#4045 datastore v3: a parent run recording its child's rejected approval on a nested step is judged as needing approve

Summary

judgeStep in src/domain/datastore_v3/content_bindings.ts (swamp-club#3922) adds approve to a forwarded run record's needed actions whenever a step's approvalDecision changes. That includes the record a parent run writes when its nested workflow step reads a child run whose approval gate was rejected: execution_service.ts (the child-rejected branch of the nested call) calls StepRun.rejectNested(decision, error), which copies the child's decision onto the parent's nested step and fails it.

So a caller holding only run on the parent workflow, resuming a parent run whose child was rejected, forwards a record judged as needing approve on the parent workflow, though no one is deciding anything: the child's approver already did, on the child.

Found while implementing swamp-club#4014 (not changed by it). Not yet reproduced end to end; worth confirming against a serve with a run-only member before fixing.

Expected

Recording a decision on a nested-call step that carries the child run's own decision for its rejected gate needs only run (or is checked against the child's stored record), not approve on the parent.

Where

• judgeStep decisionChanged handling, src/domain/datastore_v3/content_bindings.ts
• StepRun.rejectNested, src/domain/workflows/workflow_run.ts
• the nested-call child-rejected branch in src/domain/workflows/execution_service.ts
• the model property test (run_record_model_property_test.ts) has no legitimate move for a child rejection, which is why it does not catch this