test(automation): pin the run-user remedies at the store, the text slot and the CEL scope

Claude-Session: https://claude.ai/code/session_01VZqqwTj2wsihZEbfT6yyYN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/services/service-automation/src/builtin/crud-fields-value-envelope.test.ts

@@ -274,10 +274,12 @@ describe.each(NODE_TYPES)('%s `fields.*` — the retired `{…}` template dialec
     expect(writes0(withUser.writes).subject).toBe(before.subject);
     expect(before.subject).toBe('u1');
 
+    // A user-less run writes data only under an explicit `runAs: 'system'` (ADR-0049).
     const userless = await makeStack();
-    userless.automation.registerFlow('price_quote', writeFlow(nodeType, {
-      subject: { dialect: 'cel', source: 'current_user != null ? current_user.id : null' },
-    }));
+    userless.automation.registerFlow('price_quote', {
+      ...writeFlow(nodeType, { subject: { dialect: 'cel', source: 'current_user != null ? current_user.id : null' } }),
+      runAs: 'system',
+    });
     const res2 = await userless.automation.execute('price_quote', { params: PARAMS } as any);
     expect(res2.success, res2.error).toBe(true);
     expect(interpolate({ subject: '{$User.Id}' }, new Map(), {} as any).subject).toBeUndefined();

packages/services/service-automation/src/builtin/text-slot-template.test.ts

@@ -355,12 +355,12 @@ describe('#22477 — a text-slot hole may root only at a `$` variable the engine
         const withUser = harness();
         withUser.engine.registerFlow('by_user', flow('current_user.id') as never);
         expect((await withUser.engine.execute('by_user', ctx())).success).toBe(true);
-        expect(withUser.emitted[0]!.payload).toMatchObject({ message: 'By usr_7' });
+        expect(withUser.emitted[0]!.payload).toMatchObject({ body: 'By usr_7' });
 
         const userless = harness();
         userless.engine.registerFlow('by_user', flow('current_user != null ? current_user.id : null') as never);
         const noUser = { event: 'manual', object: 'account', record: ACME } as unknown as AutomationContext;
         expect((await userless.engine.execute('by_user', noUser)).success).toBe(true);
-        expect(userless.emitted[0]!.payload).toMatchObject({ message: 'By ' });
+        expect(userless.emitted[0]!.payload).toMatchObject({ body: 'By ' });
     });
 });

packages/services/service-automation/src/builtin/value-slot-template-grammar.test.ts

@@ -34,7 +34,7 @@
  */
 
 import { describe, expect, it } from 'vitest';
-import { valueSlotTemplateRefusals } from '@objectstack/spec/automation';
+import { VALUE_SLOT_TEMPLATE_REFUSAL, valueSlotTemplateRefusals } from '@objectstack/spec/automation';
 import { AutomationEngine } from '../engine.js';
 import { interpolateString } from './template.js';
 
@@ -67,8 +67,9 @@ describe('the run user — `{$User.*}` — is REFUSED, and its remedy reads what
   /** A run context the way the trigger doors build one: no `user` object, ever. */
   const SHIPPED = { userId: 'usr_1', positions: ['org_member'], tenantId: 'org_1' } as never;
   const USERLESS = {} as never;
+  /** The CEL sources the refusal of `token` prints, in order — read after the rule sentence, whose own `'…'` is not a remedy. */
   const sources = (token: string): string[] => {
-    const message = valueSlotTemplateRefusals(token)[0]?.message ?? '';
+    const message = (valueSlotTemplateRefusals(token)[0]?.message ?? '').slice(VALUE_SLOT_TEMPLATE_REFUSAL.length);
     return [...message.matchAll(/\{ dialect: 'cel', source: '([^']*)' \}/g)].map((m) => m[1]!);
   };