@objectstack/plugin-approvals 16.0.0 → 17.0.0-rc.0

package/dist/index.mjs

@@ -54,7 +54,8 @@ var init_en_objects_generated = __esm({
               pending: "pending",
               approved: "approved",
               rejected: "rejected",
-              recalled: "recalled"
+              recalled: "recalled",
+              returned: "returned"
             }
           },
           current_step: {
@@ -96,7 +97,11 @@ var init_en_objects_generated = __esm({
         },
         _views: {
           my_pending: {
-            label: "My Pending"
+            label: "My Pending",
+            emptyState: {
+              title: "No pending approvals",
+              message: "You're all caught up."
+            }
           },
           submitted_by_me: {
             label: "I Submitted"
@@ -107,6 +112,92 @@ var init_en_objects_generated = __esm({
           all_requests: {
             label: "All"
           }
+        },
+        _actions: {
+          approval_approve: {
+            label: "Approve",
+            successMessage: "Approved.",
+            params: {
+              comment: {
+                label: "Comment"
+              },
+              attachments: {
+                label: "Attachments"
+              }
+            }
+          },
+          approval_reject: {
+            label: "Reject",
+            confirmText: "Reject this request? A rejection is final for every approver.",
+            successMessage: "Rejected.",
+            params: {
+              comment: {
+                label: "Comment"
+              },
+              attachments: {
+                label: "Attachments"
+              }
+            }
+          },
+          approval_reassign: {
+            label: "Reassign",
+            successMessage: "Reassigned.",
+            params: {
+              to: {
+                label: "New approver",
+                helpText: "User to hand this step to"
+              },
+              comment: {
+                label: "Comment"
+              }
+            }
+          },
+          approval_send_back: {
+            label: "Send back",
+            successMessage: "Sent back for revision.",
+            params: {
+              comment: {
+                label: "Reason"
+              }
+            }
+          },
+          approval_request_info: {
+            label: "Request info",
+            successMessage: "Information requested.",
+            params: {
+              comment: {
+                label: "What do you need?"
+              }
+            }
+          },
+          approval_remind: {
+            label: "Send reminder",
+            successMessage: "Reminder sent.",
+            params: {
+              comment: {
+                label: "Note"
+              }
+            }
+          },
+          approval_recall: {
+            label: "Recall",
+            confirmText: "Recall this request? Approvers can no longer act on it and the record is unlocked.",
+            successMessage: "Recalled.",
+            params: {
+              comment: {
+                label: "Comment"
+              }
+            }
+          },
+          approval_resubmit: {
+            label: "Resubmit",
+            successMessage: "Resubmitted.",
+            params: {
+              comment: {
+                label: "What changed?"
+              }
+            }
+          }
         }
       },
       sys_approval_action: {
@@ -138,7 +229,14 @@ var init_en_objects_generated = __esm({
               approve: "approve",
               reject: "reject",
               recall: "recall",
-              escalate: "escalate"
+              escalate: "escalate",
+              reassign: "reassign",
+              remind: "remind",
+              request_info: "request_info",
+              comment: "comment",
+              revise: "revise",
+              resubmit: "resubmit",
+              ooo_substitute: "ooo_substitute"
             }
           },
           actor_id: {
@@ -147,13 +245,21 @@ var init_en_objects_generated = __esm({
           comment: {
             label: "Comment"
           },
+          attachments: {
+            label: "Attachments",
+            help: "Files supporting this action \u2014 e.g. a signed contract or evidence (#3266)."
+          },
           created_at: {
             label: "Created At"
           }
         },
         _views: {
           recent: {
-            label: "Recent"
+            label: "Recent",
+            emptyState: {
+              title: "No approval actions yet",
+              message: "Actions are logged automatically when approvals progress."
+            }
           },
           by_actor: {
             label: "By Actor"
@@ -257,7 +363,8 @@ var init_zh_CN_objects_generated = __esm({
               pending: "\u5F85\u5904\u7406",
               approved: "\u5DF2\u6279\u51C6",
               rejected: "\u5DF2\u62D2\u7EDD",
-              recalled: "\u5DF2\u64A4\u56DE"
+              recalled: "\u5DF2\u64A4\u56DE",
+              returned: "\u5DF2\u9000\u56DE\u4FEE\u6539"
             }
           },
           current_step: {
@@ -299,7 +406,11 @@ var init_zh_CN_objects_generated = __esm({
         },
         _views: {
           my_pending: {
-            label: "\u6211\u7684\u5F85\u529E"
+            label: "\u6211\u7684\u5F85\u529E",
+            emptyState: {
+              title: "\u6682\u65E0\u5F85\u529E\u5BA1\u6279",
+              message: "\u5168\u90E8\u5904\u7406\u5B8C\u6BD5\uFF0C\u6CA1\u6709\u7B49\u5F85\u4F60\u5BA1\u6279\u7684\u8BF7\u6C42\u3002"
+            }
           },
           submitted_by_me: {
             label: "\u6211\u63D0\u4EA4\u7684"
@@ -310,6 +421,92 @@ var init_zh_CN_objects_generated = __esm({
           all_requests: {
             label: "\u5168\u90E8"
           }
+        },
+        _actions: {
+          approval_approve: {
+            label: "\u901A\u8FC7",
+            successMessage: "\u5DF2\u901A\u8FC7\u3002",
+            params: {
+              comment: {
+                label: "\u5BA1\u6279\u610F\u89C1"
+              },
+              attachments: {
+                label: "\u9644\u4EF6"
+              }
+            }
+          },
+          approval_reject: {
+            label: "\u62D2\u7EDD",
+            confirmText: "\u62D2\u7EDD\u8BE5\u8BF7\u6C42\uFF1F\u62D2\u7EDD\u5BF9\u6240\u6709\u5BA1\u6279\u4EBA\u7ACB\u5373\u751F\u6548\u3002",
+            successMessage: "\u5DF2\u62D2\u7EDD\u3002",
+            params: {
+              comment: {
+                label: "\u5BA1\u6279\u610F\u89C1"
+              },
+              attachments: {
+                label: "\u9644\u4EF6"
+              }
+            }
+          },
+          approval_reassign: {
+            label: "\u8F6C\u7B7E",
+            successMessage: "\u5DF2\u8F6C\u7B7E\u3002",
+            params: {
+              to: {
+                label: "\u65B0\u5BA1\u6279\u4EBA",
+                helpText: "\u5C06\u6B64\u5BA1\u6279\u6B65\u9AA4\u8F6C\u4EA4\u7ED9\u7684\u7528\u6237"
+              },
+              comment: {
+                label: "\u5907\u6CE8"
+              }
+            }
+          },
+          approval_send_back: {
+            label: "\u9000\u56DE\u4FEE\u6539",
+            successMessage: "\u5DF2\u9000\u56DE\u4FEE\u6539\u3002",
+            params: {
+              comment: {
+                label: "\u539F\u56E0"
+              }
+            }
+          },
+          approval_request_info: {
+            label: "\u9000\u56DE\u8865\u5145",
+            successMessage: "\u5DF2\u9000\u56DE\u7ED9\u7533\u8BF7\u4EBA\u8865\u5145\u6750\u6599\u3002",
+            params: {
+              comment: {
+                label: "\u9700\u8981\u7533\u8BF7\u4EBA\u8865\u5145\u4EC0\u4E48\uFF1F"
+              }
+            }
+          },
+          approval_remind: {
+            label: "\u50AC\u529E",
+            successMessage: "\u5DF2\u53D1\u9001\u50AC\u529E\u3002",
+            params: {
+              comment: {
+                label: "\u5907\u6CE8"
+              }
+            }
+          },
+          approval_recall: {
+            label: "\u64A4\u56DE",
+            confirmText: "\u64A4\u56DE\u8BE5\u8BF7\u6C42\uFF1F\u64A4\u56DE\u540E\u5BA1\u6279\u4EBA\u5C06\u65E0\u6CD5\u7EE7\u7EED\u5904\u7406\uFF0C\u8BB0\u5F55\u968F\u5373\u89E3\u9501\u3002",
+            successMessage: "\u5DF2\u64A4\u56DE\u3002",
+            params: {
+              comment: {
+                label: "\u5907\u6CE8"
+              }
+            }
+          },
+          approval_resubmit: {
+            label: "\u91CD\u65B0\u63D0\u4EA4",
+            successMessage: "\u5DF2\u91CD\u65B0\u63D0\u4EA4\u3002",
+            params: {
+              comment: {
+                label: "\u4F60\u4FEE\u6539\u4E86\u4EC0\u4E48\uFF1F"
+              }
+            }
+          }
         }
       },
       sys_approval_action: {
@@ -341,7 +538,14 @@ var init_zh_CN_objects_generated = __esm({
               approve: "\u6279\u51C6",
               reject: "\u62D2\u7EDD",
               recall: "\u64A4\u56DE",
-              escalate: "\u5347\u7EA7"
+              escalate: "\u5347\u7EA7",
+              reassign: "\u8F6C\u7B7E",
+              remind: "\u50AC\u529E",
+              request_info: "\u8981\u6C42\u8865\u5145\u6750\u6599",
+              comment: "\u8BC4\u8BBA",
+              revise: "\u9000\u56DE\u4FEE\u6539",
+              resubmit: "\u91CD\u65B0\u63D0\u4EA4",
+              ooo_substitute: "\u4E0D\u5728\u5C97\u6539\u6D3E"
             }
           },
           actor_id: {
@@ -350,13 +554,21 @@ var init_zh_CN_objects_generated = __esm({
           comment: {
             label: "\u8BC4\u8BBA"
           },
+          attachments: {
+            label: "\u9644\u4EF6",
+            help: "\u652F\u6301\u8BE5\u64CD\u4F5C\u7684\u6587\u4EF6\u2014\u2014\u4F8B\u5982\u5DF2\u7B7E\u7F72\u7684\u5408\u540C\u6216\u8BC1\u660E\u6750\u6599\uFF08#3266\uFF09\u3002"
+          },
           created_at: {
             label: "\u521B\u5EFA\u65F6\u95F4"
           }
         },
         _views: {
           recent: {
-            label: "\u6700\u8FD1"
+            label: "\u6700\u8FD1",
+            emptyState: {
+              title: "\u6682\u65E0\u5BA1\u6279\u64CD\u4F5C\u8BB0\u5F55",
+              message: "\u5BA1\u6279\u63A8\u8FDB\u65F6\u4F1A\u81EA\u52A8\u8BB0\u5F55\u64CD\u4F5C\u3002"
+            }
           },
           by_actor: {
             label: "\u6309\u6267\u884C\u4EBA"
@@ -460,7 +672,8 @@ var init_ja_JP_objects_generated = __esm({
               pending: "\u4FDD\u7559\u4E2D",
               approved: "\u627F\u8A8D\u6E08\u307F",
               rejected: "\u5374\u4E0B\u6E08\u307F",
-              recalled: "\u53D6\u308A\u6D88\u3057\u6E08\u307F"
+              recalled: "\u53D6\u308A\u6D88\u3057\u6E08\u307F",
+              returned: "\u5DEE\u3057\u623B\u3057\u6E08\u307F"
             }
           },
           current_step: {
@@ -502,7 +715,11 @@ var init_ja_JP_objects_generated = __esm({
         },
         _views: {
           my_pending: {
-            label: "\u81EA\u5206\u306E\u4FDD\u7559\u4E2D"
+            label: "\u81EA\u5206\u306E\u4FDD\u7559\u4E2D",
+            emptyState: {
+              title: "\u627F\u8A8D\u5F85\u3061\u306F\u3042\u308A\u307E\u305B\u3093",
+              message: "\u3059\u3079\u3066\u51E6\u7406\u6E08\u307F\u3067\u3059\u3002\u3042\u306A\u305F\u306E\u627F\u8A8D\u3092\u5F85\u3064\u30EA\u30AF\u30A8\u30B9\u30C8\u306F\u3042\u308A\u307E\u305B\u3093\u3002"
+            }
           },
           submitted_by_me: {
             label: "\u81EA\u5206\u304C\u9001\u4FE1"
@@ -513,6 +730,92 @@ var init_ja_JP_objects_generated = __esm({
           all_requests: {
             label: "\u3059\u3079\u3066"
           }
+        },
+        _actions: {
+          approval_approve: {
+            label: "\u627F\u8A8D",
+            successMessage: "\u627F\u8A8D\u3057\u307E\u3057\u305F\u3002",
+            params: {
+              comment: {
+                label: "\u30B3\u30E1\u30F3\u30C8"
+              },
+              attachments: {
+                label: "\u6DFB\u4ED8\u30D5\u30A1\u30A4\u30EB"
+              }
+            }
+          },
+          approval_reject: {
+            label: "\u5374\u4E0B",
+            confirmText: "\u3053\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u5374\u4E0B\u3057\u307E\u3059\u304B\uFF1F\u5374\u4E0B\u306F\u3059\u3079\u3066\u306E\u627F\u8A8D\u8005\u306B\u5BFE\u3057\u3066\u6700\u7D42\u6C7A\u5B9A\u306B\u306A\u308A\u307E\u3059\u3002",
+            successMessage: "\u5374\u4E0B\u3057\u307E\u3057\u305F\u3002",
+            params: {
+              comment: {
+                label: "\u30B3\u30E1\u30F3\u30C8"
+              },
+              attachments: {
+                label: "\u6DFB\u4ED8\u30D5\u30A1\u30A4\u30EB"
+              }
+            }
+          },
+          approval_reassign: {
+            label: "\u518D\u5272\u308A\u5F53\u3066",
+            successMessage: "\u518D\u5272\u308A\u5F53\u3066\u3057\u307E\u3057\u305F\u3002",
+            params: {
+              to: {
+                label: "\u65B0\u3057\u3044\u627F\u8A8D\u8005",
+                helpText: "\u3053\u306E\u30B9\u30C6\u30C3\u30D7\u3092\u5F15\u304D\u7D99\u3050\u30E6\u30FC\u30B6\u30FC"
+              },
+              comment: {
+                label: "\u30B3\u30E1\u30F3\u30C8"
+              }
+            }
+          },
+          approval_send_back: {
+            label: "\u5DEE\u3057\u623B\u3057",
+            successMessage: "\u4FEE\u6B63\u306E\u305F\u3081\u5DEE\u3057\u623B\u3057\u307E\u3057\u305F\u3002",
+            params: {
+              comment: {
+                label: "\u7406\u7531"
+              }
+            }
+          },
+          approval_request_info: {
+            label: "\u8FFD\u52A0\u60C5\u5831\u3092\u4F9D\u983C",
+            successMessage: "\u8FFD\u52A0\u60C5\u5831\u3092\u4F9D\u983C\u3057\u307E\u3057\u305F\u3002",
+            params: {
+              comment: {
+                label: "\u4F55\u304C\u5FC5\u8981\u3067\u3059\u304B\uFF1F"
+              }
+            }
+          },
+          approval_remind: {
+            label: "\u30EA\u30DE\u30A4\u30F3\u30C0\u30FC\u9001\u4FE1",
+            successMessage: "\u30EA\u30DE\u30A4\u30F3\u30C0\u30FC\u3092\u9001\u4FE1\u3057\u307E\u3057\u305F\u3002",
+            params: {
+              comment: {
+                label: "\u30E1\u30E2"
+              }
+            }
+          },
+          approval_recall: {
+            label: "\u53D6\u308A\u4E0B\u3052",
+            confirmText: "\u3053\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u53D6\u308A\u4E0B\u3052\u307E\u3059\u304B\uFF1F\u627F\u8A8D\u8005\u306F\u64CD\u4F5C\u3067\u304D\u306A\u304F\u306A\u308A\u3001\u30EC\u30B3\u30FC\u30C9\u306E\u30ED\u30C3\u30AF\u304C\u89E3\u9664\u3055\u308C\u307E\u3059\u3002",
+            successMessage: "\u53D6\u308A\u4E0B\u3052\u307E\u3057\u305F\u3002",
+            params: {
+              comment: {
+                label: "\u30B3\u30E1\u30F3\u30C8"
+              }
+            }
+          },
+          approval_resubmit: {
+            label: "\u518D\u63D0\u51FA",
+            successMessage: "\u518D\u63D0\u51FA\u3057\u307E\u3057\u305F\u3002",
+            params: {
+              comment: {
+                label: "\u4F55\u3092\u5909\u66F4\u3057\u307E\u3057\u305F\u304B\uFF1F"
+              }
+            }
+          }
         }
       },
       sys_approval_action: {
@@ -544,7 +847,14 @@ var init_ja_JP_objects_generated = __esm({
               approve: "\u627F\u8A8D",
               reject: "\u5374\u4E0B",
               recall: "\u53D6\u6D88",
-              escalate: "\u30A8\u30B9\u30AB\u30EC\u30FC\u30B7\u30E7\u30F3"
+              escalate: "\u30A8\u30B9\u30AB\u30EC\u30FC\u30B7\u30E7\u30F3",
+              reassign: "\u518D\u5272\u308A\u5F53\u3066",
+              remind: "\u30EA\u30DE\u30A4\u30F3\u30C0\u30FC",
+              request_info: "\u8FFD\u52A0\u60C5\u5831\u4F9D\u983C",
+              comment: "\u30B3\u30E1\u30F3\u30C8",
+              revise: "\u5DEE\u3057\u623B\u3057",
+              resubmit: "\u518D\u63D0\u51FA",
+              ooo_substitute: "\u4E0D\u5728\u6642\u4EE3\u7406"
             }
           },
           actor_id: {
@@ -553,13 +863,21 @@ var init_ja_JP_objects_generated = __esm({
           comment: {
             label: "\u30B3\u30E1\u30F3\u30C8"
           },
+          attachments: {
+            label: "\u6DFB\u4ED8\u30D5\u30A1\u30A4\u30EB",
+            help: "\u3053\u306E\u64CD\u4F5C\u3092\u88CF\u4ED8\u3051\u308B\u30D5\u30A1\u30A4\u30EB\u2014\u2014\u7F72\u540D\u6E08\u307F\u5951\u7D04\u66F8\u3084\u8A3C\u6191\u306A\u3069\uFF08#3266\uFF09\u3002"
+          },
           created_at: {
             label: "\u4F5C\u6210\u65E5\u6642"
           }
         },
         _views: {
           recent: {
-            label: "\u6700\u8FD1"
+            label: "\u6700\u8FD1",
+            emptyState: {
+              title: "\u627F\u8A8D\u64CD\u4F5C\u306F\u307E\u3060\u3042\u308A\u307E\u305B\u3093",
+              message: "\u627F\u8A8D\u304C\u9032\u3080\u3068\u64CD\u4F5C\u306F\u81EA\u52D5\u7684\u306B\u8A18\u9332\u3055\u308C\u307E\u3059\u3002"
+            }
           },
           by_actor: {
             label: "\u64CD\u4F5C\u8005\u5225"
@@ -663,7 +981,8 @@ var init_es_ES_objects_generated = __esm({
               pending: "Pendiente",
               approved: "Aprobada",
               rejected: "Rechazada",
-              recalled: "Retirada"
+              recalled: "Retirada",
+              returned: "Devuelta para revisi\xF3n"
             }
           },
           current_step: {
@@ -705,7 +1024,11 @@ var init_es_ES_objects_generated = __esm({
         },
         _views: {
           my_pending: {
-            label: "Mis pendientes"
+            label: "Mis pendientes",
+            emptyState: {
+              title: "Sin aprobaciones pendientes",
+              message: "Est\xE1s al d\xEDa: nada espera tu aprobaci\xF3n."
+            }
           },
           submitted_by_me: {
             label: "Enviadas por m\xED"
@@ -716,6 +1039,92 @@ var init_es_ES_objects_generated = __esm({
           all_requests: {
             label: "Todas"
           }
+        },
+        _actions: {
+          approval_approve: {
+            label: "Aprobar",
+            successMessage: "Aprobada.",
+            params: {
+              comment: {
+                label: "Comentario"
+              },
+              attachments: {
+                label: "Adjuntos"
+              }
+            }
+          },
+          approval_reject: {
+            label: "Rechazar",
+            confirmText: "\xBFRechazar esta solicitud? Un rechazo es definitivo para todos los aprobadores.",
+            successMessage: "Rechazada.",
+            params: {
+              comment: {
+                label: "Comentario"
+              },
+              attachments: {
+                label: "Adjuntos"
+              }
+            }
+          },
+          approval_reassign: {
+            label: "Reasignar",
+            successMessage: "Reasignada.",
+            params: {
+              to: {
+                label: "Nuevo aprobador",
+                helpText: "Usuario al que se entrega este paso"
+              },
+              comment: {
+                label: "Comentario"
+              }
+            }
+          },
+          approval_send_back: {
+            label: "Devolver",
+            successMessage: "Devuelta para revisi\xF3n.",
+            params: {
+              comment: {
+                label: "Motivo"
+              }
+            }
+          },
+          approval_request_info: {
+            label: "Pedir informaci\xF3n",
+            successMessage: "Informaci\xF3n solicitada.",
+            params: {
+              comment: {
+                label: "\xBFQu\xE9 necesitas?"
+              }
+            }
+          },
+          approval_remind: {
+            label: "Enviar recordatorio",
+            successMessage: "Recordatorio enviado.",
+            params: {
+              comment: {
+                label: "Nota"
+              }
+            }
+          },
+          approval_recall: {
+            label: "Retirar",
+            confirmText: "\xBFRetirar esta solicitud? Los aprobadores ya no podr\xE1n actuar sobre ella y el registro se desbloquear\xE1.",
+            successMessage: "Retirada.",
+            params: {
+              comment: {
+                label: "Comentario"
+              }
+            }
+          },
+          approval_resubmit: {
+            label: "Reenviar",
+            successMessage: "Reenviada.",
+            params: {
+              comment: {
+                label: "\xBFQu\xE9 ha cambiado?"
+              }
+            }
+          }
         }
       },
       sys_approval_action: {
@@ -747,7 +1156,14 @@ var init_es_ES_objects_generated = __esm({
               approve: "Aprobar",
               reject: "Rechazar",
               recall: "Retirar",
-              escalate: "Escalar"
+              escalate: "Escalar",
+              reassign: "Reasignaci\xF3n",
+              remind: "Recordatorio",
+              request_info: "Petici\xF3n de informaci\xF3n",
+              comment: "Comentario",
+              revise: "Devoluci\xF3n",
+              resubmit: "Reenv\xEDo",
+              ooo_substitute: "Sustituci\xF3n por ausencia"
             }
           },
           actor_id: {
@@ -756,13 +1172,21 @@ var init_es_ES_objects_generated = __esm({
           comment: {
             label: "Comentario"
           },
+          attachments: {
+            label: "Adjuntos",
+            help: "Archivos que respaldan esta acci\xF3n, p. ej. un contrato firmado o pruebas (#3266)."
+          },
           created_at: {
             label: "Creado el"
           }
         },
         _views: {
           recent: {
-            label: "Recientes"
+            label: "Recientes",
+            emptyState: {
+              title: "A\xFAn no hay acciones de aprobaci\xF3n",
+              message: "Las acciones se registran autom\xE1ticamente a medida que avanza la aprobaci\xF3n."
+            }
           },
           by_actor: {
             label: "Por actor"
@@ -1047,13 +1471,22 @@ var SysApprovalRequest = ObjectSchema.create({
   // per-viewer block (#3310): approver actions on `record.viewer.can_act`
   // (the caller is a current pending approver — same check the service
   // authorizes a decision with, so position/team approvers resolve correctly),
-  // submitter actions on `record.viewer.is_submitter`. `viewer` is attached by
-  // getRequest/listRequests; where it is absent the predicate fails closed.
+  // submitter actions on `record.viewer.is_submitter`. The core decision levers
+  // (approve/reject/reassign) additionally OR in `record.viewer.can_override`
+  // (#3424) so a platform/tenant admin can rescue a request routed to an
+  // unstaffed position — otherwise undecidable, locking the record forever — by
+  // approving, rejecting, or reassigning it to a real approver. `viewer` is
+  // attached by getRequest/listRequests; where it is absent the predicate fails
+  // closed.
   actions: [
     {
       name: "approval_approve",
       label: "Approve",
       icon: "check-circle",
+      // Primary decision — the console renders this filled/highlighted so it
+      // stands out from the secondary levers in the drawer's action bar,
+      // matching the mobile card hierarchy (objectui#2762 P1-5).
+      variant: "primary",
       type: "api",
       method: "POST",
       target: "/api/v1/approvals/requests/{id}/approve",
@@ -1064,7 +1497,7 @@ var SysApprovalRequest = ObjectSchema.create({
         // string[]`; the decision route persists them on `sys_approval_action`.
         { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: "record.viewer.can_act",
+      visible: "record.viewer.can_act || record.viewer.can_override",
       locations: ["record_section", "list_item"],
       successMessage: "Approved.",
       refreshAfter: true
@@ -1073,6 +1506,9 @@ var SysApprovalRequest = ObjectSchema.create({
       name: "approval_reject",
       label: "Reject",
       icon: "x-circle",
+      // Destructive decision — rendered in the console's danger styling so it
+      // reads as the irreversible action it is (objectui#2762 P1-5).
+      variant: "danger",
       type: "api",
       method: "POST",
       target: "/api/v1/approvals/requests/{id}/reject",
@@ -1080,7 +1516,7 @@ var SysApprovalRequest = ObjectSchema.create({
         { name: "comment", label: "Comment", type: "textarea", required: false },
         { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: "record.viewer.can_act",
+      visible: "record.viewer.can_act || record.viewer.can_override",
       confirmText: "Reject this request? A rejection is final for every approver.",
       locations: ["record_section", "list_item"],
       successMessage: "Rejected.",
@@ -1102,7 +1538,7 @@ var SysApprovalRequest = ObjectSchema.create({
         { field: "submitter_id", name: "to", label: "New approver", required: true, helpText: "User to hand this step to" },
         { name: "comment", label: "Comment", type: "textarea", required: false }
       ],
-      visible: "record.viewer.can_act",
+      visible: "record.viewer.can_act || record.viewer.can_override",
       locations: ["record_section"],
       successMessage: "Reassigned.",
       refreshAfter: true
@@ -1219,6 +1655,14 @@ var SysApprovalAction = ObjectSchema2.create({
   // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{action} \xB7 {step_name}",
   highlightFields: ["request_id", "step_name", "action", "actor_id", "created_at"],
+  // ADR-0104 D3 wave 2. `attachments` is a media field, so the files it holds
+  // are OWNED by this row — and the storage service would otherwise authorize
+  // their download by testing whether the caller can READ this row. It cannot:
+  // this table is deliberately closed to ordinary approver positions, so that
+  // test denies the very approver the attachment was filed for. The approvals
+  // service already owns the rule for seeing a decision (visibility of the
+  // parent request, exactly as `listActions` applies it), so it answers.
+  fileAccessDelegate: "approvals",
   listViews: {
     recent: {
       type: "grid",
@@ -1470,9 +1914,9 @@ var SysApprovalDelegation = ObjectSchema4.create({
     trackHistory: true,
     searchable: true,
     apiEnabled: true,
-    apiMethods: ["get", "list", "create", "update", "delete"],
-    trash: true,
-    mru: false
+    // `bulk` = the batch shape of the verbs above; the gate is `bulk ∧ child`
+    // (#3391 P1), so omitting it 405s /batch and the *Many routes (#3026).
+    apiMethods: ["get", "list", "create", "update", "delete", "bulk"]
   }
 });
 
@@ -1480,16 +1924,167 @@ var SysApprovalDelegation = ObjectSchema4.create({
 import { createHash, randomBytes } from "crypto";
 import {
   APPROVAL_BRANCH_LABELS,
-  canonicalApproverType
+  approverTypeIsOrgScoped,
+  canonicalApproverType,
+  normalizeDecisionOutputs
 } from "@objectstack/spec/automation";
+import { ExpressionEngine, collectCelRootIdentifiers } from "@objectstack/formula";
+import {
+  ADMIN_FULL_ACCESS,
+  ORGANIZATION_ADMIN_GRANTS,
+  BUILTIN_IDENTITY_PLATFORM_ADMIN,
+  BUILTIN_IDENTITY_ORG_OWNER,
+  BUILTIN_IDENTITY_ORG_ADMIN
+} from "@objectstack/spec/identity";
+import { RESUME_AUTHORITY_SERVICE } from "@objectstack/spec/contracts";
+import { isFileIdToken } from "@objectstack/spec/data";
 import { isGrantActive } from "@objectstack/core";
+
+// src/approver-org-scope.ts
+var MAX_ORG_DEPTH = 32;
+var SYSTEM_CTX = { isSystem: true };
+function fail(message) {
+  throw new Error(`VALIDATION_FAILED: ${message}`);
+}
+async function findOrg(engine, where) {
+  try {
+    const rows = await engine.find("sys_organization", {
+      filter: where,
+      fields: ["id", "slug", "parent_organization_id"],
+      limit: 1,
+      context: SYSTEM_CTX
+    });
+    return Array.isArray(rows) && rows[0] ? rows[0] : null;
+  } catch {
+    return null;
+  }
+}
+async function ancestorChain(engine, orgId) {
+  const chain = [];
+  const seen = /* @__PURE__ */ new Set();
+  let cursor = orgId;
+  for (let depth = 0; cursor && depth < MAX_ORG_DEPTH; depth++) {
+    if (seen.has(cursor)) break;
+    seen.add(cursor);
+    chain.push(cursor);
+    const row = await findOrg(engine, { id: cursor });
+    const parent = row?.parent_organization_id;
+    cursor = parent ? String(parent) : null;
+  }
+  return chain;
+}
+async function resolveApproverDirectoryOrg(deps, declaration, requestOrgId, approverType, isOrgScopedType) {
+  const declared = typeof declaration === "string" ? declaration.trim() : "";
+  if (!declared) return requestOrgId;
+  if (!isOrgScopedType) {
+    fail(
+      `approver type '${approverType}' resolves people without an organization directory, so 'organization: ${declared}' would have no effect \u2014 remove it (ADR-0105 D9 applies to position / org_membership_level / department / expression)`
+    );
+  }
+  const posture = deps.posture?.();
+  if (posture && posture !== "group") {
+    fail(
+      `cross-organization approver targeting ('organization: ${declared}') requires the 'group' tenancy posture; this deployment resolves '${posture}' (ADR-0105 D9)`
+    );
+  }
+  const requestOrg = requestOrgId ? String(requestOrgId) : "";
+  if (!requestOrg) {
+    fail(
+      `'organization: ${declared}' cannot be resolved for a request that carries no organization \u2014 cross-organization targeting needs an organization to resolve from`
+    );
+  }
+  const chain = await ancestorChain(deps.engine, requestOrg);
+  if (declared === "$root") {
+    const root = chain[chain.length - 1];
+    if (root === requestOrg && chain.length === 1) {
+      fail(
+        `'organization: $root' resolved to the request's own organization \u2014 this organization has no 'parent_organization_id' lineage. Declare the group hierarchy (ADR-0105 D6) or drop the targeting`
+      );
+    }
+    return root;
+  }
+  if (declared === "$parent") {
+    const parent = chain[1];
+    if (!parent) {
+      fail(
+        `'organization: $parent' has no parent to resolve to \u2014 the request's organization is already the root of its group (ADR-0105 D6 'parent_organization_id')`
+      );
+    }
+    return parent;
+  }
+  const target = await findOrg(deps.engine, { slug: declared });
+  if (!target?.id) {
+    fail(
+      `no organization with slug '${declared}' \u2014 'organization' takes an organization SLUG or a symbol ($root / $parent), never an id (ids are per-deployment, flows are portable)`
+    );
+  }
+  const targetId = String(target.id);
+  if (targetId === requestOrg) return targetId;
+  const targetChain = await ancestorChain(deps.engine, targetId);
+  const targetRoot = targetChain[targetChain.length - 1];
+  const requestRoot = chain[chain.length - 1];
+  if (!targetRoot || !requestRoot || targetRoot !== requestRoot) {
+    fail(
+      `organization '${declared}' is not in the same group as the request's organization \u2014 cross-organization approval routes WITHIN one group (they must share a 'parent_organization_id' root, ADR-0105 D6/D9)`
+    );
+  }
+  return targetId;
+}
+async function filterApproversWhoCanRead(deps, userIds, requestOrgId, context) {
+  const requestOrg = requestOrgId ? String(requestOrgId) : "";
+  if (!requestOrg || userIds.length === 0) return userIds;
+  let members = [];
+  try {
+    members = await deps.engine.find("sys_member", {
+      filter: { organization_id: requestOrg, user_id: { $in: userIds } },
+      fields: ["user_id"],
+      limit: 1e4,
+      context: SYSTEM_CTX
+    });
+  } catch {
+    return userIds;
+  }
+  const canRead = new Set(
+    (members ?? []).map((m) => String(m?.user_id ?? "")).filter(Boolean)
+  );
+  const dropped = userIds.filter((u) => !canRead.has(u));
+  if (dropped.length === 0) return userIds;
+  deps.logger?.warn?.(
+    `[approvals] ADR-0105 D9: ${dropped.length} cross-organization approver(s) dropped \u2014 they hold '${context.value ?? context.approverType}' in organization '${context.directoryOrgId}' but no membership in the request's organization '${requestOrg}', so the D2 union wall would hide the request from them. Grant those users a membership in the request's organization, or retarget the approver.`,
+    { dropped, requestOrganizationId: requestOrg, directoryOrganizationId: context.directoryOrgId }
+  );
+  return userIds.filter((u) => canRead.has(u));
+}
+
+// src/approval-service.ts
 var REMIND_COOLDOWN_MS = 4 * 60 * 60 * 1e3;
 var ESCALATION_JOB_NAME = "approvals-sla-escalation";
 var ESCALATION_SCAN_INTERVAL_MS = 5 * 60 * 1e3;
 var SLA_ACTOR_ID = "system:sla";
+var DEAD_RUN_ACTOR_ID = "system:dead-run";
+var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "cancelled",
+  "timed_out"
+]);
 var ACTION_TOKEN_TTL_MS = 72 * 60 * 60 * 1e3;
-var SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] };
+var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+function actingUserId(context) {
+  const userId = context?.userId;
+  return typeof userId === "string" && userId ? userId : null;
+}
 var OOO_MAX_CHAIN = 8;
+var GRAPH_APPROVER_TYPES = /* @__PURE__ */ new Set([
+  "team",
+  "department",
+  "business_unit",
+  "bu",
+  "position",
+  "org_membership_level",
+  "manager"
+]);
+var APPROVER_EXPRESSION_ROOTS = /* @__PURE__ */ new Set(["current", "trigger", "vars"]);
 function uid(prefix) {
   const g = globalThis;
   if (g.crypto?.randomUUID) return `${prefix}_${g.crypto.randomUUID()}`;
@@ -1543,7 +2138,26 @@ function rowFromRequest(row) {
     step_label: cfg?.__nodeLabel ?? prettifyMachineName(row.current_step),
     sla_due_at: slaDueAt(row.created_at, cfg),
     // ADR-0044 revision round (rides the config snapshot; absent ⇒ round 1).
-    round: typeof cfg?.__round === "number" ? cfg.__round : void 0
+    round: typeof cfg?.__round === "number" ? cfg.__round : void 0,
+    // objectui#2902: the node's record-lock policy. The lock is enforced
+    // server-side in `lifecycle-hooks.ts` off THIS SAME snapshot with the
+    // same `!== false` default, so the flag a client renders and the rule the
+    // server applies can never drift. Without it a console can only see
+    // "a pending request exists" and has to assume the record is locked —
+    // which mislabels every `lockRecord: false` node as locked and hides an
+    // edit the server would have accepted.
+    lock_record: cfg?.lockRecord !== false,
+    // #3447 P2: the node's author-declared decision outputs, surfaced so a
+    // decision UI can render input fields for them and POST `outputs` on
+    // approve/reject. Per-request (each node declares its own), which is why
+    // this rides the row instead of the static action params. Two shapes for
+    // version skew: `decision_outputs` stays the bare KEY list an older
+    // console renders as text inputs; `decision_output_defs` carries the
+    // normalized typed declarations a picker-aware console prefers.
+    ...(() => {
+      const defs = normalizeDecisionOutputs(cfg?.decisionOutputs);
+      return defs.length ? { decision_outputs: defs.map((d) => d.key), decision_output_defs: defs } : {};
+    })()
   };
 }
 function slaDueAt(createdAt, cfg) {
@@ -1553,7 +2167,29 @@ function slaDueAt(createdAt, cfg) {
   if (Number.isNaN(t)) return void 0;
   return new Date(t + hours * 36e5).toISOString();
 }
+function normalizeActionAttachment(entry) {
+  if (entry == null) return void 0;
+  if (typeof entry === "string") {
+    const id = entry.trim();
+    if (!id) return void 0;
+    return isFileIdToken(id) ? { id } : { id, url: id };
+  }
+  if (typeof entry === "object") {
+    const id = entry.id ?? entry.file_id;
+    if (id == null || String(id) === "") return void 0;
+    const mimeType = entry.mimeType ?? entry.mime_type;
+    return {
+      id: String(id),
+      name: typeof entry.name === "string" ? entry.name : void 0,
+      url: typeof entry.url === "string" ? entry.url : void 0,
+      mimeType: typeof mimeType === "string" ? mimeType : void 0,
+      size: typeof entry.size === "number" ? entry.size : void 0
+    };
+  }
+  return void 0;
+}
 function rowFromAction(row) {
+  const attachments = Array.isArray(row.attachments) ? row.attachments.map(normalizeActionAttachment).filter((a) => !!a) : [];
   return {
     id: String(row.id),
     request_id: String(row.request_id),
@@ -1562,10 +2198,9 @@ function rowFromAction(row) {
     action: row.action,
     actor_id: row.actor_id ?? void 0,
     comment: row.comment ?? void 0,
-    // Decision attachments (#3266). The column shipped in #3268 but this
-    // contract mapping didn't — the raw engine row carried the fileIds while
-    // every consumer of listActions saw none (caught by browser verification).
-    attachments: Array.isArray(row.attachments) && row.attachments.length ? row.attachments.map(String) : void 0,
+    // Decision attachments (#3266): rich descriptors carrying the display name +
+    // download URL, so consumers label/open them without reading `sys_file`.
+    attachments: attachments.length ? attachments : void 0,
     created_at: row.created_at ?? void 0
   };
 }
@@ -1577,6 +2212,33 @@ var _ApprovalService = class _ApprovalService {
     this.automation = opts.automation;
     this.messaging = opts.messaging;
     this.publicBaseUrl = (opts.publicBaseUrl ?? "").replace(/\/$/, "");
+    this.tenancyPosture = opts.tenancyPosture;
+  }
+  /** Attach (or replace) the ADR-0105 D9 posture provider. */
+  attachTenancyPosture(provider) {
+    this.tenancyPosture = provider;
+  }
+  /** Deps bundle for the ADR-0105 D9 org-scope helpers. */
+  get orgScopeDeps() {
+    return {
+      engine: this.engine,
+      posture: this.tenancyPosture,
+      logger: this.logger
+    };
+  }
+  /**
+   * [ADR-0105 D9] Which organization's directory resolves ONE approver spec.
+   * Absent declaration ⇒ the request's own organization (unchanged, no reads).
+   */
+  async directoryOrgFor(a, requestOrgId) {
+    const rawType = String(a?.type ?? "");
+    return resolveApproverDirectoryOrg(
+      this.orgScopeDeps,
+      a?.organization,
+      requestOrgId,
+      rawType,
+      approverTypeIsOrgScoped(rawType)
+    );
   }
   /** Attach (or replace) the automation surface used to resume flow runs. */
   attachAutomation(automation) {
@@ -1611,13 +2273,107 @@ var _ApprovalService = class _ApprovalService {
     const rows = await this.engine.find("sys_approval_request", {
       where: { id: requestId },
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const raw = Array.isArray(rows) ? rows[0] : null;
     if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
     if (raw.status !== "pending") throw new Error(`INVALID_STATE: request is ${raw.status}`);
     return raw;
   }
+  /**
+   * Privileged-override gate (#3424). A stuck approval — one routed to a
+   * position/team with no holders (so its `pending_approvers` is only an
+   * unresolvable `type:value` literal) or to approvers who have all since left —
+   * is otherwise undecidable: no concrete user is in the slate, so every normal
+   * `decide` / `reassign` / `recall` is `FORBIDDEN` and (with `lockRecord`) the
+   * record stays locked forever with no in-product recovery. A platform or
+   * tenant admin — the same posture the engine's superuser bypass already
+   * trusts — may always act on a PENDING request to release it: approve, reject,
+   * reassign it to a real approver, or recall it.
+   *
+   * A platform admin crosses the tenant wall (matching the unscoped
+   * `admin_full_access` evidence); a tenant admin may override only within their
+   * own org (or an org-less request). A system context always passes. Signals are
+   * read defensively off the resolved exec context (`permissions` / `positions` /
+   * the derived `posture`, ADR-0095) so any transport that resolves through the
+   * shared authz resolver lights this up without extra wiring.
+   */
+  isOverrideActor(context, requestOrg) {
+    if (!context) return false;
+    if (context.isSystem) return true;
+    const perms = Array.isArray(context.permissions) ? context.permissions : [];
+    const positions = Array.isArray(context.positions) ? context.positions : [];
+    const posture = context.posture;
+    const isPlatformAdmin = posture === "PLATFORM_ADMIN" || perms.includes(ADMIN_FULL_ACCESS) || positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN);
+    if (isPlatformAdmin) return true;
+    const isTenantAdmin = posture === "TENANT_ADMIN" || ORGANIZATION_ADMIN_GRANTS.some((n) => perms.includes(n)) || positions.includes(BUILTIN_IDENTITY_ORG_OWNER) || positions.includes(BUILTIN_IDENTITY_ORG_ADMIN);
+    if (!isTenantAdmin) return false;
+    const actorTenant = context.tenantId ?? context.organizationId ?? null;
+    return requestOrg == null || actorTenant != null && String(requestOrg) === String(actorTenant);
+  }
+  /**
+   * Pin the acting identity to the AUTHENTICATED CALLER (#3800).
+   *
+   * Every public entrypoint accepts an `actorId`, and the REST routes fill it
+   * from `body.actorId ?? body.actor_id ?? context.userId` — so before this
+   * gate the body won. The authorization checks downstream all read that value
+   * (`pending_approvers.includes(input.actorId)`, `submitter_id === actorId`),
+   * which made the body-supplied string not merely the audit label but the key
+   * that opens the door: any authenticated user could name a pending approver
+   * and have that approver's decision recorded and the owning flow resumed.
+   * #3783 drew this line for the data-write identity ({@link actingUserId});
+   * this closes the authorization half.
+   *
+   * A caller may still name an identity OTHER than their bare user id, because
+   * a slot legitimately can be keyed by one: `resolveApproverSpec` stores the
+   * `type:value` literal when a graph lookup yields nothing, and an author may
+   * write an email as a `user` approver. So the rule is not "actorId must equal
+   * userId" — it is **"actorId must be an identity the SERVER can prove belongs
+   * to the caller"**. Anything else is `FORBIDDEN`.
+   *
+   * A system context is exempt and keeps its explicit actor: the SLA sweep
+   * passes the reserved {@link SLA_ACTOR_ID} sentinel, and the ADR-0043 action
+   * link passes the approver its single-use token is cryptographically bound to
+   * (having also put them on the context). Those are the only two callers that
+   * hold a trustworthy actor with no session behind them.
+   *
+   * A caller with NO identity at all cannot act. That case is reachable: the
+   * REST anonymous-deny only fires when `api.requireAuth` is set, so without it
+   * an anonymous request previously decided approvals outright by naming one.
+   */
+  async resolveActor(actorId, context) {
+    if (context?.isSystem) {
+      if (!actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+      return actorId;
+    }
+    const uid2 = actingUserId(context);
+    if (!uid2) {
+      throw new Error("FORBIDDEN: an approval action requires an authenticated caller");
+    }
+    if (!actorId || String(actorId) === uid2) return uid2;
+    const named = String(actorId);
+    for (const position of context.positions ?? []) {
+      if (named === `position:${position}` || named === `role:${position}`) return named;
+    }
+    if (named.includes("@") && await this.callerHasEmail(uid2, named)) return named;
+    throw new Error(
+      `FORBIDDEN: cannot act as '${named}' \u2014 an approval action is recorded against the authenticated caller`
+    );
+  }
+  /** Does `userId`'s own account carry `email`? (Slots keyed by email, #3800.) */
+  async callerHasEmail(userId, email) {
+    try {
+      const rows = await this.engine.find("sys_user", {
+        where: { id: userId },
+        limit: 1,
+        context: SYSTEM_CTX2
+      });
+      const row = Array.isArray(rows) ? rows[0] : null;
+      return !!row?.email && String(row.email).toLowerCase() === email.toLowerCase();
+    } catch {
+      return false;
+    }
+  }
   /**
    * Expand the approvers on an Approval node into user IDs by querying the
    * graph tables for `team:` / `department:` / `position:` /
@@ -1652,7 +2408,7 @@ var _ApprovalService = class _ApprovalService {
    * `opts.substitutions` collector to record the hops for audit + notification.
    */
   async expandApprovers(step, record, organizationId, opts) {
-    var _a;
+    var _a, _b, _c;
     if (!step || !Array.isArray(step.approvers)) return [];
     const now = opts?.now ?? this.clock.now().getTime();
     const out = [];
@@ -1660,12 +2416,34 @@ var _ApprovalService = class _ApprovalService {
     for (let idx = 0; idx < specs.length; idx++) {
       const a = specs[idx];
       if (!a) continue;
-      const ids = await this.resolveApproverSpec(a, record, organizationId, now, opts?.substitutions);
       const groupKey = a.group != null && String(a.group) !== "" ? String(a.group) : `#${idx}`;
+      if (canonicalApproverType(String(a.type)) === "expression") {
+        const resolved = await this.resolveExpressionApprovers(
+          a,
+          record,
+          organizationId,
+          now,
+          opts?.substitutions,
+          opts?.exprCtx
+        );
+        if (opts?.resolvedFrom) opts.resolvedFrom[`expression#${idx}`] = resolved.raw;
+        for (const entry of resolved.slots) {
+          if (!entry.id) continue;
+          out.push(entry.id);
+          if (opts?.groups) {
+            ((_a = opts.groups)[_b = entry.id] ?? (_a[_b] = [])).push(entry.subGroup ? `${groupKey}:${entry.subGroup}` : groupKey);
+          }
+        }
+        continue;
+      }
+      if (opts?.resolvedFrom && canonicalApproverType(String(a.type)) === "field" && a.value != null) {
+        opts.resolvedFrom[`field:${a.value}`] = record?.[a.value] ?? null;
+      }
+      const ids = await this.resolveApproverSpec(a, record, organizationId, now, opts?.substitutions);
       for (const u of ids) {
         if (!u) continue;
         out.push(u);
-        if (opts?.groups) ((_a = opts.groups)[u] ?? (_a[u] = [])).push(groupKey);
+        if (opts?.groups) ((_c = opts.groups)[u] ?? (_c[u] = [])).push(groupKey);
       }
     }
     return out.filter(Boolean);
@@ -1686,24 +2464,35 @@ var _ApprovalService = class _ApprovalService {
         { deprecated: a.type, canonical: type }
       );
     }
+    const directoryOrg = await this.directoryOrgFor(a, organizationId);
+    const crossOrg = directoryOrg !== organizationId;
     if (type === "user") {
       return this.applyOooDelegation(String(a.value), now, organizationId, substitutions);
     }
     if (type === "field" && record) {
-      return this.applyOooDelegation(String(record[a.value] ?? ""), now, organizationId, substitutions);
+      const out = [];
+      for (const id of csvSplit(record[a.value])) {
+        out.push(...await this.applyOooDelegation(id, now, organizationId, substitutions));
+      }
+      return out;
     }
+    const bounded = async (users) => crossOrg ? filterApproversWhoCanRead(this.orgScopeDeps, users, organizationId, {
+      approverType: type,
+      value: a.value != null ? String(a.value) : void 0,
+      directoryOrgId: directoryOrg
+    }) : users;
     try {
       if (type === "team") {
         const users = await this.expandTeamUsers(String(a.value));
         if (users.length) return users;
       } else if (type === "department" || type === "business_unit" || type === "bu") {
-        const users = await this.expandBusinessUnitUsers(String(a.value), organizationId);
+        const users = await bounded(await this.expandBusinessUnitUsers(String(a.value), directoryOrg));
         if (users.length) return users;
       } else if (type === "position") {
-        const users = await this.expandPositionUsers(String(a.value), organizationId);
+        const users = await bounded(await this.expandPositionUsers(String(a.value), directoryOrg));
         if (users.length) return users;
       } else if (type === "org_membership_level") {
-        const users = await this.expandMembershipTierUsers(String(a.value), organizationId);
+        const users = await bounded(await this.expandMembershipTierUsers(String(a.value), directoryOrg));
         if (users.length) return users;
       } else if (type === "manager" && record) {
         const subject = record[a.value] ?? record.owner_id;
@@ -1714,8 +2503,122 @@ var _ApprovalService = class _ApprovalService {
       }
     } catch {
     }
+    if (type === "queue") {
+      this.logger?.warn?.(
+        `[approvals] approver type 'queue' is not implemented \u2014 the slot resolves to nobody (#3508)`,
+        { value: a.value }
+      );
+    } else if (GRAPH_APPROVER_TYPES.has(type)) {
+      this.logger?.warn?.(
+        `[approvals] approver '${type}:${a.value}' expanded to nobody \u2014 the slot routes to no one and the request cannot advance until someone is added or the approver is re-pointed (#3807)`,
+        { type, value: a.value, organizationId: organizationId ?? null }
+      );
+    }
     return [`${a.type}:${a.value}`];
   }
+  /**
+   * Resolve an `expression` approver (#3447 P2): evaluate its CEL source at
+   * node entry against the three explicit roots — `current` (live record),
+   * `trigger` (submit snapshot), `vars` (flow variables) — then expand the
+   * result into people per `resolveAs`.
+   *
+   * Every failure here THROWS (config/parse errors as `VALIDATION_FAILED`,
+   * evaluation faults as `EXPRESSION_FAILED`) so the approval node fails
+   * loudly instead of opening a request routed to nobody — an approver
+   * expression that cannot run is a routing bug, never "condition not met".
+   * Error messages carry the correct spelling because their primary reader is
+   * the AI author fixing the flow on the next validate pass.
+   *
+   * Returns `slots` (approver id + optional per_group sub-key) and `raw` (the
+   * expression's own values, pre-expansion) for the `__resolvedFrom` audit.
+   */
+  async resolveExpressionApprovers(a, liveRecord, organizationId, now, substitutions, exprCtx) {
+    const source = String(a.value ?? "").trim();
+    if (!source) {
+      throw new Error("VALIDATION_FAILED: expression approver has an empty expression");
+    }
+    const parsed = collectCelRootIdentifiers(source);
+    if (!parsed.ok) {
+      throw new Error(`VALIDATION_FAILED: expression approver does not parse: ${parsed.error} \u2014 source: \`${source}\``);
+    }
+    const illegal = parsed.roots.filter((r) => !APPROVER_EXPRESSION_ROOTS.has(r));
+    if (illegal.length) {
+      const hint = illegal.includes("record") || illegal.includes("previous") ? `\`record\`/\`previous\` are not bound here \u2014 write \`current.<field>\` for the record's live state at node entry, or \`trigger.<field>\` for the submit-time snapshot (\`vars.previous\` carries the pre-update row)` : `did you mean \`current.<field>\` (live record), \`trigger.<field>\` (submit snapshot), or \`vars.<name>\` (flow variable)?`;
+      throw new Error(
+        `VALIDATION_FAILED: expression approver references \`${illegal.join("`, `")}\` \u2014 only \`current.*\`, \`trigger.*\` and \`vars.*\` are available; ${hint}. Source: \`${source}\``
+      );
+    }
+    const result = ExpressionEngine.evaluate(
+      { dialect: "cel", source },
+      { extra: { current: liveRecord ?? {}, trigger: exprCtx?.trigger ?? {}, vars: exprCtx?.vars ?? {} } }
+    );
+    if (!result.ok) {
+      throw new Error(
+        `EXPRESSION_FAILED: expression approver failed to evaluate (${result.error.kind}): ${result.error.message} \u2014 source: \`${source}\``
+      );
+    }
+    const value = result.value;
+    let raw;
+    if (value == null || value === "") {
+      raw = [];
+    } else if (typeof value === "string") {
+      raw = csvSplit(value);
+    } else if (Array.isArray(value)) {
+      const bad = value.find((v) => v != null && typeof v !== "string" && typeof v !== "number");
+      if (bad !== void 0) {
+        throw new Error(
+          `EXPRESSION_FAILED: expression approver must yield ids (string / CSV / string array), got an array containing ${typeof bad} \u2014 source: \`${source}\``
+        );
+      }
+      raw = value.map((v) => String(v ?? "").trim()).filter(Boolean);
+    } else {
+      throw new Error(
+        `EXPRESSION_FAILED: expression approver must yield ids (string / CSV / string array), got ${typeof value} \u2014 source: \`${source}\``
+      );
+    }
+    const resolveAs = String(a.resolveAs ?? "user");
+    if (resolveAs === "user") {
+      const slots2 = [];
+      for (const id of raw) {
+        for (const routed of await this.applyOooDelegation(id, now, organizationId, substitutions)) {
+          slots2.push({ id: routed });
+        }
+      }
+      return { slots: slots2, raw };
+    }
+    const directoryOrg = await this.directoryOrgFor(a, organizationId);
+    const crossOrg = directoryOrg !== organizationId;
+    const slots = [];
+    for (const key of raw) {
+      let users = [];
+      try {
+        if (resolveAs === "department") users = await this.expandBusinessUnitUsers(key, directoryOrg);
+        else if (resolveAs === "position") users = await this.expandPositionUsers(key, directoryOrg);
+        else if (resolveAs === "team") users = await this.expandTeamUsers(key);
+        else {
+          throw new Error(
+            `VALIDATION_FAILED: expression approver has unknown resolveAs '${resolveAs}' \u2014 use 'user', 'department', 'position', or 'team'`
+          );
+        }
+      } catch (err) {
+        if (String(err?.message ?? "").startsWith("VALIDATION_FAILED")) throw err;
+        users = [];
+      }
+      if (crossOrg && users.length) {
+        users = await filterApproversWhoCanRead(this.orgScopeDeps, users, organizationId, {
+          approverType: resolveAs,
+          value: key,
+          directoryOrgId: directoryOrg
+        });
+      }
+      if (!users.length) {
+        slots.push({ id: `${resolveAs}:${key}`, subGroup: key });
+        continue;
+      }
+      for (const u of users) slots.push({ id: u, subGroup: key });
+    }
+    return { slots, raw };
+  }
   /** Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy). */
   async expandTeamUsers(teamId) {
     if (!teamId) return [];
@@ -1725,22 +2628,46 @@ var _ApprovalService = class _ApprovalService {
         filter: { team_id: teamId },
         fields: ["user_id"],
         limit: 1e4,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
     } catch {
       rows = [];
     }
     return Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
   }
+  /**
+   * Tenant scope for a `sys_business_unit` read that may legitimately be
+   * env-wide (#3807).
+   *
+   * `organization_id = null` on a platform object means "owned by no
+   * organization" — a row written by a seed, the file layer, or bootstrap,
+   * i.e. before (or outside) any org exists. A strict
+   * `organization_id = <request org>` equality made every such row invisible:
+   * the seed check below found nothing, the whole expansion returned `[]`, and
+   * the approver fell back to the dead `department:<id>` literal that routes to
+   * nobody. That is not an edge case — an app's org tree is normally seeded
+   * (a seed cannot know the org id the runtime mints at boot) while the
+   * approval request always carries one, so EVERY department approver a
+   * designer could pick resolved to nobody.
+   *
+   * Widen to "this org ∪ env-wide", the same predicate `sys_metadata`'s
+   * pending-draft listing settled on for the identical reason. Another org's
+   * unit still fails the match, so the wall between two organizations is
+   * unchanged — only rows belonging to no org at all become visible.
+   */
+  businessUnitOrgScope(filter, organizationId) {
+    if (!organizationId) return filter;
+    return { ...filter, $or: [{ organization_id: organizationId }, { organization_id: null }] };
+  }
   /** Recursive department — walks `sys_business_unit.parent_business_unit_id`. */
   async expandBusinessUnitUsers(businessUnitId, organizationId) {
     if (!businessUnitId) return [];
     try {
       const seed = await this.engine.find("sys_business_unit", {
-        filter: organizationId ? { id: businessUnitId, organization_id: organizationId } : { id: businessUnitId },
+        filter: this.businessUnitOrgScope({ id: businessUnitId }, organizationId),
         fields: ["id", "active"],
         limit: 1,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       const seedRow = Array.isArray(seed) ? seed[0] : null;
       if (!seedRow || seedRow.active === false) return [];
@@ -1753,9 +2680,11 @@ var _ApprovalService = class _ApprovalService {
       const parent = queue.shift();
       let kids = [];
       try {
-        const filter = { parent_business_unit_id: parent, active: { $ne: false } };
-        if (organizationId) filter.organization_id = organizationId;
-        kids = await this.engine.find("sys_business_unit", { filter, fields: ["id"], limit: 1e3, context: SYSTEM_CTX });
+        const filter = this.businessUnitOrgScope(
+          { parent_business_unit_id: parent, active: { $ne: false } },
+          organizationId
+        );
+        kids = await this.engine.find("sys_business_unit", { filter, fields: ["id"], limit: 1e3, context: SYSTEM_CTX2 });
       } catch {
         kids = [];
       }
@@ -1773,7 +2702,7 @@ var _ApprovalService = class _ApprovalService {
         filter: { business_unit_id: { $in: Array.from(seen) } },
         fields: ["user_id"],
         limit: 1e4,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
     } catch {
       rows = [];
@@ -1798,7 +2727,7 @@ var _ApprovalService = class _ApprovalService {
         filter,
         fields: ["user_id"],
         limit: 1e4,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       for (const r of rows ?? []) {
         const uid2 = String(r.user_id ?? "");
@@ -1821,7 +2750,7 @@ var _ApprovalService = class _ApprovalService {
     if (organizationId) filter.organization_id = organizationId;
     let rows = [];
     try {
-      rows = await this.engine.find("sys_member", { filter, fields: ["user_id"], limit: 1e4, context: SYSTEM_CTX });
+      rows = await this.engine.find("sys_member", { filter, fields: ["user_id"], limit: 1e4, context: SYSTEM_CTX2 });
     } catch {
       rows = [];
     }
@@ -1833,7 +2762,7 @@ var _ApprovalService = class _ApprovalService {
         filter: { id: userId },
         fields: ["id", "manager_id"],
         limit: 1,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       const row = Array.isArray(rows) ? rows[0] : null;
       return row?.manager_id ? String(row.manager_id) : null;
@@ -1883,7 +2812,7 @@ var _ApprovalService = class _ApprovalService {
         filter: { delegator_id: delegatorId },
         fields: ["id", "delegator_id", "delegate_id", "valid_from", "valid_until", "reason", "organization_id"],
         limit: 50,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
     } catch {
       return null;
@@ -1897,14 +2826,86 @@ var _ApprovalService = class _ApprovalService {
     });
     return active[0];
   }
-  /** Mirror a request status onto a business-object field, if configured. */
-  async mirrorStatusField(object, recordId, field, status) {
+  /**
+   * Mirror a request status onto a business-object field, if configured.
+   *
+   * **Elevated, but not anonymous (#3783).** The write stays `isSystem`: the
+   * record is normally LOCKED while its approval is live and the submitter
+   * cannot edit it, so only a platform write can land the status — that is what
+   * the lock hook's system exemption (`lifecycle-hooks.ts`) is for. What it must
+   * NOT do is throw away *who* caused the transition. Every status below is
+   * something a specific human just did — a submitter submitting or recalling,
+   * an approver deciding or sending back — and this write is what fires the
+   * target object's record-change flows. With no `userId` on it those cascades
+   * inherit no trigger user, and since #3760 a `runAs:'user'` run with no trigger
+   * user has its data ops REFUSED — so "when the invoice is approved, do X", the
+   * most natural approvals automation there is, had to declare `runAs:'system'`
+   * and take blanket elevation for a case where a perfectly good scoped identity
+   * existed. Re-attaching the actor lets those cascades run as the deciding user
+   * with RLS enforced. Same shape the approval node already uses when it calls
+   * into this service (`approval-node.ts`).
+   *
+   * `actorId` is `null` for the genuinely machine-driven transitions (the SLA
+   * escalation's auto-decision, the dead-run sweep). There is no human to name
+   * there, and naming a sentinel would put a non-user in `updated_by` and in
+   * every downstream flow's identity. Those cascades stay user-less — a flow
+   * that wants to react to them still has to declare `runAs:'system'`, which is
+   * the honest answer rather than an oversight.
+   *
+   * Deliberately carries `userId` ONLY, not the request's org. On an
+   * ExecutionContext `tenantId` is a driver-scoping knob, not attribution
+   * (`buildDriverOptions` turns it into a tenant predicate on the update), so
+   * passing it would newly org-scope this write and silently no-op the mirror on
+   * a record whose org differs from the request's — while buying nothing: the
+   * automation engine back-fills the run's `tenantId` from the resolved user's
+   * own grants.
+   */
+  async mirrorStatusField(object, recordId, field, status, actorId) {
     try {
-      await this.engine.update(object, { id: recordId, [field]: status }, { context: SYSTEM_CTX });
+      const context = actorId ? { ...SYSTEM_CTX2, userId: actorId } : SYSTEM_CTX2;
+      await this.engine.update(object, { id: recordId, [field]: status }, { context });
     } catch (err) {
       this.logger?.warn?.(`[approvals] mirrorStatusField failed: ${err?.message ?? err}`);
     }
   }
+  /**
+   * Re-read a business record's CURRENT state by id so approver resolution binds
+   * to live data at node entry, not the trigger snapshot the flow froze into
+   * `$record` at submit time (#3447). A `field` / `manager` approver names *who*
+   * decides, and an earlier node — or the approver of an earlier step — may have
+   * written that routing field after submit (e.g. a lead reviewer picking which
+   * departments co-review). Graph approvers (team / position / …) already query
+   * live; this brings the in-record types into line.
+   *
+   * Read under system identity: approver routing is a platform concern and the
+   * record is the flow's own subject, so the submitter's RLS/FLS must not narrow
+   * it. Degrades to `fallback` (the snapshot) when the record can't be re-read —
+   * hard-deleted between submit and node entry, or an object whose backend can't
+   * serve a point read — warning rather than throwing so a transient miss can't
+   * wedge an approval. That "warn but proceed" stance matches the
+   * no-concrete-approver guard (#3424) and the "record is gone" enrichment path
+   * that already falls back to the payload snapshot.
+   */
+  async loadLiveRecord(object, recordId, fallback) {
+    try {
+      const rows = await this.engine.find(object, {
+        where: { id: recordId },
+        limit: 1,
+        context: SYSTEM_CTX2
+      });
+      const live = Array.isArray(rows) ? rows[0] : rows;
+      if (live) return live;
+      this.logger?.warn?.(
+        `[approvals] live record ${object}/${recordId} not found at node entry \u2014 resolving approvers against the trigger snapshot (#3447 fallback).`,
+        { object, recordId }
+      );
+    } catch (err) {
+      this.logger?.warn?.(
+        `[approvals] live record re-read failed for ${object}/${recordId}: ${err?.message ?? err} \u2014 resolving approvers against the trigger snapshot (#3447 fallback).`
+      );
+    }
+    return fallback ?? {};
+  }
   // ── ADR-0019: Approval-as-flow-node ──────────────────────────
   //
   // A flow's Approval node opens a request via `openNodeRequest` (carrying its
@@ -1916,6 +2917,10 @@ var _ApprovalService = class _ApprovalService {
    * Open a pending approval request on behalf of a flow's Approval node. The
    * node config (approvers / behavior / status field) is snapshotted on the row
    * so a decision can be made without any process to resolve against.
+   *
+   * #3447 P2: may instead return an {@link ApprovalNodeAutoOutcome} — no
+   * request opened — when the slate resolves empty and the node's
+   * `onEmptyApprovers` policy is `auto_approve`.
    */
   async openNodeRequest(input, context) {
     if (!input.object) throw new Error("VALIDATION_FAILED: object is required");
@@ -1924,7 +2929,7 @@ var _ApprovalService = class _ApprovalService {
     const existing = await this.engine.find("sys_approval_request", {
       where: { object_name: input.object, record_id: input.recordId, status: "pending" },
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     if (Array.isArray(existing) && existing[0]) {
       throw new Error(`DUPLICATE_REQUEST: a pending approval already exists for ${input.object}/${input.recordId}`);
@@ -1933,26 +2938,56 @@ var _ApprovalService = class _ApprovalService {
     const nowDate = this.clock.now();
     const substitutions = [];
     const groups = {};
+    const liveRecord = await this.loadLiveRecord(input.object, input.recordId, input.record);
+    const resolvedFrom = {};
     const approvers = await this.expandApprovers(
       { approvers: input.config.approvers },
-      input.record,
+      liveRecord,
       ctxOrg,
-      { now: nowDate.getTime(), substitutions, groups }
+      {
+        now: nowDate.getTime(),
+        substitutions,
+        groups,
+        exprCtx: { trigger: input.record ?? null, vars: input.variables ?? null },
+        resolvedFrom
+      }
     );
+    if (!approvers.some((a) => a && !a.includes(":"))) {
+      const emptyPolicy = input.config.onEmptyApprovers ?? "admin_rescue";
+      if (emptyPolicy === "fail") {
+        throw new Error(
+          `NO_APPROVERS: approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no concrete approver and its onEmptyApprovers policy is 'fail'. Check that the approver target(s) are staffed / the routing field or expression yields user ids at node entry.`
+        );
+      }
+      if (emptyPolicy === "auto_approve") {
+        this.logger?.warn?.(
+          `[approvals] approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no concrete approver \u2014 auto-approving per onEmptyApprovers: 'auto_approve' (no request opened).`,
+          { object: input.object, recordId: input.recordId, node: input.nodeId, resolved: approvers }
+        );
+        return { autoApproved: true, reason: "empty_approvers" };
+      }
+      this.logger?.warn?.(
+        `[approvals] approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no concrete approver \u2014 the request is decidable only by a privileged admin. Check that the approver target(s) are staffed.`,
+        { object: input.object, recordId: input.recordId, node: input.nodeId, resolved: approvers }
+      );
+    }
     const now = nowDate.toISOString();
     const id = uid("areq");
     const processName = `flow:${input.flowName ?? input.nodeId}`;
     const configSnapshot = { ...input.config };
     if (input.flowLabel) configSnapshot.__flowLabel = input.flowLabel;
     if (input.nodeLabel) configSnapshot.__nodeLabel = input.nodeLabel;
-    if (input.config.behavior === "quorum" || input.config.behavior === "per_group") {
+    if (input.config.behavior && input.config.behavior !== "first_response") {
       configSnapshot.__approverGroups = groups;
     }
+    if (Object.keys(resolvedFrom).length) {
+      configSnapshot.__resolvedFrom = resolvedFrom;
+    }
     try {
       const prior = await this.engine.find("sys_approval_request", {
         where: { flow_run_id: input.runId, flow_node_id: input.nodeId },
         limit: 500,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       const n = Array.isArray(prior) ? prior.length : 0;
       if (n > 0) configSnapshot.__round = n + 1;
@@ -1976,7 +3011,7 @@ var _ApprovalService = class _ApprovalService {
       created_at: now,
       updated_at: now
     };
-    await this.engine.insert("sys_approval_request", row, { context: SYSTEM_CTX });
+    await this.engine.insert("sys_approval_request", row, { context: SYSTEM_CTX2 });
     await this.syncApproverIndex(id, approvers, ctxOrg, now);
     await this.engine.insert("sys_approval_action", {
       id: uid("aact"),
@@ -1988,7 +3023,7 @@ var _ApprovalService = class _ApprovalService {
       actor_id: input.submitterId ?? context.userId ?? null,
       comment: null,
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     for (const sub of substitutions) {
       await this.engine.insert("sys_approval_action", {
         id: uid("aact"),
@@ -2000,7 +3035,7 @@ var _ApprovalService = class _ApprovalService {
         actor_id: null,
         comment: `${sub.from} \u2192 ${sub.to}${sub.reason ? ` \u2014 ${sub.reason}` : ""}`,
         created_at: now
-      }, { context: SYSTEM_CTX });
+      }, { context: SYSTEM_CTX2 });
       await this.notify({
         topic: "approval.ooo_substituted",
         audience: [sub.to],
@@ -2025,7 +3060,13 @@ var _ApprovalService = class _ApprovalService {
       });
     }
     if (input.config.approvalStatusField) {
-      await this.mirrorStatusField(input.object, input.recordId, input.config.approvalStatusField, "pending");
+      await this.mirrorStatusField(
+        input.object,
+        input.recordId,
+        input.config.approvalStatusField,
+        "pending",
+        row.submitter_id ?? null
+      );
     }
     return rowFromRequest(row);
   }
@@ -2069,27 +3110,52 @@ var _ApprovalService = class _ApprovalService {
    */
   async decideNode(requestId, input, context) {
     if (!requestId) throw new Error("VALIDATION_FAILED: requestId is required");
-    if (!input?.actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+    const actorId = await this.resolveActor(input?.actorId, context);
     if (input.decision !== "approve" && input.decision !== "reject") {
       throw new Error("VALIDATION_FAILED: decision must be approve|reject");
     }
     const rawRows = await this.engine.find("sys_approval_request", {
       where: { id: requestId },
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const raw = Array.isArray(rawRows) ? rawRows[0] : null;
     if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
     if (raw.status !== "pending") throw new Error(`INVALID_STATE: request is ${raw.status}`);
     const pendingApprovers = csvSplit(raw.pending_approvers);
-    if (!context.isSystem && !pendingApprovers.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not a pending approver`);
+    const isOverride = this.isOverrideActor(context, raw.organization_id ?? null);
+    const isSlotHolder = pendingApprovers.includes(actorId);
+    if (!isSlotHolder && !isOverride) {
+      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
     }
     const config = parseJson(raw.node_config_json, { approvers: [], behavior: "first_response" });
     const org = raw.organization_id ?? null;
     const nodeId = raw.flow_node_id ?? raw.current_step ?? null;
     const runId = raw.flow_run_id ?? null;
     const now = this.clock.now().toISOString();
+    const outputKeys = input.outputs ? Object.keys(input.outputs) : [];
+    let acceptedOutputs;
+    if (outputKeys.length) {
+      const declared = normalizeDecisionOutputs(config.decisionOutputs).map((d) => d.key);
+      if (!declared.length) {
+        throw new Error(
+          `VALIDATION_FAILED: this approval node declares no decisionOutputs \u2014 outputs are not accepted. Declare the keys on the node config (decisionOutputs: [${outputKeys.map((k) => `'${k}'`).join(", ")}]) to let approvers hand them to the flow.`
+        );
+      }
+      const reserved = outputKeys.filter((k) => k === "decision" || k === "requestId");
+      if (reserved.length) {
+        throw new Error(
+          `VALIDATION_FAILED: decision output key(s) \`${reserved.join("`, `")}\` are reserved by the resume envelope \u2014 pick different names.`
+        );
+      }
+      const undeclared = outputKeys.filter((k) => !declared.includes(k));
+      if (undeclared.length) {
+        throw new Error(
+          `VALIDATION_FAILED: decision output key(s) \`${undeclared.join("`, `")}\` are not declared on this node \u2014 declared keys: ${declared.map((k) => `'${k}'`).join(", ") || "(none)"}.`
+        );
+      }
+      acceptedOutputs = { ...input.outputs };
+    }
     await this.engine.insert("sys_approval_action", {
       id: uid("aact"),
       request_id: requestId,
@@ -2097,23 +3163,23 @@ var _ApprovalService = class _ApprovalService {
       step_name: nodeId,
       step_index: 0,
       action: input.decision,
-      actor_id: input.actorId,
+      actor_id: actorId,
       comment: input.comment ?? null,
       attachments: input.attachments?.length ? input.attachments : null,
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     const behavior = config.behavior ?? "first_response";
-    if (input.decision === "approve" && behavior !== "first_response") {
+    if (input.decision === "approve" && behavior !== "first_response" && isSlotHolder) {
       const acts = await this.engine.find("sys_approval_action", {
         where: { request_id: requestId, step_index: 0, action: "approve" },
         limit: 1e3,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       const approved = new Set((acts ?? []).map((a) => String(a.actor_id ?? "")).filter(Boolean));
       const snapshotGroups = config.__approverGroups;
       let original;
       let groupMap;
-      if (snapshotGroups && (behavior === "quorum" || behavior === "per_group")) {
+      if (snapshotGroups) {
         groupMap = snapshotGroups;
         original = Object.keys(snapshotGroups);
       } else {
@@ -2129,27 +3195,65 @@ var _ApprovalService = class _ApprovalService {
         await this.engine.update("sys_approval_request", {
           id: requestId,
           pending_approvers: stillPending.join(","),
-          updated_at: now
-        }, { context: SYSTEM_CTX });
+          updated_at: now,
+          // #3447 P2: a mid-tally approval may carry outputs too (unanimous /
+          // per_group co-sign, each approver contributing their declared keys)
+          // — accumulate them on the snapshot so the FINALIZING decision hands
+          // the merged set to the flow.
+          ...acceptedOutputs ? {
+            node_config_json: JSON.stringify({
+              ...config,
+              __decisionOutputs: { ...config.__decisionOutputs ?? {}, ...acceptedOutputs }
+            })
+          } : {}
+        }, { context: SYSTEM_CTX2 });
         await this.syncApproverIndex(requestId, stillPending, org, now);
-        const fresh2 = await this.getRequest(requestId, context);
+        const fresh2 = await this.readBackRequest(requestId, context);
         return { request: fresh2, runId, nodeId, finalized: false, decision: input.decision };
       }
     }
     const finalStatus = input.decision === "approve" ? "approved" : "rejected";
+    const mergedOutputs = acceptedOutputs || config.__decisionOutputs ? { ...config.__decisionOutputs ?? {}, ...acceptedOutputs ?? {} } : void 0;
     await this.engine.update("sys_approval_request", {
       id: requestId,
       status: finalStatus,
       pending_approvers: null,
       completed_at: now,
-      updated_at: now
-    }, { context: SYSTEM_CTX });
+      updated_at: now,
+      ...mergedOutputs ? {
+        node_config_json: JSON.stringify({ ...config, __decisionOutputs: mergedOutputs })
+      } : {}
+    }, { context: SYSTEM_CTX2 });
     await this.syncApproverIndex(requestId, [], org, now);
     if (config.approvalStatusField) {
-      await this.mirrorStatusField(raw.object_name, raw.record_id, config.approvalStatusField, finalStatus);
+      await this.mirrorStatusField(
+        raw.object_name,
+        raw.record_id,
+        config.approvalStatusField,
+        finalStatus,
+        actingUserId(context)
+      );
     }
-    const fresh = await this.getRequest(requestId, context);
-    return { request: fresh, runId, nodeId, finalized: true, decision: input.decision };
+    const fresh = await this.readBackRequest(requestId, context);
+    return { request: fresh, runId, nodeId, finalized: true, decision: input.decision, outputs: mergedOutputs };
+  }
+  /**
+   * Continue the owning flow run after an outcome this service has already
+   * authorized and written down (#3801).
+   *
+   * The `approval` node declares `resumeAuthority: 'service'`, so the engine
+   * refuses any resume of an approval suspension that does not carry
+   * {@link RESUME_AUTHORITY_SERVICE}. Every approvals-side resume goes through
+   * here so the marker is stamped in ONE place — a new outcome path cannot
+   * quietly ship a resume that the gate then rejects at runtime, and nothing
+   * in this file hands the marker to a caller-supplied signal.
+   *
+   * Callers still guard on `typeof this.automation?.resume === 'function'`
+   * (approvals runs fine with no automation attached) and keep their own
+   * try/catch, because what a failed resume means differs per path.
+   */
+  async serviceResume(runId, signal) {
+    await this.automation.resume(runId, { ...signal, [RESUME_AUTHORITY_SERVICE]: true });
   }
   /**
    * Public contract entrypoint (ADR-0019). Records a decision on a node-driven
@@ -2162,9 +3266,14 @@ var _ApprovalService = class _ApprovalService {
     if (result.finalized && result.runId && typeof this.automation?.resume === "function") {
       const branchLabel = result.decision === "approve" ? APPROVAL_BRANCH_LABELS.approve : APPROVAL_BRANCH_LABELS.reject;
       try {
-        await this.automation.resume(result.runId, {
+        await this.serviceResume(result.runId, {
           branchLabel,
-          output: { decision: result.decision, requestId }
+          // #3447 P2: accepted decision outputs ride the resume envelope and
+          // land as `<nodeId>.<key>` flow variables — a later approval node's
+          // `expression` approver reads them as `vars.<nodeId>.<key>`.
+          // Reserved keys are spread LAST so no output can shadow them (the
+          // whitelist already rejects them; this is defense in depth).
+          output: { ...result.outputs ?? {}, decision: result.decision, requestId }
         });
         resumed = true;
       } catch (err) {
@@ -2198,11 +3307,11 @@ var _ApprovalService = class _ApprovalService {
    */
   async recall(requestId, input, context) {
     if (!requestId) throw new Error("VALIDATION_FAILED: requestId is required");
-    if (!input?.actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+    const actorId = await this.resolveActor(input?.actorId, context);
     const rawRows = await this.engine.find("sys_approval_request", {
       where: { id: requestId },
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const raw = Array.isArray(rawRows) ? rawRows[0] : null;
     if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
@@ -2210,7 +3319,7 @@ var _ApprovalService = class _ApprovalService {
     if (raw.status !== "pending" && !inReviseWindow) {
       throw new Error(`INVALID_STATE: request is ${raw.status}`);
     }
-    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(input.actorId)) {
+    if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
       throw new Error(`FORBIDDEN: only the submitter may recall this request`);
     }
     if (inReviseWindow) await this.assertLatestForRun(raw);
@@ -2226,20 +3335,26 @@ var _ApprovalService = class _ApprovalService {
       step_name: nodeId,
       step_index: 0,
       action: "recall",
-      actor_id: input.actorId,
+      actor_id: actorId,
       comment: input.comment ?? null,
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     await this.engine.update("sys_approval_request", {
       id: requestId,
       status: "recalled",
       pending_approvers: null,
       completed_at: now,
       updated_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     await this.syncApproverIndex(requestId, [], org, now);
     if (config.approvalStatusField) {
-      await this.mirrorStatusField(raw.object_name, raw.record_id, config.approvalStatusField, "recalled");
+      await this.mirrorStatusField(
+        raw.object_name,
+        raw.record_id,
+        config.approvalStatusField,
+        "recalled",
+        actingUserId(context)
+      );
     }
     let resumed = false;
     if (inReviseWindow) {
@@ -2256,7 +3371,7 @@ var _ApprovalService = class _ApprovalService {
       }
     } else if (runId && typeof this.automation?.resume === "function") {
       try {
-        await this.automation.resume(runId, {
+        await this.serviceResume(runId, {
           branchLabel: APPROVAL_BRANCH_LABELS.reject,
           output: { decision: "recall", requestId }
         });
@@ -2269,7 +3384,7 @@ var _ApprovalService = class _ApprovalService {
         });
       }
     }
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh, runId, resumed };
   }
   // ── Send back for revision / resubmit (ADR-0044) ─────────────
@@ -2287,11 +3402,11 @@ var _ApprovalService = class _ApprovalService {
    * `output.autoRejected = true`) so instances cannot orbit forever.
    */
   async sendBack(requestId, input, context) {
-    if (!input?.actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+    const actorId = await this.resolveActor(input?.actorId, context);
     const raw = await this.loadPendingRow(requestId);
     const pending = csvSplit(raw.pending_approvers);
-    if (!context.isSystem && !pending.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not a pending approver`);
+    if (!context.isSystem && !pending.includes(actorId)) {
+      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
     }
     const config = parseJson(raw.node_config_json, { approvers: [], behavior: "first_response" });
     const org = raw.organization_id ?? null;
@@ -2305,7 +3420,7 @@ var _ApprovalService = class _ApprovalService {
       const siblings = await this.engine.find("sys_approval_request", {
         where: { flow_run_id: runId, flow_node_id: nodeId, status: "returned" },
         limit: 500,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       priorSendBacks = Array.isArray(siblings) ? siblings.length : 0;
     }
@@ -2316,10 +3431,10 @@ var _ApprovalService = class _ApprovalService {
       step_name: nodeId,
       step_index: 0,
       action: "revise",
-      actor_id: input.actorId,
+      actor_id: actorId,
       comment: input.comment ?? null,
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     if (priorSendBacks >= maxRevisions) {
       await this.engine.insert("sys_approval_action", {
         id: uid("aact"),
@@ -2328,25 +3443,31 @@ var _ApprovalService = class _ApprovalService {
         step_name: nodeId,
         step_index: 0,
         action: "reject",
-        actor_id: input.actorId,
+        actor_id: actorId,
         comment: `Auto-rejected: revision limit (${maxRevisions}) exceeded`,
         created_at: now
-      }, { context: SYSTEM_CTX });
+      }, { context: SYSTEM_CTX2 });
       await this.engine.update("sys_approval_request", {
         id: requestId,
         status: "rejected",
         pending_approvers: null,
         completed_at: now,
         updated_at: now
-      }, { context: SYSTEM_CTX });
+      }, { context: SYSTEM_CTX2 });
       await this.syncApproverIndex(requestId, [], org, now);
       if (config.approvalStatusField) {
-        await this.mirrorStatusField(raw.object_name, raw.record_id, config.approvalStatusField, "rejected");
+        await this.mirrorStatusField(
+          raw.object_name,
+          raw.record_id,
+          config.approvalStatusField,
+          "rejected",
+          actingUserId(context)
+        );
       }
       let resumed2 = false;
       if (runId && typeof this.automation?.resume === "function") {
         try {
-          await this.automation.resume(runId, {
+          await this.serviceResume(runId, {
             branchLabel: APPROVAL_BRANCH_LABELS.reject,
             output: { decision: "reject", autoRejected: true, requestId }
           });
@@ -2363,7 +3484,7 @@ var _ApprovalService = class _ApprovalService {
         await this.notify({
           topic: "approval.returned",
           audience: [String(raw.submitter_id)],
-          actorId: input.actorId,
+          actorId,
           source: { object: "sys_approval_request", id: requestId },
           payload: {
             title: "Approval auto-rejected",
@@ -2372,7 +3493,7 @@ var _ApprovalService = class _ApprovalService {
           }
         });
       }
-      const fresh2 = await this.getRequest(requestId, context);
+      const fresh2 = await this.readBackRequest(requestId, context);
       return { request: fresh2, runId, resumed: resumed2, autoRejected: true };
     }
     await this.engine.update("sys_approval_request", {
@@ -2381,15 +3502,21 @@ var _ApprovalService = class _ApprovalService {
       pending_approvers: null,
       completed_at: now,
       updated_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     await this.syncApproverIndex(requestId, [], org, now);
     if (config.approvalStatusField) {
-      await this.mirrorStatusField(raw.object_name, raw.record_id, config.approvalStatusField, "returned");
+      await this.mirrorStatusField(
+        raw.object_name,
+        raw.record_id,
+        config.approvalStatusField,
+        "returned",
+        actingUserId(context)
+      );
     }
     let resumed = false;
     if (runId && typeof this.automation?.resume === "function") {
       try {
-        await this.automation.resume(runId, {
+        await this.serviceResume(runId, {
           branchLabel: APPROVAL_BRANCH_LABELS.revise,
           output: { decision: "revise", requestId }
         });
@@ -2406,7 +3533,7 @@ var _ApprovalService = class _ApprovalService {
       await this.notify({
         topic: "approval.returned",
         audience: [String(raw.submitter_id)],
-        actorId: input.actorId,
+        actorId,
         source: { object: "sys_approval_request", id: requestId },
         payload: {
           title: "Sent back for revision",
@@ -2415,7 +3542,7 @@ var _ApprovalService = class _ApprovalService {
         }
       });
     }
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh, runId, resumed };
   }
   /**
@@ -2426,25 +3553,25 @@ var _ApprovalService = class _ApprovalService {
    * round-N+1 request — fresh approver slate, record re-locks.
    */
   async resubmit(requestId, input, context) {
-    if (!input?.actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+    const actorId = await this.resolveActor(input?.actorId, context);
     const rawRows = await this.engine.find("sys_approval_request", {
       where: { id: requestId },
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const raw = Array.isArray(rawRows) ? rawRows[0] : null;
     if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
     if (raw.status !== "returned") {
       throw new Error(`INVALID_STATE: request is ${raw.status} (resubmit applies to returned requests)`);
     }
-    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(input.actorId)) {
+    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
       throw new Error("FORBIDDEN: only the submitter may resubmit");
     }
     await this.assertLatestForRun(raw);
     const colliding = await this.engine.find("sys_approval_request", {
       where: { object_name: raw.object_name, record_id: raw.record_id, status: "pending" },
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     if (Array.isArray(colliding) && colliding[0]) {
       throw new Error(
@@ -2462,14 +3589,14 @@ var _ApprovalService = class _ApprovalService {
       step_name: nodeId,
       step_index: 0,
       action: "resubmit",
-      actor_id: input.actorId,
+      actor_id: actorId,
       comment: input.comment ?? null,
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     let resumed = false;
     if (runId && typeof this.automation?.resume === "function") {
       try {
-        await this.automation.resume(runId, {
+        await this.serviceResume(runId, {
           branchLabel: APPROVAL_BRANCH_LABELS.resubmit,
           output: { resubmitted: true, requestId }
         });
@@ -2482,7 +3609,7 @@ var _ApprovalService = class _ApprovalService {
         });
       }
     }
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh, runId, resumed };
   }
   /**
@@ -2517,7 +3644,7 @@ var _ApprovalService = class _ApprovalService {
       where: { flow_run_id: runId },
       orderBy: [{ field: "created_at", order: "desc" }],
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const latest = Array.isArray(rows) ? rows[0] : null;
     if (latest && String(latest.id) !== String(raw.id)) {
@@ -2528,25 +3655,33 @@ var _ApprovalService = class _ApprovalService {
   /**
    * Hand a pending-approver slot to someone else. `from` defaults to the
    * actor itself; the actor must hold the slot being handed over (or be a
-   * system caller). Audits `reassign` and notifies the new approver.
+   * system caller). A privileged admin (#3424) may reassign a request whose
+   * slate holds no real user — an unstaffed-position literal — by handing the
+   * whole request to a real approver, rescuing it from the locked dead-end.
+   * Audits `reassign` and notifies the new approver.
    */
   async reassign(requestId, input, context) {
-    if (!input?.actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+    const actorId = await this.resolveActor(input?.actorId, context);
     const to = String(input?.to ?? "").trim();
     if (!to) throw new Error("VALIDATION_FAILED: `to` (new approver) is required");
     const raw = await this.loadPendingRow(requestId);
     const pending = csvSplit(raw.pending_approvers);
-    const from = String(input.from ?? input.actorId).trim();
-    if (!pending.includes(from)) {
-      throw new Error(`FORBIDDEN: '${from}' is not a pending approver on this request`);
-    }
-    if (!context.isSystem && input.actorId !== from && !pending.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not a pending approver`);
-    }
     if (pending.includes(to)) {
       throw new Error(`VALIDATION_FAILED: '${to}' is already a pending approver`);
     }
-    const next = pending.map((a) => a === from ? to : a);
+    const isOverride = this.isOverrideActor(context, raw.organization_id ?? null);
+    const from = String(input.from ?? actorId).trim();
+    let next;
+    if (pending.includes(from)) {
+      if (!context.isSystem && !isOverride && actorId !== from && !pending.includes(actorId)) {
+        throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
+      }
+      next = pending.map((a) => a === from ? to : a);
+    } else if (isOverride) {
+      next = [to];
+    } else {
+      throw new Error(`FORBIDDEN: '${from}' is not a pending approver on this request`);
+    }
     const now = this.clock.now().toISOString();
     await this.engine.insert("sys_approval_action", {
       id: uid("aact"),
@@ -2555,10 +3690,10 @@ var _ApprovalService = class _ApprovalService {
       step_name: raw.flow_node_id ?? raw.current_step ?? null,
       step_index: 0,
       action: "reassign",
-      actor_id: input.actorId,
+      actor_id: actorId,
       comment: input.comment ?? `${from} \u2192 ${to}`,
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     let configPatch = {};
     try {
       const cfg = parseJson(raw.node_config_json, null);
@@ -2575,12 +3710,12 @@ var _ApprovalService = class _ApprovalService {
       pending_approvers: next.join(","),
       updated_at: now,
       ...configPatch
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     await this.syncApproverIndex(requestId, next, raw.organization_id ?? null, now);
     await this.notify({
       topic: "approval.reassigned",
       audience: [to],
-      actorId: input.actorId,
+      actorId,
       source: { object: "sys_approval_request", id: requestId },
       dedupKey: `approval-reassign-${requestId}-${to}`,
       payload: {
@@ -2589,7 +3724,7 @@ var _ApprovalService = class _ApprovalService {
         actionUrl: "/system/approvals"
       }
     });
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh };
   }
   /**
@@ -2597,16 +3732,16 @@ var _ApprovalService = class _ApprovalService {
    * reminder per {@link REMIND_COOLDOWN_MS} per request.
    */
   async remind(requestId, input, context) {
-    if (!input?.actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+    const actorId = await this.resolveActor(input?.actorId, context);
     const raw = await this.loadPendingRow(requestId);
-    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(input.actorId)) {
+    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
       throw new Error("FORBIDDEN: only the submitter may send reminders");
     }
     const acts = await this.engine.find("sys_approval_action", {
       where: { request_id: requestId, action: "remind" },
       orderBy: [{ field: "created_at", order: "desc" }],
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const last = Array.isArray(acts) ? acts[0] : null;
     const now = this.clock.now();
@@ -2622,10 +3757,10 @@ var _ApprovalService = class _ApprovalService {
       step_name: raw.flow_node_id ?? raw.current_step ?? null,
       step_index: 0,
       action: "remind",
-      actor_id: input.actorId,
+      actor_id: actorId,
       comment: input.comment ?? null,
       created_at: nowIso
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     let notified = 0;
     const concrete = pending.filter((a) => a && !a.includes(":"));
     const literals = pending.filter((a) => a && a.includes(":"));
@@ -2635,7 +3770,7 @@ var _ApprovalService = class _ApprovalService {
         notified += await this.notify({
           topic: "approval.reminder",
           audience: [approver],
-          actorId: input.actorId,
+          actorId,
           source: { object: "sys_approval_request", id: requestId },
           dedupKey: `approval-remind-${requestId}-${nowIso}-${approver}`,
           payload: {
@@ -2660,7 +3795,7 @@ var _ApprovalService = class _ApprovalService {
       notified += await this.notify({
         topic: "approval.reminder",
         audience: literals,
-        actorId: input.actorId,
+        actorId,
         source: { object: "sys_approval_request", id: requestId },
         dedupKey: `approval-remind-${requestId}-${nowIso}`,
         payload: {
@@ -2670,7 +3805,7 @@ var _ApprovalService = class _ApprovalService {
         }
       });
     }
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh, notified };
   }
   // ── Actionable links (ADR-0043) ──────────────────────────────
@@ -2705,7 +3840,7 @@ var _ApprovalService = class _ApprovalService {
         expires_at: expires,
         consumed_at: null,
         created_at: now.toISOString()
-      }, { context: SYSTEM_CTX });
+      }, { context: SYSTEM_CTX2 });
       out[action] = rawToken;
     }
     return out;
@@ -2718,7 +3853,7 @@ var _ApprovalService = class _ApprovalService {
     const rows = await this.engine.find("sys_approval_token", {
       where: { token_hash: hash },
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const token = Array.isArray(rows) ? rows[0] : null;
     if (!token) return { ok: false, reason: "invalid" };
@@ -2726,7 +3861,7 @@ var _ApprovalService = class _ApprovalService {
     if (Date.parse(token.expires_at) < this.clock.now().getTime()) {
       return { ok: false, reason: "expired" };
     }
-    const request = await this.getRequest(token.request_id, SYSTEM_CTX);
+    const request = await this.getRequest(token.request_id, SYSTEM_CTX2);
     if (!request || request.status !== "pending") {
       return { ok: false, reason: "not_pending", request: request ?? void 0 };
     }
@@ -2751,12 +3886,19 @@ var _ApprovalService = class _ApprovalService {
     await this.engine.update("sys_approval_token", {
       id: res.token.id,
       consumed_at: this.clock.now().toISOString()
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     const out = await this.decide(res.token.request_id, {
       decision: res.token.action,
       actorId: res.token.approver_id,
       comment: "Via action link"
-    }, SYSTEM_CTX);
+      // The token IS the authentication (#3783): it is single-use, hashed at
+      // rest and bound to one approver, who `resolveActionToken` has just
+      // re-checked still holds a pending slot. So this decision has a real
+      // acting user even though no session carried it — name them on the
+      // context, so the status mirror and every flow it cascades into are
+      // attributed exactly like a decision made through the UI. Elevation is
+      // unchanged: `isSystem` still stands in for the missing session.
+    }, { ...SYSTEM_CTX2, userId: res.token.approver_id });
     return { ok: true, action: res.token.action, request: out.request, approverId: res.token.approver_id };
   }
   /**
@@ -2764,12 +3906,12 @@ var _ApprovalService = class _ApprovalService {
    * pending — a thread interaction, not a flow decision.
    */
   async requestInfo(requestId, input, context) {
-    if (!input?.actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+    const actorId = await this.resolveActor(input?.actorId, context);
     if (!input?.comment?.trim()) throw new Error("VALIDATION_FAILED: comment is required");
     const raw = await this.loadPendingRow(requestId);
     const pending = csvSplit(raw.pending_approvers);
-    if (!context.isSystem && !pending.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not a pending approver`);
+    if (!context.isSystem && !pending.includes(actorId)) {
+      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
     }
     const now = this.clock.now().toISOString();
     await this.engine.insert("sys_approval_action", {
@@ -2779,15 +3921,15 @@ var _ApprovalService = class _ApprovalService {
       step_name: raw.flow_node_id ?? raw.current_step ?? null,
       step_index: 0,
       action: "request_info",
-      actor_id: input.actorId,
+      actor_id: actorId,
       comment: input.comment.trim(),
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     if (raw.submitter_id) {
       await this.notify({
         topic: "approval.request_info",
         audience: [String(raw.submitter_id)],
-        actorId: input.actorId,
+        actorId,
         source: { object: "sys_approval_request", id: requestId },
         payload: {
           title: "More information requested",
@@ -2796,18 +3938,18 @@ var _ApprovalService = class _ApprovalService {
         }
       });
     }
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh };
   }
   /** Free-form reply on the thread (submitter or any pending approver). */
   async comment(requestId, input, context) {
-    if (!input?.actorId) throw new Error("VALIDATION_FAILED: actorId is required");
+    const actorId = await this.resolveActor(input?.actorId, context);
     if (!input?.comment?.trim()) throw new Error("VALIDATION_FAILED: comment is required");
     const raw = await this.loadPendingRow(requestId);
     const pending = csvSplit(raw.pending_approvers);
-    const isSubmitter = raw.submitter_id && String(raw.submitter_id) === String(input.actorId);
-    if (!context.isSystem && !isSubmitter && !pending.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not on this request`);
+    const isSubmitter = raw.submitter_id && String(raw.submitter_id) === String(actorId);
+    if (!context.isSystem && !isSubmitter && !pending.includes(actorId)) {
+      throw new Error(`FORBIDDEN: actor '${actorId}' is not on this request`);
     }
     const now = this.clock.now().toISOString();
     await this.engine.insert("sys_approval_action", {
@@ -2817,16 +3959,16 @@ var _ApprovalService = class _ApprovalService {
       step_name: raw.flow_node_id ?? raw.current_step ?? null,
       step_index: 0,
       action: "comment",
-      actor_id: input.actorId,
+      actor_id: actorId,
       comment: input.comment.trim(),
       attachments: input.attachments?.length ? input.attachments : null,
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     const audience = isSubmitter ? pending : [String(raw.submitter_id ?? "")].filter(Boolean);
     await this.notify({
       topic: "approval.comment",
       audience,
-      actorId: input.actorId,
+      actorId,
       source: { object: "sys_approval_request", id: requestId },
       payload: {
         title: "New comment on an approval",
@@ -2834,7 +3976,7 @@ var _ApprovalService = class _ApprovalService {
         actionUrl: "/system/approvals"
       }
     });
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh };
   }
   // ── SLA escalation (ADR-0042) ─────────────────────────────────
@@ -2851,7 +3993,7 @@ var _ApprovalService = class _ApprovalService {
       rows = await this.engine.find("sys_approval_request", {
         where: { status: "pending" },
         limit: 500,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       }) ?? [];
     } catch (err) {
       this.logger?.warn?.("[approvals] escalation scan failed to list requests", {
@@ -2870,7 +4012,7 @@ var _ApprovalService = class _ApprovalService {
         const prior = await this.engine.find("sys_approval_action", {
           where: { request_id: raw.id, action: "escalate" },
           limit: 1,
-          context: SYSTEM_CTX
+          context: SYSTEM_CTX2
         });
         if (Array.isArray(prior) && prior[0]) continue;
         await this.escalateRequest(raw, esc2);
@@ -2887,6 +4029,130 @@ var _ApprovalService = class _ApprovalService {
     }
     return { scanned: rows.length, escalated };
   }
+  // ── Dead-run release (#3456) ──────────────────────────────────
+  /**
+   * One dead-run sweep: a pending request whose owning flow run has reached a
+   * TERMINAL state can never be decided — nothing is left to resume — so the
+   * request is finalised as `recalled` and, with `lockRecord`, the record it was
+   * holding is released.
+   *
+   * This is the recovery half of #3456. The prevention half is the record lock's
+   * owning-run exemption (`lifecycle-hooks.ts`), which stops a run from killing
+   * itself on its own lock in the first place; this sweep cleans up the runs that
+   * still die — for any reason, including a process crash, which no in-band
+   * handler can catch because the process that would have run it is gone.
+   *
+   * **Fail-safe by construction.** It acts only on an explicit terminal status
+   * from a closed set. Every other answer — `paused` (the normal state of a run
+   * waiting on its approval), `running`, an unrecognised status, `null` (unknown
+   * run, evicted log, no durable store), a `getRun` that throws, or no automation
+   * engine at all — is read as "still alive" and left strictly alone. The failure
+   * mode is therefore "a dead run's lock survives until an admin recalls it"
+   * (today's behaviour, #3424), never "a live approval is destroyed".
+   *
+   * `recalled` is the finalisation because it is the platform's existing terminal
+   * state for *a live request that ended without a decision*; the audit row names
+   * the real cause and {@link DEAD_RUN_ACTOR_ID} the real actor, so a dead-run
+   * release is never mistaken for a submitter's withdrawal.
+   */
+  async releaseDeadRunRequests() {
+    if (typeof this.automation?.getRun !== "function") return { scanned: 0, released: 0 };
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_approval_request", {
+        where: { status: "pending" },
+        limit: 500,
+        context: SYSTEM_CTX2
+      }) ?? [];
+    } catch (err) {
+      this.logger?.warn?.("[approvals] dead-run sweep failed to list requests", {
+        error: err?.message ?? String(err)
+      });
+      return { scanned: 0, released: 0 };
+    }
+    let released = 0;
+    for (const raw of rows) {
+      try {
+        const runId = raw?.flow_run_id ? String(raw.flow_run_id) : "";
+        if (!runId) continue;
+        let status;
+        try {
+          const run = await this.automation.getRun(runId);
+          status = typeof run?.status === "string" ? run.status : void 0;
+        } catch (err) {
+          this.logger?.warn?.("[approvals] dead-run sweep could not read run status", {
+            request: raw?.id,
+            run: runId,
+            error: err?.message ?? String(err)
+          });
+          continue;
+        }
+        if (!status || !TERMINAL_RUN_STATUSES.has(status)) continue;
+        await this.abandonForDeadRun(raw, runId, status);
+        released++;
+      } catch (err) {
+        this.logger?.warn?.("[approvals] dead-run release failed for request", {
+          request: raw?.id,
+          error: err?.message ?? String(err)
+        });
+      }
+    }
+    if (released > 0) {
+      this.logger?.info?.("[approvals] dead-run sweep", { scanned: rows.length, released });
+    }
+    return { scanned: rows.length, released };
+  }
+  /**
+   * Finalise one pending request whose owning run is terminal. Mirrors the
+   * shape of {@link recall} — audit row first (so a crash mid-release leaves a
+   * trace of the intent), then the status transition, approver-index sync and
+   * the optional status-field mirror. No resume/cancel of the run: it is already
+   * terminal, which is precisely why we are here.
+   */
+  async abandonForDeadRun(raw, runId, runStatus) {
+    const org = raw.organization_id ?? null;
+    const nodeId = raw.flow_node_id ?? raw.current_step ?? null;
+    const now = this.clock.now().toISOString();
+    await this.engine.insert("sys_approval_action", {
+      id: uid("aact"),
+      request_id: raw.id,
+      organization_id: org,
+      step_name: nodeId,
+      step_index: 0,
+      action: "recall",
+      actor_id: DEAD_RUN_ACTOR_ID,
+      comment: `owning flow run ${runId} is ${runStatus} \u2014 request abandoned and record lock released`,
+      created_at: now
+    }, { context: SYSTEM_CTX2 });
+    await this.engine.update("sys_approval_request", {
+      id: raw.id,
+      status: "recalled",
+      pending_approvers: null,
+      completed_at: now,
+      updated_at: now
+    }, { context: SYSTEM_CTX2 });
+    await this.syncApproverIndex(raw.id, [], org, now);
+    const config = parseJson(
+      raw.node_config_json,
+      { approvers: [], behavior: "first_response" }
+    );
+    if (config.approvalStatusField) {
+      await this.mirrorStatusField(
+        raw.object_name,
+        raw.record_id,
+        config.approvalStatusField,
+        "recalled",
+        null
+      );
+    }
+    this.logger?.warn?.("[approvals] released a record held by a dead approval run", {
+      request: raw.id,
+      run: runId,
+      runStatus,
+      object: raw.object_name,
+      record: raw.record_id
+    });
+  }
   /** Execute the configured escalation action for one overdue request. */
   async escalateRequest(raw, esc2) {
     const action = esc2.action ?? "notify";
@@ -2912,13 +4178,13 @@ var _ApprovalService = class _ApprovalService {
       actor_id: SLA_ACTOR_ID,
       comment: `${action}${escalateTo ? ` \u2192 ${escalateTo}` : ""}`,
       created_at: now
-    }, { context: SYSTEM_CTX });
+    }, { context: SYSTEM_CTX2 });
     if (action === "reassign" && escalatees.length) {
       await this.engine.update("sys_approval_request", {
         id: raw.id,
         pending_approvers: escalatees.join(","),
         updated_at: now
-      }, { context: SYSTEM_CTX });
+      }, { context: SYSTEM_CTX2 });
       await this.syncApproverIndex(raw.id, escalatees, raw.organization_id ?? null, now);
       await this.notify({
         topic: "approval.escalated",
@@ -2936,7 +4202,7 @@ var _ApprovalService = class _ApprovalService {
         decision: action === "auto_approve" ? "approve" : "reject",
         actorId: SLA_ACTOR_ID,
         comment: "SLA escalation"
-      }, SYSTEM_CTX);
+      }, SYSTEM_CTX2);
     } else {
       await this.notify({
         topic: "approval.sla_breached",
@@ -3004,7 +4270,7 @@ var _ApprovalService = class _ApprovalService {
         where: { id: { $in: targets } },
         fields: ["id", "name", "email"],
         limit: targets.length,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       for (const u of users ?? []) {
         if (u?.id && (u.name || u.email)) names.set(String(u.id), String(u.name ?? u.email));
@@ -3018,7 +4284,7 @@ var _ApprovalService = class _ApprovalService {
           where: { email: { $in: unresolvedEmails } },
           fields: ["email", "name"],
           limit: unresolvedEmails.length,
-          context: SYSTEM_CTX
+          context: SYSTEM_CTX2
         });
         for (const u of users ?? []) {
           if (u?.email && u.name) names.set(String(u.email), String(u.name));
@@ -3044,11 +4310,32 @@ var _ApprovalService = class _ApprovalService {
       return [];
     }
   }
+  /**
+   * Field key → display label for an object's schema. Lets the inbox summary
+   * show a human field name ("考核状态") instead of a title-cased machine key
+   * ("Assessment Status"). For a single-locale project the schema label already
+   * IS the localized string; symmetric with `resolveDisplayField`/lookup
+   * resolution that power `payload_display`.
+   */
+  resolveFieldLabels(object) {
+    try {
+      const schema = this.engine.getSchema?.(object);
+      const fields = schema?.fields ?? {};
+      const out = {};
+      for (const [key, f] of Object.entries(fields)) {
+        if (f?.label) out[key] = String(f.label);
+      }
+      return out;
+    } catch {
+      return {};
+    }
+  }
   /**
    * Attach inbox display fields to rows so clients never render a raw
    * identifier: `record_title`, `submitter_name`, `object_label`,
-   * `pending_approver_names` (user-id approvers), and `payload_display`
-   * (lookup foreign keys in the snapshot → referenced record titles).
+   * `pending_approver_names` (user-id approvers), `payload_display`
+   * (lookup foreign keys in the snapshot → referenced record titles), and
+   * `payload_labels` (snapshot field keys → the target object's field labels).
    * Batched: one query per distinct object (target + referenced) plus one
    * `sys_user` lookup. Best-effort — a deleted record falls back to the
    * payload snapshot, and any failure leaves the field unset rather than
@@ -3080,7 +4367,7 @@ var _ApprovalService = class _ApprovalService {
         const recs = await this.engine.find(object, {
           where: { id: { $in: ids } },
           limit: ids.length,
-          context: SYSTEM_CTX
+          context: SYSTEM_CTX2
         });
         for (const rec of recs ?? []) {
           const title = _ApprovalService.pickTitle(rec, displayField);
@@ -3090,9 +4377,12 @@ var _ApprovalService = class _ApprovalService {
       }
     }
     const lookupFieldsByObject = /* @__PURE__ */ new Map();
+    const fieldLabelsByObject = /* @__PURE__ */ new Map();
     for (const object of byObject.keys()) {
       const lookups = this.resolveLookupFields(object);
       if (lookups.length) lookupFieldsByObject.set(object, lookups);
+      const labels = this.resolveFieldLabels(object);
+      if (Object.keys(labels).length) fieldLabelsByObject.set(object, labels);
     }
     const refIds = /* @__PURE__ */ new Map();
     for (const r of rows) {
@@ -3118,7 +4408,7 @@ var _ApprovalService = class _ApprovalService {
         const recs = await this.engine.find(object, {
           where: { id: { $in: ids } },
           limit: ids.length,
-          context: SYSTEM_CTX
+          context: SYSTEM_CTX2
         });
         for (const rec of recs ?? []) {
           const title = _ApprovalService.pickTitle(rec, displayField);
@@ -3159,6 +4449,15 @@ var _ApprovalService = class _ApprovalService {
         }
         if (Object.keys(display).length) r.payload_display = display;
       }
+      const fieldLabels = fieldLabelsByObject.get(r.object_name);
+      if (fieldLabels && r.payload && typeof r.payload === "object") {
+        const labels = {};
+        for (const key of Object.keys(r.payload)) {
+          const l = fieldLabels[key];
+          if (l) labels[key] = l;
+        }
+        if (Object.keys(labels).length) r.payload_labels = labels;
+      }
     }
   }
   // ── Pending-approver index (issue #1745) ─────────────────────
@@ -3174,12 +4473,12 @@ var _ApprovalService = class _ApprovalService {
     const existing = await this.engine.find("sys_approval_approver", {
       where: { request_id: requestId },
       limit: 500,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const rows = Array.isArray(existing) ? existing : [];
     for (const row of rows) {
       if (desired.has(String(row.approver))) desired.delete(String(row.approver));
-      else await this.engine.delete("sys_approval_approver", { where: { id: row.id }, context: SYSTEM_CTX });
+      else await this.engine.delete("sys_approval_approver", { where: { id: row.id }, context: SYSTEM_CTX2 });
     }
     for (const approver of desired) {
       await this.engine.insert("sys_approval_approver", {
@@ -3188,7 +4487,7 @@ var _ApprovalService = class _ApprovalService {
         approver,
         organization_id: org,
         created_at: now
-      }, { context: SYSTEM_CTX });
+      }, { context: SYSTEM_CTX2 });
     }
   }
   /**
@@ -3206,7 +4505,7 @@ var _ApprovalService = class _ApprovalService {
         fields: ["id", "pending_approvers", "organization_id"],
         limit: PAGE,
         offset,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       const rows = Array.isArray(batch) ? batch : [];
       for (const r of rows) {
@@ -3223,7 +4522,7 @@ var _ApprovalService = class _ApprovalService {
         orderBy: [{ field: "created_at", order: "asc" }],
         limit: PAGE,
         offset,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       const rows = Array.isArray(batch) ? batch : [];
       indexRows.push(...rows);
@@ -3237,7 +4536,7 @@ var _ApprovalService = class _ApprovalService {
       const want = desired.get(reqId);
       const have = seen.get(reqId) ?? seen.set(reqId, /* @__PURE__ */ new Set()).get(reqId);
       if (!want || !want.approvers.has(String(row.approver)) || have.has(String(row.approver))) {
-        await this.engine.delete("sys_approval_approver", { where: { id: row.id }, context: SYSTEM_CTX });
+        await this.engine.delete("sys_approval_approver", { where: { id: row.id }, context: SYSTEM_CTX2 });
         deleted++;
         continue;
       }
@@ -3254,7 +4553,7 @@ var _ApprovalService = class _ApprovalService {
           approver,
           organization_id: want.org,
           created_at: now
-        }, { context: SYSTEM_CTX });
+        }, { context: SYSTEM_CTX2 });
         inserted++;
       }
     }
@@ -3304,7 +4603,7 @@ var _ApprovalService = class _ApprovalService {
       where,
       fields: ["request_id"],
       limit: _ApprovalService.APPROVER_INDEX_CAP,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const list = Array.isArray(rows) ? rows : [];
     if (list.length >= _ApprovalService.APPROVER_INDEX_CAP) {
@@ -3315,6 +4614,88 @@ var _ApprovalService = class _ApprovalService {
     }
     return [...new Set(list.map((r) => String(r.request_id)))];
   }
+  /**
+   * The request ids this caller is a PARTICIPANT of, or `null` for a caller
+   * who may see everything in scope (#3590).
+   *
+   * These reads deliberately run with `SYSTEM_CTX` to bypass RLS — the
+   * approver-visibility rule spans several identity forms that RLS cannot model
+   * cleanly, which is why it has to be expressed here. Until now only the
+   * TENANT half of that rule was applied, so any authenticated user could read
+   * any request in their tenant (and, once attachments derived their access
+   * from the request, its files too). This adds the participant half.
+   *
+   * A participant is the submitter, a current approver, or someone who has
+   * already acted on the request (a past approver whose slot has moved on, a
+   * commenter). Admins with override authority keep the unrestricted view the
+   * "all requests" console surface depends on.
+   *
+   * Keying on the concrete user id is sufficient rather than an approximation:
+   * position/team/manager/field approvers are resolved to concrete user ids at
+   * open time, and the `type:value` literal is only the fallback for a spec
+   * that resolved to NOBODY — a slot no one can act on either way (`can_act`
+   * is a plain membership test over the resolved ids). So this cannot hide a
+   * request from someone who could actually act on it.
+   */
+  async visibleRequestIds(context, tenantOrg) {
+    if (this.isOverrideActor(context, tenantOrg)) return null;
+    const uid2 = context?.userId != null ? String(context.userId) : "";
+    if (!uid2) return /* @__PURE__ */ new Set();
+    const ids = /* @__PURE__ */ new Set();
+    const cap = _ApprovalService.APPROVER_INDEX_CAP;
+    const add = (rows, key) => {
+      const list = Array.isArray(rows) ? rows : [];
+      for (const r of list) if (r?.[key] != null) ids.add(String(r[key]));
+      if (list.length >= cap) {
+        this.logger?.warn?.(
+          "[approvals] participant-visibility probe hit its window \u2014 some requests may be hidden from a legitimate participant",
+          { cap, key }
+        );
+      }
+    };
+    try {
+      for (const id of await this.approverRequestIds([uid2], tenantOrg) ?? []) ids.add(id);
+      const orgWhere = tenantOrg ? { organization_id: tenantOrg } : {};
+      add(
+        await this.engine.find("sys_approval_request", {
+          where: { submitter_id: uid2, ...orgWhere },
+          fields: ["id"],
+          limit: cap,
+          context: SYSTEM_CTX2
+        }),
+        "id"
+      );
+      add(
+        await this.engine.find("sys_approval_action", {
+          where: { actor_id: uid2 },
+          fields: ["request_id"],
+          limit: cap,
+          context: SYSTEM_CTX2
+        }),
+        "request_id"
+      );
+    } catch (err) {
+      this.logger?.warn?.("[approvals] participant-visibility probe failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return ids;
+  }
+  /** Intersect an existing `where.id` constraint with the participant set. */
+  applyVisibility(where, visible) {
+    if (!visible) return true;
+    if (visible.size === 0) return false;
+    let allowed = [...visible];
+    const current = where.id;
+    if (typeof current === "string") allowed = allowed.filter((x) => x === current);
+    else if (current && typeof current === "object" && Array.isArray(current.$in)) {
+      const set = new Set(current.$in.map((v) => String(v)));
+      allowed = allowed.filter((x) => set.has(x));
+    }
+    if (allowed.length === 0) return false;
+    where.id = allowed.length === 1 ? allowed[0] : { $in: allowed };
+    return true;
+  }
   async listRequests(filter, context) {
     const { where, tenantOrg } = this.buildRequestWhere(filter, context);
     const approverTargets = (Array.isArray(filter?.approverId) ? filter.approverId : filter?.approverId ? [filter.approverId] : []).map((t) => String(t).trim()).filter(Boolean);
@@ -3323,10 +4704,11 @@ var _ApprovalService = class _ApprovalService {
       if (ids.length === 0) return [];
       where.id = ids.length === 1 ? ids[0] : { $in: ids };
     }
+    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg))) return [];
     const findOpts = {
       where,
       orderBy: [{ field: "created_at", order: "desc" }],
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     };
     if (filter?.limit != null || filter?.offset != null) {
       findOpts.limit = Math.min(Math.max(filter?.limit ?? 50, 1), 200);
@@ -3348,10 +4730,11 @@ var _ApprovalService = class _ApprovalService {
       if (ids.length === 0) return 0;
       where.id = ids.length === 1 ? ids[0] : { $in: ids };
     }
+    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg))) return 0;
     const countFn = this.engine.count;
     if (typeof countFn === "function") {
       try {
-        const n = await countFn.call(this.engine, "sys_approval_request", { where, context: SYSTEM_CTX });
+        const n = await countFn.call(this.engine, "sys_approval_request", { where, context: SYSTEM_CTX2 });
         if (typeof n === "number") return n;
       } catch {
       }
@@ -3360,11 +4743,28 @@ var _ApprovalService = class _ApprovalService {
       where,
       fields: ["id"],
       limit: ids ? Math.max(500, ids.length) : 500,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     return Array.isArray(rows) ? rows.length : 0;
   }
+  /**
+   * Read the request a write path just changed, to echo back as its result.
+   *
+   * NOT participant-gated (#3590), deliberately: the operation authorized
+   * itself by its own rule before writing, so re-asking "may you see this?"
+   * for the echo answers a question that has already been settled — and would
+   * answer it WRONG for a caller context that carries no `userId` (a
+   * flow-driven resume, a service-to-service call), turning a successful write
+   * into a `null` result. Gating belongs on the read API, not on an
+   * operation's own return value.
+   */
+  async readBackRequest(requestId, context) {
+    return this.loadRequest(requestId, context, false);
+  }
   async getRequest(requestId, context) {
+    return this.loadRequest(requestId, context, true);
+  }
+  async loadRequest(requestId, context, enforceVisibility) {
     if (!requestId) return null;
     const where = { id: requestId };
     const tenantOrg = context?.organizationId ?? context?.tenantId;
@@ -3372,9 +4772,13 @@ var _ApprovalService = class _ApprovalService {
     const rows = await this.engine.find("sys_approval_request", {
       where,
       limit: 1,
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     if (!Array.isArray(rows) || !rows[0]) return null;
+    if (enforceVisibility) {
+      const visible = await this.visibleRequestIds(context, tenantOrg ?? null);
+      if (visible && !visible.has(String(rows[0].id))) return null;
+    }
     const row = rowFromRequest(rows[0]);
     await this.enrichRows([row]);
     await this.attachFlowSteps(row);
@@ -3401,7 +4805,7 @@ var _ApprovalService = class _ApprovalService {
       const acts = await this.engine.find("sys_approval_action", {
         where: { request_id: row.id, step_index: 0, action: "approve" },
         limit: 1e3,
-        context: SYSTEM_CTX
+        context: SYSTEM_CTX2
       });
       const approved = new Set((acts ?? []).map((a) => String(a.actor_id ?? "")).filter(Boolean));
       const snapshot = cfg?.__approverGroups;
@@ -3422,6 +4826,14 @@ var _ApprovalService = class _ApprovalService {
         });
         progress.got = progress.groups.filter((g) => g.satisfied).length;
         progress.need = progress.groups.length;
+        const pendingGroups = {};
+        for (const a of row.pending_approvers ?? []) {
+          const named = (snapshot[a] ?? []).filter((g) => !/^#\d+$/.test(g));
+          if (named.length) pendingGroups[a] = named;
+        }
+        if (Object.keys(pendingGroups).length) {
+          row.pending_approver_groups = pendingGroups;
+        }
       }
       row.decision_progress = progress;
     } catch {
@@ -3433,8 +4845,13 @@ var _ApprovalService = class _ApprovalService {
    * caller's user id is in the resolved `pending_approvers` while the request is
    * still `pending` (position/team/manager approvers are already resolved to
    * concrete user ids at open time, so a plain membership test is faithful).
-   * `is_submitter` is a straight owner check. System/tokenless contexts get a
-   * both-false block. Cheap + synchronous — safe on list reads.
+   * `is_submitter` is a straight owner check. `can_override` (#3424) is true for
+   * a platform/tenant admin on a PENDING request — the recovery path for an
+   * approval routed to an unstaffed position or to approvers who have all left;
+   * clients OR it into the decision actions' `visible` gate so an admin can act
+   * even when they hold no slot. System/tokenless contexts get a both-false
+   * `can_act`/`is_submitter` block (system gets `can_override` too — it may act
+   * on anything). Cheap + synchronous — safe on list reads.
    */
   attachViewers(rows, context) {
     const uid2 = context?.userId != null ? String(context.userId) : null;
@@ -3442,7 +4859,8 @@ var _ApprovalService = class _ApprovalService {
       const pending = row.pending_approvers ?? [];
       row.viewer = {
         can_act: row.status === "pending" && !!uid2 && pending.includes(uid2),
-        is_submitter: !!uid2 && row.submitter_id != null && String(row.submitter_id) === uid2
+        is_submitter: !!uid2 && row.submitter_id != null && String(row.submitter_id) === uid2,
+        can_override: row.status === "pending" && this.isOverrideActor(context, row.organization_id ?? null)
       };
     }
   }
@@ -3489,7 +4907,7 @@ var _ApprovalService = class _ApprovalService {
       where: { request_id: requestId },
       limit: 500,
       orderBy: [{ field: "created_at", order: "asc" }],
-      context: SYSTEM_CTX
+      context: SYSTEM_CTX2
     });
     const actions = Array.isArray(rows) ? rows.map(rowFromAction) : [];
     const names = await this.resolveUserNames(
@@ -3501,6 +4919,36 @@ var _ApprovalService = class _ApprovalService {
     }
     return actions;
   }
+  /**
+   * `IFileAccessDelegate` — may this caller download a decision attachment?
+   * (ADR-0104 D3 wave 2; declared by `sys_approval_action.fileAccessDelegate`.)
+   *
+   * A file referenced by `sys_approval_action.attachments` is owned by that
+   * audit row, so the storage service would otherwise authorize the download by
+   * testing whether the caller can READ the row. It cannot: `sys_approval_action`
+   * is deliberately closed to ordinary approver positions, so that test denies
+   * the very approver the attachment was filed for.
+   *
+   * The rule that actually governs seeing a decision is the one `listActions`
+   * applies — can the caller see the PARENT REQUEST? — so this reuses it
+   * exactly, rather than inventing a second, looser rule for the bytes. Fails
+   * closed on any error.
+   */
+  async authorizeFileRead(actionId, context) {
+    if (!actionId) return false;
+    try {
+      const rows = await this.engine.find("sys_approval_action", {
+        where: { id: actionId },
+        limit: 1,
+        context: SYSTEM_CTX2
+      });
+      const requestId = (Array.isArray(rows) ? rows[0] : void 0)?.request_id;
+      if (!requestId) return false;
+      return !!await this.getRequest(String(requestId), context);
+    } catch {
+      return false;
+    }
+  }
 };
 /** Window the approver-index probe — pending queues live far below this. */
 _ApprovalService.APPROVER_INDEX_CAP = 1e4;
@@ -3695,6 +5143,8 @@ function bindApprovalLockHook(engine, logger) {
     if (Array.isArray(roles) && roles.includes("admin")) return;
     const pending = await pendingRequestFor(engine, object, id);
     if (!pending) return;
+    const writerRun = ctx?.provenance?.flowRunId;
+    if (writerRun && pending.flow_run_id && String(writerRun) === String(pending.flow_run_id)) return;
     const config = parseJson2(pending.node_config_json, {});
     if (config?.lockRecord === false) return;
     const mirror = config?.approvalStatusField;
@@ -3751,7 +5201,22 @@ import {
   getApprovalNodeConfigJsonSchema,
   APPROVAL_NODE_TYPE
 } from "@objectstack/spec/automation";
-var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+var SYSTEM_CTX3 = { isSystem: true, positions: [], permissions: [] };
+function nestVariables(variables) {
+  const vars = {};
+  for (const [key, value] of variables) {
+    const segs = key.split(".");
+    let cursor = vars;
+    for (let i = 0; i < segs.length - 1; i++) {
+      if (typeof cursor[segs[i]] !== "object" || cursor[segs[i]] === null) {
+        cursor[segs[i]] = {};
+      }
+      cursor = cursor[segs[i]];
+    }
+    cursor[segs[segs.length - 1]] = value;
+  }
+  return vars;
+}
 function registerApprovalNode(automation, service, logger) {
   automation.registerNodeExecutor({
     type: APPROVAL_NODE_TYPE,
@@ -3767,6 +5232,15 @@ function registerApprovalNode(automation, service, logger) {
       // Human decision: the run suspends here awaiting an external reply.
       supportsPause: true,
       isAsync: true,
+      // #3801: this pause is NOT resumable through the generic run-resume
+      // route. Continuing an approval is a side effect of a DECISION, and the
+      // decision is the thing that must be authorized (the approver slate),
+      // recorded (`sys_approval_action`) and mirrored (the status field) —
+      // all of which lives in `ApprovalService.decide`. The engine now refuses
+      // any resume of an approval suspension that does not carry the service's
+      // in-process marker, so "decide via the approvals API, never a raw engine
+      // resume" is enforced rather than merely documented.
+      resumeAuthority: "service",
       // Publish the node's config contract (ADR-0018 §configSchema) so the
       // Studio flow designer renders the Approval property form from the engine
       // rather than a hardcoded client form — the engine owns the shape.
@@ -3800,13 +5274,28 @@ function registerApprovalNode(automation, service, logger) {
           nodeLabel: typeof node.label === "string" ? node.label : void 0,
           submitterId: context?.userId ?? null,
           record,
-          organizationId: context?.organizationId ?? context?.tenantId ?? null
+          organizationId: context?.organizationId ?? context?.tenantId ?? null,
+          // #3447 P2: flow variables (nested, as CEL conditions see them) — the
+          // `vars.*` root for `expression` approvers; `record` above doubles as
+          // their `trigger.*` snapshot root.
+          variables: nestVariables(variables)
         }, {
-          ...SYSTEM_CTX2,
+          ...SYSTEM_CTX3,
           userId: context?.userId,
           organizationId: context?.organizationId,
           tenantId: context?.tenantId
         });
+        if ("autoApproved" in request) {
+          logger?.info?.("[approvals] approval node auto-approved (empty approver slate)", {
+            node: node.id,
+            run: String(runId)
+          });
+          return {
+            success: true,
+            branchLabel: "approve",
+            output: { decision: "approve", autoApproved: true }
+          };
+        }
         logger?.info?.("[approvals] approval node suspended run", {
           node: node.id,
           request: request.id,
@@ -3892,7 +5381,21 @@ var ApprovalsServicePlugin = class {
     this.service = new ApprovalService({
       engine,
       logger: ctx.logger,
-      publicBaseUrl: this.options.publicBaseUrl
+      publicBaseUrl: this.options.publicBaseUrl,
+      // [ADR-0105 D9] Cross-organization approver targeting is a `group`-posture
+      // capability. Read LAZILY (not captured at start) because the tenancy
+      // service resolves its posture during its own start, which may not have
+      // run yet; an unresolvable posture reads as "unknown" and the guard
+      // stands down rather than refusing a legitimate flow on a minimal stack.
+      tenancyPosture: () => {
+        try {
+          const tenancy = ctx.getService("tenancy");
+          const posture = tenancy?.posture;
+          return typeof posture === "string" && posture ? posture : void 0;
+        } catch {
+          return void 0;
+        }
+      }
     });
     if (!this.options.disableAutoHooks) {
       try {
@@ -3918,12 +5421,23 @@ var ApprovalsServicePlugin = class {
         if (!jobs || typeof jobs.schedule !== "function" || !this.service) return;
         const svc = this.service;
         const intervalMs = this.options.escalationScanIntervalMs ?? ESCALATION_SCAN_INTERVAL_MS;
-        await jobs.schedule(ESCALATION_JOB_NAME, { type: "interval", intervalMs }, async () => {
-          await svc.runEscalations();
-        });
+        const sweep = async () => {
+          const results = await Promise.allSettled([
+            svc.runEscalations(),
+            svc.releaseDeadRunRequests()
+          ]);
+          for (const r of results) {
+            if (r.status === "rejected") {
+              ctx.logger.warn?.("[approvals] periodic sweep leg failed", {
+                error: r.reason?.message ?? String(r.reason)
+              });
+            }
+          }
+        };
+        await jobs.schedule(ESCALATION_JOB_NAME, { type: "interval", intervalMs }, sweep);
         this.escalationJobScheduled = true;
-        void svc.runEscalations().catch((err) => {
-          ctx.logger.warn?.("[approvals] boot escalation sweep failed", { error: err?.message });
+        void sweep().catch((err) => {
+          ctx.logger.warn?.("[approvals] boot sweep failed", { error: err?.message });
         });
         ctx.logger.info("ApprovalsServicePlugin: SLA escalation scan scheduled", { intervalMs });
       } catch {