@stigmer/server 3.25.0 → 3.27.0

package/src/domain/workflowexecution/__tests__/list-read-scope-summaries.test.ts

@@ -1,27 +1,32 @@
 /**
- * Pins the ListReadScope arm of BOTH getExecutionSummary handlers (C2
- * Stage 4's ExecutionReadScope port, absorbed into the generalized seam
- * by 20260830.01.sp.list-read-scoping):
+ * Pins the read of BOTH getExecutionSummary handlers through the list
+ * index and the ListReadScope's restrict verb:
  *
- *   - a composed scope narrows the aggregation to authorized ids ∩ the
- *     requested org (the Java GetExecutionSummary baseline);
- *   - an EMPTY authorized set answers the proto DEFAULT INSTANCE — the
- *     conformance-pinned multi-tenant zero shape (workflow: success_rate
- *     0 and NO cost summary — the exact opposite of the OSS -1 sentinel
- *     and always-present zero cost) falls out of the scoping;
- *   - NO scope composed = the full scan, org NOT consulted (the OSS
- *     single-user semantics, byte-identity guarded here as well as by
- *     the conformance rosters).
+ *   - the rows are the requested org's, within the time window, read
+ *     through the index in every posture (a row with no creation stamp is
+ *     kept, as the aggregation loop keeps it);
+ *   - a composed scope is offered exactly those rows and never asked to
+ *     enumerate (its enumeration verb throws here); the aggregation runs
+ *     over the rows it keeps;
+ *   - when it keeps NONE the answer is the proto DEFAULT INSTANCE — the
+ *     conformance-pinned multi-tenant zero shape (workflow: success_rate 0
+ *     and NO cost summary, the opposite of the OSS -1 sentinel and
+ *     always-present zero cost);
+ *   - NO scope composed = every row of the org and window, and the OSS
+ *     zero pins hold.
  */
-import { create, toBinary } from "@bufbuild/protobuf";
-import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { afterEach, describe, expect, it } from "vitest";
 
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { ExecutionPhase as AgentExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { GetAgentExecutionSummaryRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
 import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
 import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
-import { GetExecutionSummaryRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
+import {
+  GetExecutionSummaryRequestSchema,
+  SummaryTimeWindow,
+} from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import { createLogger } from "../../../boot/logger.js";
@@ -29,6 +34,8 @@ import type { ListReadScope } from "../../../extensions/list-read-scope.js";
 import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
 import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
 import type { Store } from "../../../store/interface.js";
+import { tempStore } from "../../../store/sqlite/__tests__/support.js";
+import type { TempStore } from "../../../store/sqlite/__tests__/support.js";
 
 import { getExecutionSummary as getAgentSummary } from "../../agentexecution/usage.js";
 import { getExecutionSummary as getWorkflowSummary } from "../get-execution-summary.js";
@@ -40,73 +47,135 @@ const silentLogger = createLogger({
 });
 
 const caller = testCallerIdentity();
+const NOW_SECONDS = BigInt(Math.floor(Date.now() / 1000));
+const DAY = 24n * 60n * 60n;
 
-function scopeOf(ids: ReadonlyArray<string>): ListReadScope {
+interface RecordingScope extends ListReadScope {
+  readonly offered: Array<{ kind: ApiResourceKind; ids: string[] }>;
+}
+
+/** A scope that keeps `allowed`, records what it was offered, and refuses to enumerate. */
+function restrictingScope(allowed: ReadonlyArray<string>): RecordingScope {
+  const offered: Array<{ kind: ApiResourceKind; ids: string[] }> = [];
   return {
-    authorizedResourceIds: () => Promise.resolve(new Set(ids)),
-    restrictListEntries: () => Promise.resolve(new Set<string>()),
+    offered,
+    authorizedResourceIds: () =>
+      Promise.reject(new Error("the summaries never enumerate")),
+    restrictListEntries: (_caller, kind, entries) => {
+      offered.push({ kind, ids: entries.map((e) => e.id).sort() });
+      return Promise.resolve(
+        new Set(entries.map((e) => e.id).filter((id) => allowed.includes(id))),
+      );
+    },
   };
 }
 
-/** A store whose listResources answers the given serialized rows. */
-function listOnlyStore(rows: Uint8Array[]): Store {
-  return { listResources: () => Promise.resolve(rows) } as unknown as Store;
-}
+let temp: TempStore | undefined;
+afterEach(async () => {
+  await temp?.cleanup();
+  temp = undefined;
+});
 
-function workflowExecRow(id: string, org: string, phase: ExecutionPhase) {
-  return toBinary(
-    WorkflowExecutionSchema,
-    create(WorkflowExecutionSchema, {
-      metadata: { id, name: id, slug: id, org },
-      status: { phase },
-    }),
-  );
+function audit(createdDaysAgo: bigint | undefined) {
+  return createdDaysAgo === undefined
+    ? {}
+    : {
+        audit: {
+          specAudit: {
+            createdAt: {
+              seconds: NOW_SECONDS - createdDaysAgo * DAY,
+              nanos: 0,
+            },
+          },
+        },
+      };
 }
 
-function agentExecRow(id: string, org: string, phase: AgentExecutionPhase) {
-  return toBinary(
-    AgentExecutionSchema,
-    create(AgentExecutionSchema, {
-      metadata: { id, name: id, org },
-      status: { phase },
-    }),
-  );
+async function workflowStore(): Promise<Store> {
+  temp = tempStore();
+  const rows: Array<[string, string, ExecutionPhase, bigint | undefined]> = [
+    ["wfe_mine_done", "acme", ExecutionPhase.EXECUTION_COMPLETED, 1n],
+    ["wfe_mine_run", "acme", ExecutionPhase.EXECUTION_IN_PROGRESS, undefined],
+    ["wfe_not_mine", "acme", ExecutionPhase.EXECUTION_FAILED, 1n],
+    ["wfe_stale", "acme", ExecutionPhase.EXECUTION_FAILED, 30n],
+    ["wfe_other_org", "rival", ExecutionPhase.EXECUTION_FAILED, 1n],
+  ];
+  for (const [id, org, phase, days] of rows) {
+    await temp.store.saveResource(
+      ApiResourceKind.workflow_execution,
+      id,
+      WorkflowExecutionSchema,
+      create(WorkflowExecutionSchema, {
+        metadata: { id, name: id, slug: id, org },
+        status: { phase, ...audit(days) },
+      }),
+    );
+  }
+  return temp.store;
 }
 
-describe("workflow getExecutionSummary read scope", () => {
-  const rows = [
-    workflowExecRow("wfe_mine_done", "acme", ExecutionPhase.EXECUTION_COMPLETED),
-    workflowExecRow("wfe_mine_run", "acme", ExecutionPhase.EXECUTION_IN_PROGRESS),
-    // Authorized but in ANOTHER org — the org intersection must drop it.
-    workflowExecRow("wfe_other_org", "rival", ExecutionPhase.EXECUTION_FAILED),
-    // In the org but NOT authorized — the id set must drop it.
-    workflowExecRow("wfe_not_mine", "acme", ExecutionPhase.EXECUTION_FAILED),
+async function agentStore(): Promise<Store> {
+  temp = tempStore();
+  const rows: Array<[string, string]> = [
+    ["aexec_mine", "acme"],
+    ["aexec_not_mine", "acme"],
+    ["aexec_other_org", "rival"],
   ];
-
-  function deps(scope: ListReadScope | undefined) {
-    return {
-      store: listOnlyStore(rows),
-      logger: silentLogger,
-      listReadScope: scope,
-    };
+  for (const [id, org] of rows) {
+    await temp.store.saveResource(
+      ApiResourceKind.agent_execution,
+      id,
+      AgentExecutionSchema,
+      create(AgentExecutionSchema, {
+        metadata: { id, name: id, org },
+        status: {
+          phase: AgentExecutionPhase.EXECUTION_IN_PROGRESS,
+          ...audit(1n),
+        },
+      }),
+    );
   }
+  return temp.store;
+}
+
+const LAST_7D = { org: "acme", timeWindow: SummaryTimeWindow.LAST_7D };
 
-  it("narrows to authorized ids ∩ the requested org", async () => {
+describe("workflow getExecutionSummary read", () => {
+  it("offers the scope the org's rows within the window, and aggregates the ones it keeps", async () => {
+    const scope = restrictingScope([
+      "wfe_mine_done",
+      "wfe_mine_run",
+      "wfe_other_org",
+    ]);
     const summary = await getWorkflowSummary(
-      deps(scopeOf(["wfe_mine_done", "wfe_mine_run", "wfe_other_org"])),
-      create(GetExecutionSummaryRequestSchema, { org: "acme" }),
+      {
+        store: await workflowStore(),
+        logger: silentLogger,
+        listReadScope: scope,
+      },
+      create(GetExecutionSummaryRequestSchema, LAST_7D),
       caller,
     );
+    expect(scope.offered).toEqual([
+      {
+        kind: ApiResourceKind.workflow_execution,
+        ids: ["wfe_mine_done", "wfe_mine_run", "wfe_not_mine"],
+      },
+    ]);
     expect(summary.totalCount).toBe(2);
     expect(summary.activeCount).toBe(1);
     // One terminal (completed) — a real 100%, not the -1 sentinel.
     expect(summary.successRate).toBe(1);
   });
 
-  it("an empty authorized set answers the default instance — the multi-tenant zero shape", async () => {
+  it("answers the default instance when the scope keeps none — the multi-tenant zero shape", async () => {
     const summary = await getWorkflowSummary(
-      deps(scopeOf([])),
-      create(GetExecutionSummaryRequestSchema, { org: "acme" }),
+      {
+        store: await workflowStore(),
+        logger: silentLogger,
+        listReadScope: restrictingScope([]),
+      },
+      create(GetExecutionSummaryRequestSchema, LAST_7D),
       caller,
     );
     expect(summary.successRate).toBe(0);
@@ -115,48 +184,52 @@ describe("workflow getExecutionSummary read scope", () => {
     expect(summary.avgDuration).toBeUndefined();
   });
 
-  it("no scope composed = the full scan; org is NOT consulted (OSS byte-identity)", async () => {
+  it("with no scope composed counts every row of the org and window, and keeps the OSS zero pins", async () => {
     const summary = await getWorkflowSummary(
-      deps(undefined),
-      create(GetExecutionSummaryRequestSchema, { org: "acme" }),
+      {
+        store: await workflowStore(),
+        logger: silentLogger,
+        listReadScope: undefined,
+      },
+      create(GetExecutionSummaryRequestSchema, LAST_7D),
       caller,
     );
-    // All four rows counted, the rival org's included; and the OSS zero
-    // pins hold: the -1 sentinel family and the ALWAYS-present cost
-    // summary.
-    expect(summary.totalCount).toBe(4);
+    // The org's three rows in the window, the unstamped one included; the
+    // stale row and the rival org's row are not read.
+    expect(summary.totalCount).toBe(3);
     expect(summary.totalCost).toBeDefined();
   });
 });
 
-describe("agent getExecutionSummary read scope", () => {
-  const rows = [
-    agentExecRow("aexec_mine", "acme", AgentExecutionPhase.EXECUTION_IN_PROGRESS),
-    agentExecRow("aexec_other_org", "rival", AgentExecutionPhase.EXECUTION_IN_PROGRESS),
-    agentExecRow("aexec_not_mine", "acme", AgentExecutionPhase.EXECUTION_IN_PROGRESS),
-  ];
-
-  function deps(scope: ListReadScope | undefined) {
+describe("agent getExecutionSummary read", () => {
+  function deps(store: Store, scope: ListReadScope | undefined) {
     return {
-      store: listOnlyStore(rows),
+      store,
       logger: silentLogger,
       authorizer: newPermissiveSingleTeamAuthorizer(),
       listReadScope: scope,
     };
   }
 
-  it("narrows to authorized ids ∩ the requested org", async () => {
+  it("offers the scope the org's rows as agent executions, and aggregates the ones it keeps", async () => {
+    const scope = restrictingScope(["aexec_mine", "aexec_other_org"]);
     const summary = await getAgentSummary(
-      deps(scopeOf(["aexec_mine", "aexec_other_org"])),
+      deps(await agentStore(), scope),
       create(GetAgentExecutionSummaryRequestSchema, { org: "acme" }),
       caller,
     );
+    expect(scope.offered).toEqual([
+      {
+        kind: ApiResourceKind.agent_execution,
+        ids: ["aexec_mine", "aexec_not_mine"],
+      },
+    ]);
     expect(summary.activeCount).toBe(1);
   });
 
-  it("an empty authorized set answers the default instance", async () => {
+  it("answers the default instance when the scope keeps none", async () => {
     const summary = await getAgentSummary(
-      deps(scopeOf([])),
+      deps(await agentStore(), restrictingScope([])),
       create(GetAgentExecutionSummaryRequestSchema, { org: "acme" }),
       caller,
     );
@@ -165,29 +238,12 @@ describe("agent getExecutionSummary read scope", () => {
     expect(summary.avgDuration).toBeUndefined();
   });
 
-  it("no scope composed = the full scan across orgs (OSS byte-identity)", async () => {
+  it("with no scope composed counts every row of the org", async () => {
     const summary = await getAgentSummary(
-      deps(undefined),
-      create(GetAgentExecutionSummaryRequestSchema, { org: "acme" }),
-      caller,
-    );
-    expect(summary.activeCount).toBe(3);
-  });
-
-  it("the scope receives the kind it is scoping (agent_execution here)", async () => {
-    const kinds: ApiResourceKind[] = [];
-    const recordingScope: ListReadScope = {
-      authorizedResourceIds: (_caller, kind) => {
-        kinds.push(kind);
-        return Promise.resolve(new Set<string>());
-      },
-      restrictListEntries: () => Promise.resolve(new Set<string>()),
-    };
-    await getAgentSummary(
-      deps(recordingScope),
+      deps(await agentStore(), undefined),
       create(GetAgentExecutionSummaryRequestSchema, { org: "acme" }),
       caller,
     );
-    expect(kinds).toEqual([ApiResourceKind.agent_execution]);
+    expect(summary.activeCount).toBe(2);
   });
 });

package/src/domain/workflowexecution/__tests__/workflowexecution.test.ts

@@ -9,10 +9,11 @@
  *
  * Load-bearing pins the zero-record conformance arm cannot cover:
  *   - list's legacy-phase fallback vs filter.phases precedence, the T13
- *     structured filter over seeded rows, the started_at-descending sort
- *     default, and the total_pages placeholder;
+ *     structured filter over seeded rows, the newest-created default
+ *     order and its cursor pages (a token refused on another request),
+ *     and a non-default sort answering its first page with no token;
  *   - listByWorkflow matching EITHER spec.workflow_id or
- *     spec.workflow_instance_id;
+ *     spec.workflow_instance_id, and paging the workflow's runs;
  *   - getEventLog cursor pagination over REAL persisted events: has_more
  *     from the +1 fetch, latest_sequence, the 500 cap, the multi-type
  *     in-memory filter, and the malformed-record skip;
@@ -20,7 +21,8 @@
  *     avg duration, failure ranks, cost breakdown, workflow scoping,
  *     time-window cutoff);
  *   - listPendingApprovals projection (task_name not task_id; requester
- *     from spec audit) and its pre-truncation total_count;
+ *     from spec audit), its pre-truncation total_count, and its cursor
+ *     splitting one execution's waiting tasks across pages;
  *   - update's status-clearing standard build and delete's audit-trail
  *     return, over the wire.
  */
@@ -246,7 +248,10 @@ function eventRecord(
 
 describe("get / list / listByWorkflow over the wire", () => {
   it("get answers NotFound for an unknown id", async () => {
-    await expectCode(() => query.get({ value: "wfexec_missing" }), Code.NotFound);
+    await expectCode(
+      () => query.get({ value: "wfexec_missing" }),
+      Code.NotFound,
+    );
   });
 
   it("get round-trips a seeded execution", async () => {
@@ -269,9 +274,7 @@ describe("get / list / listByWorkflow over the wire", () => {
         (entry) => entry.status?.phase === ExecutionPhase.EXECUTION_FAILED,
       ),
     ).toBe(true);
-    expect(legacy.entries.map((entry) => entry.metadata?.id)).toContain(
-      failed,
-    );
+    expect(legacy.entries.map((entry) => entry.metadata?.id)).toContain(failed);
     expect(legacy.totalPages).toBe(1);
 
     // filter.phases supersedes the legacy field: a COMPLETED filter with a
@@ -288,17 +291,115 @@ describe("get / list / listByWorkflow over the wire", () => {
     ).toBe(true);
   });
 
-  it("list defaults to started_at descending", async () => {
-    const early = await seed(
-      seedInput({ startedAt: "2026-05-23T10:00:00Z" }),
+  it("list defaults to newest created first, so a queued run leads", async () => {
+    const org = "order-org";
+    const started = await seed(
+      seedInput({
+        org,
+        startedAt: "2026-05-23T14:00:00Z",
+        createdAtMs: Date.parse("2026-05-23T09:00:00Z"),
+      }),
+    );
+    const queued = await seed(
+      seedInput({
+        org,
+        phase: ExecutionPhase.EXECUTION_PENDING,
+        createdAtMs: Date.parse("2026-05-23T10:00:00Z"),
+      }),
     );
-    const late = await seed(seedInput({ startedAt: "2026-05-23T14:00:00Z" }));
 
-    const result = await query.list({});
-    const positions = new Map(
-      result.entries.map((entry, index) => [entry.metadata?.id, index]),
+    const result = await query.list({ org });
+    expect(result.entries.map((entry) => entry.metadata?.id)).toEqual([
+      queued,
+      started,
+    ]);
+  });
+
+  it("list pages newest created first with no gap or duplicate, and refuses a token on another request", async () => {
+    const org = "paging-org";
+    const base = Date.parse("2026-09-01T00:00:00Z");
+    const newestFirst: string[] = [];
+    for (let i = 0; i < 5; i++) {
+      newestFirst.unshift(
+        await seed(seedInput({ org, createdAtMs: base + i * 1000 })),
+      );
+    }
+    await seed(seedInput({ org: "other-org", createdAtMs: base + 10_000 }));
+
+    const walked: string[] = [];
+    let pageToken = "";
+    let firstToken = "";
+    do {
+      const page = await query.list({ org, pageSize: 2, pageToken });
+      expect(page.entries.length).toBeLessThanOrEqual(2);
+      expect(page.totalPages).toBe(page.nextPageToken === "" ? 1 : 0);
+      walked.push(...page.entries.map((entry) => entry.metadata!.id));
+      firstToken = firstToken === "" ? page.nextPageToken : firstToken;
+      pageToken = page.nextPageToken;
+    } while (pageToken !== "");
+    expect(walked).toEqual(newestFirst);
+
+    const replayed = await expectCode(
+      () =>
+        query.list({ org: "other-org", pageSize: 2, pageToken: firstToken }),
+      Code.InvalidArgument,
+    );
+    expect(replayed.rawMessage).toBe(
+      "page_token was issued for a different request",
     );
-    expect(positions.get(late)).toBeLessThan(positions.get(early)!);
+  });
+
+  it("a sort other than creation sorts the whole set and returns its first page with no token", async () => {
+    const org = "sorted-org";
+    const hours = ["10", "12", "14"];
+    for (const hour of hours) {
+      await seed(
+        seedInput({
+          org,
+          startedAt: `2026-05-23T${hour}:00:00Z`,
+          createdAtMs: Date.parse(`2026-05-20T${hour}:00:00Z`),
+        }),
+      );
+    }
+
+    const page = await query.list({
+      org,
+      pageSize: 2,
+      sortField: ExecutionSortField.STARTED_AT,
+      sortAscending: true,
+    });
+    expect(page.entries.map((entry) => entry.status?.startedAt)).toEqual([
+      "2026-05-23T10:00:00Z",
+      "2026-05-23T12:00:00Z",
+    ]);
+    expect(page.nextPageToken).toBe("");
+  });
+
+  it("listByWorkflow pages the workflow's runs", async () => {
+    const base = Date.parse("2026-09-03T00:00:00Z");
+    const newestFirst: string[] = [];
+    for (let i = 0; i < 3; i++) {
+      newestFirst.unshift(
+        await seed(
+          seedInput({ workflowId: "wf_paged", createdAtMs: base + i * 1000 }),
+        ),
+      );
+    }
+
+    const first = await query.listByWorkflow({
+      workflowId: "wf_paged",
+      pageSize: 2,
+    });
+    expect(first.nextPageToken).not.toBe("");
+    const second = await query.listByWorkflow({
+      workflowId: "wf_paged",
+      pageSize: 2,
+      pageToken: first.nextPageToken,
+    });
+    expect(second.nextPageToken).toBe("");
+    expect(
+      [...first.entries, ...second.entries].map((entry) => entry.metadata?.id),
+    ).toEqual(newestFirst);
   });
 
   it("listByWorkflow requires workflow_id and matches either spec reference", async () => {
@@ -343,12 +444,17 @@ describe("getEventLog over the wire (CW-7 pagination contract)", () => {
     const records: WorkflowExecutionEventRecord[] = [];
     for (let sequence = 1; sequence <= 5; sequence++) {
       records.push(
-        eventRecord(id, sequence, WorkflowEventType.task_started, `t${sequence}`),
+        eventRecord(
+          id,
+          sequence,
+          WorkflowEventType.task_started,
+          `t${sequence}`,
+        ),
       );
     }
-    expect(
-      await server.store.appendWorkflowExecutionEvents(id, records),
-    ).toBe(5);
+    expect(await server.store.appendWorkflowExecutionEvents(id, records)).toBe(
+      5,
+    );
 
     const page1 = await query.getEventLog({ executionId: id, pageSize: 2 });
     expect(page1.events).toHaveLength(2);
@@ -360,10 +466,7 @@ describe("getEventLog over the wire (CW-7 pagination contract)", () => {
       pageSize: 2,
       afterSequence: page1.latestSequence,
     });
-    expect(page2.events.map((event) => event.sequenceNumber)).toEqual([
-      3n,
-      4n,
-    ]);
+    expect(page2.events.map((event) => event.sequenceNumber)).toEqual([3n, 4n]);
     expect(page2.hasMore).toBe(true);
 
     const page3 = await query.getEventLog({
@@ -444,7 +547,10 @@ describe("getEventLog over the wire (CW-7 pagination contract)", () => {
     ]);
     const tailPage = await query.getEventLog({ executionId: tail });
     expect(tailPage.events.map((event) => event.sequenceNumber)).toEqual([1n]);
-    expect(tailPage.latestSequence, "malformed rows never advance the cursor").toBe(1n);
+    expect(
+      tailPage.latestSequence,
+      "malformed rows never advance the cursor",
+    ).toBe(1n);
   });
 
   it("caps page_size at 500 and defaults to 100", async () => {
@@ -548,7 +654,10 @@ describe("getExecutionSummary over the wire", () => {
     });
     expect(windowed.totalCount).toBe(0);
     expect(windowed.successRate).toBe(-1);
-    expect(windowed.totalCost, "zero cost summary is ALWAYS present").toBeDefined();
+    expect(
+      windowed.totalCost,
+      "zero cost summary is ALWAYS present",
+    ).toBeDefined();
     expect(windowed.avgDuration, "no completed runs → absent").toBeUndefined();
 
     const allTime = await query.getExecutionSummary({
@@ -603,9 +712,9 @@ describe("listPendingApprovals over the wire", () => {
     expect(entry?.workflowName).toBe("Approval Flow");
     expect(entry?.requester).toBe("usr_seeder");
     expect(entry?.uiHint).toBe("approval-form");
-    expect(
-      result.entries.some((item) => item.taskName === "paused-gate"),
-    ).toBe(false);
+    expect(result.entries.some((item) => item.taskName === "paused-gate")).toBe(
+      false,
+    );
   });
 
   it("total_count is the pre-truncation total", async () => {
@@ -621,6 +730,54 @@ describe("listPendingApprovals over the wire", () => {
     expect(page.entries).toHaveLength(1);
     expect(page.totalCount).toBeGreaterThanOrEqual(3);
   });
+
+  it("pages newest execution first, then each execution's waiting tasks in order, across page boundaries", async () => {
+    const org = "approvals-paging-org";
+    const waiting = (taskName: string) => ({
+      taskName,
+      status: WorkflowTaskStatus.WORKFLOW_TASK_WAITING_APPROVAL,
+    });
+    const older = await seed(
+      seedInput({
+        org,
+        phase: ExecutionPhase.EXECUTION_IN_PROGRESS,
+        createdAtMs: Date.parse("2026-09-04T00:00:00Z"),
+        tasks: [waiting("older-gate")],
+      }),
+    );
+    const newer = await seed(
+      seedInput({
+        org,
+        phase: ExecutionPhase.EXECUTION_IN_PROGRESS,
+        createdAtMs: Date.parse("2026-09-04T00:00:01Z"),
+        tasks: [waiting("first-gate"), waiting("second-gate")],
+      }),
+    );
+
+    const walked: Array<[string, string]> = [];
+    let pageToken = "";
+    do {
+      const page = await query.listPendingApprovals({
+        org,
+        pageSize: 1,
+        pageToken,
+      });
+      expect(page.totalCount).toBe(3);
+      walked.push(
+        ...page.entries.map((entry): [string, string] => [
+          entry.executionId,
+          entry.taskName,
+        ]),
+      );
+      pageToken = page.nextPageToken;
+    } while (pageToken !== "");
+
+    expect(walked).toEqual([
+      [newer, "first-gate"],
+      [newer, "second-gate"],
+      [older, "older-gate"],
+    ]);
+  });
 });
 
 describe("updateStatus over the wire", () => {
@@ -717,7 +874,9 @@ describe("subscribe over the wire (streaming smoke through the real transport)",
       }
     }, Code.InvalidArgument);
     await expectCode(async () => {
-      for await (const _ of query.subscribe({ executionId: "wfexec_missing" })) {
+      for await (const _ of query.subscribe({
+        executionId: "wfexec_missing",
+      })) {
         break;
       }
     }, Code.NotFound);
@@ -1256,7 +1415,10 @@ describe("submitFileDecision over the wire (propagation through the REAL in-proc
     const changeSet = child.status?.fileChangeSets.find(
       (cs) => cs.id === changeSetId,
     );
-    expect(changeSet?.decisions, "the child recorded the decision").toHaveLength(1);
+    expect(
+      changeSet?.decisions,
+      "the child recorded the decision",
+    ).toHaveLength(1);
   });
 
   it("the child's actionable rejection PROPAGATES unchanged (the file-decision asymmetry)", async () => {