fix(plugin-approvals): require warn on ApprovalServiceOptions logger sink (#10937)

Drops the `?` from `warn` on ApprovalServiceOptions['logger'] so a sink
declaring an optional `error` always has a guaranteed durability-report
channel (#9754, #10556). `error` stays optional. This is the thirteenth of
the card's thirteen mechanical repairs -- held out of #10691 to serialize
against PR #10547, which owned this file while open; that fence cleared
when #10739 merged.

Deletes the now-stale row from the shrink-only
scripts/optional-error-sink-contract.baseline.json (the checker itself
named the row as no-longer-red). The other two rows -- plugin-security's
default-sink design call and service-settings' no-fallback design call --
are untouched; both remain escalated to the maintainer.

No construction site needed a widening fix: the sole non-test call
(ApprovalsServicePlugin.start) passes ctx.logger, whose warn is already
required by the core Logger contract.

Part of #10556.


Claude-Session: https://claude.ai/code/session_0f14f70b-575c-5f2b-a235-4000a55db042

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-warren

.changeset/approval-service-logger-warn-required.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/plugin-approvals": minor
+---
+
+**BREAKING** (compile-time only): `ApprovalServiceOptions['logger']` now
+declares a **non-optional** `warn`, so a durability report always has
+somewhere to land (#9754, #10556). This is the thirteenth of the thirteen
+mechanical repairs the card names — held out of #10691 to serialize against
+PR #10547, which owned `approval-service.ts` while it was open; that fence
+has since cleared.
+
+`minor`, not `major`: during the launch window this stack ships breaking
+changes as `minor` — every publishable package versions in lockstep, so a
+`major` would promote the whole release. `patch` would be wrong in the other
+direction, because this *can* break a consumer's build. This is the same
+reasoning #10691 used for the twelve sibling repairs; no exemption for a
+types-only break was found there either, and none applies here.
+
+`error` stays optional — hosts legitimately inject reduced sinks, and
+requiring `error` was measured and rejected as #9754 option C. What changes
+is that its *absence* now has a declared, guaranteed destination. Call sites
+keep the `logger?.warn?.(…)` spelling as the backstop for hosts the type
+cannot reach, so **no runtime behaviour changes**: nothing that printed
+before stops printing, and nothing silent starts printing.
+
+### Who has to change, and what to do
+
+Only a caller that constructs `ApprovalService` (or an `ApprovalServiceOptions`
+value) with a `logger` object that has **no `warn` method** — for example
+`{ error }` alone. Add a `warn` member; there is no rename, no removal, and no
+stored value or metadata key to rewrite. The only non-test construction site
+in this repo (`ApprovalsServicePlugin.start`, in this same package) passes the
+kernel `ctx.logger`, whose `warn` is already required, so the in-repo cost is
+zero.
+
+<!-- adr-0087: not-required (runtime-interface-only packages/plugins/plugin-approvals/src/approval-service.ts#ApprovalServiceOptions) the tightened type is a plain TypeScript logger interface -- no Zod projection, no metadata surface, and it is referenced by none -- so `objectstack migrate meta` has nothing to rewrite. Nothing is removed or renamed and no stored value moves; the only consumer action is adding a `warn` member at a construction site the compiler names. -->

packages/plugins/plugin-approvals/src/approval-service.ts

@@ -536,7 +536,7 @@ function rowFromAction(row: any): ApprovalActionRow {
 export interface ApprovalServiceOptions {
   engine: ApprovalEngine;
   clock?: ApprovalClock;
-  logger?: { info?: (msg: any, ...rest: any[]) => void; warn?: (msg: any, ...rest: any[]) => void; error?: (msg: any, ...rest: any[]) => void; debug?: (msg: any, ...rest: any[]) => void };
+  logger?: { info?: (msg: any, ...rest: any[]) => void; warn: (msg: any, ...rest: any[]) => void; error?: (msg: any, ...rest: any[]) => void; debug?: (msg: any, ...rest: any[]) => void };
   /**
    * Optional automation surface used to resume a suspended flow run when a
    * decision finalises a request. Usually attached after construction via

scripts/optional-error-sink-contract.baseline.json

@@ -21,19 +21,17 @@
     "           metadata-protocol, plugin-approvals/lifecycle-hooks, both plugin-audit sinks,",
     "           both plugin-auth sinks, plugin-email/attachment-reclaim, plugin-reports,",
     "           plugin-sharing, plugin-webhooks and service-knowledge.",
-    "  = 3    — what is left, and NONE of the three is left for lack of effort:",
-    "           one is a serialisation leftover whose reason has expired (approval-service.ts),",
-    "           and two are DESIGN calls escalated to the maintainer rather than answered by a",
-    "           dev to make this checker green (security-plugin.ts, settings-service.types.ts)."
+    "  = 3    — what was left after #10556's first PR, and NONE of the three was left for lack",
+    "           of effort: one was a serialisation leftover whose reason had expired",
+    "           (approval-service.ts), and two are DESIGN calls escalated to the maintainer",
+    "           rather than answered by a dev to make this checker green (security-plugin.ts,",
+    "           settings-service.types.ts).",
+    "  -1     — #10556's follow-up dispatch repaired the serialisation leftover once its",
+    "           fence (PR #10547/#10739) cleared: `logger@ApprovalServiceOptions` dropped the",
+    "           `?` from `warn`, mechanically identical to the twelve already paid down.",
+    "  = 2    — both remaining rows are the escalated DESIGN calls; neither is a `?` deletion."
   ],
   "entries": [
-    {
-      "file": "packages/plugins/plugin-approvals/src/approval-service.ts",
-      "sink": "logger@ApprovalServiceOptions",
-      "verdict": "optional-fallback",
-      "members": "{ info? warn? error? debug? }",
-      "note": "Approval-service options bag. Mechanically identical to the twelve repaired in #10556 — drop the `?` from `warn`. Held out of that PR to serialize against PR #10546, which owned this file while it was open. #10546 has since MERGED (2026-08-21), so the reason this row is still here has expired: it is a one-line repair awaiting a dispatch, not a design call and not an exemption."
-    },
     {
       "file": "packages/plugins/plugin-security/src/security-plugin.ts",
       "sink": "logger@SecurityPlugin",