@objectstack/plugin-approvals 16.1.0 → 17.0.0-rc.0

package/src/approval-service.test.ts

@@ -9,7 +9,7 @@
  * the read API, and the global record-lock hook.
  */
 
-import { describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { ApprovalService, REMIND_COOLDOWN_MS } from './approval-service.js';
 import { bindApprovalLockHook, bindDelegationWriteGuard, unbindAllHooks } from './lifecycle-hooks.js';
 
@@ -45,9 +45,13 @@ function makeFakeEngine() {
     return true;
   }
 
+  /** Every `update` the service made, with the context it presented (#3783). */
+  const writes: Array<{ object: string; data: any; context: any }> = [];
+
   return {
     _tables: tables,
     _hooks: hooks,
+    _writes: writes,
     async find(object: string, options?: any) {
       const rows = ensure(object).filter(r => matches(r, options?.filter ?? options?.where));
       if (options?.orderBy?.[0]) {
@@ -73,6 +77,7 @@ function makeFakeEngine() {
     async update(object: string, idOrData: any, _opts?: any) {
       const data = typeof idOrData === 'object' ? idOrData : _opts;
       const id = typeof idOrData === 'object' ? idOrData.id : idOrData;
+      writes.push({ object, data, context: _opts?.context });
       const table = ensure(object);
       const i = table.findIndex(r => r.id === id);
       if (i >= 0) table[i] = { ...table[i], ...data };
@@ -113,6 +118,15 @@ function makeFakeEngine() {
 const CTX = { userId: 'u1', tenantId: 't1', positions: [], permissions: [] } as any;
 const SYS = { isSystem: true, positions: [], permissions: [] } as any;
 
+/**
+ * The signed-in caller, when it is someone other than {@link CTX}'s `u1`.
+ * An approval action is recorded against the AUTHENTICATED caller (#3800), so a
+ * test that acts as `u9` has to present `u9`'s context — naming them in
+ * `actorId` while calling as `u1` is the impersonation the service now refuses.
+ */
+const asUser = (userId: string) =>
+  ({ userId, tenantId: 't1', positions: [], permissions: [] }) as any;
+
 function nodeConfig(approvers: string[], extra: Record<string, any> = {}) {
   return {
     approvers: approvers.map(v => ({ type: 'user' as const, value: v })),
@@ -169,6 +183,40 @@ describe('ApprovalService (node era)', () => {
     expect(JSON.parse(raw.node_config_json)).toMatchObject({ behavior: 'first_response', lockRecord: true });
   });
 
+  // ── record-lock policy on the read row (objectui#2902) ──────────
+  //
+  // The lock is enforced in `lifecycle-hooks.ts` off `node_config_json`, but
+  // the row projection used to drop the flag entirely — so a client could see
+  // "a pending request exists" and nothing more, and had to assume every
+  // pending node locked the record. Chaining nodes with different policies
+  // made that visibly wrong. These pin the flag onto every read path.
+
+  it('lock_record: true when the node locks (the schema default)', async () => {
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+    expect(req.lock_record).toBe(true);
+    const [listed] = await svc.listRequests({ object: 'opportunity', recordId: 'opp1' }, SYS);
+    expect(listed.lock_record).toBe(true);
+    expect((await svc.getRequest(req.id, SYS))!.lock_record).toBe(true);
+  });
+
+  it('lock_record: false when the node opts out — the same read the hook honors', async () => {
+    const req = await svc.openNodeRequest(openInput(['u9'], {}, { lockRecord: false }), CTX);
+    expect(req.lock_record).toBe(false);
+    const [listed] = await svc.listRequests({ object: 'opportunity', recordId: 'opp1' }, SYS);
+    expect(listed.lock_record).toBe(false);
+    expect((await svc.getRequest(req.id, SYS))!.lock_record).toBe(false);
+  });
+
+  it('lock_record: an unset lockRecord reads as locked, matching the hook default', async () => {
+    // The hook allows the write only on an explicit `=== false`; the flag must
+    // default the same way or the UI would offer an edit the server rejects.
+    const req = await svc.openNodeRequest(
+      { ...openInput(['u9']), config: { approvers: [{ type: 'user' as const, value: 'u9' }], behavior: 'first_response' as const } } as any,
+      CTX,
+    );
+    expect(req.lock_record).toBe(true);
+  });
+
   it('openNodeRequest: deduplicates a pending request per (object, record)', async () => {
     await svc.openNodeRequest(openInput(['u9']), CTX);
     await expect(svc.openNodeRequest(openInput(['u9'], { runId: 'run_2' }), CTX))
@@ -187,6 +235,325 @@ describe('ApprovalService (node era)', () => {
     expect(engine._tables['opportunity'][0].approval_status).toBe('pending');
   });
 
+  // ── approver expansion: field (live re-read + fan-out, #3447) ────
+  //
+  // A `field` approver names WHO decides from a record field. It must bind to
+  // the record's LIVE value at node entry — an earlier step (or the approver of
+  // an earlier step) may have written it after submit — not the trigger snapshot
+  // the run froze into `$record`. A multi-select user field fans out into one
+  // slot per user.
+
+  const fieldInput = (extra: Record<string, any> = {}) => ({
+    ...openInput([]),
+    config: {
+      approvers: [{ type: 'field' as const, value: 'approvers_dynamic' }],
+      behavior: 'unanimous' as const,
+      lockRecord: true,
+    },
+    ...extra,
+  });
+
+  it('field approver: resolves against the LIVE record, not the trigger snapshot (#3447)', async () => {
+    // The minimal repro: submitted with the routing field empty; a prior step
+    // wrote the co-reviewers mid-flow. Resolution must see them.
+    engine._tables['opportunity'] = [{ id: 'opp1', amount: 100, approvers_dynamic: ['u2', 'u3'] }];
+    const req = await svc.openNodeRequest(
+      fieldInput({ record: { id: 'opp1', amount: 100, approvers_dynamic: [] } }), CTX,
+    );
+    expect(req.pending_approvers.sort()).toEqual(['u2', 'u3']);
+  });
+
+  it('field approver: the live value WINS over a stale snapshot value (#3447)', async () => {
+    // Snapshot named u1; the record now names u2. u2 decides.
+    engine._tables['opportunity'] = [{ id: 'opp1', approvers_dynamic: ['u2'] }];
+    const req = await svc.openNodeRequest(
+      fieldInput({ record: { id: 'opp1', approvers_dynamic: ['u1'] } }), CTX,
+    );
+    expect(req.pending_approvers).toEqual(['u2']);
+  });
+
+  it('field approver: fans a multi-select user field into one slot per user (#3447)', async () => {
+    engine._tables['opportunity'] = [{ id: 'opp1', approvers_dynamic: ['u2', 'u3', 'u4'] }];
+    const req = await svc.openNodeRequest(fieldInput({ record: { id: 'opp1' } }), CTX);
+    expect(req.pending_approvers.sort()).toEqual(['u2', 'u3', 'u4']);
+  });
+
+  it('field approver: fans a legacy CSV string field into multiple slots (#3447)', async () => {
+    engine._tables['opportunity'] = [{ id: 'opp1', approvers_dynamic: 'u2,u3' }];
+    const req = await svc.openNodeRequest(fieldInput({ record: { id: 'opp1' } }), CTX);
+    expect(req.pending_approvers.sort()).toEqual(['u2', 'u3']);
+  });
+
+  it('field approver: falls back to the trigger snapshot when the record is gone (#3447)', async () => {
+    // No `opportunity` row — hard-deleted between submit and node entry. The
+    // snapshot still carries a value, so the request opens against it (warn but
+    // proceed) rather than wedging the flow.
+    const req = await svc.openNodeRequest(
+      fieldInput({ record: { id: 'opp1', approvers_dynamic: ['u7'] } }), CTX,
+    );
+    expect(req.pending_approvers).toEqual(['u7']);
+  });
+
+  // ── approver expansion: expression (#3447 P2) ───────────────────
+  //
+  // A CEL expression resolved at node entry over three EXPLICIT roots:
+  // `current.*` (live record), `trigger.*` (submit snapshot), `vars.*` (flow
+  // variables). `record` / bare fields are rejected before evaluation — the
+  // runtime env would resolve them as dyn → null → a silently-empty slate.
+
+  const exprInput = (
+    value: string,
+    extra: Record<string, any> = {},
+    approverExtra: Record<string, any> = {},
+    configExtra: Record<string, any> = {},
+  ) => ({
+    ...openInput([]),
+    config: {
+      approvers: [{ type: 'expression' as const, value, ...approverExtra }],
+      behavior: 'unanimous' as const,
+      lockRecord: true,
+      ...configExtra,
+    },
+    ...extra,
+  });
+
+  it('expression: current.* reads the LIVE record at node entry (#3447 P2)', async () => {
+    engine._tables['opportunity'] = [{ id: 'opp1', approvers_dynamic: ['u2', 'u3'] }];
+    const req = await svc.openNodeRequest(
+      exprInput('current.approvers_dynamic', { record: { id: 'opp1', approvers_dynamic: [] } }), CTX,
+    ) as any;
+    expect(req.pending_approvers.sort()).toEqual(['u2', 'u3']);
+  });
+
+  it('expression: trigger.* reads the submit-time snapshot, not the live row (#3447 P2)', async () => {
+    engine._tables['opportunity'] = [{ id: 'opp1', reviewer: 'new_reviewer' }];
+    const req = await svc.openNodeRequest(
+      exprInput('trigger.reviewer', { record: { id: 'opp1', reviewer: 'old_reviewer' } }), CTX,
+    ) as any;
+    expect(req.pending_approvers).toEqual(['old_reviewer']);
+  });
+
+  it('expression: vars.* reads flow variables; a CSV string fans out (#3447 P2)', async () => {
+    const req = await svc.openNodeRequest(
+      exprInput('vars.approval_lead.next_reviewers', {
+        variables: { approval_lead: { next_reviewers: 'u5, u6' } },
+      }), CTX,
+    ) as any;
+    expect(req.pending_approvers.sort()).toEqual(['u5', 'u6']);
+  });
+
+  it('expression: an array result fans out into one slot per id (#3447 P2)', async () => {
+    const req = await svc.openNodeRequest(
+      exprInput('vars.picked', { variables: { picked: ['u2', 'u3', 'u4'] } }), CTX,
+    ) as any;
+    expect(req.pending_approvers.sort()).toEqual(['u2', 'u3', 'u4']);
+  });
+
+  it('expression: OOO delegation applies per resolved user (#3447 P2 / #1322)', async () => {
+    engine._tables['sys_approval_delegation'] = [{
+      id: 'del1', delegator_id: 'u2', delegate_id: 'u9',
+      valid_from: '2026-01-01T00:00:00Z', valid_until: '2026-12-31T00:00:00Z',
+      reason: 'leave', organization_id: 't1',
+    }];
+    const req = await svc.openNodeRequest(
+      exprInput('vars.picked', { variables: { picked: ['u2', 'u3'] } }), CTX,
+    ) as any;
+    expect(req.pending_approvers.sort()).toEqual(['u3', 'u9']);
+  });
+
+  it('expression: rejects a `record` root BEFORE evaluation, prescribing current/trigger (#3447 P2)', async () => {
+    await expect(svc.openNodeRequest(exprInput('record.approvers_dynamic'), CTX))
+      .rejects.toThrow(/VALIDATION_FAILED[\s\S]*`record`[\s\S]*current\.<field>/);
+  });
+
+  it('expression: rejects an unknown bare root with the closed-root hint (#3447 P2)', async () => {
+    await expect(svc.openNodeRequest(exprInput('approvers_dynamic'), CTX))
+      .rejects.toThrow(/VALIDATION_FAILED.*approvers_dynamic.*current\.\*/s);
+  });
+
+  it('expression: a non-parsing source fails loudly, not as an empty slate (#3447 P2)', async () => {
+    await expect(svc.openNodeRequest(exprInput('current..'), CTX))
+      .rejects.toThrow(/VALIDATION_FAILED.*does not parse/s);
+  });
+
+  it('expression: a non-id result type (bool) fails loudly (#3447 P2)', async () => {
+    const req = svc.openNodeRequest(
+      exprInput('current.amount > 100', { record: { id: 'opp1', amount: 500 } }), CTX,
+    );
+    await expect(req).rejects.toThrow(/EXPRESSION_FAILED.*must yield ids/s);
+  });
+
+  it('expression + resolveAs department: expands each returned id through the graph, one per_group group per department (#3447 P2)', async () => {
+    engine._tables['sys_business_unit'] = [
+      { id: 'd1', active: true, organization_id: 't1' },
+      { id: 'd2', active: true, organization_id: 't1' },
+    ];
+    engine._tables['sys_business_unit_member'] = [
+      { id: 'm1', business_unit_id: 'd1', user_id: 'u2' },
+      { id: 'm2', business_unit_id: 'd1', user_id: 'u3' },
+      { id: 'm3', business_unit_id: 'd2', user_id: 'u4' },
+    ];
+    const req = await svc.openNodeRequest(
+      exprInput('vars.picked_departments', {
+        variables: { picked_departments: ['d1', 'd2'] },
+      }, { resolveAs: 'department' }, { behavior: 'per_group' }), CTX,
+    ) as any;
+    expect(req.pending_approvers.sort()).toEqual(['u2', 'u3', 'u4']);
+    // Each department forms its own sub-group: one sign-off per department.
+    const raw = engine._tables['sys_approval_request'][0];
+    const snapshot = JSON.parse(raw.node_config_json);
+    expect(snapshot.__approverGroups).toEqual({
+      u2: ['#0:d1'], u3: ['#0:d1'], u4: ['#0:d2'],
+    });
+  });
+
+  it('expression + resolveAs: an unstaffed department keeps a literal slot (#3447 P2)', async () => {
+    engine._tables['sys_business_unit'] = [{ id: 'd9', active: true, organization_id: 't1' }];
+    const req = await svc.openNodeRequest(
+      exprInput('vars.picked', { variables: { picked: ['d9'] } }, { resolveAs: 'department' }), CTX,
+    ) as any;
+    expect(req.pending_approvers).toEqual(['department:d9']);
+  });
+
+  it('expression: __resolvedFrom snapshots the resolution INPUT for audit (#3447 P2)', async () => {
+    engine._tables['opportunity'] = [{ id: 'opp1', approvers_dynamic: ['u2'] }];
+    await svc.openNodeRequest(exprInput('current.approvers_dynamic', { record: { id: 'opp1' } }), CTX);
+    const raw = engine._tables['sys_approval_request'][0];
+    const snapshot = JSON.parse(raw.node_config_json);
+    expect(snapshot.__resolvedFrom).toEqual({ 'expression#0': ['u2'] });
+  });
+
+  it('expression: a MISSING key is a loud error, never a silent empty slate (#3447 P2)', async () => {
+    // CEL map access on an absent key throws ("No such key") — deliberate:
+    // referencing a variable nobody wrote is a wiring bug, not "no approvers".
+    // An EMPTY slate is expressed by a present-but-empty value (next test
+    // group); authors guard optional inputs with `has(...)` / `.?` explicitly.
+    await expect(svc.openNodeRequest(
+      exprInput('vars.never_written', { variables: {} }), CTX,
+    )).rejects.toThrow(/EXPRESSION_FAILED.*No such key/s);
+  });
+
+  // ── onEmptyApprovers policy (#3447 P2) ──────────────────────────
+  //
+  // "Empty" = the expression/field RESOLVED (key present) but yielded nobody.
+  // A missing key is a loud error instead (test above).
+
+  it("onEmptyApprovers 'fail': an empty slate fails the open loudly", async () => {
+    await expect(svc.openNodeRequest(
+      exprInput('vars.picked', { variables: { picked: [] } }, {}, { onEmptyApprovers: 'fail' }), CTX,
+    )).rejects.toThrow(/NO_APPROVERS/);
+    expect(engine._tables['sys_approval_request'] ?? []).toHaveLength(0);
+  });
+
+  it("onEmptyApprovers 'auto_approve': no request opens, outcome says autoApproved", async () => {
+    const outcome = await svc.openNodeRequest(
+      exprInput('vars.picked', { variables: { picked: [] } }, {}, { onEmptyApprovers: 'auto_approve' }), CTX,
+    );
+    expect(outcome).toEqual({ autoApproved: true, reason: 'empty_approvers' });
+    expect(engine._tables['sys_approval_request'] ?? []).toHaveLength(0);
+  });
+
+  it("onEmptyApprovers default ('admin_rescue'): the request still opens for admin takeover (#3424)", async () => {
+    const req = await svc.openNodeRequest(
+      exprInput('vars.picked', { variables: { picked: [] } }), CTX,
+    ) as any;
+    expect(req.status).toBe('pending');
+    expect(req.pending_approvers).toEqual([]);
+    expect(engine._tables['sys_approval_request']).toHaveLength(1);
+  });
+
+  // ── decision outputs (#3447 P2) ─────────────────────────────────
+
+  it('decision outputs: rejected when the node declares none', async () => {
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+    await expect(svc.decideNode(req.id, {
+      decision: 'approve', actorId: 'u9', outputs: { next: 'u2' },
+    }, SYS)).rejects.toThrow(/VALIDATION_FAILED.*declares no decisionOutputs/s);
+  });
+
+  it('decision outputs: rejected when a key is undeclared', async () => {
+    const req = await svc.openNodeRequest(
+      openInput(['u9'], {}, { decisionOutputs: ['next_reviewers'] }), CTX,
+    );
+    await expect(svc.decideNode(req.id, {
+      decision: 'approve', actorId: 'u9', outputs: { other_key: 1 },
+    }, SYS)).rejects.toThrow(/VALIDATION_FAILED.*other_key.*not declared/s);
+  });
+
+  it('decision outputs: reserved keys are rejected even when declared', async () => {
+    const req = await svc.openNodeRequest(
+      openInput(['u9'], {}, { decisionOutputs: ['decision'] }), CTX,
+    );
+    await expect(svc.decideNode(req.id, {
+      decision: 'approve', actorId: 'u9', outputs: { decision: 'spoofed' },
+    }, SYS)).rejects.toThrow(/VALIDATION_FAILED.*reserved/s);
+  });
+
+  it('decision outputs: typed declarations normalize — whitelist by key, defs surfaced for the UI', async () => {
+    const req = await svc.openNodeRequest(
+      openInput(['u9'], {}, {
+        decisionOutputs: [
+          { key: 'next_reviewers', label: 'Next Reviewers', type: 'user', multiple: true },
+          'note',
+        ],
+      }), CTX,
+    ) as any;
+    // Key list stays the version-skew-safe shape; defs carry the typed form.
+    expect(req.decision_outputs).toEqual(['next_reviewers', 'note']);
+    expect(req.decision_output_defs).toEqual([
+      { key: 'next_reviewers', label: 'Next Reviewers', type: 'user', multiple: true },
+      { key: 'note' },
+    ]);
+    // A typed declaration whitelists exactly like a bare key.
+    const out = await svc.decideNode(req.id, {
+      decision: 'approve', actorId: 'u9', outputs: { next_reviewers: ['u2', 'u3'] },
+    }, SYS);
+    expect(out.outputs).toEqual({ next_reviewers: ['u2', 'u3'] });
+  });
+
+  it('decision outputs: declared keys surface on the request row as decision_outputs (#3447 P2 UI)', async () => {
+    // The decision UI renders one input per declared key — the keys ride the
+    // request read (per-request; the static action params can't carry them).
+    const req = await svc.openNodeRequest(
+      openInput(['u9'], {}, { decisionOutputs: ['next_reviewers', 'note'] }), CTX,
+    ) as any;
+    expect(req.decision_outputs).toEqual(['next_reviewers', 'note']);
+    const listed = await svc.listRequests({ status: 'pending' }, SYS);
+    expect((listed[0] as any).decision_outputs).toEqual(['next_reviewers', 'note']);
+    // A node declaring none omits the field entirely.
+    engine._tables['sys_approval_request'] = [];
+    const plain = await svc.openNodeRequest(openInput(['u9']), CTX) as any;
+    expect(plain.decision_outputs).toBeUndefined();
+  });
+
+  it('decision outputs: accepted keys return from decideNode and snapshot as __decisionOutputs', async () => {
+    const req = await svc.openNodeRequest(
+      openInput(['u9'], {}, { decisionOutputs: ['next_reviewers', 'note'] }), CTX,
+    );
+    const out = await svc.decideNode(req.id, {
+      decision: 'approve', actorId: 'u9', outputs: { next_reviewers: ['u2', 'u3'] },
+    }, SYS);
+    expect(out.finalized).toBe(true);
+    expect(out.outputs).toEqual({ next_reviewers: ['u2', 'u3'] });
+    const raw = engine._tables['sys_approval_request'][0];
+    expect(JSON.parse(raw.node_config_json).__decisionOutputs).toEqual({ next_reviewers: ['u2', 'u3'] });
+  });
+
+  it('decision outputs: co-sign votes accumulate, the finalizing decision hands the merged set over', async () => {
+    const req = await svc.openNodeRequest(
+      openInput(['u1', 'u2'], {}, { behavior: 'unanimous', decisionOutputs: ['legal_note', 'finance_note'] }), CTX,
+    );
+    const first = await svc.decideNode(req.id, {
+      decision: 'approve', actorId: 'u1', outputs: { legal_note: 'ok' },
+    }, SYS);
+    expect(first.finalized).toBe(false);
+    const second = await svc.decideNode(req.id, {
+      decision: 'approve', actorId: 'u2', outputs: { finance_note: 'ok too' },
+    }, SYS);
+    expect(second.finalized).toBe(true);
+    expect(second.outputs).toEqual({ legal_note: 'ok', finance_note: 'ok too' });
+  });
+
   // ── approver expansion: position (ADR-0090 D3) ──────────────────
 
   const positionInput = (extra: Record<string, any> = {}) => ({
@@ -297,6 +664,69 @@ describe('ApprovalService (node era)', () => {
     expect(req.pending_approvers.sort()).toEqual(['u5', 'u6']);
   });
 
+  // #3807 — an app's org tree is normally SEEDED, and a seed cannot know the
+  // organization id the runtime mints at boot, so those rows carry
+  // `organization_id = null` while every approval request carries an org. The
+  // old strict equality made each of them invisible and every `department`
+  // approver resolved to the dead `department:<id>` literal.
+  const departmentInput = (value: string) => positionInput({
+    config: {
+      approvers: [{ type: 'department' as const, value }],
+      behavior: 'first_response' as const,
+      lockRecord: true,
+    },
+  });
+
+  it('department approver: an env-wide (null-org) business unit still resolves (#3807)', async () => {
+    engine._tables['sys_business_unit'] = [
+      { id: 'bu_seeded', organization_id: null, active: true },
+      { id: 'bu_seeded_child', parent_business_unit_id: 'bu_seeded', organization_id: null, active: true },
+    ];
+    engine._tables['sys_business_unit_member'] = [
+      { id: 'bm1', business_unit_id: 'bu_seeded', user_id: 'u5' },
+      { id: 'bm2', business_unit_id: 'bu_seeded_child', user_id: 'u6' },
+    ];
+    const req = await svc.openNodeRequest(departmentInput('bu_seeded'), CTX);
+    // Both the seed check AND the subtree descent must see the null-org rows.
+    expect(req.pending_approvers.sort()).toEqual(['u5', 'u6']);
+  });
+
+  it('department approver: another organization’s unit stays invisible (#3807 keeps the wall)', async () => {
+    engine._tables['sys_business_unit'] = [
+      { id: 'bu_other', organization_id: 't2', active: true },
+      { id: 'bu_other_child', parent_business_unit_id: 'bu_other', organization_id: 't2', active: true },
+    ];
+    engine._tables['sys_business_unit_member'] = [
+      { id: 'bm1', business_unit_id: 'bu_other', user_id: 'intruder' },
+      { id: 'bm2', business_unit_id: 'bu_other_child', user_id: 'intruder2' },
+    ];
+    const req = await svc.openNodeRequest(departmentInput('bu_other'), CTX);
+    expect(req.pending_approvers).toEqual(['department:bu_other']);
+  });
+
+  it('department approver: a null-org subtree does not drag in another org’s child unit (#3807)', async () => {
+    engine._tables['sys_business_unit'] = [
+      { id: 'bu_seeded', organization_id: null, active: true },
+      { id: 'bu_mine', parent_business_unit_id: 'bu_seeded', organization_id: 't1', active: true },
+      { id: 'bu_theirs', parent_business_unit_id: 'bu_seeded', organization_id: 't2', active: true },
+    ];
+    engine._tables['sys_business_unit_member'] = [
+      { id: 'bm1', business_unit_id: 'bu_mine', user_id: 'u5' },
+      { id: 'bm2', business_unit_id: 'bu_theirs', user_id: 'intruder' },
+    ];
+    const req = await svc.openNodeRequest(departmentInput('bu_seeded'), CTX);
+    expect(req.pending_approvers).toEqual(['u5']);
+  });
+
+  it('department approver: an inactive env-wide unit still contributes nobody (#3807)', async () => {
+    engine._tables['sys_business_unit'] = [{ id: 'bu_seeded', organization_id: null, active: false }];
+    engine._tables['sys_business_unit_member'] = [
+      { id: 'bm1', business_unit_id: 'bu_seeded', user_id: 'u5' },
+    ];
+    const req = await svc.openNodeRequest(departmentInput('bu_seeded'), CTX);
+    expect(req.pending_approvers).toEqual(['department:bu_seeded']);
+  });
+
   // ── decideNode ──────────────────────────────────────────────────
 
   it('decideNode: first_response approve finalizes immediately', async () => {
@@ -418,11 +848,13 @@ describe('ApprovalService (node era)', () => {
   it('getRequest: viewer.can_act is true for a pending approver, false for the submitter', async () => {
     const req = await svc.openNodeRequest(openInput(['u9']), CTX); // submitter u1, approver u9
     const asApprover = await svc.getRequest(req.id, { userId: 'u9', tenantId: 't1' } as any);
-    expect(asApprover!.viewer).toEqual({ can_act: true, is_submitter: false });
+    expect(asApprover!.viewer).toEqual({ can_act: true, is_submitter: false, can_override: false });
     const asSubmitter = await svc.getRequest(req.id, { userId: 'u1', tenantId: 't1' } as any);
-    expect(asSubmitter!.viewer).toEqual({ can_act: false, is_submitter: true });
-    const asOther = await svc.getRequest(req.id, { userId: 'u_stranger', tenantId: 't1' } as any);
-    expect(asOther!.viewer).toEqual({ can_act: false, is_submitter: false });
+    expect(asSubmitter!.viewer).toEqual({ can_act: false, is_submitter: true, can_override: false });
+    // #3590: a same-tenant stranger participates in nothing, so the request is
+    // not readable at all — previously it came back with an all-false viewer
+    // block, which meant every authenticated user could read every request.
+    expect(await svc.getRequest(req.id, { userId: 'u_stranger', tenantId: 't1' } as any)).toBeNull();
   });
 
   it('getRequest: viewer.can_act drops to false once the request is finalized', async () => {
@@ -539,6 +971,27 @@ describe('ApprovalService (node era)', () => {
     expect(rows[0].payload_display).toEqual({ account: 'Acme Corp' });
   });
 
+  it('enrichment maps snapshot field keys to the object field labels', async () => {
+    (engine as any).getSchema = (name: string) =>
+      name === 'opportunity'
+        ? {
+            label: 'Opportunity',
+            fields: {
+              id: {}, // no label → excluded from payload_labels
+              name: { label: 'Deal Name' },
+              amount: { label: 'Deal Amount' },
+            },
+          }
+        : undefined;
+    await svc.openNodeRequest(
+      openInput(['u9'], { record: { id: 'opp1', name: 'Acme Renewal', amount: 100 } }), CTX,
+    );
+    const rows = await svc.listRequests({ status: 'pending' }, SYS);
+    // Only keys present in the snapshot AND carrying a schema label are mapped;
+    // `id` (unlabeled) is dropped.
+    expect(rows[0].payload_labels).toEqual({ name: 'Deal Name', amount: 'Deal Amount' });
+  });
+
   it('enrichment maps user-id approvers to display names', async () => {
     engine._tables['sys_user'] = [{ id: 'u9', name: 'Grace Hopper', email: 'grace@example.com' }];
     await svc.openNodeRequest(openInput(['u9']), CTX);
@@ -561,7 +1014,7 @@ describe('ApprovalService (node era)', () => {
 
   it('reassign: hands the slot to a new approver and audits the move', async () => {
     const req = await svc.openNodeRequest(openInput(['u9', 'u2']), CTX);
-    const out = await svc.reassign(req.id, { actorId: 'u9', to: 'u7' }, CTX);
+    const out = await svc.reassign(req.id, { actorId: 'u9', to: 'u7' }, asUser('u9'));
     expect(out.request.pending_approvers).toEqual(['u7', 'u2']);
     const actions = await svc.listActions(req.id, SYS);
     expect(actions.at(-1)).toMatchObject({ action: 'reassign', actor_id: 'u9', comment: 'u9 → u7' });
@@ -571,15 +1024,15 @@ describe('ApprovalService (node era)', () => {
     const emitted: any[] = [];
     svc.attachMessaging({ async emit(input) { emitted.push(input); } });
     const req = await svc.openNodeRequest(openInput(['u9']), CTX);
-    await svc.reassign(req.id, { actorId: 'u9', to: 'u7' }, CTX);
+    await svc.reassign(req.id, { actorId: 'u9', to: 'u7' }, asUser('u9'));
     expect(emitted).toHaveLength(1);
     expect(emitted[0]).toMatchObject({ topic: 'approval.reassigned', audience: ['u7'] });
   });
 
   it('reassign: blocks a non-holder and duplicate targets', async () => {
     const req = await svc.openNodeRequest(openInput(['u9', 'u2']), CTX);
-    await expect(svc.reassign(req.id, { actorId: 'intruder', to: 'u7' }, CTX)).rejects.toThrow(/FORBIDDEN/);
-    await expect(svc.reassign(req.id, { actorId: 'u9', to: 'u2' }, CTX)).rejects.toThrow(/VALIDATION_FAILED/);
+    await expect(svc.reassign(req.id, { actorId: 'intruder', to: 'u7' }, asUser('intruder'))).rejects.toThrow(/FORBIDDEN/);
+    await expect(svc.reassign(req.id, { actorId: 'u9', to: 'u2' }, asUser('u9'))).rejects.toThrow(/VALIDATION_FAILED/);
   });
 
   it('remind: notifies pending approvers, audits, and throttles repeats', async () => {
@@ -628,7 +1081,7 @@ describe('ApprovalService (node era)', () => {
     const emitted: any[] = [];
     svc.attachMessaging({ async emit(input) { emitted.push(input); } });
     const req = await svc.openNodeRequest(openInput(['u9']), CTX);
-    const out = await svc.requestInfo(req.id, { actorId: 'u9', comment: 'Need the Q3 numbers' }, CTX);
+    const out = await svc.requestInfo(req.id, { actorId: 'u9', comment: 'Need the Q3 numbers' }, asUser('u9'));
     expect(out.request.status).toBe('pending');
     expect(out.request.pending_approvers).toEqual(['u9']);
     expect(emitted[0]).toMatchObject({ topic: 'approval.request_info', audience: ['u1'] });
@@ -639,8 +1092,8 @@ describe('ApprovalService (node era)', () => {
   it('comment: submitter and approver may reply; outsiders may not', async () => {
     const req = await svc.openNodeRequest(openInput(['u9']), CTX);
     await svc.comment(req.id, { actorId: 'u1', comment: 'Numbers attached.' }, CTX);
-    await svc.comment(req.id, { actorId: 'u9', comment: 'Thanks, reviewing.' }, CTX);
-    await expect(svc.comment(req.id, { actorId: 'outsider', comment: 'hi' }, { positions: [], permissions: [] } as any))
+    await svc.comment(req.id, { actorId: 'u9', comment: 'Thanks, reviewing.' }, asUser('u9'));
+    await expect(svc.comment(req.id, { actorId: 'outsider', comment: 'hi' }, asUser('outsider')))
       .rejects.toThrow(/FORBIDDEN/);
     const actions = await svc.listActions(req.id, SYS);
     expect(actions.filter(a => a.action === 'comment')).toHaveLength(2);
@@ -692,7 +1145,7 @@ describe('ApprovalService (node era)', () => {
     expect(await svc.redeemActionToken(short.approve)).toMatchObject({ ok: false, reason: 'expired' });
 
     const live = await svc.issueActionTokens(req.id, 'u9');
-    await svc.reassign(req.id, { actorId: 'u9', to: 'u7' }, CTX);
+    await svc.reassign(req.id, { actorId: 'u9', to: 'u7' }, asUser('u9'));
     expect(await svc.redeemActionToken(live.approve)).toMatchObject({ ok: false, reason: 'not_approver' });
 
     const forU7 = await svc.issueActionTokens(req.id, 'u7');
@@ -1034,6 +1487,127 @@ describe('ApprovalService (node era)', () => {
   });
 });
 
+// ── Admin / privileged override (#3424) ──────────────────────────────
+//
+// An approval routed to a position/team with NO holders resolves to only the
+// unresolvable `position:<name>` literal — no concrete user is in the slate, so
+// every normal decision is FORBIDDEN and (with lockRecord) the record stays
+// locked forever with no in-product recovery. A platform or tenant admin may
+// act on the pending request to release it: approve, reject, reassign it to a
+// real approver, or recall it. Privilege is org-scoped for tenant admins.
+describe('ApprovalService — admin override (#3424)', () => {
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let svc: ApprovalService;
+  let n = 0;
+  const baseTime = new Date('2026-01-15T10:00:00Z').getTime();
+
+  // Admin exec contexts, shaped like the resolved authz envelope (permissions
+  // carry the permission-set names the shared resolver aggregates).
+  const PLATFORM_ADMIN = { userId: 'root', tenantId: 't1', positions: [], permissions: ['admin_full_access'] } as any;
+  const TENANT_ADMIN = { userId: 'owner', tenantId: 't1', positions: [], permissions: ['organization_admin'] } as any;
+  const OTHER_TENANT_ADMIN = { userId: 'owner2', tenantId: 't2', positions: [], permissions: ['organization_admin'] } as any;
+  const MEMBER = { userId: 'nobody', tenantId: 't1', positions: [], permissions: [] } as any;
+
+  // A request routed to an UNSTAFFED position → `pending_approvers` falls back to
+  // the `position:sales_manager` literal, undecidable by any normal user.
+  const stuckInput = (extra: Record<string, any> = {}) => ({
+    object: 'opportunity', recordId: 'opp1', runId: 'run_1', nodeId: 'approve_step',
+    flowName: 'deal_approval',
+    config: { approvers: [{ type: 'position' as const, value: 'sales_manager' }], behavior: 'first_response' as const, lockRecord: true },
+    record: { id: 'opp1', amount: 100 },
+    ...extra,
+  });
+
+  beforeEach(() => {
+    engine = makeFakeEngine();
+    n = 0;
+    svc = new ApprovalService({ engine: engine as any, clock: { now: () => new Date(baseTime + (n++) * 1000) } });
+  });
+
+  it('the stuck request is undecidable by any normal user (repro)', async () => {
+    const req = await svc.openNodeRequest(stuckInput(), CTX);
+    expect(req.pending_approvers).toEqual(['position:sales_manager']);
+    // Even the org owner-by-id is not in the resolved (empty) slate.
+    await expect(svc.decideNode(req.id, { decision: 'approve', actorId: 'nobody' }, MEMBER))
+      .rejects.toThrow(/FORBIDDEN/);
+  });
+
+  it('a tenant admin can approve a stuck request, finalizing it (which releases the lock)', async () => {
+    const req = await svc.openNodeRequest(stuckInput(), CTX);
+    const out = await svc.decide(req.id, { decision: 'approve', actorId: 'owner' }, TENANT_ADMIN);
+    expect(out.finalized).toBe(true);
+    expect(out.request.status).toBe('approved');
+    // No pending request remains → the record-lock hook no longer blocks edits.
+    const fresh = await svc.getRequest(req.id, SYS);
+    expect(fresh?.status).toBe('approved');
+    expect(fresh?.pending_approvers).toEqual([]);
+    // Audited under the admin's own id — never spoofed as an approver.
+    const acts = await svc.listActions(req.id, SYS);
+    expect(acts.at(-1)).toMatchObject({ action: 'approve', actor_id: 'owner' });
+  });
+
+  it('a platform admin can reject a stuck request', async () => {
+    const req = await svc.openNodeRequest(stuckInput(), CTX);
+    const out = await svc.decide(req.id, { decision: 'reject', actorId: 'root' }, PLATFORM_ADMIN);
+    expect(out.finalized).toBe(true);
+    expect(out.request.status).toBe('rejected');
+  });
+
+  it('an admin override finalizes even a unanimous request immediately (not one vote among the slate)', async () => {
+    const req = await svc.openNodeRequest(stuckInput({
+      config: { approvers: [{ type: 'position' as const, value: 'sales_manager' }], behavior: 'unanimous' as const, lockRecord: true },
+    }), CTX);
+    const out = await svc.decide(req.id, { decision: 'approve', actorId: 'owner' }, TENANT_ADMIN);
+    expect(out.finalized).toBe(true);
+    expect(out.request.status).toBe('approved');
+  });
+
+  it('an admin can reassign a stuck request to a real approver, who then decides normally', async () => {
+    const req = await svc.openNodeRequest(stuckInput(), CTX);
+    const out = await svc.reassign(req.id, { actorId: 'owner', to: 'u7' }, TENANT_ADMIN);
+    expect(out.request.pending_approvers).toEqual(['u7']);
+    const decided = await svc.decideNode(
+      req.id, { decision: 'approve', actorId: 'u7' },
+      { userId: 'u7', tenantId: 't1', positions: [], permissions: [] } as any,
+    );
+    expect(decided.finalized).toBe(true);
+  });
+
+  it('an admin can recall (withdraw) a stuck request', async () => {
+    const req = await svc.openNodeRequest(stuckInput(), CTX);
+    const out = await svc.recall(req.id, { actorId: 'owner', comment: 'unstaffed role' }, TENANT_ADMIN);
+    expect(out.request.status).toBe('recalled');
+    expect(out.request.pending_approvers).toEqual([]);
+  });
+
+  it('a tenant admin of a DIFFERENT org cannot override (privilege is org-scoped)', async () => {
+    const req = await svc.openNodeRequest(stuckInput(), CTX); // organization_id = t1
+    await expect(svc.decideNode(req.id, { decision: 'approve', actorId: 'owner2' }, OTHER_TENANT_ADMIN))
+      .rejects.toThrow(/FORBIDDEN/);
+  });
+
+  it('viewer.can_override reflects the privilege, and drops once finalized', async () => {
+    const req = await svc.openNodeRequest(stuckInput(), CTX);
+    const asAdmin = await svc.getRequest(req.id, TENANT_ADMIN);
+    expect(asAdmin!.viewer).toMatchObject({ can_act: false, can_override: true });
+    // Someone who CAN see the request but holds no override privilege — the
+    // submitter. `can_override` is about the privilege, not about access, so
+    // the check needs a participant rather than a stranger.
+    const asSubmitter = await svc.getRequest(req.id, CTX);
+    expect(asSubmitter!.viewer!.can_override).toBe(false);
+    await svc.decide(req.id, { decision: 'approve', actorId: 'owner' }, TENANT_ADMIN);
+    const after = await svc.getRequest(req.id, TENANT_ADMIN);
+    expect(after!.viewer!.can_override).toBe(false);
+  });
+
+  // #3590: a plain member who participates in nothing now sees nothing — a
+  // request is no longer readable merely because you are in the same tenant.
+  it('a non-participant member cannot read the request at all', async () => {
+    const req = await svc.openNodeRequest(stuckInput(), CTX);
+    expect(await svc.getRequest(req.id, MEMBER)).toBeNull();
+  });
+});
+
 describe('record-lock hook (node era)', () => {
   let engine: ReturnType<typeof makeFakeEngine>;
   let svc: ApprovalService;
@@ -1098,34 +1672,227 @@ describe('record-lock hook (node era)', () => {
     ).resolves.toBeUndefined();
   });
 
-  it('unbindAllHooks removes the lock hook', () => {
-    expect(unbindAllHooks(engine as any)).toBe(1);
-    expect(engine._hooks['beforeUpdate']).toHaveLength(0);
+  // ── #3456 prevention half: the lock must not kill the run that owns it ──
+
+  it('allows the OWNING run to write its own target record', async () => {
+    await expect(
+      engine.fire('beforeUpdate', {
+        object: 'opportunity',
+        input: { id: 'opp1', data: { amount: 200 } },
+        // Neither elevated nor admin — the exemption rides on run identity
+        // alone, so a `runAs:'user'` run stays RLS-scoped while it writes.
+        session: { isSystem: false, positions: [], userId: 'u1' },
+        provenance: { flowRunId: 'run_1' },
+      }),
+    ).resolves.toBeUndefined();
   });
-});
 
-// ── Out-of-office auto-skip (#1322 M1/M4) ─────────────────────────────
-//
-// When a resolved individual approver has declared an active OOO delegation,
-// the slot is rerouted to the delegate at resolution time (never a background
-// job), audited as `ooo_substitute`, and both parties are notified. Group /
-// graph approvers (position/team/department/tier) are left untouched.
-describe('ApprovalService — out-of-office delegation (#1322)', () => {
-  // Mid-window instant for the issue's own example (leave 5/26–5/30).
-  const OOO_NOW = new Date('2026-05-27T10:00:00Z').getTime();
-  let engine: ReturnType<typeof makeFakeEngine>;
-  let svc: ApprovalService;
-  let emitted: any[];
+  // #3712 — the residual #3703 left open. A schedule-triggered run resolves NO
+  // principal, so it arrives with no session at all; provenance is the only
+  // thing it carries, and the exemption must key on that rather than on an
+  // identity the run does not have.
+  it('allows an identity-less (schedule-triggered) owning run — no session at all', async () => {
+    await expect(
+      engine.fire('beforeUpdate', {
+        object: 'opportunity',
+        input: { id: 'opp1', data: { amount: 200 } },
+        provenance: { flowRunId: 'run_1' },
+      }),
+    ).resolves.toBeUndefined();
+  });
 
-  function seedDelegation(rows: Array<Record<string, any>>) {
-    engine._tables['sys_approval_delegation'] = rows.map((r, i) => ({
-      id: `del${i}`,
-      organization_id: 't1',
-      valid_from: '2026-05-26T00:00:00Z',
-      valid_until: '2026-05-30T00:00:00Z',
-      reason: 'Annual leave',
-      ...r,
-    }));
+  it('still blocks a DIFFERENT run writing the locked record', async () => {
+    await expect(
+      engine.fire('beforeUpdate', {
+        object: 'opportunity',
+        input: { id: 'opp1', data: { amount: 200 } },
+        session: { isSystem: false, positions: [], userId: 'u1' },
+        provenance: { flowRunId: 'run_other' },
+      }),
+    ).rejects.toThrow(/RECORD_LOCKED/);
+  });
+
+  it('still blocks an identity-less caller with no provenance at all', async () => {
+    // The bare-kernel / no-context write. Nothing to match, nothing exempted.
+    await expect(
+      engine.fire('beforeUpdate', {
+        object: 'opportunity',
+        input: { id: 'opp1', data: { amount: 200 } },
+      }),
+    ).rejects.toThrow(/RECORD_LOCKED/);
+  });
+
+  it('does not exempt anyone when the pending request carries no run id', async () => {
+    // A request with no owning run has nothing to match against — a stray
+    // `flowRunId` must not become a skeleton key.
+    engine._tables['sys_approval_request'][0].flow_run_id = null;
+    await expect(
+      engine.fire('beforeUpdate', {
+        object: 'opportunity',
+        input: { id: 'opp1', data: { amount: 200 } },
+        session: { isSystem: false, positions: [], userId: 'u1' },
+        provenance: { flowRunId: 'run_1' },
+      }),
+    ).rejects.toThrow(/RECORD_LOCKED/);
+  });
+
+  it('unbindAllHooks removes the lock hook', () => {
+    expect(unbindAllHooks(engine as any)).toBe(1);
+    expect(engine._hooks['beforeUpdate']).toHaveLength(0);
+  });
+});
+
+// ── #3456 recovery half: release records held by a dead approval run ──
+//
+// The prevention half above stops a run from dying on its own lock. This sweep
+// covers the runs that die anyway — including a process crash, which no in-band
+// handler can clean up because the process that would run it is gone.
+//
+// The load-bearing property is what it must NOT do: a run merely *paused* on its
+// approval is the normal state of every live request, so anything short of an
+// explicit terminal status has to be read as "alive".
+describe('ApprovalService — dead-run release (#3456)', () => {
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let svc: ApprovalService;
+  let n = 0;
+  const baseTime = new Date('2026-01-15T10:00:00Z').getTime();
+
+  /** Attach an automation surface whose `getRun` answers with `status`. */
+  const withRunStatus = (status: string | null) =>
+    svc.attachAutomation({ getRun: async () => (status == null ? null : { status }) } as any);
+
+  const requestRow = () => engine._tables['sys_approval_request'][0];
+
+  beforeEach(async () => {
+    engine = makeFakeEngine();
+    n = 0;
+    svc = new ApprovalService({ engine: engine as any, clock: { now: () => new Date(baseTime + (n++) * 1000) } });
+    bindApprovalLockHook(engine as any);
+    await svc.openNodeRequest(openInput(['u9'], {}, { approvalStatusField: 'approval_status' }), CTX);
+    engine._tables['opportunity'] = [{ id: 'opp1', amount: 100 }];
+  });
+
+  it('releases a pending request whose owning run failed', async () => {
+    withRunStatus('failed');
+    expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 1, released: 1 });
+    expect(requestRow().status).toBe('recalled');
+    expect(requestRow().pending_approvers).toBeNull();
+    expect(requestRow().completed_at).toBeTruthy();
+  });
+
+  it('audits the release as a dead-run abandonment, not a submitter recall', async () => {
+    withRunStatus('failed');
+    await svc.releaseDeadRunRequests();
+    const action = engine._tables['sys_approval_action'].find((a: any) => a.actor_id === 'system:dead-run');
+    expect(action).toBeTruthy();
+    expect(action.action).toBe('recall');
+    expect(action.comment).toMatch(/run_1/);
+    expect(action.comment).toMatch(/failed/);
+  });
+
+  it('actually unlocks the record — a plain user edit succeeds afterwards', async () => {
+    // The end-to-end point of the whole sweep.
+    const edit = () => engine.fire('beforeUpdate', {
+      object: 'opportunity',
+      input: { id: 'opp1', data: { amount: 200 } },
+      session: { isSystem: false, positions: [], userId: 'u1' },
+    });
+    await expect(edit()).rejects.toThrow(/RECORD_LOCKED/);   // held by the dead run
+    withRunStatus('failed');
+    await svc.releaseDeadRunRequests();
+    await expect(edit()).resolves.toBeUndefined();            // released
+  });
+
+  it('mirrors the configured status field on release', async () => {
+    withRunStatus('failed');
+    await svc.releaseDeadRunRequests();
+    expect(engine._tables['opportunity'][0].approval_status).toBe('recalled');
+  });
+
+  it('leaves a PAUSED run alone — that is a live approval', async () => {
+    withRunStatus('paused');
+    expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 1, released: 0 });
+    expect(requestRow().status).toBe('pending');
+  });
+
+  it.each([
+    ['an unknown run (null)', null],
+    ['an unrecognised status', 'reticulating_splines'],
+    ['a still-running run', 'running'],
+  ])('leaves the request pending for %s', async (_label, status) => {
+    withRunStatus(status as any);
+    expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 1, released: 0 });
+    expect(requestRow().status).toBe('pending');
+  });
+
+  it('leaves the request pending when getRun throws', async () => {
+    svc.attachAutomation({ getRun: async () => { throw new Error('engine unreachable'); } } as any);
+    expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 1, released: 0 });
+    expect(requestRow().status).toBe('pending');
+  });
+
+  it('is a no-op with no automation engine attached', async () => {
+    expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 0, released: 0 });
+    expect(requestRow().status).toBe('pending');
+  });
+
+  it('is a no-op when the surface has no getRun (older engine)', async () => {
+    svc.attachAutomation({ resume: async () => undefined } as any);
+    expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 0, released: 0 });
+    expect(requestRow().status).toBe('pending');
+  });
+
+  it('skips a request with no owning run', async () => {
+    requestRow().flow_run_id = null;
+    withRunStatus('failed');
+    expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 1, released: 0 });
+    expect(requestRow().status).toBe('pending');
+  });
+
+  it.each(['completed', 'cancelled', 'timed_out'])(
+    'releases on the other terminal status %s', async (status) => {
+      // A terminal run can never decide its request, whatever ended it — a
+      // `completed` one means someone resumed the run out of band.
+      withRunStatus(status);
+      expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 1, released: 1 });
+      expect(requestRow().status).toBe('recalled');
+    },
+  );
+
+  it('one unreadable request does not stop the sweep', async () => {
+    await svc.openNodeRequest(
+      { ...openInput(['u9']), recordId: 'opp2', runId: 'run_2' } as any, CTX,
+    );
+    let call = 0;
+    svc.attachAutomation({
+      getRun: async () => { call++; if (call === 1) throw new Error('boom'); return { status: 'failed' }; },
+    } as any);
+    expect(await svc.releaseDeadRunRequests()).toEqual({ scanned: 2, released: 1 });
+  });
+});
+
+// ── Out-of-office auto-skip (#1322 M1/M4) ─────────────────────────────
+//
+// When a resolved individual approver has declared an active OOO delegation,
+// the slot is rerouted to the delegate at resolution time (never a background
+// job), audited as `ooo_substitute`, and both parties are notified. Group /
+// graph approvers (position/team/department/tier) are left untouched.
+describe('ApprovalService — out-of-office delegation (#1322)', () => {
+  // Mid-window instant for the issue's own example (leave 5/26–5/30).
+  const OOO_NOW = new Date('2026-05-27T10:00:00Z').getTime();
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let svc: ApprovalService;
+  let emitted: any[];
+
+  function seedDelegation(rows: Array<Record<string, any>>) {
+    engine._tables['sys_approval_delegation'] = rows.map((r, i) => ({
+      id: `del${i}`,
+      organization_id: 't1',
+      valid_from: '2026-05-26T00:00:00Z',
+      valid_until: '2026-05-30T00:00:00Z',
+      reason: 'Annual leave',
+      ...r,
+    }));
   }
 
   beforeEach(() => {
@@ -1183,6 +1950,20 @@ describe('ApprovalService — out-of-office delegation (#1322)', () => {
     expect(req.pending_approvers).toEqual(['bob']);
   });
 
+  it('type:field (multi-select) — reroutes each out-of-office user independently (#3447)', async () => {
+    // Pre-#3447 the array was stringified to one bogus id ('alice,dave'), which
+    // matched no delegation — OOO silently no-op'd. Fanned out, alice → bob
+    // applies and dave is left untouched.
+    seedDelegation([{ delegator_id: 'alice', delegate_id: 'bob' }]);
+    const input = {
+      ...openInput([]),
+      record: { id: 'opp1', reviewers: ['alice', 'dave'] },
+      config: { approvers: [{ type: 'field', value: 'reviewers' }], behavior: 'unanimous', lockRecord: true },
+    };
+    const req = await svc.openNodeRequest(input as any, CTX);
+    expect(req.pending_approvers.sort()).toEqual(['bob', 'dave']);
+  });
+
   it('type:manager — reroutes when the resolved manager is out of office', async () => {
     engine._tables['sys_user'] = [{ id: 'carol', manager_id: 'alice' }];
     seedDelegation([{ delegator_id: 'alice', delegate_id: 'bob' }]);
@@ -1451,6 +2232,33 @@ describe('ApprovalService — decision_progress & deep links (#2678 P1.5)', () =
     expect(row.decision_progress.groups.find((g: any) => g.group === 'finance')).toMatchObject({ got: 0, satisfied: false });
   });
 
+  it('per_group: pending_approver_groups maps each pending approver to its group (objectui#2807)', async () => {
+    const req = await svc.openNodeRequest(cfg([U('l1', 'legal'), U('f1', 'finance')], 'per_group'), CTX);
+    let row: any = await svc.getRequest(req.id, SYS);
+    // Every pending slot is labeled with the group it fills.
+    expect(row.pending_approver_groups).toEqual({ l1: ['legal'], f1: ['finance'] });
+    // Once legal signs off, l1 drops out of pending — and out of the map.
+    await svc.decideNode(req.id, { decision: 'approve', actorId: 'l1' }, SYS);
+    row = await svc.getRequest(req.id, SYS);
+    expect(row.pending_approver_groups).toEqual({ f1: ['finance'] });
+  });
+
+  it('per_group with unnamed groups omits synthetic keys; non-per_group omits the map (objectui#2807)', async () => {
+    // Distinct (record, run) so the two opens aren't a duplicate-pending clash.
+    const mk = (approvers: any[], behavior: string, recordId: string, runId: string, extra: Record<string, any> = {}) => ({
+      ...openInput([], { recordId, runId }),
+      config: { approvers, behavior, lockRecord: true, ...extra },
+    });
+    // Unnamed approvers → synthetic `#N` group keys, which are not surfaced.
+    const unnamed = await svc.openNodeRequest(mk([U('u1'), U('u2')], 'per_group', 'opp_u', 'run_u'), CTX);
+    const uRow: any = await svc.getRequest(unnamed.id, SYS);
+    expect(uRow.pending_approver_groups).toBeUndefined();
+    // Quorum aggregates approvals, not groups — no approver→group map.
+    const q = await svc.openNodeRequest(mk([U('a1'), U('a2')], 'quorum', 'opp_q', 'run_q', { minApprovals: 2 }), CTX);
+    const qRow: any = await svc.getRequest(q.id, SYS);
+    expect(qRow.pending_approver_groups).toBeUndefined();
+  });
+
   it('quorum: progress reports approvals against the clamped threshold', async () => {
     const req = await svc.openNodeRequest(cfg([U('u1'), U('u2'), U('u3')], 'quorum', { minApprovals: 2 }), CTX);
     await svc.decideNode(req.id, { decision: 'approve', actorId: 'u1' }, SYS);
@@ -1477,7 +2285,7 @@ describe('ApprovalService — decision_progress & deep links (#2678 P1.5)', () =
 // listActions must surface decision attachments through the contract mapping
 // (#3266 — the column existed but rowFromAction dropped it; caught in browser).
 describe('ApprovalService — listActions attachments mapping (#3266)', () => {
-  it('returns the attachments recorded on a decision', async () => {
+  it('normalizes a bare fileId string into an attachment descriptor', async () => {
     const engine = makeFakeEngine();
     let n = 0;
     const svc = new ApprovalService({ engine: engine as any, clock: { now: () => new Date(1757000000000 + (n++) * 1000) } });
@@ -1485,6 +2293,566 @@ describe('ApprovalService — listActions attachments mapping (#3266)', () => {
     await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9', attachments: ['file_a'] }, SYS);
     const acts = await svc.listActions(req.id, SYS);
     const approve = acts.find(a => a.action === 'approve');
-    expect(approve?.attachments).toEqual(['file_a']);
+    expect(approve?.attachments).toEqual([{ id: 'file_a' }]);
+  });
+
+  // The normal case. The column STORES an opaque sys_file id (ADR-0104 D3);
+  // the ObjectQL read path resolves it into the expanded
+  // `{ id, name, size, mimeType, url }` form on the way out. The old
+  // `.map(String)` turned that object into "[object Object]", so the inbox chip
+  // had no name and 404'd on open. The mapping must pass it through unmangled.
+  it('passes the engine-expanded file value through with its name and url', async () => {
+    const engine = makeFakeEngine();
+    let n = 0;
+    const svc = new ApprovalService({ engine: engine as any, clock: { now: () => new Date(1757000000000 + (n++) * 1000) } });
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+    await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9' }, SYS);
+    // Simulate what the read path hands back after resolving the stored id.
+    const row = engine._tables['sys_approval_action'].find((a: any) => a.action === 'approve');
+    row.attachments = [
+      { id: 'file_a', name: 'signed-contract.pdf', mimeType: 'application/pdf', size: 24, url: '/api/v1/storage/files/file_a' },
+    ];
+    const acts = await svc.listActions(req.id, SYS);
+    const approve = acts.find(a => a.action === 'approve');
+    expect(approve?.attachments).toEqual([
+      { id: 'file_a', name: 'signed-contract.pdf', mimeType: 'application/pdf', size: 24, url: '/api/v1/storage/files/file_a' },
+    ]);
+  });
+
+  // Rows written before file-as-reference hold an inline blob whose keys are
+  // snake_case (`file_id`, `mime_type`). They stay readable until the backfill
+  // converts them, so both casings must map — the same drift that made objectui
+  // stop recognising images when the expanded form arrived.
+  it('maps a legacy inline blob (file_id / mime_type) written before the cutover', async () => {
+    const engine = makeFakeEngine();
+    let n = 0;
+    const svc = new ApprovalService({ engine: engine as any, clock: { now: () => new Date(1757000000000 + (n++) * 1000) } });
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+    await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9' }, SYS);
+    const row = engine._tables['sys_approval_action'].find((a: any) => a.action === 'approve');
+    row.attachments = [
+      { file_id: 'file_b', name: 'old.pdf', mime_type: 'application/pdf', size: 12, url: 'https://cdn/old.pdf' },
+    ];
+    const acts = await svc.listActions(req.id, SYS);
+    expect(acts.find(a => a.action === 'approve')?.attachments).toEqual([
+      { id: 'file_b', name: 'old.pdf', mimeType: 'application/pdf', size: 12, url: 'https://cdn/old.pdf' },
+    ]);
+  });
+});
+
+// #3508: `queue` is declared-but-unenforced — resolveApproverSpec has no queue
+// branch, so the spec value falls through to the dead `queue:<id>` literal.
+// The engine must at least WARN so operators can see the silent dead slot;
+// the spec marks the type non-authorable so designers stop offering it.
+describe('ApprovalService — queue approver is unresolved (#3508)', () => {
+  it('falls back to the dead literal and warns', async () => {
+    const engine = makeFakeEngine();
+    const warnings: any[] = [];
+    let n = 0;
+    const svc = new ApprovalService({
+      engine: engine as any,
+      clock: { now: () => new Date(1757000000000 + (n++) * 1000) },
+      logger: { warn: (msg: any, meta: any) => warnings.push([msg, meta]) },
+    });
+    const req = await svc.openNodeRequest(
+      { ...openInput([]), config: { approvers: [{ type: 'queue', value: 'q_west' }], behavior: 'first_response', lockRecord: false } },
+      CTX,
+    );
+    // No queue expansion exists: the slot is the raw `type:value` literal,
+    // which matches no real user id — the request routes to nobody.
+    expect(req.pending_approvers).toEqual(['queue:q_west']);
+    expect(warnings.some(([msg]) => String(msg).includes("'queue'") && String(msg).includes('#3508'))).toBe(true);
+  });
+});
+
+// #3807 follow-up: `queue` was not the only way to end up with a slot nobody
+// can act on — every GRAPH approver type falls back to the same literal when
+// its lookup finds no one, and that fallback used to happen in total silence.
+// A stuck approval was the first symptom; the log said nothing. The literal
+// stays (15.x slots and substring fixtures depend on it) — it just announces
+// itself now.
+describe('ApprovalService — a graph approver that expands to nobody warns (#3807)', () => {
+  const svcWithWarnings = (engine: any) => {
+    const warnings: any[] = [];
+    let n = 0;
+    const svc = new ApprovalService({
+      engine,
+      clock: { now: () => new Date(1757000000000 + (n++) * 1000) },
+      logger: { warn: (msg: any, meta: any) => warnings.push([msg, meta]) },
+    });
+    return { svc, warnings };
+  };
+
+  const approverInput = (type: string, value: string) => ({
+    ...openInput([]),
+    config: { approvers: [{ type, value }], behavior: 'first_response' as const, lockRecord: false },
+  });
+
+  it.each([
+    ['team', 'team_gone'],
+    ['department', 'bu_gone'],
+    ['position', 'nobody_holds_this'],
+    ['org_membership_level', 'member'],
+  ])('%s: the dead literal is logged with its type, value and org', async (type, value) => {
+    const engine = makeFakeEngine();
+    const { svc, warnings } = svcWithWarnings(engine);
+    const req = await svc.openNodeRequest(approverInput(type, value), CTX);
+
+    expect(req.pending_approvers).toEqual([`${type}:${value}`]);
+    const hit = warnings.find(([msg]) => String(msg).includes('expanded to nobody'));
+    expect(hit, `no warning for ${type}`).toBeTruthy();
+    expect(String(hit[0])).toContain('#3807');
+    expect(hit[1]).toMatchObject({ type, value, organizationId: 't1' });
+  });
+
+  it('stays quiet when the graph DOES resolve someone', async () => {
+    const engine = makeFakeEngine();
+    engine._tables['sys_team_member'] = [{ id: 'tm1', team_id: 'team_ok', user_id: 'u5' }];
+    const { svc, warnings } = svcWithWarnings(engine);
+    const req = await svc.openNodeRequest(approverInput('team', 'team_ok'), CTX);
+
+    expect(req.pending_approvers).toEqual(['u5']);
+    expect(warnings.filter(([msg]) => String(msg).includes('expanded to nobody'))).toEqual([]);
+  });
+
+  it('stays quiet for `user` — a literal id was never a lookup that could come back empty', async () => {
+    const engine = makeFakeEngine();
+    const { svc, warnings } = svcWithWarnings(engine);
+    const req = await svc.openNodeRequest(approverInput('user', 'u_unknown'), CTX);
+
+    expect(req.pending_approvers).toEqual(['u_unknown']);
+    expect(warnings.filter(([msg]) => String(msg).includes('expanded to nobody'))).toEqual([]);
+  });
+});
+
+// ── File-access delegate (ADR-0104 D3 wave 2) ────────────────────────
+//
+// A decision attachment is OWNED by its `sys_approval_action` row, so the
+// storage service would otherwise authorize the download by testing whether
+// the caller can READ that row. It cannot — the table is closed to ordinary
+// approver positions — which denied the very approver the attachment was filed
+// for (reproduced in the browser against app-showcase). `sys_approval_action`
+// therefore declares `fileAccessDelegate: 'approvals'` and the service answers,
+// reusing the rule that already governs seeing a decision: visibility of the
+// PARENT REQUEST, exactly as listActions applies it.
+describe('ApprovalService — authorizeFileRead delegate (ADR-0104 D3 wave 2)', () => {
+  const svcFor = (engine: any) => {
+    let n = 0;
+    return new ApprovalService({
+      engine,
+      clock: { now: () => new Date(1757000000000 + (n++) * 1000) },
+    });
+  };
+
+  const seedDecision = async (engine: any) => {
+    const svc = svcFor(engine);
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+    await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9', attachments: ['file_a'] }, SYS);
+    const action = engine._tables['sys_approval_action'].find((a: any) => a.action === 'approve');
+    return { svc, req, actionId: String(action.id) };
+  };
+
+  it('allows a caller who can see the parent request', async () => {
+    const engine = makeFakeEngine();
+    const { svc, actionId } = await seedDecision(engine);
+
+    expect(await svc.authorizeFileRead(actionId, SYS)).toBe(true);
+  });
+
+  it('denies a caller who cannot see the parent request', async () => {
+    const engine = makeFakeEngine();
+    const { svc, actionId } = await seedDecision(engine);
+    // getRequest is the single gate this delegates to — when it yields nothing
+    // for this caller, the bytes must be refused too.
+    vi.spyOn(svc as any, 'getRequest').mockResolvedValue(null);
+
+    expect(await svc.authorizeFileRead(actionId, CTX)).toBe(false);
+  });
+
+  it('denies an unknown action id', async () => {
+    const engine = makeFakeEngine();
+    const { svc } = await seedDecision(engine);
+
+    expect(await svc.authorizeFileRead('aact_does_not_exist', SYS)).toBe(false);
+    expect(await svc.authorizeFileRead('', SYS)).toBe(false);
+  });
+
+  it('fails CLOSED when the lookup throws', async () => {
+    const engine = makeFakeEngine();
+    const { svc, actionId } = await seedDecision(engine);
+    vi.spyOn(engine as any, 'find').mockRejectedValue(new Error('driver down'));
+
+    expect(await svc.authorizeFileRead(actionId, SYS)).toBe(false);
+  });
+
+  it('sys_approval_action declares the delegate, so the storage gate asks the service', async () => {
+    const { SysApprovalAction } = await import('./sys-approval-action.object.js');
+    expect((SysApprovalAction as any).fileAccessDelegate).toBe('approvals');
+  });
+});
+
+// ── Participant visibility (#3590) ───────────────────────────────────
+//
+// getRequest/listRequests deliberately query with SYSTEM_CTX (the
+// approver-visibility rule spans identity forms RLS cannot model), but only
+// the TENANT half of that rule was ever applied — so any authenticated user
+// could read any request in their tenant, and after #3580 its decision
+// attachments too. These lock in the participant half.
+describe('ApprovalService — participant visibility (#3590)', () => {
+  const svcFor = (engine: any) => {
+    let n = 0;
+    return new ApprovalService({ engine, clock: { now: () => new Date(1757000000000 + (n++) * 1000) } });
+  };
+  const asUser = (userId: string) => ({ userId, tenantId: 't1', positions: [], permissions: [] } as any);
+  const ADMIN = { userId: 'root', tenantId: 't1', positions: [], permissions: ['admin_full_access'] } as any;
+
+  it('the submitter and a pending approver can read it; a same-tenant stranger cannot', async () => {
+    const engine = makeFakeEngine();
+    const svc = svcFor(engine);
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX); // submitter u1, approver u9
+
+    expect(await svc.getRequest(req.id, asUser('u1'))).not.toBeNull();
+    expect(await svc.getRequest(req.id, asUser('u9'))).not.toBeNull();
+    expect(await svc.getRequest(req.id, asUser('u_stranger'))).toBeNull();
+  });
+
+  it('someone who already acted keeps access after their slot moves on', async () => {
+    const engine = makeFakeEngine();
+    const svc = svcFor(engine);
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+    await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9' }, SYS);
+
+    // u9 is no longer a pending approver, but the decision is theirs — the
+    // audit trail (and its attachments) must not vanish from under them.
+    expect(await svc.getRequest(req.id, asUser('u9'))).not.toBeNull();
+  });
+
+  it('an override admin keeps the unrestricted view the console depends on', async () => {
+    const engine = makeFakeEngine();
+    const svc = svcFor(engine);
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+
+    expect(await svc.getRequest(req.id, ADMIN)).not.toBeNull();
+  });
+
+  it('a tokenless context sees nothing — the gate fails closed', async () => {
+    const engine = makeFakeEngine();
+    const svc = svcFor(engine);
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+
+    expect(await svc.getRequest(req.id, { tenantId: 't1', positions: [], permissions: [] } as any)).toBeNull();
+  });
+
+  it('listRequests no longer returns the whole tenant when no approverId filter is passed', async () => {
+    const engine = makeFakeEngine();
+    const svc = svcFor(engine);
+    const mine = await svc.openNodeRequest(openInput(['u9']), CTX);            // submitter u1
+    await svc.openNodeRequest(openInput(['u7'], { recordId: 'opp2', record: { id: 'opp2' } }), asUser('u_other')); // unrelated to u1
+
+    // The old behaviour: omit approverId and receive every request in the
+    // tenant. `approverId` is a filter, never authorization.
+    const seen = await svc.listRequests(undefined, asUser('u1'));
+    expect(seen.map(r => r.id)).toEqual([mine.id]);
+
+    const strangerSees = await svc.listRequests(undefined, asUser('u_stranger'));
+    expect(strangerSees).toEqual([]);
+
+    // The admin console still sees everything.
+    expect((await svc.listRequests(undefined, ADMIN)).length).toBeGreaterThanOrEqual(2);
+  });
+
+  it('countRequests agrees with the list it paginates', async () => {
+    const engine = makeFakeEngine();
+    const svc = svcFor(engine);
+    await svc.openNodeRequest(openInput(['u9']), CTX);
+    await svc.openNodeRequest(openInput(['u7'], { recordId: 'opp2', record: { id: 'opp2' } }), asUser('u_other'));
+
+    expect(await svc.countRequests(undefined, asUser('u_stranger'))).toBe(0);
+    expect(await svc.countRequests(undefined, asUser('u1'))).toBe(1);
+  });
+
+  it('a write path still echoes back its own result to the user who made it', async () => {
+    const engine = makeFakeEngine();
+    const svc = svcFor(engine);
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+
+    // Approving CLEARS `pending_approvers`, so the approver stops being a
+    // participant the instant their own write lands. The operation authorized
+    // itself; re-gating the echo would turn a successful write into a null
+    // result for the very person who made it.
+    const res = await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9' }, asUser('u9'));
+    expect(res.request).not.toBeNull();
+    expect(res.request.status).toBe('approved');
+  });
+
+  it('a service-to-service write echoes back too (no session at all)', async () => {
+    const engine = makeFakeEngine();
+    const svc = svcFor(engine);
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+
+    // Flow-driven resumes and the SLA sweep carry no user. Since #3800 that is
+    // expressible only as a SYSTEM context — a user-less non-system caller can
+    // no longer act by naming an approver.
+    const res = await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9' }, SYS);
+    expect(res.request).not.toBeNull();
+    expect(res.request.status).toBe('approved');
+  });
+});
+
+// ── The ordering invariant the dead-run sweep rests on (#3456) ─────────
+//
+// `releaseDeadRunRequests` recalls a PENDING request whose owning run has
+// reached a TERMINAL state, on the premise that such a pair can only be an
+// orphan. That premise is not self-evident — it holds only because every
+// in-band transition moves the request OUT of `pending` before it hands the run
+// back. Resume first and a run that finishes promptly afterwards would be
+// indistinguishable from an orphan, so the sweep would cancel a LIVE approval —
+// precisely the one failure mode it is built never to have.
+//
+// Nothing enforces that ordering: it is a convention spread across four public
+// methods and seven resume/cancelRun call sites, any of which a refactor could
+// reorder without a single existing test going red. So pin the invariant
+// itself rather than the call order of any one method — at the instant the run
+// is handed back, no request owned by that run may still be `pending`.
+describe('in-band transitions finalise before they resume (#3456 invariant)', () => {
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let svc: ApprovalService;
+  let n = 0;
+  const baseTime = new Date('2026-01-15T10:00:00Z').getTime();
+  /** One entry per hand-back, with any still-pending requests owned by the run. */
+  let handoffs: Array<{ hook: string; stillPending: string[] }>;
+
+  /** A flow whose approval node declares the `revise` out-edge send-back needs. */
+  const REVISE_FLOW = {
+    name: 'deal_approval',
+    edges: [{ id: 'e_rev', source: 'approve_step', target: 'wait_revision', label: 'revise' }],
+  };
+
+  function recordHandoff(hook: string) {
+    const rows = (engine._tables['sys_approval_request'] ?? []) as any[];
+    handoffs.push({
+      hook,
+      stillPending: rows
+        .filter(r => String(r.flow_run_id ?? '') === 'run_1' && r.status === 'pending')
+        .map(r => String(r.id)),
+    });
+  }
+
+  /** Assert every hand-back this scenario made was clean. */
+  function expectCleanHandoffs() {
+    expect(
+      handoffs.length,
+      'the run was never handed back — this scenario did not exercise the invariant',
+    ).toBeGreaterThan(0);
+    for (const h of handoffs) {
+      expect(
+        h.stillPending,
+        `${h.hook}() handed run_1 back while it still owned a pending request — `
+        + 'the dead-run sweep would treat that as an orphan and cancel a live approval',
+      ).toEqual([]);
+    }
+  }
+
+  beforeEach(async () => {
+    engine = makeFakeEngine();
+    n = 0;
+    handoffs = [];
+    svc = new ApprovalService({ engine: engine as any, clock: { now: () => new Date(baseTime + (n++) * 1000) } });
+    svc.attachAutomation({
+      async resume() { recordHandoff('resume'); },
+      async cancelRun() { recordHandoff('cancelRun'); },
+      async getFlow() { return REVISE_FLOW; },
+    } as any);
+    engine._tables['opportunity'] = [{ id: 'opp1', amount: 100 }];
+  });
+
+  const open = (configExtra: Record<string, any> = {}) =>
+    svc.openNodeRequest(openInput(['u9'], {}, configExtra), CTX);
+
+  it('decide(approve) finalises before resuming', async () => {
+    const req = await open();
+    await svc.decide(req.id, { decision: 'approve', actorId: 'u9' }, SYS);
+    expectCleanHandoffs();
+  });
+
+  it('decide(reject) finalises before resuming', async () => {
+    const req = await open();
+    await svc.decide(req.id, { decision: 'reject', actorId: 'u9' }, SYS);
+    expectCleanHandoffs();
+  });
+
+  it('recall finalises before resuming', async () => {
+    const req = await open();
+    await svc.recall(req.id, { actorId: 'u1' }, CTX);
+    expectCleanHandoffs();
+  });
+
+  it('sendBack finalises before resuming', async () => {
+    const req = await open();
+    await svc.sendBack(req.id, { actorId: 'u9', comment: 'fix the totals' }, asUser('u9'));
+    expectCleanHandoffs();
+  });
+
+  it('sendBack past the revision budget auto-rejects before resuming', async () => {
+    // `maxRevisions: 0` takes the ADR-0044 loop-guard branch on the first
+    // send-back — a separate resume site from the normal path above.
+    const req = await open({ maxRevisions: 0 });
+    const out = await svc.sendBack(req.id, { actorId: 'u9' }, asUser('u9'));
+    expect(out.autoRejected, 'expected the auto-reject branch').toBe(true);
+    expectCleanHandoffs();
+  });
+
+  it('recall inside the revise window cancels the run without a pending request', async () => {
+    const req = await open();
+    await svc.sendBack(req.id, { actorId: 'u9' }, asUser('u9'));
+    handoffs = [];                                   // isolate the recall's own hand-back
+    await svc.recall(req.id, { actorId: 'u1' }, CTX);
+    expect(handoffs.map(h => h.hook)).toContain('cancelRun');
+    expectCleanHandoffs();
+  });
+
+  it('resubmit re-enters the node without leaving the old request pending', async () => {
+    const req = await open();
+    await svc.sendBack(req.id, { actorId: 'u9' }, asUser('u9'));
+    handoffs = [];                                   // isolate the resubmit's own hand-back
+    await svc.resubmit(req.id, { actorId: 'u1' }, CTX);
+    expectCleanHandoffs();
+  });
+});
+
+/**
+ * #3783 — the status mirror names the human who caused the transition.
+ *
+ * The mirror write lands on the CUSTOMER's object, so it is what fires that
+ * object's record-change flows. It has to stay `isSystem` (the record is locked
+ * while its approval is live), but dropping the actor left every one of those
+ * cascades with no trigger user — which #3760 now refuses outright, forcing
+ * "when the invoice is approved, do X" to declare `runAs:'system'`.
+ *
+ * Each case therefore asserts BOTH halves: the elevation survives (or the lock
+ * hook stops mirroring at all) and the identity is present.
+ */
+describe('status mirror identity (#3783)', () => {
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let svc: ApprovalService;
+  let n = 0;
+  const baseTime = new Date('2026-01-15T10:00:00Z').getTime();
+
+  const REVISE_FLOW = {
+    name: 'deal_approval',
+    edges: [{ id: 'e_rev', source: 'approve_step', target: 'wait_revision', label: 'revise' }],
+  };
+
+  /** The context the service presented on the mirror write, or undefined. */
+  const mirrorContext = () =>
+    engine._writes.filter(w => w.object === 'opportunity').at(-1)?.context as any;
+
+  const open = (configExtra: Record<string, any> = {}, ctx: any = CTX) =>
+    svc.openNodeRequest(openInput(['u9'], {}, { approvalStatusField: 'approval_status', ...configExtra }), ctx);
+
+  beforeEach(() => {
+    engine = makeFakeEngine();
+    n = 0;
+    svc = new ApprovalService({ engine: engine as any, clock: { now: () => new Date(baseTime + (n++) * 1000) } });
+    svc.attachAutomation({
+      async resume() {},
+      async cancelRun() {},
+      async getFlow() { return REVISE_FLOW; },
+    } as any);
+    engine._tables['opportunity'] = [{ id: 'opp1', amount: 100 }];
+  });
+
+  it('submit: mirrors as the submitter, still elevated', async () => {
+    await open();
+    expect(mirrorContext()).toMatchObject({ isSystem: true, userId: 'u1' });
+  });
+
+  it('decide: mirrors as the deciding user', async () => {
+    const req = await open();
+    const approver = { ...CTX, userId: 'u9' };
+    await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9' }, approver as any);
+    expect(engine._tables['opportunity'][0].approval_status).toBe('approved');
+    expect(mirrorContext()).toMatchObject({ isSystem: true, userId: 'u9' });
+  });
+
+  it('recall: mirrors as the recalling user', async () => {
+    const req = await open();
+    await svc.recall(req.id, { actorId: 'u1' }, CTX);
+    expect(mirrorContext()).toMatchObject({ isSystem: true, userId: 'u1' });
+  });
+
+  it('sendBack: mirrors as the approver who returned it', async () => {
+    const req = await open();
+    const approver = { ...CTX, userId: 'u9' };
+    await svc.sendBack(req.id, { actorId: 'u9', comment: 'redo the totals' }, approver as any);
+    expect(engine._tables['opportunity'][0].approval_status).toBe('returned');
+    expect(mirrorContext()).toMatchObject({ isSystem: true, userId: 'u9' });
+  });
+
+  it('sendBack past the revision budget: the auto-reject mirror names the approver too', async () => {
+    const req = await open({ maxRevisions: 0 });
+    const approver = { ...CTX, userId: 'u9' };
+    const out = await svc.sendBack(req.id, { actorId: 'u9' }, approver as any);
+    expect(out.autoRejected, 'expected the auto-reject branch').toBe(true);
+    expect(engine._tables['opportunity'][0].approval_status).toBe('rejected');
+    expect(mirrorContext()).toMatchObject({ isSystem: true, userId: 'u9' });
+  });
+
+  it('action link: mirrors as the approver the token is bound to', async () => {
+    // ADR-0043 email approval — no session at all, but the single-use hashed
+    // token names exactly one approver, and `resolveActionToken` has just
+    // re-checked they still hold a pending slot. That IS an authenticated act.
+    const req = await open();
+    const { approve } = await svc.issueActionTokens(req.id, 'u9');
+    expect(await svc.redeemActionToken(approve)).toMatchObject({ ok: true });
+    expect(mirrorContext()).toMatchObject({ isSystem: true, userId: 'u9' });
+  });
+
+  it('never takes the identity from the caller-supplied actorId', async () => {
+    // `actorId` arrives in the REST body (`body.actorId ?? context.userId`).
+    // #3783 kept it out of the mirror identity; #3800 then stopped it from
+    // reaching the slate check too, so borrowing a slot holder's identity now
+    // fails outright rather than merely mislabelling the write. The mirror is
+    // the second line here, not the first — assert both, so neither can regress
+    // silently behind the other.
+    const req = await open();
+    const someoneElse = { ...CTX, userId: 'intruder' };
+    await expect(
+      svc.decideNode(req.id, { decision: 'approve', actorId: 'u9' }, someoneElse as any),
+    ).rejects.toThrow(/FORBIDDEN/);
+    expect(engine._tables['opportunity'][0].approval_status).toBe('pending');
+    expect(mirrorContext()?.userId).not.toBe('u9');
+  });
+
+  it('SLA auto-decision: stays user-less — no human did it', async () => {
+    const req = await open({ escalation: { timeoutHours: 1, action: 'auto_approve', notifySubmitter: false } });
+    const raw = engine._tables['sys_approval_request'].find((r: any) => r.id === req.id)!;
+    raw.created_at = new Date(baseTime - 3 * 60 * 60 * 1000).toISOString();
+    await svc.runEscalations();
+    expect(engine._tables['opportunity'][0].approval_status).toBe('approved');
+    // `system:sla` is a reserved audit actor, not a user — it must never be
+    // presented as one. The cascade stays user-less on purpose; a flow that
+    // wants to react to an SLA auto-decision declares runAs:'system'.
+    expect(mirrorContext()?.userId).toBeUndefined();
+    expect(mirrorContext()).toMatchObject({ isSystem: true });
+  });
+
+  it('dead-run sweep: stays user-less — no human did it', async () => {
+    await open();
+    svc.attachAutomation({ getRun: async () => ({ status: 'failed' }) } as any);
+    expect(await svc.releaseDeadRunRequests()).toMatchObject({ released: 1 });
+    expect(engine._tables['opportunity'][0].approval_status).toBe('recalled');
+    expect(mirrorContext()?.userId).toBeUndefined();
+    expect(mirrorContext()).toMatchObject({ isSystem: true });
+  });
+
+  it('carries the actor WITHOUT org-scoping the write', async () => {
+    // `tenantId` on an ExecutionContext is a driver-scoping knob, not
+    // attribution: ObjectQL turns it into a tenant predicate on the update. The
+    // submitter's org (`t1` on CTX) must therefore not ride along, or the mirror
+    // would silently no-op on a record whose org differs from the request's.
+    await open();
+    expect(mirrorContext()).not.toHaveProperty('tenantId');
+    expect(mirrorContext()).not.toHaveProperty('organizationId');
   });
 });