   the subjects an author needs — `submitter_id` (who is removed),
+ *   `onEmptyApprovers` (where an emptied slate goes) and `'auto_approve'` (the
+ *   one policy refused beside it, §6). The prose itself is not pinned.
+ * - §6 THE REFUSED PAIR (#25635, ruling 6386627950, letter A):
+ *   `excludeSubmitter: true` beside `onEmptyApprovers: 'auto_approve'` is
+ *   refused at the parse, ONE issue at `onEmptyApprovers` — the key the ruled
+ *   prescription edits — naming both keys and the three policies it offers.
+ *   Controls: every other policy beside `true`, and `auto_approve` beside a
+ *   `false` or omitted key, parse green. The refusal reaches the flow door
+ *   (the issue at the node config's own key, and the build judge's
+ *   `node-config-refused-by-contract`), and it is independent of the
+ *   `fallbackApprovers` pairing: a config that trips both carries both, and the
+ *   one edit to `'fallback'` clears both.
  */
 
 import { describe, expect, it } from 'vitest';
@@ -39,6 +49,7 @@ import {
   ApprovalNodeConfigSchema,
   getApprovalNodeConfigJsonSchema,
 } from './approval.zod';
+import { flowNodeConfigRefusals } from './flow-node-config-refusals';
 import { FlowSchema } from './flow.zod';
 
 type Door = { safeParse: (v: unknown) => z.ZodSafeParseResult<unknown> };
@@ -195,4 +206,80 @@ describe('§5 the describe declares the key planned and names its two subjects',
     expect(doc()).toContain('`submitter_id`');
     expect(doc()).toContain('`onEmptyApprovers`');
   });
+
+  it("names the one policy refused beside it ('auto_approve'), so an author reading it is not surprised by §6", () => {
+    expect(doc()).toContain("'auto_approve'");
+  });
+});
+
+// ───────────────────────────────────────────────────────────────────────────
+// §6 the refused pair: excludeSubmitter: true + onEmptyApprovers: 'auto_approve'
+// ───────────────────────────────────────────────────────────────────────────
+
+describe("§6 excludeSubmitter: true beside onEmptyApprovers: 'auto_approve' is refused at the parse", () => {
+  const PAIR = { ...BASE, excludeSubmitter: true, onEmptyApprovers: 'auto_approve' };
+  const FALLBACK = [{ type: 'org_membership_level', value: 'owner' }];
+
+  /** The refusal's message, read off the contract itself — never re-spelled here. */
+  const refusalMessage = (value: unknown): string => {
+    const result = ApprovalNodeConfigSchema.safeParse(value);
+    if (result.success) return '';
+    return result.error.issues.find((i) => i.path.join('.') === 'onEmptyApprovers')?.message ?? '';
+  };
+
+  it('refuses the pair with ONE issue, at onEmptyApprovers (the key the prescribed edit changes)', () => {
+    expect(issues(ApprovalNodeConfigSchema, PAIR)).toEqual([{ code: 'custom', path: 'onEmptyApprovers' }]);
+  });
+
+  it('names both keys and the three policies it offers instead', () => {
+    const message = refusalMessage(PAIR);
+    for (const subject of ['excludeSubmitter', "'auto_approve'", "'admin_rescue'", "'fail'", "'fallback'", 'fallbackApprovers']) {
+      expect(message, subject).toContain(subject);
+    }
+  });
+
+  it.each([
+    ['admin_rescue, declared', { onEmptyApprovers: 'admin_rescue' }],
+    ['admin_rescue, the default (key omitted)', {}],
+    ['fail', { onEmptyApprovers: 'fail' }],
+    ['fallback with fallbackApprovers', { onEmptyApprovers: 'fallback', fallbackApprovers: FALLBACK }],
+  ])('control: excludeSubmitter: true beside %s parses green', (_label, policy) => {
+    expect(issues(ApprovalNodeConfigSchema, { ...BASE, excludeSubmitter: true, ...policy })).toEqual([]);
+  });
+
+  it.each([
+    ['excludeSubmitter: false', { excludeSubmitter: false }],
+    ['excludeSubmitter omitted', {}],
+  ])("control: onEmptyApprovers: 'auto_approve' beside %s parses green and keeps its meaning", (_label, exclusion) => {
+    const config = { ...BASE, ...exclusion, onEmptyApprovers: 'auto_approve' };
+    expect(issues(ApprovalNodeConfigSchema, config)).toEqual([]);
+    expect(ApprovalNodeConfigSchema.parse(config).onEmptyApprovers).toBe('auto_approve');
+  });
+
+  it('reaches the flow door: FlowSchema refuses it at the node config key, in the contract\'s own words', () => {
+    const result = FlowSchema.safeParse(flowWith({ config: PAIR }));
+    expect(result.success).toBe(false);
+    const found = result.success ? [] : result.error.issues.map((i) => ({ code: i.code, path: i.path.join('.'), message: i.message }));
+    expect(found.map(({ code, path }) => ({ code, path }))).toEqual([
+      { code: 'custom', path: 'nodes.1.config.onEmptyApprovers' },
+    ]);
+    expect(found[0]!.message).toContain(refusalMessage(PAIR));
+  });
+
+  it("reaches the build judge as node-config-refused-by-contract on onEmptyApprovers", () => {
+    const refusals = flowNodeConfigRefusals('approval', PAIR);
+    expect(refusals.map(({ code, path }) => ({ code, path }))).toEqual([
+      { code: 'node-config-refused-by-contract', path: 'onEmptyApprovers' },
+    ]);
+    expect(refusals[0]!.message).toContain(refusalMessage(PAIR));
+  });
+
+  it('is independent of the fallbackApprovers pairing: both arms report, and one edit to fallback clears both', () => {
+    const both = { ...PAIR, fallbackApprovers: FALLBACK };
+    expect(issues(ApprovalNodeConfigSchema, both)).toEqual([
+      { code: 'custom', path: 'onEmptyApprovers' },
+      { code: 'custom', path: 'onEmptyApprovers' },
+    ]);
+    expect(issues(ApprovalNodeConfigSchema, { ...both, onEmptyApprovers: 'fallback' })).toEqual([]);
+  });
 });
@@ -829,6 +829,59 @@ function checkFallbackApproversPairing(
   });
 }
 
+/**
+ * `excludeSubmitter: true` beside `onEmptyApprovers: 'auto_approve'` is
+ * refused as a pair (ruling 6386627950 on #25635, letter A).
+ *
+ * ## Why the pair contradicts itself
+ *
+ * `excludeSubmitter` exists so that a submitter cannot approve their own
+ * request. The slate it empties is the slate of a submitter who was its only
+ * approver, and an emptied slate takes the node's `onEmptyApprovers` route.
+ * Under `auto_approve` that route approves the request with nobody deciding:
+ * the submitter's own request passes, the one outcome the option was written
+ * to prevent. The ruling that governs the option (6377842908: an emptied slate
+ * "never passes silently") is made true here, in the contract both ends read,
+ * rather than by a runtime override of an authored policy (AGENTS.md Prime
+ * Directive 12: reject at authoring, never reinterpret in a consumer).
+ *
+ * ## Where the issue lands
+ *
+ * On `onEmptyApprovers`, because the ruled prescription is a different policy
+ * (`admin_rescue`, `fail` or `fallback`), so that is the key the author edits.
+ * The message names both keys, but unlike {@link checkFallbackApproversPairing}
+ * it does not offer removing the other key as an equal fix: removing
+ * `excludeSubmitter` drops the control the author asked for, and an author or
+ * an AI told that either key will do takes the cheaper edit.
+ *
+ * ## What it does NOT judge
+ *
+ * Only `true` arms it. `false` and an omitted key are the "off" the option
+ * defaults to, under which `auto_approve` keeps its own meaning. No other
+ * policy is refused: `admin_rescue` and `fallback` open the request on other
+ * people, and `fail` stops the run; none of them passes the request. Who the
+ * runtime removes, and what the approval record says, is the approval
+ * engine's (`plugin-approvals`), not this rule's.
+ */
+function checkExcludeSubmitterPolicyPairing(
+  cfg: { excludeSubmitter?: unknown; onEmptyApprovers?: unknown },
+  ctx: z.RefinementCtx,
+): void {
+  if (cfg.excludeSubmitter !== true || cfg.onEmptyApprovers !== 'auto_approve') return;
+  ctx.addIssue({
+    code: 'custom',
+    path: ['onEmptyApprovers'],
+    message:
+      "onEmptyApprovers: 'auto_approve' cannot be paired with excludeSubmitter: true. "
+      + 'excludeSubmitter removes the submitter from the slate, and when that leaves nobody '
+      + "'auto_approve' approves the request with no one deciding, so a submitter who is the "
+      + 'only approver gets their own request approved: the outcome excludeSubmitter exists to '
+      + "prevent. Choose a policy that never passes the request: 'admin_rescue' (the default, "
+      + "which opens it on the organization's administrators), 'fail', or 'fallback' with a "
+      + 'fallbackApprovers list naming who decides.',
+  });
+}
+
 export const ApprovalNodeConfigSchema = lazySchema(() => strictObject(
   {
     surface: "this approval node's config",
@@ -886,6 +939,11 @@ export const ApprovalNodeConfigSchema = lazySchema(() => strictObject(
    * - **An emptied slate.** Takes the node's `onEmptyApprovers` route, never a
    *   silent pass, and the approval record shows that the exclusion changed
    *   the route (the ruled behaviour, built in `plugin-approvals` by #25573).
+   *   The one policy that would pass it, `'auto_approve'`, is refused beside
+   *   `excludeSubmitter: true` at the parse by
+   *   {@link checkExcludeSubmitterPolicyPairing} (ruling 6386627950 on
+   *   #25635), so "never a silent pass" holds in the contract, not only at
+   *   the run.
    * - **Off by default, and ABSENT when off.** `.optional()`, not
    *   `.default(false)`: a node that does not author the key parses to
    *   exactly the output it parsed to before the key existed, so every stored
@@ -908,7 +966,9 @@ export const ApprovalNodeConfigSchema = lazySchema(() => strictObject(
     + 'removed from the slate `approvers` resolves to, whatever approver type produced them. If that leaves '
     + 'nobody, the request takes the node\'s `onEmptyApprovers` route (`admin_rescue` by default, or '
     + '`fallbackApprovers` under `\'fallback\'`) and never passes silently, and the approval record shows that '
-    + 'the exclusion changed the route. Omitted or false (the default), the slate stays as resolved. '
+    + 'the exclusion changed the route. `onEmptyApprovers: \'auto_approve\'` is refused beside '
+    + '`excludeSubmitter: true`, because it would approve exactly the request this option exists to stop; '
+    + 'choose `\'admin_rescue\'`, `\'fail\'` or `\'fallback\'`. Omitted or false (the default), the slate stays as resolved. '
     + 'The approval engine does not read this key yet, so today the submitter is NOT removed: keep any guard '
     + 'you rely on (an `expression` approver or a validation rule) until it does.',
   ),
@@ -976,7 +1036,8 @@ export const ApprovalNodeConfigSchema = lazySchema(() => strictObject(
    *    slate can only mean a configuration bug.
    *  - `auto_approve` — skip the request and continue down the `approve` edge
    *    with `output.autoApproved = true`. The DingTalk/Feishu default; opt-in
-   *    here because it silently waves the record through.
+   *    here because it silently waves the record through. Refused beside
+   *    `excludeSubmitter: true` ({@link checkExcludeSubmitterPolicyPairing}).
    *  - `fallback` — open the request on {@link ApprovalNodeConfig.fallbackApprovers}
    *    instead: the way to NAME who decides, rather than leave it to the
    *    organization's administrators. Measured elsewhere as
@@ -1058,7 +1119,7 @@ export const ApprovalNodeConfigSchema = lazySchema(() => strictObject(
    */
   maxRevisions: z.number().int().min(0).default(3)
     .describe('Max send-backs for revision before auto-reject (0 = send-back disabled)'),
-}).superRefine(checkFallbackApproversPairing));
+}).superRefine(checkFallbackApproversPairing).superRefine(checkExcludeSubmitterPolicyPairing));
 export type ApprovalNodeConfig = z.input<typeof ApprovalNodeConfigSchema>;
 /** Post-parse shape of {@link ApprovalNodeConfig} — defaults applied, transforms run (ADR-0122). */
 export type ApprovalNodeConfigParsed = z.infer<typeof ApprovalNodeConfigSchema>;