@objectstack/plugin-approvals 16.1.0 → 17.0.0-rc.0

package/src/approval-service.ts

@@ -3,13 +3,24 @@
 import { createHash, randomBytes } from 'node:crypto';
 import {
   APPROVAL_BRANCH_LABELS,
+  approverTypeIsOrgScoped,
   canonicalApproverType,
+  normalizeDecisionOutputs,
   type ApprovalNodeConfig,
 } from '@objectstack/spec/automation';
+import { ExpressionEngine, collectCelRootIdentifiers } from '@objectstack/formula';
+import {
+  ADMIN_FULL_ACCESS,
+  ORGANIZATION_ADMIN_GRANTS,
+  BUILTIN_IDENTITY_PLATFORM_ADMIN,
+  BUILTIN_IDENTITY_ORG_OWNER,
+  BUILTIN_IDENTITY_ORG_ADMIN,
+} from '@objectstack/spec/identity';
 import type {
   IApprovalService,
   ApprovalRequestRow,
   ApprovalActionRow,
+  ApprovalActionAttachment,
   ApprovalDecisionInput,
   ApprovalDecisionResult,
   ApprovalRecallInput,
@@ -21,7 +32,15 @@ import type {
   ApprovalStatus,
   SharingExecutionContext,
 } from '@objectstack/spec/contracts';
+import { RESUME_AUTHORITY_SERVICE } from '@objectstack/spec/contracts';
+import { isFileIdToken } from '@objectstack/spec/data';
 import { isGrantActive } from '@objectstack/core';
+import {
+  filterApproversWhoCanRead,
+  resolveApproverDirectoryOrg,
+  type ApproverOrgScopeDeps,
+  type ApproverOrgScopeEngine,
+} from './approver-org-scope.js';
 
 /**
  * Node-era approval runtime (ADR-0019).
@@ -53,7 +72,18 @@ export interface ApprovalClock { now(): Date }
  * plugin when an automation engine is present (see `approval-node.ts`).
  */
 export interface ApprovalResumeSurface {
-  resume?(runId: string, signal?: { output?: Record<string, unknown>; branchLabel?: string }): Promise<unknown>;
+  resume?(runId: string, signal?: {
+    output?: Record<string, unknown>;
+    branchLabel?: string;
+    /**
+     * #3801: the engine refuses a resume of an `approval` suspension unless
+     * the signal carries this marker — the proof that the resume is the tail
+     * of a decision THIS service already authorized and recorded, not a raw
+     * `POST …/runs/:runId/resume` around it. Every resume below stamps it via
+     * {@link ApprovalService.serviceResume}.
+     */
+    [RESUME_AUTHORITY_SERVICE]?: true;
+  }): Promise<unknown>;
   /** Flow definition lookup, used to derive step-progress display data. */
   getFlow?(name: string): Promise<any | null>;
   /**
@@ -62,6 +92,19 @@ export interface ApprovalResumeSurface {
    * which has no reject edge to resume down.
    */
   cancelRun?(runId: string, reason?: string): Promise<unknown>;
+  /**
+   * Look up a run's recorded outcome (#3456). Used by the dead-run sweep to ask
+   * "is the run behind this pending request still alive?".
+   *
+   * The contract that makes the sweep safe is the answer for a run that is
+   * merely SUSPENDED (the normal state of a run waiting on an approval): the
+   * engine writes no execution-log entry until a run reaches a terminal state,
+   * so a suspended run resolves to `null`, never to a status. The sweep
+   * therefore acts only on an explicit terminal-failure status and treats
+   * `null` — unknown run, evicted log, no durable store, no automation engine —
+   * as "still alive".
+   */
+  getRun?(runId: string): Promise<{ status?: string } | null>;
 }
 
 /**
@@ -90,6 +133,24 @@ export const ESCALATION_JOB_NAME = 'approvals-sla-escalation';
 export const ESCALATION_SCAN_INTERVAL_MS = 5 * 60 * 1000;
 /** Reserved actor id for machine decisions made by the SLA scanner. */
 export const SLA_ACTOR_ID = 'system:sla';
+/** Reserved actor id for requests abandoned because their run died (#3456). */
+export const DEAD_RUN_ACTOR_ID = 'system:dead-run';
+/**
+ * Run statuses that mean "this run will never resume", so a request still
+ * pending on it is orphaned (#3456). A CLOSED set, deliberately: the dead-run
+ * sweep treats every other answer — `paused` (a run waiting on its approval,
+ * the normal case), `running`, an unknown status, or no answer at all — as
+ * alive, so an unrecognised state can never cost someone a live approval.
+ *
+ * `completed` belongs here with the failure states. The approval node only
+ * writes a request row on the path where it also suspends the run, and every
+ * in-band transition (decide / recall / send-back / resubmit) finalises the
+ * request *before* it resumes the run — so a completed run with a still-pending
+ * request means the run was resumed out of band and left the request behind.
+ */
+const TERMINAL_RUN_STATUSES: ReadonlySet<string> = new Set([
+  'completed', 'failed', 'cancelled', 'timed_out',
+]);
 
 /** Default lifetime of an actionable-link token (ADR-0043). */
 export const ACTION_TOKEN_TTL_MS = 72 * 60 * 60 * 1000;
@@ -101,6 +162,33 @@ export type ActionTokenOutcome =
 
 const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;
 
+/**
+ * Who is acting, for the purpose of a data write made on their behalf (#3783).
+ *
+ * Reads the AUTHENTICATED principal off the execution context — deliberately not
+ * `input.actorId`. When this was written the two could still disagree: every
+ * public entrypoint took `actorId` from the request body (`body.actorId ??
+ * context.userId`, see the REST approval routes) and the service only checked
+ * that it named a pending approver, never that it was the caller. That was
+ * called tolerable on an audit row — but the same unchecked value was the
+ * authorization key, so it was in fact impersonation, and #3800 closed it:
+ * {@link ApprovalService.resolveActor} now pins the actor to an identity the
+ * server can prove belongs to the caller. This helper stays the separate,
+ * stricter answer for a DATA WRITE, which wants the bare human id and never a
+ * `type:value` slot literal or a machine sentinel.
+ *
+ * A caller holding a trustworthy actor with no session behind it — the ADR-0043
+ * action link, whose token cryptographically binds exactly one approver — puts
+ * that actor ON the context instead of relying on this.
+ *
+ * `null` for a machine caller (the SLA sweep passes {@link SYSTEM_CTX}), so a
+ * reserved sentinel like {@link SLA_ACTOR_ID} can never surface as a `userId`.
+ */
+function actingUserId(context: SharingExecutionContext | undefined): string | null {
+  const userId = (context as { userId?: unknown } | undefined)?.userId;
+  return typeof userId === 'string' && userId ? userId : null;
+}
+
 /**
  * Max hops when following an OOO delegation chain (#1322 M1): A out → B, B out
  * → C, … Bounds the walk so a mis-configured chain can't loop or resolve
@@ -108,6 +196,21 @@ const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;
  */
 const OOO_MAX_CHAIN = 8;
 
+/**
+ * Approver types resolved by QUERYING a graph rather than by taking `value`
+ * literally (#3807). Each can legitimately come back empty — an unstaffed
+ * position, an emptied team, a mis-pointed unit — and the caller then falls
+ * back to a `type:value` literal that no user can act on. They are listed here
+ * so that dead end gets one warning instead of passing in silence.
+ *
+ * `user` / `field` are deliberately absent: they resolve to the id they were
+ * given without a lookup, so there is no "expanded to nobody" state to report.
+ * `business_unit` / `bu` are the accepted dialects of `department`.
+ */
+const GRAPH_APPROVER_TYPES: ReadonlySet<string> = new Set([
+  'team', 'department', 'business_unit', 'bu', 'position', 'org_membership_level', 'manager',
+]);
+
 /** One OOO delegation hop applied while resolving an approver (#1322 M1/M4). */
 interface OooSubstitution {
   /** The approver who was skipped (out of office). */
@@ -118,6 +221,43 @@ interface OooSubstitution {
   reason: string | null;
 }
 
+/**
+ * The CLOSED set of namespace roots an `expression` approver may reference
+ * (#3447 P2). Three explicit times/sources, no `record`, no bare field names:
+ * `record` means "the record at event time" everywhere else on the platform
+ * (flow conditions: trigger snapshot; hooks: the write payload), so binding it
+ * here — to either time — would silently alias one meaning to the other. The
+ * runtime CEL env treats unknown roots as `dyn` (→ `null` → an empty slate),
+ * so out-of-contract roots MUST be rejected before evaluation; both this
+ * pre-check and the lint rule read the roots via
+ * {@link collectCelRootIdentifiers} so they can never drift.
+ */
+const APPROVER_EXPRESSION_ROOTS = new Set(['current', 'trigger', 'vars']);
+
+/**
+ * Evaluation context an approval node hands to `expression` approvers
+ * (#3447 P2). `current` (the live record) is supplied by openNodeRequest's
+ * re-read; these two carry the other roots.
+ */
+export interface ApproverExpressionContext {
+  /** Submit-time snapshot (the flow's `$record`) — bound as `trigger.*`. */
+  trigger?: Record<string, unknown> | null;
+  /** Flow variables at node entry (nested by dotted key) — bound as `vars.*`. */
+  vars?: Record<string, unknown> | null;
+}
+
+/**
+ * Non-request outcome of {@link ApprovalService.openNodeRequest}: the node
+ * resolved an empty approver slate and its `onEmptyApprovers: 'auto_approve'`
+ * policy waved it through (#3447 P2). No `sys_approval_request` row exists —
+ * nobody was ever asked — so the node must complete down its `approve` edge
+ * instead of suspending.
+ */
+export interface ApprovalNodeAutoOutcome {
+  autoApproved: true;
+  reason: 'empty_approvers';
+}
+
 function uid(prefix: string): string {
   const g: any = globalThis as any;
   if (g.crypto?.randomUUID) return `${prefix}_${g.crypto.randomUUID()}`;
@@ -184,6 +324,27 @@ function rowFromRequest(row: any): ApprovalRequestRow {
     sla_due_at: slaDueAt(row.created_at, cfg),
     // ADR-0044 revision round (rides the config snapshot; absent ⇒ round 1).
     round: typeof cfg?.__round === 'number' ? cfg.__round : undefined,
+    // objectui#2902: the node's record-lock policy. The lock is enforced
+    // server-side in `lifecycle-hooks.ts` off THIS SAME snapshot with the
+    // same `!== false` default, so the flag a client renders and the rule the
+    // server applies can never drift. Without it a console can only see
+    // "a pending request exists" and has to assume the record is locked —
+    // which mislabels every `lockRecord: false` node as locked and hides an
+    // edit the server would have accepted.
+    lock_record: cfg?.lockRecord !== false,
+    // #3447 P2: the node's author-declared decision outputs, surfaced so a
+    // decision UI can render input fields for them and POST `outputs` on
+    // approve/reject. Per-request (each node declares its own), which is why
+    // this rides the row instead of the static action params. Two shapes for
+    // version skew: `decision_outputs` stays the bare KEY list an older
+    // console renders as text inputs; `decision_output_defs` carries the
+    // normalized typed declarations a picker-aware console prefers.
+    ...(() => {
+      const defs = normalizeDecisionOutputs(cfg?.decisionOutputs);
+      return defs.length
+        ? { decision_outputs: defs.map(d => d.key), decision_output_defs: defs }
+        : {};
+    })(),
   } as any;
 }
 
@@ -196,7 +357,58 @@ function slaDueAt(createdAt: unknown, cfg: any): string | undefined {
   return new Date(t + hours * 3600_000).toISOString();
 }
 
+/**
+ * Normalize one raw `attachments` entry into an {@link ApprovalActionAttachment}.
+ *
+ * `sys_approval_action.attachments` is a `Field.file` (multiple), so the column
+ * **stores opaque `sys_file` ids** — that is the stored form of every media
+ * field (ADR-0104 D3). What arrives here is whichever of three forms the read
+ * path produced:
+ *
+ *  1. the **expanded** `{ id, name, size, mimeType, url }` the ObjectQL read
+ *     path resolves a stored id into — the normal case;
+ *  2. a **bare id**, when there was nothing to expand it into (storage service
+ *     absent, file not committed);
+ *  3. a **legacy inline blob** (`{ file_id, name, mime_type, url, … }`) written
+ *     before file-as-reference, until the backfill converts it.
+ *
+ * The original mapping did `String(entry)`, which turned form 1 into the
+ * literal `"[object Object]"` — so the inbox timeline showed a nameless,
+ * un-openable attachment chip (#3266 follow-up; caught by browser verification).
+ *
+ * Note the casing: the expanded form carries `mimeType`, the legacy blob
+ * `mime_type`. Both are accepted for the duration of the migration window.
+ */
+function normalizeActionAttachment(entry: any): ApprovalActionAttachment | undefined {
+  if (entry == null) return undefined;
+  // Form 2 — a bare reference. `isFileIdToken` is the platform's single arbiter
+  // of "is this string an opaque file id, or a URL?", shared with the engine's
+  // read resolver, so the two cannot disagree about what counts as an id.
+  if (typeof entry === 'string') {
+    const id = entry.trim();
+    if (!id) return undefined;
+    return isFileIdToken(id) ? { id } : { id, url: id };
+  }
+  if (typeof entry === 'object') {
+    // Forms 1 and 3 — `file_id` is the legacy blob's key for the same thing.
+    const id = entry.id ?? entry.file_id;
+    if (id == null || String(id) === '') return undefined;
+    const mimeType = entry.mimeType ?? entry.mime_type;
+    return {
+      id: String(id),
+      name: typeof entry.name === 'string' ? entry.name : undefined,
+      url: typeof entry.url === 'string' ? entry.url : undefined,
+      mimeType: typeof mimeType === 'string' ? mimeType : undefined,
+      size: typeof entry.size === 'number' ? entry.size : undefined,
+    };
+  }
+  return undefined;
+}
+
 function rowFromAction(row: any): ApprovalActionRow {
+  const attachments = Array.isArray(row.attachments)
+    ? row.attachments.map(normalizeActionAttachment).filter((a: ApprovalActionAttachment | undefined): a is ApprovalActionAttachment => !!a)
+    : [];
   return {
     id: String(row.id),
     request_id: String(row.request_id),
@@ -205,10 +417,9 @@ function rowFromAction(row: any): ApprovalActionRow {
     action: row.action,
     actor_id: row.actor_id ?? undefined,
     comment: row.comment ?? undefined,
-    // Decision attachments (#3266). The column shipped in #3268 but this
-    // contract mapping didn't — the raw engine row carried the fileIds while
-    // every consumer of listActions saw none (caught by browser verification).
-    attachments: Array.isArray(row.attachments) && row.attachments.length ? row.attachments.map(String) : undefined,
+    // Decision attachments (#3266): rich descriptors carrying the display name +
+    // download URL, so consumers label/open them without reading `sys_file`.
+    attachments: attachments.length ? attachments : undefined,
     created_at: row.created_at ?? undefined,
   };
 }
@@ -232,6 +443,14 @@ export interface ApprovalServiceOptions {
    * the Console and IM webviews; outbound email needs the absolute form.
    */
   publicBaseUrl?: string;
+  /**
+   * [ADR-0105 D9] The tenancy posture in force. Cross-organization approver
+   * targeting is a `group`-posture capability; the resolver refuses the
+   * declaration under any other posture rather than silently ignoring it.
+   * Absent (a stack booted with no tenancy service) reads as "unknown" and the
+   * guard stands down.
+   */
+  tenancyPosture?: () => string | undefined;
 }
 
 export class ApprovalService implements IApprovalService {
@@ -241,6 +460,7 @@ export class ApprovalService implements IApprovalService {
   private automation?: ApprovalResumeSurface;
   private messaging?: ApprovalMessagingSurface;
   private publicBaseUrl: string;
+  private tenancyPosture?: () => string | undefined;
 
   constructor(opts: ApprovalServiceOptions) {
     this.engine = opts.engine;
@@ -249,6 +469,36 @@ export class ApprovalService implements IApprovalService {
     this.automation = opts.automation;
     this.messaging = opts.messaging;
     this.publicBaseUrl = (opts.publicBaseUrl ?? '').replace(/\/$/, '');
+    this.tenancyPosture = opts.tenancyPosture;
+  }
+
+  /** Attach (or replace) the ADR-0105 D9 posture provider. */
+  attachTenancyPosture(provider: () => string | undefined): void {
+    this.tenancyPosture = provider;
+  }
+
+  /** Deps bundle for the ADR-0105 D9 org-scope helpers. */
+  private get orgScopeDeps(): ApproverOrgScopeDeps {
+    return {
+      engine: this.engine as unknown as ApproverOrgScopeEngine,
+      posture: this.tenancyPosture,
+      logger: this.logger,
+    };
+  }
+
+  /**
+   * [ADR-0105 D9] Which organization's directory resolves ONE approver spec.
+   * Absent declaration ⇒ the request's own organization (unchanged, no reads).
+   */
+  private async directoryOrgFor(a: any, requestOrgId: string | null | undefined): Promise<string | null | undefined> {
+    const rawType = String(a?.type ?? '');
+    return resolveApproverDirectoryOrg(
+      this.orgScopeDeps,
+      a?.organization,
+      requestOrgId,
+      rawType,
+      approverTypeIsOrgScoped(rawType),
+    );
   }
 
   /** Attach (or replace) the automation surface used to resume flow runs. */
@@ -307,6 +557,120 @@ export class ApprovalService implements IApprovalService {
     return raw;
   }
 
+  /**
+   * Privileged-override gate (#3424). A stuck approval — one routed to a
+   * position/team with no holders (so its `pending_approvers` is only an
+   * unresolvable `type:value` literal) or to approvers who have all since left —
+   * is otherwise undecidable: no concrete user is in the slate, so every normal
+   * `decide` / `reassign` / `recall` is `FORBIDDEN` and (with `lockRecord`) the
+   * record stays locked forever with no in-product recovery. A platform or
+   * tenant admin — the same posture the engine's superuser bypass already
+   * trusts — may always act on a PENDING request to release it: approve, reject,
+   * reassign it to a real approver, or recall it.
+   *
+   * A platform admin crosses the tenant wall (matching the unscoped
+   * `admin_full_access` evidence); a tenant admin may override only within their
+   * own org (or an org-less request). A system context always passes. Signals are
+   * read defensively off the resolved exec context (`permissions` / `positions` /
+   * the derived `posture`, ADR-0095) so any transport that resolves through the
+   * shared authz resolver lights this up without extra wiring.
+   */
+  private isOverrideActor(context: SharingExecutionContext, requestOrg?: string | null): boolean {
+    if (!context) return false;
+    if (context.isSystem) return true;
+    const perms = Array.isArray(context.permissions) ? context.permissions : [];
+    const positions = Array.isArray(context.positions) ? context.positions : [];
+    const posture = (context as any).posture;
+    const isPlatformAdmin = posture === 'PLATFORM_ADMIN'
+      || perms.includes(ADMIN_FULL_ACCESS)
+      || positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN);
+    if (isPlatformAdmin) return true;
+    const isTenantAdmin = posture === 'TENANT_ADMIN'
+      || ORGANIZATION_ADMIN_GRANTS.some((n) => perms.includes(n))
+      || positions.includes(BUILTIN_IDENTITY_ORG_OWNER)
+      || positions.includes(BUILTIN_IDENTITY_ORG_ADMIN);
+    if (!isTenantAdmin) return false;
+    // A tenant admin's authority stops at their own org; a null-org request is
+    // global and any admin may release it.
+    const actorTenant = (context as any).tenantId ?? (context as any).organizationId ?? null;
+    return requestOrg == null || (actorTenant != null && String(requestOrg) === String(actorTenant));
+  }
+
+  /**
+   * Pin the acting identity to the AUTHENTICATED CALLER (#3800).
+   *
+   * Every public entrypoint accepts an `actorId`, and the REST routes fill it
+   * from `body.actorId ?? body.actor_id ?? context.userId` — so before this
+   * gate the body won. The authorization checks downstream all read that value
+   * (`pending_approvers.includes(input.actorId)`, `submitter_id === actorId`),
+   * which made the body-supplied string not merely the audit label but the key
+   * that opens the door: any authenticated user could name a pending approver
+   * and have that approver's decision recorded and the owning flow resumed.
+   * #3783 drew this line for the data-write identity ({@link actingUserId});
+   * this closes the authorization half.
+   *
+   * A caller may still name an identity OTHER than their bare user id, because
+   * a slot legitimately can be keyed by one: `resolveApproverSpec` stores the
+   * `type:value` literal when a graph lookup yields nothing, and an author may
+   * write an email as a `user` approver. So the rule is not "actorId must equal
+   * userId" — it is **"actorId must be an identity the SERVER can prove belongs
+   * to the caller"**. Anything else is `FORBIDDEN`.
+   *
+   * A system context is exempt and keeps its explicit actor: the SLA sweep
+   * passes the reserved {@link SLA_ACTOR_ID} sentinel, and the ADR-0043 action
+   * link passes the approver its single-use token is cryptographically bound to
+   * (having also put them on the context). Those are the only two callers that
+   * hold a trustworthy actor with no session behind them.
+   *
+   * A caller with NO identity at all cannot act. That case is reachable: the
+   * REST anonymous-deny only fires when `api.requireAuth` is set, so without it
+   * an anonymous request previously decided approvals outright by naming one.
+   */
+  private async resolveActor(
+    actorId: string | undefined,
+    context: SharingExecutionContext,
+  ): Promise<string> {
+    // The machine callers — their actor is server-minted, not caller-supplied.
+    if (context?.isSystem) {
+      if (!actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+      return actorId;
+    }
+    const uid = actingUserId(context);
+    if (!uid) {
+      throw new Error('FORBIDDEN: an approval action requires an authenticated caller');
+    }
+    // The common case: no actor named, or the caller named themselves.
+    if (!actorId || String(actorId) === uid) return uid;
+
+    // Named something else — allow it ONLY if the server can prove the caller
+    // holds that identity. `positions` is resolved by the shared authz resolver
+    // (never client-supplied); `role:` is the ADR-0090 D3 deprecated spelling
+    // that 15.x-era slots and the Console's own identity list still carry.
+    const named = String(actorId);
+    for (const position of context.positions ?? []) {
+      if (named === `position:${position}` || named === `role:${position}`) return named;
+    }
+    // Email last — it costs a read, so only when nothing cheaper matched.
+    if (named.includes('@') && await this.callerHasEmail(uid, named)) return named;
+
+    throw new Error(
+      `FORBIDDEN: cannot act as '${named}' — an approval action is recorded against the authenticated caller`,
+    );
+  }
+
+  /** Does `userId`'s own account carry `email`? (Slots keyed by email, #3800.) */
+  private async callerHasEmail(userId: string, email: string): Promise<boolean> {
+    try {
+      const rows = await this.engine.find('sys_user', {
+        where: { id: userId }, limit: 1, context: SYSTEM_CTX,
+      });
+      const row: any = Array.isArray(rows) ? rows[0] : null;
+      return !!row?.email && String(row.email).toLowerCase() === email.toLowerCase();
+    } catch {
+      return false;
+    }
+  }
+
   /**
    * Expand the approvers on an Approval node into user IDs by querying the
    * graph tables for `team:` / `department:` / `position:` /
@@ -344,7 +708,19 @@ export class ApprovalService implements IApprovalService {
     step: any,
     record?: any,
     organizationId?: string | null,
-    opts?: { now?: number; substitutions?: OooSubstitution[]; groups?: Record<string, string[]> },
+    opts?: {
+      now?: number;
+      substitutions?: OooSubstitution[];
+      groups?: Record<string, string[]>;
+      /** #3447 P2: `trigger`/`vars` roots for `expression` approvers. */
+      exprCtx?: ApproverExpressionContext;
+      /**
+       * #3447 P2 audit collector: what each dynamic spec resolved FROM (the
+       * live field value / the expression's intermediate values), snapshotted
+       * as `__resolvedFrom` so "why these people" stays answerable later.
+       */
+      resolvedFrom?: Record<string, unknown>;
+    },
   ): Promise<string[]> {
     if (!step || !Array.isArray(step.approvers)) return [];
     const now = opts?.now ?? this.clock.now().getTime();
@@ -353,11 +729,34 @@ export class ApprovalService implements IApprovalService {
     for (let idx = 0; idx < specs.length; idx++) {
       const a = specs[idx];
       if (!a) continue;
-      const ids = await this.resolveApproverSpec(a, record, organizationId, now, opts?.substitutions);
-      // per_group (#3266): tag each resolved id with this spec's group. An
-      // approver without an explicit `group` forms its own group keyed by
-      // position, so a plain per-approver list still behaves predictably.
+      // Approvers without an explicit `group` each form their own group keyed
+      // by position (#3266), so a plain per-approver list behaves predictably.
       const groupKey = a.group != null && String(a.group) !== '' ? String(a.group) : `#${idx}`;
+
+      // #3447 P2: `expression` approvers resolve OUTSIDE resolveApproverSpec —
+      // a graph-expanded expression (resolveAs: department/…) must key each
+      // intermediate value as its own per_group group, which the flat string[]
+      // contract of resolveApproverSpec cannot carry.
+      if (canonicalApproverType(String(a.type)) === 'expression') {
+        const resolved = await this.resolveExpressionApprovers(
+          a, record, organizationId, now, opts?.substitutions, opts?.exprCtx,
+        );
+        if (opts?.resolvedFrom) opts.resolvedFrom[`expression#${idx}`] = resolved.raw;
+        for (const entry of resolved.slots) {
+          if (!entry.id) continue;
+          out.push(entry.id);
+          if (opts?.groups) {
+            (opts.groups[entry.id] ??= []).push(entry.subGroup ? `${groupKey}:${entry.subGroup}` : groupKey);
+          }
+        }
+        continue;
+      }
+
+      if (opts?.resolvedFrom && canonicalApproverType(String(a.type)) === 'field' && a.value != null) {
+        opts.resolvedFrom[`field:${a.value}`] = (record as any)?.[a.value] ?? null;
+      }
+      const ids = await this.resolveApproverSpec(a, record, organizationId, now, opts?.substitutions);
+      // per_group (#3266): tag each resolved id with this spec's group.
       for (const u of ids) {
         if (!u) continue;
         out.push(u);
@@ -393,24 +792,65 @@ export class ApprovalService implements IApprovalService {
         { deprecated: a.type, canonical: type },
       );
     }
+    // [ADR-0105 D9] WHERE this approver is looked up — the request's own
+    // organization unless the spec targets another one in the same group.
+    //
+    // Resolved HERE, above the `user` / `field` / `manager` early returns,
+    // because refusing a declaration on a directory-less type is one of the
+    // things this resolution DOES (those types name a person outright, so
+    // `organization` on them cannot narrow anything and an author who wrote it
+    // misunderstood the field). Resolving it after those returns made the
+    // refusal unreachable and the declaration silently inert — exactly the
+    // "ignored, not refused" behaviour ADR-0105 D9 rules out, and what the
+    // cloud group-posture dogfood caught.
+    //
+    // Costs nothing on the overwhelmingly common path: with no `organization`
+    // declared, the resolver returns the request org without reading anything.
+    const directoryOrg = await this.directoryOrgFor(a, organizationId);
+    const crossOrg = directoryOrg !== organizationId;
+
     if (type === 'user') {
       return this.applyOooDelegation(String(a.value), now, organizationId, substitutions);
     }
     if (type === 'field' && record) {
-      return this.applyOooDelegation(String((record as any)[a.value] ?? ''), now, organizationId, substitutions);
+      // #3447: a record field can name MANY approvers — a multi-select user
+      // field arrives as an array (or a legacy CSV string). Fan each out into
+      // its own slot and OOO-substitute per person; collapsing to `String(...)`
+      // (→ `'u1,u2'`) would mint one bogus approver id and skip every delegate.
+      const out: string[] = [];
+      for (const id of csvSplit((record as any)[a.value])) {
+        out.push(...await this.applyOooDelegation(id, now, organizationId, substitutions));
+      }
+      return out;
     }
+    // `directoryOrg` / `crossOrg` were resolved at the TOP of this method, so
+    // the refusal reaches directory-less types too. Resolution failures
+    // propagate: they are routing bugs, and that call sits OUTSIDE the
+    // swallowing try below on purpose (see the catch's comment).
+    //
+    // A cross-org slate is filtered to the people who can actually READ the
+    // request (D2 union); same-org routing is untouched and does no extra read.
+    const bounded = async (users: string[]): Promise<string[]> => (
+      crossOrg
+        ? filterApproversWhoCanRead(this.orgScopeDeps, users, organizationId, {
+          approverType: type, value: a.value != null ? String(a.value) : undefined,
+          directoryOrgId: directoryOrg,
+        })
+        : users
+    );
+
     try {
       if (type === 'team') {
         const users = await this.expandTeamUsers(String(a.value));
         if (users.length) return users;
       } else if (type === 'department' || type === 'business_unit' || type === 'bu') {
-        const users = await this.expandBusinessUnitUsers(String(a.value), organizationId);
+        const users = await bounded(await this.expandBusinessUnitUsers(String(a.value), directoryOrg));
         if (users.length) return users;
       } else if (type === 'position') {
-        const users = await this.expandPositionUsers(String(a.value), organizationId);
+        const users = await bounded(await this.expandPositionUsers(String(a.value), directoryOrg));
         if (users.length) return users;
       } else if (type === 'org_membership_level') {
-        const users = await this.expandMembershipTierUsers(String(a.value), organizationId);
+        const users = await bounded(await this.expandMembershipTierUsers(String(a.value), directoryOrg));
         if (users.length) return users;
       } else if (type === 'manager' && record) {
         const subject = (record as any)[a.value] ?? (record as any).owner_id;
@@ -419,10 +859,176 @@ export class ApprovalService implements IApprovalService {
           if (mgr) return this.applyOooDelegation(mgr, now, organizationId, substitutions);
         }
       }
-    } catch { /* fall through */ }
+    } catch { /* a directory lookup failed → fall through to the literal slot */ }
+    // #3508: `queue` is declared-but-unenforced — there is no queue branch
+    // above, so a queue approver always lands here and the `queue:<id>` slot
+    // routes to nobody. The spec marks it non-authorable
+    // (NON_AUTHORABLE_APPROVER_TYPES) so designers stop offering it; warn for
+    // the stored flows that still carry one, so the silent dead slot is at
+    // least visible to operators.
+    if (type === 'queue') {
+      this.logger?.warn?.(
+        `[approvals] approver type 'queue' is not implemented — the slot resolves to nobody (#3508)`,
+        { value: a.value },
+      );
+    } else if (GRAPH_APPROVER_TYPES.has(type)) {
+      // #3807 follow-up — every OTHER way to land here is a graph type whose
+      // lookup produced nobody, and the literal below is a slot no user can
+      // ever act on. That silence is what let #3807 hide: a `department`
+      // approver pointing at a seeded (env-wide) unit resolved to
+      // `department:<id>` on every request, the request opened with an empty
+      // slate, and nothing in the logs said so — the first symptom was a
+      // permanently stuck approval (#3424). The fallback itself stays (a
+      // literal keeps 15.x slots and substring fixtures working); it just
+      // stops being invisible.
+      this.logger?.warn?.(
+        `[approvals] approver '${type}:${a.value}' expanded to nobody — the slot routes to no one `
+        + `and the request cannot advance until someone is added or the approver is re-pointed (#3807)`,
+        { type, value: a.value, organizationId: organizationId ?? null },
+      );
+    }
     return [`${a.type}:${a.value}`];
   }
 
+  /**
+   * Resolve an `expression` approver (#3447 P2): evaluate its CEL source at
+   * node entry against the three explicit roots — `current` (live record),
+   * `trigger` (submit snapshot), `vars` (flow variables) — then expand the
+   * result into people per `resolveAs`.
+   *
+   * Every failure here THROWS (config/parse errors as `VALIDATION_FAILED`,
+   * evaluation faults as `EXPRESSION_FAILED`) so the approval node fails
+   * loudly instead of opening a request routed to nobody — an approver
+   * expression that cannot run is a routing bug, never "condition not met".
+   * Error messages carry the correct spelling because their primary reader is
+   * the AI author fixing the flow on the next validate pass.
+   *
+   * Returns `slots` (approver id + optional per_group sub-key) and `raw` (the
+   * expression's own values, pre-expansion) for the `__resolvedFrom` audit.
+   */
+  private async resolveExpressionApprovers(
+    a: any,
+    liveRecord: any,
+    organizationId: string | null | undefined,
+    now: number,
+    substitutions?: OooSubstitution[],
+    exprCtx?: ApproverExpressionContext,
+  ): Promise<{ slots: Array<{ id: string; subGroup?: string }>; raw: string[] }> {
+    const source = String(a.value ?? '').trim();
+    if (!source) {
+      throw new Error('VALIDATION_FAILED: expression approver has an empty expression');
+    }
+
+    // Closed-root pre-check. The runtime env resolves ANY unknown root as dyn →
+    // null, so `record.x` / a bare field would silently yield an empty slate;
+    // reject it here with the correct spelling instead.
+    const parsed = collectCelRootIdentifiers(source);
+    if (!parsed.ok) {
+      throw new Error(`VALIDATION_FAILED: expression approver does not parse: ${parsed.error} — source: \`${source}\``);
+    }
+    const illegal = parsed.roots.filter(r => !APPROVER_EXPRESSION_ROOTS.has(r));
+    if (illegal.length) {
+      const hint = illegal.includes('record') || illegal.includes('previous')
+        ? `\`record\`/\`previous\` are not bound here — write \`current.<field>\` for the record's live state `
+          + `at node entry, or \`trigger.<field>\` for the submit-time snapshot (\`vars.previous\` carries the pre-update row)`
+        : `did you mean \`current.<field>\` (live record), \`trigger.<field>\` (submit snapshot), or \`vars.<name>\` (flow variable)?`;
+      throw new Error(
+        `VALIDATION_FAILED: expression approver references \`${illegal.join('`, `')}\` — `
+        + `only \`current.*\`, \`trigger.*\` and \`vars.*\` are available; ${hint}. Source: \`${source}\``,
+      );
+    }
+
+    const result = ExpressionEngine.evaluate(
+      { dialect: 'cel', source },
+      { extra: { current: liveRecord ?? {}, trigger: exprCtx?.trigger ?? {}, vars: exprCtx?.vars ?? {} } },
+    );
+    if (!result.ok) {
+      throw new Error(
+        `EXPRESSION_FAILED: expression approver failed to evaluate (${result.error.kind}): `
+        + `${result.error.message} — source: \`${source}\``,
+      );
+    }
+
+    // Normalize to a string list: a user-id/CSV string, an array of ids, or
+    // null/empty (an EMPTY slate — legal, handled by onEmptyApprovers). Any
+    // other shape is a config bug, rejected loudly.
+    const value = result.value as unknown;
+    let raw: string[];
+    if (value == null || value === '') {
+      raw = [];
+    } else if (typeof value === 'string') {
+      raw = csvSplit(value);
+    } else if (Array.isArray(value)) {
+      const bad = value.find(v => v != null && typeof v !== 'string' && typeof v !== 'number');
+      if (bad !== undefined) {
+        throw new Error(
+          `EXPRESSION_FAILED: expression approver must yield ids (string / CSV / string array), `
+          + `got an array containing ${typeof bad} — source: \`${source}\``,
+        );
+      }
+      raw = value.map(v => String(v ?? '').trim()).filter(Boolean);
+    } else {
+      throw new Error(
+        `EXPRESSION_FAILED: expression approver must yield ids (string / CSV / string array), `
+        + `got ${typeof value} — source: \`${source}\``,
+      );
+    }
+
+    // `resolveAs` expansion. `user` (default): each value IS a person —
+    // individually routed, so OOO delegation applies (#1322). Graph kinds
+    // re-expand each value through the same lookups the static types use; a
+    // group still has its other members, so like the static graph types they
+    // are NOT OOO-substituted, and with per_group each intermediate value
+    // forms its own sub-group (one sign-off per returned department). A value
+    // whose expansion is empty keeps a `<kind>:<value>` literal slot — same
+    // unstaffed-target behaviour (and #3424 admin rescue) as the static types.
+    const resolveAs = String(a.resolveAs ?? 'user');
+    if (resolveAs === 'user') {
+      const slots: Array<{ id: string }> = [];
+      for (const id of raw) {
+        for (const routed of await this.applyOooDelegation(id, now, organizationId, substitutions)) {
+          slots.push({ id: routed });
+        }
+      }
+      return { slots, raw };
+    }
+    // [ADR-0105 D9] An expression that re-expands into a graph kind consults the
+    // same org-scoped directories the static types do, so it honours the same
+    // targeting. Resolved once for the whole slate, before the per-value loop —
+    // the declaration is a property of the spec, not of what the CEL returned.
+    const directoryOrg = await this.directoryOrgFor(a, organizationId);
+    const crossOrg = directoryOrg !== organizationId;
+    const slots: Array<{ id: string; subGroup: string }> = [];
+    for (const key of raw) {
+      let users: string[] = [];
+      try {
+        if (resolveAs === 'department') users = await this.expandBusinessUnitUsers(key, directoryOrg);
+        else if (resolveAs === 'position') users = await this.expandPositionUsers(key, directoryOrg);
+        else if (resolveAs === 'team') users = await this.expandTeamUsers(key);
+        else {
+          throw new Error(
+            `VALIDATION_FAILED: expression approver has unknown resolveAs '${resolveAs}' — `
+            + `use 'user', 'department', 'position', or 'team'`,
+          );
+        }
+      } catch (err: any) {
+        if (String(err?.message ?? '').startsWith('VALIDATION_FAILED')) throw err;
+        users = [];
+      }
+      if (crossOrg && users.length) {
+        users = await filterApproversWhoCanRead(this.orgScopeDeps, users, organizationId, {
+          approverType: resolveAs, value: key, directoryOrgId: directoryOrg,
+        });
+      }
+      if (!users.length) {
+        slots.push({ id: `${resolveAs}:${key}`, subGroup: key });
+        continue;
+      }
+      for (const u of users) slots.push({ id: u, subGroup: key });
+    }
+    return { slots, raw };
+  }
+
   /** Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy). */
   private async expandTeamUsers(teamId: string): Promise<string[]> {
     if (!teamId) return [];
@@ -438,15 +1044,41 @@ export class ApprovalService implements IApprovalService {
     return Array.from(new Set((rows ?? []).map((r: any) => String(r.user_id ?? '')).filter(Boolean)));
   }
 
+  /**
+   * Tenant scope for a `sys_business_unit` read that may legitimately be
+   * env-wide (#3807).
+   *
+   * `organization_id = null` on a platform object means "owned by no
+   * organization" — a row written by a seed, the file layer, or bootstrap,
+   * i.e. before (or outside) any org exists. A strict
+   * `organization_id = <request org>` equality made every such row invisible:
+   * the seed check below found nothing, the whole expansion returned `[]`, and
+   * the approver fell back to the dead `department:<id>` literal that routes to
+   * nobody. That is not an edge case — an app's org tree is normally seeded
+   * (a seed cannot know the org id the runtime mints at boot) while the
+   * approval request always carries one, so EVERY department approver a
+   * designer could pick resolved to nobody.
+   *
+   * Widen to "this org ∪ env-wide", the same predicate `sys_metadata`'s
+   * pending-draft listing settled on for the identical reason. Another org's
+   * unit still fails the match, so the wall between two organizations is
+   * unchanged — only rows belonging to no org at all become visible.
+   */
+  private businessUnitOrgScope(
+    filter: Record<string, unknown>,
+    organizationId?: string | null,
+  ): Record<string, unknown> {
+    if (!organizationId) return filter;
+    return { ...filter, $or: [{ organization_id: organizationId }, { organization_id: null }] };
+  }
+
   /** Recursive department — walks `sys_business_unit.parent_business_unit_id`. */
   private async expandBusinessUnitUsers(businessUnitId: string, organizationId?: string | null): Promise<string[]> {
     if (!businessUnitId) return [];
     // Seed sanity check: skip if dept doesn't exist or is inactive within tenant.
     try {
       const seed = await this.engine.find('sys_business_unit', {
-        filter: organizationId
-          ? { id: businessUnitId, organization_id: organizationId }
-          : { id: businessUnitId },
+        filter: this.businessUnitOrgScope({ id: businessUnitId }, organizationId),
         fields: ['id', 'active'],
         limit: 1,
         context: SYSTEM_CTX,
@@ -461,8 +1093,10 @@ export class ApprovalService implements IApprovalService {
       const parent = queue.shift()!;
       let kids: any[] = [];
       try {
-        const filter: any = { parent_business_unit_id: parent, active: { $ne: false } };
-        if (organizationId) filter.organization_id = organizationId;
+        const filter = this.businessUnitOrgScope(
+          { parent_business_unit_id: parent, active: { $ne: false } },
+          organizationId,
+        );
         kids = await this.engine.find('sys_business_unit', { filter, fields: ['id'], limit: 1000, context: SYSTEM_CTX } as any);
       } catch { kids = []; }
       for (const k of kids ?? []) {
@@ -607,15 +1241,94 @@ export class ApprovalService implements IApprovalService {
     return active[0];
   }
 
-  /** Mirror a request status onto a business-object field, if configured. */
-  private async mirrorStatusField(object: string, recordId: string, field: string, status: string): Promise<void> {
+  /**
+   * Mirror a request status onto a business-object field, if configured.
+   *
+   * **Elevated, but not anonymous (#3783).** The write stays `isSystem`: the
+   * record is normally LOCKED while its approval is live and the submitter
+   * cannot edit it, so only a platform write can land the status — that is what
+   * the lock hook's system exemption (`lifecycle-hooks.ts`) is for. What it must
+   * NOT do is throw away *who* caused the transition. Every status below is
+   * something a specific human just did — a submitter submitting or recalling,
+   * an approver deciding or sending back — and this write is what fires the
+   * target object's record-change flows. With no `userId` on it those cascades
+   * inherit no trigger user, and since #3760 a `runAs:'user'` run with no trigger
+   * user has its data ops REFUSED — so "when the invoice is approved, do X", the
+   * most natural approvals automation there is, had to declare `runAs:'system'`
+   * and take blanket elevation for a case where a perfectly good scoped identity
+   * existed. Re-attaching the actor lets those cascades run as the deciding user
+   * with RLS enforced. Same shape the approval node already uses when it calls
+   * into this service (`approval-node.ts`).
+   *
+   * `actorId` is `null` for the genuinely machine-driven transitions (the SLA
+   * escalation's auto-decision, the dead-run sweep). There is no human to name
+   * there, and naming a sentinel would put a non-user in `updated_by` and in
+   * every downstream flow's identity. Those cascades stay user-less — a flow
+   * that wants to react to them still has to declare `runAs:'system'`, which is
+   * the honest answer rather than an oversight.
+   *
+   * Deliberately carries `userId` ONLY, not the request's org. On an
+   * ExecutionContext `tenantId` is a driver-scoping knob, not attribution
+   * (`buildDriverOptions` turns it into a tenant predicate on the update), so
+   * passing it would newly org-scope this write and silently no-op the mirror on
+   * a record whose org differs from the request's — while buying nothing: the
+   * automation engine back-fills the run's `tenantId` from the resolved user's
+   * own grants.
+   */
+  private async mirrorStatusField(
+    object: string,
+    recordId: string,
+    field: string,
+    status: string,
+    actorId: string | null,
+  ): Promise<void> {
     try {
-      await this.engine.update(object, { id: recordId, [field]: status }, { context: SYSTEM_CTX });
+      const context = actorId ? { ...SYSTEM_CTX, userId: actorId } : SYSTEM_CTX;
+      await this.engine.update(object, { id: recordId, [field]: status }, { context });
     } catch (err: any) {
       this.logger?.warn?.(`[approvals] mirrorStatusField failed: ${err?.message ?? err}`);
     }
   }
 
+  /**
+   * Re-read a business record's CURRENT state by id so approver resolution binds
+   * to live data at node entry, not the trigger snapshot the flow froze into
+   * `$record` at submit time (#3447). A `field` / `manager` approver names *who*
+   * decides, and an earlier node — or the approver of an earlier step — may have
+   * written that routing field after submit (e.g. a lead reviewer picking which
+   * departments co-review). Graph approvers (team / position / …) already query
+   * live; this brings the in-record types into line.
+   *
+   * Read under system identity: approver routing is a platform concern and the
+   * record is the flow's own subject, so the submitter's RLS/FLS must not narrow
+   * it. Degrades to `fallback` (the snapshot) when the record can't be re-read —
+   * hard-deleted between submit and node entry, or an object whose backend can't
+   * serve a point read — warning rather than throwing so a transient miss can't
+   * wedge an approval. That "warn but proceed" stance matches the
+   * no-concrete-approver guard (#3424) and the "record is gone" enrichment path
+   * that already falls back to the payload snapshot.
+   */
+  private async loadLiveRecord(object: string, recordId: string, fallback?: any): Promise<any> {
+    try {
+      const rows = await this.engine.find(object, {
+        where: { id: recordId }, limit: 1, context: SYSTEM_CTX,
+      } as any);
+      const live = Array.isArray(rows) ? rows[0] : rows;
+      if (live) return live;
+      this.logger?.warn?.(
+        `[approvals] live record ${object}/${recordId} not found at node entry — `
+        + 'resolving approvers against the trigger snapshot (#3447 fallback).',
+        { object, recordId },
+      );
+    } catch (err: any) {
+      this.logger?.warn?.(
+        `[approvals] live record re-read failed for ${object}/${recordId}: ${err?.message ?? err} — `
+        + 'resolving approvers against the trigger snapshot (#3447 fallback).',
+      );
+    }
+    return fallback ?? {};
+  }
+
   // ── ADR-0019: Approval-as-flow-node ──────────────────────────
   //
   // A flow's Approval node opens a request via `openNodeRequest` (carrying its
@@ -628,6 +1341,10 @@ export class ApprovalService implements IApprovalService {
    * Open a pending approval request on behalf of a flow's Approval node. The
    * node config (approvers / behavior / status field) is snapshotted on the row
    * so a decision can be made without any process to resolve against.
+   *
+   * #3447 P2: may instead return an {@link ApprovalNodeAutoOutcome} — no
+   * request opened — when the slate resolves empty and the node's
+   * `onEmptyApprovers` policy is `auto_approve`.
    */
   async openNodeRequest(
     input: {
@@ -644,9 +1361,15 @@ export class ApprovalService implements IApprovalService {
       submitterId?: string | null;
       record?: any;
       organizationId?: string | null;
+      /**
+       * #3447 P2: flow variables at node entry (nested by dotted key, as the
+       * engine's CEL conditions see them) — the `vars.*` root for `expression`
+       * approvers. `input.record` doubles as their `trigger.*` root.
+       */
+      variables?: Record<string, unknown> | null;
     },
     context: SharingExecutionContext,
-  ): Promise<ApprovalRequestRow> {
+  ): Promise<ApprovalRequestRow | ApprovalNodeAutoOutcome> {
     if (!input.object) throw new Error('VALIDATION_FAILED: object is required');
     if (!input.recordId) throw new Error('VALIDATION_FAILED: recordId is required');
     if (!input.runId) throw new Error('VALIDATION_FAILED: runId is required');
@@ -669,10 +1392,51 @@ export class ApprovalService implements IApprovalService {
     // per_group finalization is decided against the slate resolved at OPEN time
     // (OOO-substituted), not re-resolved live at each decision.
     const groups: Record<string, string[]> = {};
+    // #3447: resolve approvers against the record's LIVE state at node entry, not
+    // the trigger snapshot carried in `input.record`. This is the whole fix — an
+    // earlier step may have written the field this node routes on.
+    const liveRecord = await this.loadLiveRecord(input.object, input.recordId, input.record);
+    const resolvedFrom: Record<string, unknown> = {};
     const approvers = await this.expandApprovers(
-      { approvers: input.config.approvers }, input.record, ctxOrg, { now: nowDate.getTime(), substitutions, groups },
+      { approvers: input.config.approvers }, liveRecord, ctxOrg, {
+        now: nowDate.getTime(), substitutions, groups,
+        exprCtx: { trigger: input.record ?? null, vars: input.variables ?? null },
+        resolvedFrom,
+      },
     );
 
+    // Empty-slate policy (#3447 P2). "Empty" = no CONCRETE person — an
+    // unstaffed position / empty expression result leaves only `type:value`
+    // literal slots, decidable by nobody.
+    if (!approvers.some(a => a && !a.includes(':'))) {
+      const emptyPolicy = (input.config as any).onEmptyApprovers ?? 'admin_rescue';
+      if (emptyPolicy === 'fail') {
+        throw new Error(
+          `NO_APPROVERS: approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no `
+          + `concrete approver and its onEmptyApprovers policy is 'fail'. Check that the approver target(s) `
+          + `are staffed / the routing field or expression yields user ids at node entry.`,
+        );
+      }
+      if (emptyPolicy === 'auto_approve') {
+        this.logger?.warn?.(
+          `[approvals] approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no `
+          + `concrete approver — auto-approving per onEmptyApprovers: 'auto_approve' (no request opened).`,
+          { object: input.object, recordId: input.recordId, node: input.nodeId, resolved: approvers },
+        );
+        return { autoApproved: true, reason: 'empty_approvers' };
+      }
+      // #3424 admin_rescue (default): the request is still opened (a privileged
+      // admin can override it, and legacy 15.x literal slots stay queryable) —
+      // the only option that neither waves the record through nor kills the
+      // run — but warn loudly so the misconfiguration surfaces instead of
+      // silently locking the record with no obvious cause.
+      this.logger?.warn?.(
+        `[approvals] approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no concrete approver`
+        + ' — the request is decidable only by a privileged admin. Check that the approver target(s) are staffed.',
+        { object: input.object, recordId: input.recordId, node: input.nodeId, resolved: approvers },
+      );
+    }
+
     const now = nowDate.toISOString();
     const id = uid('areq');
     const processName = `flow:${input.flowName ?? input.nodeId}`;
@@ -681,10 +1445,23 @@ export class ApprovalService implements IApprovalService {
     const configSnapshot: any = { ...input.config };
     if (input.flowLabel) configSnapshot.__flowLabel = input.flowLabel;
     if (input.nodeLabel) configSnapshot.__nodeLabel = input.nodeLabel;
-    // Snapshot the resolved approver→group map for quorum/per_group tallying.
-    if (input.config.behavior === 'quorum' || input.config.behavior === 'per_group') {
+    // Snapshot the resolved approver→group map for EVERY multi-approver
+    // behavior (was quorum/per_group only). #3447 P2 makes this load-bearing
+    // for unanimous too: an `expression` approver can only resolve at OPEN
+    // time (decide has no flow variables to evaluate against), so the tally
+    // must read the open-time slate — which also pins unanimous+field to the
+    // slate the approvers actually saw, instead of re-reading a field that may
+    // have changed again since.
+    if (input.config.behavior && input.config.behavior !== 'first_response') {
       configSnapshot.__approverGroups = groups;
     }
+    // #3447 P2: snapshot what the dynamic approver sources resolved FROM (the
+    // live routing-field value / the expression's intermediate values) so the
+    // audit trail answers "why these people" — the resolution INPUT, pairing
+    // the resolution RESULT already persisted as `pending_approvers`.
+    if (Object.keys(resolvedFrom).length) {
+      configSnapshot.__resolvedFrom = resolvedFrom;
+    }
     // ADR-0044 round numbering: rounds of a revise loop share the run — count
     // this (run, node)'s prior requests; the new one is round N+1. Stamped on
     // the snapshot (precedent: __flowLabel), so no schema migration.
@@ -760,7 +1537,17 @@ export class ApprovalService implements IApprovalService {
     // Record lock (when `lockRecord !== false`) is enforced by the beforeUpdate
     // hook keyed on the now-pending request; no extra write needed here.
     if (input.config.approvalStatusField) {
-      await this.mirrorStatusField(input.object, input.recordId, input.config.approvalStatusField, 'pending');
+      // Attributed to whoever the row itself calls the submitter (#3783), so
+      // there is exactly one answer to "who submitted this". Not the
+      // {@link actingUserId} route: `submitterId` is server-supplied here (the
+      // approval node passes the run's own trigger user) and unreachable from a
+      // request body, so it carries none of the caller-controlled risk that rule
+      // exists for — and it already resolves to `context.userId` in every
+      // first-party path.
+      await this.mirrorStatusField(
+        input.object, input.recordId, input.config.approvalStatusField, 'pending',
+        row.submitter_id ?? null,
+      );
     }
 
     return rowFromRequest(row);
@@ -814,11 +1601,11 @@ export class ApprovalService implements IApprovalService {
    */
   async decideNode(
     requestId: string,
-    input: { decision: 'approve' | 'reject'; actorId: string; comment?: string; attachments?: string[] },
+    input: { decision: 'approve' | 'reject'; actorId: string; comment?: string; attachments?: string[]; outputs?: Record<string, unknown> },
     context: SharingExecutionContext,
-  ): Promise<{ request: ApprovalRequestRow; runId: string | null; nodeId: string | null; finalized: boolean; decision: 'approve' | 'reject' }> {
+  ): Promise<{ request: ApprovalRequestRow; runId: string | null; nodeId: string | null; finalized: boolean; decision: 'approve' | 'reject'; outputs?: Record<string, unknown> }> {
     if (!requestId) throw new Error('VALIDATION_FAILED: requestId is required');
-    if (!input?.actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+    const actorId = await this.resolveActor(input?.actorId, context);
     if (input.decision !== 'approve' && input.decision !== 'reject') {
       throw new Error('VALIDATION_FAILED: decision must be approve|reject');
     }
@@ -832,8 +1619,13 @@ export class ApprovalService implements IApprovalService {
     if (raw.status !== 'pending') throw new Error(`INVALID_STATE: request is ${raw.status}`);
 
     const pendingApprovers = csvSplit(raw.pending_approvers);
-    if (!context.isSystem && !pendingApprovers.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not a pending approver`);
+    // A privileged admin may override a stuck request (#3424) even when they
+    // hold no slot — the escape hatch for an approval routed to an unstaffed
+    // position or to approvers who have all left.
+    const isOverride = this.isOverrideActor(context, raw.organization_id ?? null);
+    const isSlotHolder = pendingApprovers.includes(actorId);
+    if (!isSlotHolder && !isOverride) {
+      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
     }
 
     const config = parseJson<ApprovalNodeConfig>(raw.node_config_json, { approvers: [], behavior: 'first_response' } as any);
@@ -842,11 +1634,46 @@ export class ApprovalService implements IApprovalService {
     const runId: string | null = raw.flow_run_id ?? null;
     const now = this.clock.now().toISOString();
 
+    // #3447 P2: decision outputs — validated BEFORE any write (audit included)
+    // so an out-of-contract payload rejects atomically. The trust model is a
+    // `screen` node's: the AUTHOR declares the keys (`config.decisionOutputs`),
+    // the approver only fills values. A decision carrying undeclared keys is a
+    // caller bug; `decision`/`requestId` are reserved by the resume envelope.
+    const outputKeys = input.outputs ? Object.keys(input.outputs) : [];
+    let acceptedOutputs: Record<string, unknown> | undefined;
+    if (outputKeys.length) {
+      // Typed declarations and bare keys whitelist identically — one
+      // normalizer (spec) is the single reader of the union shape.
+      const declared = normalizeDecisionOutputs((config as any).decisionOutputs).map(d => d.key);
+      if (!declared.length) {
+        throw new Error(
+          `VALIDATION_FAILED: this approval node declares no decisionOutputs — outputs are not accepted. `
+          + `Declare the keys on the node config (decisionOutputs: [${outputKeys.map(k => `'${k}'`).join(', ')}]) `
+          + `to let approvers hand them to the flow.`,
+        );
+      }
+      const reserved = outputKeys.filter(k => k === 'decision' || k === 'requestId');
+      if (reserved.length) {
+        throw new Error(
+          `VALIDATION_FAILED: decision output key(s) \`${reserved.join('`, `')}\` are reserved by the resume `
+          + `envelope — pick different names.`,
+        );
+      }
+      const undeclared = outputKeys.filter(k => !declared.includes(k));
+      if (undeclared.length) {
+        throw new Error(
+          `VALIDATION_FAILED: decision output key(s) \`${undeclared.join('`, `')}\` are not declared on this `
+          + `node — declared keys: ${declared.map(k => `'${k}'`).join(', ') || '(none)'}.`,
+        );
+      }
+      acceptedOutputs = { ...input.outputs };
+    }
+
     // Audit the decision first so the quorum/per_group tally below sees it.
     await this.engine.insert('sys_approval_action', {
       id: uid('aact'), request_id: requestId, organization_id: org,
       step_name: nodeId, step_index: 0, action: input.decision,
-      actor_id: input.actorId, comment: input.comment ?? null,
+      actor_id: actorId, comment: input.comment ?? null,
       attachments: input.attachments?.length ? input.attachments : null,
       created_at: now,
     }, { context: SYSTEM_CTX });
@@ -855,19 +1682,27 @@ export class ApprovalService implements IApprovalService {
     // finalizes the node (one veto), so only the approve path can hold it open.
     // `first_response` finalizes on the first approval (falls straight through).
     const behavior = config.behavior ?? 'first_response';
-    if (input.decision === 'approve' && behavior !== 'first_response') {
+    // A privileged override (an admin rescuing a stuck request, #3424) is an
+    // authoritative decision, not one vote among the resolved slate — it
+    // finalizes the node immediately, regardless of `unanimous`/`quorum`/
+    // `per_group`. Only a real slot holder's approval feeds the multi-approver
+    // tally below.
+    if (input.decision === 'approve' && behavior !== 'first_response' && isSlotHolder) {
       const acts = await this.engine.find('sys_approval_action', {
         where: { request_id: requestId, step_index: 0, action: 'approve' }, limit: 1000, context: SYSTEM_CTX,
       });
       const approved = new Set<string>((acts ?? []).map((a: any) => String(a.actor_id ?? '')).filter(Boolean));
 
-      // quorum / per_group tally against the OPEN-time snapshot (already
-      // OOO-substituted). unanimous re-resolves for back-compat with requests
-      // opened before the snapshot existed.
+      // Tally against the OPEN-time snapshot (already OOO-substituted) for
+      // every behavior that carries one. Re-resolution survives ONLY as the
+      // back-compat path for requests opened before the snapshot existed —
+      // it cannot ever run for an `expression` approver (#3447 P2: decide has
+      // no flow variables to evaluate against; open time is the only
+      // resolution point), and those always have a snapshot.
       const snapshotGroups = (config as any).__approverGroups as Record<string, string[]> | undefined;
       let original: string[];
       let groupMap: Record<string, string[]>;
-      if (snapshotGroups && (behavior === 'quorum' || behavior === 'per_group')) {
+      if (snapshotGroups) {
         groupMap = snapshotGroups;
         original = Object.keys(snapshotGroups);
       } else {
@@ -881,23 +1716,68 @@ export class ApprovalService implements IApprovalService {
         const stillPending = original.filter(a => !approved.has(a));
         await this.engine.update('sys_approval_request', {
           id: requestId, pending_approvers: stillPending.join(','), updated_at: now,
+          // #3447 P2: a mid-tally approval may carry outputs too (unanimous /
+          // per_group co-sign, each approver contributing their declared keys)
+          // — accumulate them on the snapshot so the FINALIZING decision hands
+          // the merged set to the flow.
+          ...(acceptedOutputs ? {
+            node_config_json: JSON.stringify({
+              ...config,
+              __decisionOutputs: { ...((config as any).__decisionOutputs ?? {}), ...acceptedOutputs },
+            }),
+          } : {}),
         }, { context: SYSTEM_CTX });
         await this.syncApproverIndex(requestId, stillPending, org, now);
-        const fresh = await this.getRequest(requestId, context);
+        const fresh = await this.readBackRequest(requestId, context);
         return { request: fresh!, runId, nodeId, finalized: false, decision: input.decision };
       }
     }
 
     const finalStatus = input.decision === 'approve' ? 'approved' : 'rejected';
+    // #3447 P2: the full accumulated output set — earlier co-sign votes' plus
+    // this finalizing decision's — resumes the run and stays snapshotted for
+    // the audit trail ("what did the approvers hand the flow").
+    const mergedOutputs: Record<string, unknown> | undefined =
+      acceptedOutputs || (config as any).__decisionOutputs
+        ? { ...((config as any).__decisionOutputs ?? {}), ...(acceptedOutputs ?? {}) }
+        : undefined;
     await this.engine.update('sys_approval_request', {
       id: requestId, status: finalStatus, pending_approvers: null, completed_at: now, updated_at: now,
+      ...(mergedOutputs ? {
+        node_config_json: JSON.stringify({ ...config, __decisionOutputs: mergedOutputs }),
+      } : {}),
     }, { context: SYSTEM_CTX });
     await this.syncApproverIndex(requestId, [], org, now);
     if (config.approvalStatusField) {
-      await this.mirrorStatusField(raw.object_name, raw.record_id, config.approvalStatusField, finalStatus);
+      await this.mirrorStatusField(
+        raw.object_name, raw.record_id, config.approvalStatusField, finalStatus,
+        actingUserId(context),
+      );
     }
-    const fresh = await this.getRequest(requestId, context);
-    return { request: fresh!, runId, nodeId, finalized: true, decision: input.decision };
+    const fresh = await this.readBackRequest(requestId, context);
+    return { request: fresh!, runId, nodeId, finalized: true, decision: input.decision, outputs: mergedOutputs };
+  }
+
+  /**
+   * Continue the owning flow run after an outcome this service has already
+   * authorized and written down (#3801).
+   *
+   * The `approval` node declares `resumeAuthority: 'service'`, so the engine
+   * refuses any resume of an approval suspension that does not carry
+   * {@link RESUME_AUTHORITY_SERVICE}. Every approvals-side resume goes through
+   * here so the marker is stamped in ONE place — a new outcome path cannot
+   * quietly ship a resume that the gate then rejects at runtime, and nothing
+   * in this file hands the marker to a caller-supplied signal.
+   *
+   * Callers still guard on `typeof this.automation?.resume === 'function'`
+   * (approvals runs fine with no automation attached) and keep their own
+   * try/catch, because what a failed resume means differs per path.
+   */
+  private async serviceResume(
+    runId: string,
+    signal: { output?: Record<string, unknown>; branchLabel?: string },
+  ): Promise<void> {
+    await this.automation!.resume!(runId, { ...signal, [RESUME_AUTHORITY_SERVICE]: true });
   }
 
   /**
@@ -918,9 +1798,14 @@ export class ApprovalService implements IApprovalService {
         ? APPROVAL_BRANCH_LABELS.approve
         : APPROVAL_BRANCH_LABELS.reject;
       try {
-        await this.automation.resume(result.runId, {
+        await this.serviceResume(result.runId, {
           branchLabel,
-          output: { decision: result.decision, requestId },
+          // #3447 P2: accepted decision outputs ride the resume envelope and
+          // land as `<nodeId>.<key>` flow variables — a later approval node's
+          // `expression` approver reads them as `vars.<nodeId>.<key>`.
+          // Reserved keys are spread LAST so no output can shadow them (the
+          // whitelist already rejects them; this is defense in depth).
+          output: { ...(result.outputs ?? {}), decision: result.decision, requestId },
         });
         resumed = true;
       } catch (err: any) {
@@ -958,7 +1843,7 @@ export class ApprovalService implements IApprovalService {
     context: SharingExecutionContext,
   ): Promise<ApprovalRecallResult> {
     if (!requestId) throw new Error('VALIDATION_FAILED: requestId is required');
-    if (!input?.actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+    const actorId = await this.resolveActor(input?.actorId, context);
 
     const rawRows = await this.engine.find('sys_approval_request', {
       where: { id: requestId }, limit: 1, context: SYSTEM_CTX,
@@ -969,7 +1854,10 @@ export class ApprovalService implements IApprovalService {
     if (raw.status !== 'pending' && !inReviseWindow) {
       throw new Error(`INVALID_STATE: request is ${raw.status}`);
     }
-    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(input.actorId)) {
+    // The submitter withdraws their own request; a privileged admin may recall
+    // any pending request to release a stuck record (#3424).
+    if (!this.isOverrideActor(context, raw.organization_id ?? null)
+      && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
       throw new Error(`FORBIDDEN: only the submitter may recall this request`);
     }
     // A returned request is only recallable while it is still the run's live
@@ -985,7 +1873,7 @@ export class ApprovalService implements IApprovalService {
     await this.engine.insert('sys_approval_action', {
       id: uid('aact'), request_id: requestId, organization_id: org,
       step_name: nodeId, step_index: 0, action: 'recall',
-      actor_id: input.actorId, comment: input.comment ?? null, created_at: now,
+      actor_id: actorId, comment: input.comment ?? null, created_at: now,
     }, { context: SYSTEM_CTX });
 
     await this.engine.update('sys_approval_request', {
@@ -993,7 +1881,10 @@ export class ApprovalService implements IApprovalService {
     }, { context: SYSTEM_CTX });
     await this.syncApproverIndex(requestId, [], org, now);
     if (config.approvalStatusField) {
-      await this.mirrorStatusField(raw.object_name, raw.record_id, config.approvalStatusField, 'recalled');
+      await this.mirrorStatusField(
+        raw.object_name, raw.record_id, config.approvalStatusField, 'recalled',
+        actingUserId(context),
+      );
     }
 
     let resumed = false;
@@ -1011,7 +1902,7 @@ export class ApprovalService implements IApprovalService {
       }
     } else if (runId && typeof this.automation?.resume === 'function') {
       try {
-        await this.automation.resume(runId, {
+        await this.serviceResume(runId, {
           branchLabel: APPROVAL_BRANCH_LABELS.reject,
           output: { decision: 'recall', requestId },
         });
@@ -1023,7 +1914,7 @@ export class ApprovalService implements IApprovalService {
       }
     }
 
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh!, runId, resumed };
   }
 
@@ -1047,11 +1938,11 @@ export class ApprovalService implements IApprovalService {
     input: ApprovalSendBackInput,
     context: SharingExecutionContext,
   ): Promise<ApprovalSendBackResult> {
-    if (!input?.actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+    const actorId = await this.resolveActor(input?.actorId, context);
     const raw = await this.loadPendingRow(requestId);
     const pending = csvSplit(raw.pending_approvers);
-    if (!context.isSystem && !pending.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not a pending approver`);
+    if (!context.isSystem && !pending.includes(actorId)) {
+      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
     }
 
     const config = parseJson<ApprovalNodeConfig>(raw.node_config_json, { approvers: [], behavior: 'first_response' } as any);
@@ -1077,7 +1968,7 @@ export class ApprovalService implements IApprovalService {
     await this.engine.insert('sys_approval_action', {
       id: uid('aact'), request_id: requestId, organization_id: org,
       step_name: nodeId, step_index: 0, action: 'revise',
-      actor_id: input.actorId, comment: input.comment ?? null, created_at: now,
+      actor_id: actorId, comment: input.comment ?? null, created_at: now,
     }, { context: SYSTEM_CTX });
 
     if (priorSendBacks >= maxRevisions) {
@@ -1085,7 +1976,7 @@ export class ApprovalService implements IApprovalService {
       await this.engine.insert('sys_approval_action', {
         id: uid('aact'), request_id: requestId, organization_id: org,
         step_name: nodeId, step_index: 0, action: 'reject',
-        actor_id: input.actorId,
+        actor_id: actorId,
         comment: `Auto-rejected: revision limit (${maxRevisions}) exceeded`, created_at: now,
       }, { context: SYSTEM_CTX });
       await this.engine.update('sys_approval_request', {
@@ -1093,12 +1984,15 @@ export class ApprovalService implements IApprovalService {
       }, { context: SYSTEM_CTX });
       await this.syncApproverIndex(requestId, [], org, now);
       if (config.approvalStatusField) {
-        await this.mirrorStatusField(raw.object_name, raw.record_id, config.approvalStatusField, 'rejected');
+        await this.mirrorStatusField(
+          raw.object_name, raw.record_id, config.approvalStatusField, 'rejected',
+          actingUserId(context),
+        );
       }
       let resumed = false;
       if (runId && typeof this.automation?.resume === 'function') {
         try {
-          await this.automation.resume(runId, {
+          await this.serviceResume(runId, {
             branchLabel: APPROVAL_BRANCH_LABELS.reject,
             output: { decision: 'reject', autoRejected: true, requestId },
           });
@@ -1113,7 +2007,7 @@ export class ApprovalService implements IApprovalService {
         await this.notify({
           topic: 'approval.returned',
           audience: [String(raw.submitter_id)],
-          actorId: input.actorId,
+          actorId: actorId,
           source: { object: 'sys_approval_request', id: requestId },
           payload: {
             title: 'Approval auto-rejected',
@@ -1122,7 +2016,7 @@ export class ApprovalService implements IApprovalService {
           },
         });
       }
-      const fresh = await this.getRequest(requestId, context);
+      const fresh = await this.readBackRequest(requestId, context);
       return { request: fresh!, runId, resumed, autoRejected: true };
     }
 
@@ -1131,13 +2025,16 @@ export class ApprovalService implements IApprovalService {
     }, { context: SYSTEM_CTX });
     await this.syncApproverIndex(requestId, [], org, now);
     if (config.approvalStatusField) {
-      await this.mirrorStatusField(raw.object_name, raw.record_id, config.approvalStatusField, 'returned');
+      await this.mirrorStatusField(
+        raw.object_name, raw.record_id, config.approvalStatusField, 'returned',
+        actingUserId(context),
+      );
     }
 
     let resumed = false;
     if (runId && typeof this.automation?.resume === 'function') {
       try {
-        await this.automation.resume(runId, {
+        await this.serviceResume(runId, {
           branchLabel: APPROVAL_BRANCH_LABELS.revise,
           output: { decision: 'revise', requestId },
         });
@@ -1153,7 +2050,7 @@ export class ApprovalService implements IApprovalService {
       await this.notify({
         topic: 'approval.returned',
         audience: [String(raw.submitter_id)],
-        actorId: input.actorId,
+        actorId: actorId,
         source: { object: 'sys_approval_request', id: requestId },
         payload: {
           title: 'Sent back for revision',
@@ -1163,7 +2060,7 @@ export class ApprovalService implements IApprovalService {
       });
     }
 
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh!, runId, resumed };
   }
 
@@ -1179,7 +2076,7 @@ export class ApprovalService implements IApprovalService {
     input: ApprovalResubmitInput,
     context: SharingExecutionContext,
   ): Promise<ApprovalResubmitResult> {
-    if (!input?.actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+    const actorId = await this.resolveActor(input?.actorId, context);
     const rawRows = await this.engine.find('sys_approval_request', {
       where: { id: requestId }, limit: 1, context: SYSTEM_CTX,
     });
@@ -1188,7 +2085,7 @@ export class ApprovalService implements IApprovalService {
     if (raw.status !== 'returned') {
       throw new Error(`INVALID_STATE: request is ${raw.status} (resubmit applies to returned requests)`);
     }
-    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(input.actorId)) {
+    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
       throw new Error('FORBIDDEN: only the submitter may resubmit');
     }
     await this.assertLatestForRun(raw);
@@ -1216,7 +2113,7 @@ export class ApprovalService implements IApprovalService {
     await this.engine.insert('sys_approval_action', {
       id: uid('aact'), request_id: requestId, organization_id: org,
       step_name: nodeId, step_index: 0, action: 'resubmit',
-      actor_id: input.actorId, comment: input.comment ?? null, created_at: now,
+      actor_id: actorId, comment: input.comment ?? null, created_at: now,
     }, { context: SYSTEM_CTX });
 
     // The next round only exists if this resume lands — surface `resumed`
@@ -1224,7 +2121,7 @@ export class ApprovalService implements IApprovalService {
     let resumed = false;
     if (runId && typeof this.automation?.resume === 'function') {
       try {
-        await this.automation.resume(runId, {
+        await this.serviceResume(runId, {
           branchLabel: APPROVAL_BRANCH_LABELS.resubmit,
           output: { resubmitted: true, requestId },
         });
@@ -1236,7 +2133,7 @@ export class ApprovalService implements IApprovalService {
       }
     }
 
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh!, runId, resumed };
   }
 
@@ -1288,38 +2185,50 @@ export class ApprovalService implements IApprovalService {
   /**
    * Hand a pending-approver slot to someone else. `from` defaults to the
    * actor itself; the actor must hold the slot being handed over (or be a
-   * system caller). Audits `reassign` and notifies the new approver.
+   * system caller). A privileged admin (#3424) may reassign a request whose
+   * slate holds no real user — an unstaffed-position literal — by handing the
+   * whole request to a real approver, rescuing it from the locked dead-end.
+   * Audits `reassign` and notifies the new approver.
    */
   async reassign(
     requestId: string,
     input: { actorId: string; to: string; from?: string; comment?: string },
     context: SharingExecutionContext,
   ): Promise<{ request: ApprovalRequestRow }> {
-    if (!input?.actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+    const actorId = await this.resolveActor(input?.actorId, context);
     const to = String(input?.to ?? '').trim();
     if (!to) throw new Error('VALIDATION_FAILED: `to` (new approver) is required');
     const raw = await this.loadPendingRow(requestId);
 
     const pending = csvSplit(raw.pending_approvers);
-    const from = String(input.from ?? input.actorId).trim();
-    if (!pending.includes(from)) {
-      throw new Error(`FORBIDDEN: '${from}' is not a pending approver on this request`);
-    }
-    if (!context.isSystem && input.actorId !== from && !pending.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not a pending approver`);
-    }
     if (pending.includes(to)) {
       throw new Error(`VALIDATION_FAILED: '${to}' is already a pending approver`);
     }
-
-    const next = pending.map(a => (a === from ? to : a));
+    const isOverride = this.isOverrideActor(context, raw.organization_id ?? null);
+    const from = String(input.from ?? actorId).trim();
+    let next: string[];
+    if (pending.includes(from)) {
+      // Normal hand-off: the actor holds the slot being moved (or is a
+      // system/admin caller acting on a real holder's slot).
+      if (!context.isSystem && !isOverride && actorId !== from && !pending.includes(actorId)) {
+        throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
+      }
+      next = pending.map(a => (a === from ? to : a));
+    } else if (isOverride) {
+      // Admin rescue (#3424): the caller holds no slot — the slate is an
+      // unstaffed-position literal or a set of departed approvers. Reassign the
+      // whole request to a real approver so the normal decision flow can resume.
+      next = [to];
+    } else {
+      throw new Error(`FORBIDDEN: '${from}' is not a pending approver on this request`);
+    }
     const now = this.clock.now().toISOString();
     // Audit first, then mutate — mirrors decideNode(), so a failed audit
     // write can never leave a moved slot without a trail.
     await this.engine.insert('sys_approval_action', {
       id: uid('aact'), request_id: requestId, organization_id: raw.organization_id ?? null,
       step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'reassign',
-      actor_id: input.actorId, comment: input.comment ?? `${from} → ${to}`, created_at: now,
+      actor_id: actorId, comment: input.comment ?? `${from} → ${to}`, created_at: now,
     }, { context: SYSTEM_CTX });
     // per_group / quorum (#3266): carry the delegated slot's group membership to
     // the new approver in the snapshot, so their approval still counts for the
@@ -1342,7 +2251,7 @@ export class ApprovalService implements IApprovalService {
     await this.notify({
       topic: 'approval.reassigned',
       audience: [to],
-      actorId: input.actorId,
+      actorId: actorId,
       source: { object: 'sys_approval_request', id: requestId },
       dedupKey: `approval-reassign-${requestId}-${to}`,
       payload: {
@@ -1352,7 +2261,7 @@ export class ApprovalService implements IApprovalService {
       },
     });
 
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh! };
   }
 
@@ -1365,9 +2274,9 @@ export class ApprovalService implements IApprovalService {
     input: { actorId: string; comment?: string },
     context: SharingExecutionContext,
   ): Promise<{ request: ApprovalRequestRow; notified: number }> {
-    if (!input?.actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+    const actorId = await this.resolveActor(input?.actorId, context);
     const raw = await this.loadPendingRow(requestId);
-    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(input.actorId)) {
+    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
       throw new Error('FORBIDDEN: only the submitter may send reminders');
     }
 
@@ -1386,7 +2295,7 @@ export class ApprovalService implements IApprovalService {
     await this.engine.insert('sys_approval_action', {
       id: uid('aact'), request_id: requestId, organization_id: raw.organization_id ?? null,
       step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'remind',
-      actor_id: input.actorId, comment: input.comment ?? null, created_at: nowIso,
+      actor_id: actorId, comment: input.comment ?? null, created_at: nowIso,
     }, { context: SYSTEM_CTX });
 
     // Per-approver fan-out: concrete identities (user ids / emails) each get
@@ -1401,7 +2310,7 @@ export class ApprovalService implements IApprovalService {
         notified += await this.notify({
           topic: 'approval.reminder',
           audience: [approver],
-          actorId: input.actorId,
+          actorId: actorId,
           source: { object: 'sys_approval_request', id: requestId },
           dedupKey: `approval-remind-${requestId}-${nowIso}-${approver}`,
           payload: {
@@ -1424,7 +2333,7 @@ export class ApprovalService implements IApprovalService {
       notified += await this.notify({
         topic: 'approval.reminder',
         audience: literals,
-        actorId: input.actorId,
+        actorId: actorId,
         source: { object: 'sys_approval_request', id: requestId },
         dedupKey: `approval-remind-${requestId}-${nowIso}`,
         payload: {
@@ -1435,7 +2344,7 @@ export class ApprovalService implements IApprovalService {
       });
     }
 
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh!, notified };
   }
 
@@ -1532,7 +2441,14 @@ export class ApprovalService implements IApprovalService {
       decision: res.token.action,
       actorId: res.token.approver_id,
       comment: 'Via action link',
-    }, SYSTEM_CTX as unknown as SharingExecutionContext);
+      // The token IS the authentication (#3783): it is single-use, hashed at
+      // rest and bound to one approver, who `resolveActionToken` has just
+      // re-checked still holds a pending slot. So this decision has a real
+      // acting user even though no session carried it — name them on the
+      // context, so the status mirror and every flow it cascades into are
+      // attributed exactly like a decision made through the UI. Elevation is
+      // unchanged: `isSystem` still stands in for the missing session.
+    }, { ...SYSTEM_CTX, userId: res.token.approver_id } as unknown as SharingExecutionContext);
     return { ok: true, action: res.token.action, request: out.request, approverId: res.token.approver_id };
   }
 
@@ -1545,26 +2461,26 @@ export class ApprovalService implements IApprovalService {
     input: { actorId: string; comment: string },
     context: SharingExecutionContext,
   ): Promise<{ request: ApprovalRequestRow }> {
-    if (!input?.actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+    const actorId = await this.resolveActor(input?.actorId, context);
     if (!input?.comment?.trim()) throw new Error('VALIDATION_FAILED: comment is required');
     const raw = await this.loadPendingRow(requestId);
     const pending = csvSplit(raw.pending_approvers);
-    if (!context.isSystem && !pending.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not a pending approver`);
+    if (!context.isSystem && !pending.includes(actorId)) {
+      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
     }
 
     const now = this.clock.now().toISOString();
     await this.engine.insert('sys_approval_action', {
       id: uid('aact'), request_id: requestId, organization_id: raw.organization_id ?? null,
       step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'request_info',
-      actor_id: input.actorId, comment: input.comment.trim(), created_at: now,
+      actor_id: actorId, comment: input.comment.trim(), created_at: now,
     }, { context: SYSTEM_CTX });
 
     if (raw.submitter_id) {
       await this.notify({
         topic: 'approval.request_info',
         audience: [String(raw.submitter_id)],
-        actorId: input.actorId,
+        actorId: actorId,
         source: { object: 'sys_approval_request', id: requestId },
         payload: {
           title: 'More information requested',
@@ -1574,7 +2490,7 @@ export class ApprovalService implements IApprovalService {
       });
     }
 
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh! };
   }
 
@@ -1584,20 +2500,20 @@ export class ApprovalService implements IApprovalService {
     input: { actorId: string; comment: string; attachments?: string[] },
     context: SharingExecutionContext,
   ): Promise<{ request: ApprovalRequestRow }> {
-    if (!input?.actorId) throw new Error('VALIDATION_FAILED: actorId is required');
+    const actorId = await this.resolveActor(input?.actorId, context);
     if (!input?.comment?.trim()) throw new Error('VALIDATION_FAILED: comment is required');
     const raw = await this.loadPendingRow(requestId);
     const pending = csvSplit(raw.pending_approvers);
-    const isSubmitter = raw.submitter_id && String(raw.submitter_id) === String(input.actorId);
-    if (!context.isSystem && !isSubmitter && !pending.includes(input.actorId)) {
-      throw new Error(`FORBIDDEN: actor '${input.actorId}' is not on this request`);
+    const isSubmitter = raw.submitter_id && String(raw.submitter_id) === String(actorId);
+    if (!context.isSystem && !isSubmitter && !pending.includes(actorId)) {
+      throw new Error(`FORBIDDEN: actor '${actorId}' is not on this request`);
     }
 
     const now = this.clock.now().toISOString();
     await this.engine.insert('sys_approval_action', {
       id: uid('aact'), request_id: requestId, organization_id: raw.organization_id ?? null,
       step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'comment',
-      actor_id: input.actorId, comment: input.comment.trim(),
+      actor_id: actorId, comment: input.comment.trim(),
       attachments: input.attachments?.length ? input.attachments : null,
       created_at: now,
     }, { context: SYSTEM_CTX });
@@ -1607,7 +2523,7 @@ export class ApprovalService implements IApprovalService {
     await this.notify({
       topic: 'approval.comment',
       audience,
-      actorId: input.actorId,
+      actorId: actorId,
       source: { object: 'sys_approval_request', id: requestId },
       payload: {
         title: 'New comment on an approval',
@@ -1616,7 +2532,7 @@ export class ApprovalService implements IApprovalService {
       },
     });
 
-    const fresh = await this.getRequest(requestId, context);
+    const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh! };
   }
 
@@ -1671,6 +2587,124 @@ export class ApprovalService implements IApprovalService {
     return { scanned: rows.length, escalated };
   }
 
+  // ── Dead-run release (#3456) ──────────────────────────────────
+
+  /**
+   * One dead-run sweep: a pending request whose owning flow run has reached a
+   * TERMINAL state can never be decided — nothing is left to resume — so the
+   * request is finalised as `recalled` and, with `lockRecord`, the record it was
+   * holding is released.
+   *
+   * This is the recovery half of #3456. The prevention half is the record lock's
+   * owning-run exemption (`lifecycle-hooks.ts`), which stops a run from killing
+   * itself on its own lock in the first place; this sweep cleans up the runs that
+   * still die — for any reason, including a process crash, which no in-band
+   * handler can catch because the process that would have run it is gone.
+   *
+   * **Fail-safe by construction.** It acts only on an explicit terminal status
+   * from a closed set. Every other answer — `paused` (the normal state of a run
+   * waiting on its approval), `running`, an unrecognised status, `null` (unknown
+   * run, evicted log, no durable store), a `getRun` that throws, or no automation
+   * engine at all — is read as "still alive" and left strictly alone. The failure
+   * mode is therefore "a dead run's lock survives until an admin recalls it"
+   * (today's behaviour, #3424), never "a live approval is destroyed".
+   *
+   * `recalled` is the finalisation because it is the platform's existing terminal
+   * state for *a live request that ended without a decision*; the audit row names
+   * the real cause and {@link DEAD_RUN_ACTOR_ID} the real actor, so a dead-run
+   * release is never mistaken for a submitter's withdrawal.
+   */
+  async releaseDeadRunRequests(): Promise<{ scanned: number; released: number }> {
+    // No liveness oracle → no basis to declare anything dead.
+    if (typeof this.automation?.getRun !== 'function') return { scanned: 0, released: 0 };
+
+    let rows: any[] = [];
+    try {
+      rows = await this.engine.find('sys_approval_request', {
+        where: { status: 'pending' }, limit: 500, context: SYSTEM_CTX,
+      }) ?? [];
+    } catch (err: any) {
+      this.logger?.warn?.('[approvals] dead-run sweep failed to list requests', {
+        error: err?.message ?? String(err),
+      });
+      return { scanned: 0, released: 0 };
+    }
+
+    let released = 0;
+    for (const raw of rows) {
+      try {
+        const runId = raw?.flow_run_id ? String(raw.flow_run_id) : '';
+        if (!runId) continue;   // not node-driven — no run owns it, nothing to check
+
+        let status: string | undefined;
+        try {
+          const run = await this.automation.getRun!(runId);
+          status = typeof run?.status === 'string' ? run.status : undefined;
+        } catch (err: any) {
+          // Unknown liveness is NOT death — leave the request pending.
+          this.logger?.warn?.('[approvals] dead-run sweep could not read run status', {
+            request: raw?.id, run: runId, error: err?.message ?? String(err),
+          });
+          continue;
+        }
+        if (!status || !TERMINAL_RUN_STATUSES.has(status)) continue;
+
+        await this.abandonForDeadRun(raw, runId, status);
+        released++;
+      } catch (err: any) {
+        // One bad row never stops the sweep (mirrors runEscalations).
+        this.logger?.warn?.('[approvals] dead-run release failed for request', {
+          request: raw?.id, error: err?.message ?? String(err),
+        });
+      }
+    }
+    if (released > 0) {
+      this.logger?.info?.('[approvals] dead-run sweep', { scanned: rows.length, released });
+    }
+    return { scanned: rows.length, released };
+  }
+
+  /**
+   * Finalise one pending request whose owning run is terminal. Mirrors the
+   * shape of {@link recall} — audit row first (so a crash mid-release leaves a
+   * trace of the intent), then the status transition, approver-index sync and
+   * the optional status-field mirror. No resume/cancel of the run: it is already
+   * terminal, which is precisely why we are here.
+   */
+  private async abandonForDeadRun(raw: any, runId: string, runStatus: string): Promise<void> {
+    const org = raw.organization_id ?? null;
+    const nodeId: string | null = raw.flow_node_id ?? raw.current_step ?? null;
+    const now = this.clock.now().toISOString();
+
+    await this.engine.insert('sys_approval_action', {
+      id: uid('aact'), request_id: raw.id, organization_id: org,
+      step_name: nodeId, step_index: 0, action: 'recall',
+      actor_id: DEAD_RUN_ACTOR_ID,
+      comment: `owning flow run ${runId} is ${runStatus} — request abandoned and record lock released`,
+      created_at: now,
+    }, { context: SYSTEM_CTX });
+
+    await this.engine.update('sys_approval_request', {
+      id: raw.id, status: 'recalled', pending_approvers: null, completed_at: now, updated_at: now,
+    }, { context: SYSTEM_CTX });
+    await this.syncApproverIndex(raw.id, [], org, now);
+
+    const config = parseJson<ApprovalNodeConfig>(
+      raw.node_config_json, { approvers: [], behavior: 'first_response' } as any,
+    );
+    if (config.approvalStatusField) {
+      // No human did this — a sweep did. Left user-less on purpose (#3783): a
+      // flow that wants to react to a dead-run release declares runAs:'system'.
+      await this.mirrorStatusField(
+        raw.object_name, raw.record_id, config.approvalStatusField, 'recalled', null,
+      );
+    }
+
+    this.logger?.warn?.('[approvals] released a record held by a dead approval run', {
+      request: raw.id, run: runId, runStatus, object: raw.object_name, record: raw.record_id,
+    });
+  }
+
   /** Execute the configured escalation action for one overdue request. */
   private async escalateRequest(raw: any, esc: any): Promise<void> {
     const action: string = esc.action ?? 'notify';
@@ -1832,11 +2866,31 @@ export class ApprovalService implements IApprovalService {
     } catch { return []; }
   }
 
+  /**
+   * Field key → display label for an object's schema. Lets the inbox summary
+   * show a human field name ("考核状态") instead of a title-cased machine key
+   * ("Assessment Status"). For a single-locale project the schema label already
+   * IS the localized string; symmetric with `resolveDisplayField`/lookup
+   * resolution that power `payload_display`.
+   */
+  private resolveFieldLabels(object: string): Record<string, string> {
+    try {
+      const schema: any = (this.engine as any).getSchema?.(object);
+      const fields = schema?.fields ?? {};
+      const out: Record<string, string> = {};
+      for (const [key, f] of Object.entries<any>(fields)) {
+        if (f?.label) out[key] = String(f.label);
+      }
+      return out;
+    } catch { return {}; }
+  }
+
   /**
    * Attach inbox display fields to rows so clients never render a raw
    * identifier: `record_title`, `submitter_name`, `object_label`,
-   * `pending_approver_names` (user-id approvers), and `payload_display`
-   * (lookup foreign keys in the snapshot → referenced record titles).
+   * `pending_approver_names` (user-id approvers), `payload_display`
+   * (lookup foreign keys in the snapshot → referenced record titles), and
+   * `payload_labels` (snapshot field keys → the target object's field labels).
    * Batched: one query per distinct object (target + referenced) plus one
    * `sys_user` lookup. Best-effort — a deleted record falls back to the
    * payload snapshot, and any failure leaves the field unset rather than
@@ -1875,9 +2929,13 @@ export class ApprovalService implements IApprovalService {
 
     // Lookup foreign keys inside payload snapshots → referenced record titles.
     const lookupFieldsByObject = new Map<string, Array<{ key: string; reference: string }>>();
+    // Field key → label per object, for the snapshot summary's field names.
+    const fieldLabelsByObject = new Map<string, Record<string, string>>();
     for (const object of byObject.keys()) {
       const lookups = this.resolveLookupFields(object);
       if (lookups.length) lookupFieldsByObject.set(object, lookups);
+      const labels = this.resolveFieldLabels(object);
+      if (Object.keys(labels).length) fieldLabelsByObject.set(object, labels);
     }
     const refIds = new Map<string, Set<string>>();
     for (const r of rows) {
@@ -1945,6 +3003,18 @@ export class ApprovalService implements IApprovalService {
         }
         if (Object.keys(display).length) r.payload_display = display;
       }
+
+      // Field labels for the snapshot keys the summary renders (only keys
+      // actually present in the payload — a deleted field's label is noise).
+      const fieldLabels = fieldLabelsByObject.get(r.object_name);
+      if (fieldLabels && r.payload && typeof r.payload === 'object') {
+        const labels: Record<string, string> = {};
+        for (const key of Object.keys(r.payload as Record<string, unknown>)) {
+          const l = fieldLabels[key];
+          if (l) labels[key] = l;
+        }
+        if (Object.keys(labels).length) r.payload_labels = labels;
+      }
     }
   }
 
@@ -2131,6 +3201,98 @@ export class ApprovalService implements IApprovalService {
     return [...new Set<string>(list.map(r => String(r.request_id)))];
   }
 
+  /**
+   * The request ids this caller is a PARTICIPANT of, or `null` for a caller
+   * who may see everything in scope (#3590).
+   *
+   * These reads deliberately run with `SYSTEM_CTX` to bypass RLS — the
+   * approver-visibility rule spans several identity forms that RLS cannot model
+   * cleanly, which is why it has to be expressed here. Until now only the
+   * TENANT half of that rule was applied, so any authenticated user could read
+   * any request in their tenant (and, once attachments derived their access
+   * from the request, its files too). This adds the participant half.
+   *
+   * A participant is the submitter, a current approver, or someone who has
+   * already acted on the request (a past approver whose slot has moved on, a
+   * commenter). Admins with override authority keep the unrestricted view the
+   * "all requests" console surface depends on.
+   *
+   * Keying on the concrete user id is sufficient rather than an approximation:
+   * position/team/manager/field approvers are resolved to concrete user ids at
+   * open time, and the `type:value` literal is only the fallback for a spec
+   * that resolved to NOBODY — a slot no one can act on either way (`can_act`
+   * is a plain membership test over the resolved ids). So this cannot hide a
+   * request from someone who could actually act on it.
+   */
+  private async visibleRequestIds(
+    context: SharingExecutionContext,
+    tenantOrg: string | null,
+  ): Promise<Set<string> | null> {
+    if (this.isOverrideActor(context, tenantOrg)) return null;
+    const uid = (context as any)?.userId != null ? String((context as any).userId) : '';
+    // A tokenless/anonymous caller participates in nothing. Fail closed.
+    if (!uid) return new Set<string>();
+
+    const ids = new Set<string>();
+    const cap = ApprovalService.APPROVER_INDEX_CAP;
+    const add = (rows: unknown, key: string) => {
+      const list: any[] = Array.isArray(rows) ? rows : [];
+      for (const r of list) if (r?.[key] != null) ids.add(String(r[key]));
+      if (list.length >= cap) {
+        this.logger?.warn?.(
+          '[approvals] participant-visibility probe hit its window — some requests may be hidden from a legitimate participant',
+          { cap, key },
+        );
+      }
+    };
+
+    try {
+      // Current approver — via the normalized index, so every identity form
+      // the write path recorded is covered.
+      for (const id of (await this.approverRequestIds([uid], tenantOrg)) ?? []) ids.add(id);
+
+      const orgWhere = tenantOrg ? { organization_id: tenantOrg } : {};
+      add(
+        await this.engine.find('sys_approval_request', {
+          where: { submitter_id: uid, ...orgWhere },
+          fields: ['id'], limit: cap, context: SYSTEM_CTX,
+        }),
+        'id',
+      );
+      // Already acted on it: a past approver whose slot has moved on, or a
+      // commenter. They saw it legitimately; keep it that way.
+      add(
+        await this.engine.find('sys_approval_action', {
+          where: { actor_id: uid },
+          fields: ['request_id'], limit: cap, context: SYSTEM_CTX,
+        }),
+        'request_id',
+      );
+    } catch (err) {
+      // Never widen on error: a failed probe yields whatever was collected.
+      this.logger?.warn?.('[approvals] participant-visibility probe failed', {
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+    return ids;
+  }
+
+  /** Intersect an existing `where.id` constraint with the participant set. */
+  private applyVisibility(where: any, visible: Set<string> | null): boolean {
+    if (!visible) return true;
+    if (visible.size === 0) return false;
+    let allowed = [...visible];
+    const current = where.id;
+    if (typeof current === 'string') allowed = allowed.filter((x) => x === current);
+    else if (current && typeof current === 'object' && Array.isArray(current.$in)) {
+      const set = new Set(current.$in.map((v: unknown) => String(v)));
+      allowed = allowed.filter((x) => set.has(x));
+    }
+    if (allowed.length === 0) return false;
+    where.id = allowed.length === 1 ? allowed[0] : { $in: allowed };
+    return true;
+  }
+
   async listRequests(
     filter: {
       object?: string;
@@ -2158,6 +3320,11 @@ export class ApprovalService implements IApprovalService {
       where.id = ids.length === 1 ? ids[0] : { $in: ids };
     }
 
+    // #3590: the caller-supplied `approverId` is a FILTER, not authorization —
+    // omitting it used to return every request in the tenant. Intersect with
+    // what this caller actually participates in.
+    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg))) return [];
+
     const findOpts: any = {
       where,
       orderBy: [{ field: 'created_at', order: 'desc' }],
@@ -2193,6 +3360,9 @@ export class ApprovalService implements IApprovalService {
       where.id = ids.length === 1 ? ids[0] : { $in: ids };
     }
 
+    // #3590 — the count must agree with the list it paginates.
+    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg))) return 0;
+
     const countFn = (this.engine as any).count;
     if (typeof countFn === 'function') {
       try {
@@ -2209,7 +3379,33 @@ export class ApprovalService implements IApprovalService {
     return Array.isArray(rows) ? rows.length : 0;
   }
 
+  /**
+   * Read the request a write path just changed, to echo back as its result.
+   *
+   * NOT participant-gated (#3590), deliberately: the operation authorized
+   * itself by its own rule before writing, so re-asking "may you see this?"
+   * for the echo answers a question that has already been settled — and would
+   * answer it WRONG for a caller context that carries no `userId` (a
+   * flow-driven resume, a service-to-service call), turning a successful write
+   * into a `null` result. Gating belongs on the read API, not on an
+   * operation's own return value.
+   */
+  private async readBackRequest(
+    requestId: string,
+    context: SharingExecutionContext,
+  ): Promise<ApprovalRequestRow | null> {
+    return this.loadRequest(requestId, context, false);
+  }
+
   async getRequest(requestId: string, context: SharingExecutionContext): Promise<ApprovalRequestRow | null> {
+    return this.loadRequest(requestId, context, true);
+  }
+
+  private async loadRequest(
+    requestId: string,
+    context: SharingExecutionContext,
+    enforceVisibility: boolean,
+  ): Promise<ApprovalRequestRow | null> {
     if (!requestId) return null;
     const where: any = { id: requestId };
     const tenantOrg = (context as any)?.organizationId ?? (context as any)?.tenantId;
@@ -2218,6 +3414,13 @@ export class ApprovalService implements IApprovalService {
       where, limit: 1, context: SYSTEM_CTX,
     });
     if (!Array.isArray(rows) || !rows[0]) return null;
+    // #3590: tenant scoping alone let any authenticated user read any request
+    // — and, once decision attachments derived their access from the request
+    // (#3580), its files too. Participation is the rest of the rule.
+    if (enforceVisibility) {
+      const visible = await this.visibleRequestIds(context, tenantOrg ?? null);
+      if (visible && !visible.has(String(rows[0].id))) return null;
+    }
     const row = rowFromRequest(rows[0]);
     await this.enrichRows([row]);
     await this.attachFlowSteps(row);
@@ -2267,6 +3470,21 @@ export class ApprovalService implements IApprovalService {
         });
         progress.got = progress.groups.filter((g: any) => g.satisfied).length;
         progress.need = progress.groups.length;
+
+        // Approver→group(s) for the STILL-PENDING slots (objectui#2807), so the
+        // console can label each "waiting on" chip with the group it represents
+        // rather than showing duplicate, context-free names. Only pending slots
+        // matter — a resolved approver has dropped out of `pending_approvers`.
+        // Synthetic (unnamed, `#N`) group keys are dropped: a `· #0` sub-tag is
+        // noise, and the client would have to filter it anyway.
+        const pendingGroups: Record<string, string[]> = {};
+        for (const a of (row.pending_approvers ?? [])) {
+          const named = (snapshot[a] ?? []).filter((g) => !/^#\d+$/.test(g));
+          if (named.length) pendingGroups[a] = named;
+        }
+        if (Object.keys(pendingGroups).length) {
+          (row as any).pending_approver_groups = pendingGroups;
+        }
       }
       (row as any).decision_progress = progress;
     } catch { /* display-only enrichment */ }
@@ -2278,8 +3496,13 @@ export class ApprovalService implements IApprovalService {
    * caller's user id is in the resolved `pending_approvers` while the request is
    * still `pending` (position/team/manager approvers are already resolved to
    * concrete user ids at open time, so a plain membership test is faithful).
-   * `is_submitter` is a straight owner check. System/tokenless contexts get a
-   * both-false block. Cheap + synchronous — safe on list reads.
+   * `is_submitter` is a straight owner check. `can_override` (#3424) is true for
+   * a platform/tenant admin on a PENDING request — the recovery path for an
+   * approval routed to an unstaffed position or to approvers who have all left;
+   * clients OR it into the decision actions' `visible` gate so an admin can act
+   * even when they hold no slot. System/tokenless contexts get a both-false
+   * `can_act`/`is_submitter` block (system gets `can_override` too — it may act
+   * on anything). Cheap + synchronous — safe on list reads.
    */
   private attachViewers(rows: ApprovalRequestRow[], context: SharingExecutionContext): void {
     const uid = (context as any)?.userId != null ? String((context as any).userId) : null;
@@ -2288,6 +3511,8 @@ export class ApprovalService implements IApprovalService {
       (row as any).viewer = {
         can_act: row.status === 'pending' && !!uid && pending.includes(uid),
         is_submitter: !!uid && row.submitter_id != null && String(row.submitter_id) === uid,
+        can_override: row.status === 'pending'
+          && this.isOverrideActor(context, (row as any).organization_id ?? null),
       };
     }
   }
@@ -2357,4 +3582,36 @@ export class ApprovalService implements IApprovalService {
     }
     return actions;
   }
+
+  /**
+   * `IFileAccessDelegate` — may this caller download a decision attachment?
+   * (ADR-0104 D3 wave 2; declared by `sys_approval_action.fileAccessDelegate`.)
+   *
+   * A file referenced by `sys_approval_action.attachments` is owned by that
+   * audit row, so the storage service would otherwise authorize the download by
+   * testing whether the caller can READ the row. It cannot: `sys_approval_action`
+   * is deliberately closed to ordinary approver positions, so that test denies
+   * the very approver the attachment was filed for.
+   *
+   * The rule that actually governs seeing a decision is the one `listActions`
+   * applies — can the caller see the PARENT REQUEST? — so this reuses it
+   * exactly, rather than inventing a second, looser rule for the bytes. Fails
+   * closed on any error.
+   */
+  async authorizeFileRead(actionId: string, context: SharingExecutionContext): Promise<boolean> {
+    if (!actionId) return false;
+    try {
+      const rows = await this.engine.find('sys_approval_action', {
+        where: { id: actionId },
+        limit: 1,
+        context: SYSTEM_CTX,
+      });
+      const requestId = (Array.isArray(rows) ? rows[0] : undefined)?.request_id;
+      if (!requestId) return false;
+      // Same gate as listActions: visibility of the decision's parent request.
+      return !!(await this.getRequest(String(requestId), context));
+    } catch {
+      return false;
+    }
+  }
 }