[Expense] Keep approver filters to exact submitter membership

[Prangshuman Das (t-prda)]

Scope

AB#646383

Exact approver-membership layer above #11452 in native stack #11893.

Build filters from exact user values using native SetRange/GetFilter, rather than projecting compressed ranges from approval-setup rows onto a different table. This prevents including an unassigned user between assigned endpoints and preserves literal wildcard/pipe values.

Retain the corrected default-fallback fixture and explicit wildcard, pipe and range-gap regressions. Re-enable only DefaultApproverFilterQuotesWildcardUserNo; the 2000-character error guard remains.

All upstream travel lifecycle permissions, posted-history checks, report-creation postcondition and telemetry changes are preserved. The deletion-only fixture from #11452 remains separate from the upstream lifecycle fixture.

Validation

Exact parent ancestry, file scope, whitespace and exclusion ownership checks pass. This layer's added/removed source lines are unchanged relative to its refreshed parent. Upstream changes are inherited through the main merge, not reverted. Earlier exact-head cumulative artifact evidence is historical after this parent reconciliation; fresh new-head runtime validation is pending. Existing excluded PDF, IN/RU gaps and tolerated-native distinctions remain; no absent/excluded case is claimed passing.

Validation limits

The previous UserPassword HTTP 401/200/401 result is historical after this reconciliation. CU139496 MicrosoftAuthenticationRespectsServerAuthMode still executes all three requests; Windows200/200/200 runtime remains unverified. The workflow clean-codeunit gate stays default-off and uptake stays explicitly enabled. No provider, authentication contract, new public event, NAV selector or foreign NST change was introduced. Excluded PDF cases and absent/excluded country/native cases remain unverified; prior tolerated-native results are not universal passes. The 59 owned re-enabled methods cover the reviewed fixes, not59 distinct product defects. Validation drafts remain Do Not Merge, outside native stack #11893.

Current checkpoint

Head 8aa85e974232a884d18e90a53cec61a2c63bf985, tree 4d05dd4d81175301c6de9498c1f0d7f74d41211f; parent f3b84be776a95f01d73b3d15c11095e9807b03ba.

Forward-integrated captured main bb7111877ff786951b86a1a0f80d8b39b8f5dacd, including upstream CLEAN27 removal 82b11d26c073de93df3aab17434069f72feab640 (PR12066), to align the direct stacked-PR warning gate. The prior direct uptake checkout retained obsolete source while warning-reference run37020063048 used main73d5794e; RU and CH therefore each reported51 additional warnings (36 AA0244,15 AA0218). Main-targeted RU validations already passed with cleaned source. No warning suppression, parameter rename, partial cherry-pick, or comparator change was made.

Local Pester:117 passed, zero failed/skipped at exact workflow, uptake and full heads. Every layer retains its exact owned patch; all changed baseline blobs equal captured main, and all remaining blobs—including exclusions—are unchanged. The23 committed wrappers/shared success-only finalizer, generator removal, current-process credential identity, ACLs, buffer clearing and narrowed platform classifier remain intact; ordinary configured reruns are unchanged.

Accepted cleanup limitation: failed/cancelled runs rely on normal container teardown; no hard-runner-loss guarantee. Normal CI uses per-run disposable credentials, but supplied credentials may differ. Hook logs prove invocation, not necessarily explicit deletion if teardown already removed the file.

Uptake retains the five query-safe URL compositions in CU148343 StandardSubmissionExposesPolicySnapshot, all assertions,8 methods, setup restoration and the single unlimited-approval fixture. Workflow remains default-off; uptake enables clean execution. Auth visibility/provider contracts and HTTP scenario are preserved. Upstream shared Spend Request zero-amount UnitTest semantics and permission cleanup from PR11561 remain unchanged. CU139806 TestGetCompanyAndEnvironmentDescriptions stays excluded pending its original rationale/current NAV verification (PR11741).

Fresh exact-head GitHub CI is pending, not passed. Previous runs are historical for these new commits. Verify all8 activity methods across22 countries if present; Windows runtime and excluded PDF/native coverage remain unverified. Only this captured main was integrated—no repeated baseline chasing. Merged prefix/native stack #11893 and draft/ready states remain unchanged; validation drafts remain Do Not Merge.

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.

[github-actions]

Issue #11561 is not valid. Please make sure you link an issue that exists, is open and is approved.