@@ -23,17 +23,28 @@ import { defineFlow } from '@objectstack/spec';
  * covers `org_membership_level` + `expression`; the kinds below are the ones no
  * other flow declares.
  *
- * ## Why `draft`
+ * ## Why `obsolete`
  *
  * Deliberate, not an oversight. The record-backed kinds point at rows a fresh
  * boot does not have: `sys_user` holds only the seeded admin, `sys_team` is
  * empty (the seeded `Team` rows are the DEMO `showcase_team` object), and both
  * unit membership (`sys_business_unit_member`) and position assignment
  * (`sys_user_position`) are runtime admin actions by design — see the seed
- * notes in `src/data/seed/index.ts`. An `active` flow over them would resolve
- * to nobody, which is precisely the silent dead slot #3508 exists to remove.
- * Shipping that as a demo would re-teach the bug. `draft` keeps it out of the
- * runtime while still loading in the designer, which is the surface under test.
+ * notes in `src/data/seed/index.ts`. An armed flow over them would resolve to
+ * nobody, which is precisely the silent dead slot #3508 exists to remove: every
+ * Field Zoo update would start a run that parks at `by_user` and, under
+ * `onEmptyApprovers: 'admin_rescue'`, files a pending approval request on the
+ * organization's administrators. Shipping that as a demo would re-teach the bug.
+ *
+ * `obsolete` is the status the platform declares for "loaded, not armed". The
+ * engine still registers the flow — the designer lists and opens it, which is
+ * the surface under test, and Studio's on/off switch reads it as Off — but it
+ * never hands the flow to a trigger and refuses a direct start with
+ * `FLOW_DISABLED`. ⛔ Not `draft`: a draft flow binds and fires exactly like an
+ * `active` one (only `obsolete` / `invalid` disable — `registerFlow` in
+ * service-automation's engine), which is why every boot logs the draft flows
+ * by name and `os validate` flags them `flow-draft-status-ambiguous`. Pinned by
+ * `test/approver-bindings-specimen-unarmed.test.ts`.
  *
  * `queue` is absent on purpose: #3536 made it non-authorable
  * (`NON_AUTHORABLE_APPROVER_TYPES` → `xEnumDeprecated`) because the engine has
@@ -44,9 +55,10 @@ export const ApproverBindingsFlow = defineFlow({
   label: 'Approver Binding Specimens (#3508)',
   description:
     'Authoring specimen: one approval node per record-backed approver kind, so the designer '
-    + 'renders each Value control. Draft on purpose — a fresh org has no rows for these kinds.',
+    + 'renders each Value control. Obsolete on purpose (loaded, never armed) — a fresh org has '
+    + 'no rows for these kinds, so an armed run would park on the org administrators.',
   type: 'autolaunched',
-  status: 'draft',
+  status: 'obsolete',
   nodes: [
     {
       id: 'start',
 
@@ -2010,8 +2010,8 @@ export const allFlows = [
   // #3447 P2 dogfood: expression approvers + decision outputs, end to end.
   DynamicApprovalFlow,
   // #3508 dogfood: one approval node per record-backed approver kind, so the
-  // designer's Value control has a specimen for each. Draft on purpose — see
-  // the module docstring.
+  // designer's Value control has a specimen for each. Obsolete on purpose
+  // (loaded, never armed) — see the module docstring.
   ApproverBindingsFlow,
   // The recalc behind the two `api` actions, served by the declared
   // `showcase_recalc_estimates_api` endpoint (src/system/apis/).
 
@@ -0,0 +1,112 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#23965] `showcase_approver_bindings` is a DESIGNER specimen: it loads, and
+ * it is never armed.
+ *
+ * Its approval nodes carry empty values over directory kinds a fresh org has
+ * no rows for, so an armed copy resolves to nobody — and, under
+ * `onEmptyApprovers: 'admin_rescue'`, every Field Zoo update starts a run that
+ * parks a pending approval request on the org administrators. It used to ship
+ * as `status: 'draft'` on the belief that draft keeps a flow out of the
+ * runtime. It does not: the engine disables a flow on `obsolete` / `invalid`
+ * only, and binds a draft flow exactly like an `active` one.
+ *
+ * This is an ENGINE reading, not a reading of the `status` literal. A literal
+ * check stays green on any spelling, including one the engine happens not to
+ * disable, which is exactly how `draft` shipped. So the shipped definition —
+ * the module's own export, which the first case proves is the very object
+ * `allFlows` loads, not a copy — is registered on
+ * a real `AutomationEngine` with a recording `record_change` trigger standing
+ * in for `@objectstack/trigger-record-change` (whose `start()` is what
+ * subscribes a flow to the object's write hooks), and the pin asserts what the
+ * engine did with it:
+ *
+ *   - it still LOADS: the engine holds the definition and lists it, which is
+ *     what the metadata door and the designer read;
+ *   - it is NOT ARMED: the trigger was never handed a binding for it, so an
+ *     update to `showcase_field_zoo` has nothing to call;
+ *   - a direct start is refused with `FLOW_DISABLED` and records no run.
+ *
+ * The positive control registers the SAME definition under `draft` and must
+ * see it bound to `showcase_field_zoo` / `record-after-update`. Without it, a
+ * harness whose trigger never binds anything would green every assertion here.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { AutomationEngine } from '@objectstack/service-automation';
+import type { FlowTrigger, FlowTriggerBinding } from '@objectstack/service-automation';
+
+import { ApproverBindingsFlow } from '../src/automation/flows/approver-bindings.flow.js';
+import { allFlows } from '../src/automation/flows/index.js';
+
+const SPECIMEN = 'showcase_approver_bindings';
+
+function silentLogger(): any {
+  const logger: any = { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} };
+  logger.child = () => logger;
+  return logger;
+}
+
+/** A `record_change` trigger that records every binding the engine hands it. */
+function recordingRecordChangeTrigger() {
+  const started: FlowTriggerBinding[] = [];
+  const trigger: FlowTrigger = {
+    type: 'record_change',
+    start(binding) {
+      started.push(binding);
+    },
+    stop() {},
+  };
+  return { trigger, started };
+}
+
+function engineWithTrigger() {
+  const engine = new AutomationEngine(silentLogger());
+  const rec = recordingRecordChangeTrigger();
+  engine.registerTrigger(rec.trigger);
+  return { engine, started: rec.started };
+}
+
+describe('#23965 — showcase_approver_bindings loads but is never armed', () => {
+  it('is part of the app, so the designer has it to open', () => {
+    expect(ApproverBindingsFlow.name).toBe(SPECIMEN);
+    expect(allFlows).toContain(ApproverBindingsFlow);
+  });
+
+  it('positive control: the same definition under `draft` IS bound to Field Zoo updates', () => {
+    const { engine, started } = engineWithTrigger();
+    const control = `${SPECIMEN}_draft_control`;
+    engine.registerFlow(control, { ...ApproverBindingsFlow, name: control, status: 'draft' } as never);
+
+    expect(started.map((b) => ({ flowName: b.flowName, object: b.object, event: b.event }))).toEqual([
+      { flowName: control, object: 'showcase_field_zoo', event: 'record-after-update' },
+    ]);
+  });
+
+  it('the shipped definition registers and lists, but is handed to no trigger', async () => {
+    const { engine, started } = engineWithTrigger();
+    engine.registerFlow(SPECIMEN, ApproverBindingsFlow as never);
+
+    // Loads: the engine holds and lists it.
+    expect(await engine.listFlows()).toContain(SPECIMEN);
+    expect(await engine.getFlow(SPECIMEN)).not.toBeNull();
+
+    // Not armed: no binding reached the record-change trigger, so a Field Zoo
+    // update has no callback to run it through.
+    expect(started.map((b) => b.flowName)).not.toContain(SPECIMEN);
+    expect(engine.getActiveTriggerBindings().map((b) => b.flowName)).not.toContain(SPECIMEN);
+
+    const state = engine.getFlowRuntimeStates().find((s) => s.name === SPECIMEN);
+    expect(state).toMatchObject({ enabled: false, bound: false, status: 'obsolete' });
+  });
+
+  it('a direct start is refused with FLOW_DISABLED and records no run', async () => {
+    const { engine } = engineWithTrigger();
+    engine.registerFlow(SPECIMEN, ApproverBindingsFlow as never);
+
+    const result = await engine.execute(SPECIMEN);
+    expect(result).toMatchObject({ success: false, code: 'FLOW_DISABLED' });
+    expect(await engine.listRuns(SPECIMEN)).toEqual([]);
+  });
+});