@objectstack/plugin-approvals 17.0.0 → 17.2.0

package/dist/index.js

@@ -1411,10 +1411,45 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
   },
   fields: {
     id: import_data.Field.text({ label: "Request ID", required: true, readonly: true, group: "System" }),
+    // ⚠️ MEASURED DEFECT, cloud#1395 — read this before trusting the column.
+    //
+    // An approval request DOES belong to an organization: it is read through the
+    // organization wall by the approvals inbox, and on a shared-database
+    // deployment a row carrying no organization is not filtered BY that wall —
+    // it is either invisible to everyone or visible to everyone, decided by
+    // whatever filter each surface happens to apply rather than by the data.
+    //
+    // The value is resolved from the ACTING CONTEXT only (`openNodeRequest`'s
+    // `ctxOrg`), so it is NULL whenever the flow that opened the request ran
+    // without one — every schedule / time-relative / api triggered run, none of
+    // which sets a tenant. On a walled single-database HotCRM SaaS boot this
+    // measured 27 of 27 rows org-less, each naming an `object_name` /
+    // `record_id` owned by a specific customer.
+    //
+    // ⛔ Do NOT read that as "platform tables do not carry an organization".
+    // `sys_audit_log` (1669 rows) was correctly attributed on the SAME boot,
+    // because its writer takes the organization from the RECORD the row is
+    // about, with the session only as fallback (plugin-audit
+    // `resolveRecordOrganizationField`, #8707 honouring #8287's ruling). Two
+    // writers read the actor; a third reads the subject. That disagreement is
+    // the defect.
+    //
+    // Which of the two a side-table row should follow is an open contract
+    // question on cloud#1395 — the audit resolver is scope-pinned to audit
+    // stamping by the #8778 ruling, so this writer needs its own. The same
+    // `ctxOrg` also stamps `sys_approval_action` and `sys_approval_approver`,
+    // so all three move together.
     organization_id: import_data.Field.lookup("sys_organization", {
       label: "Organization",
       required: false,
       group: "System",
+      // ⛔ String unchanged on purpose: it is extracted into the generated i18n
+      // bundles (`translations/*.objects.generated.ts`, as `help`), so rewording
+      // it is a translation-regeneration change and not a comment. The
+      // correction it needs — it claims a propagation that measurably does not
+      // happen, and says "Tenant" where ADR-0120 §Terminology requires
+      // "organization" — rides the cloud#1395 write-side fix, which rewrites the
+      // sentence and regenerates the four locales in one pass.
       description: "Tenant that owns this approval request (propagated from submitter context)"
     }),
     process_name: import_data.Field.text({
@@ -1558,6 +1593,28 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
   // approving, rejecting, or reassigning it to a real approver. `viewer` is
   // attached by getRequest/listRequests; where it is absent the predicate fails
   // closed.
+  //
+  // Every predicate below is guarded for the SPARSE action face (#8990). This
+  // binding is a list row or a record read carrying only what the caller
+  // projected, and CEL aborts the whole expression at key resolution — so the
+  // unguarded `record.viewer.can_act` faulted (`No such key: viewer`) on any
+  // row without the block, and the button silently vanished, indistinguishable
+  // from "the gate said no". `materializeDeclaredFields`'s doc comment in
+  // `@objectstack/objectql` is the canonical statement of the guard rule; this
+  // file follows it and does not restate it.
+  //
+  // `viewer` is a NESTED block, which needs one measurement the canonical rule
+  // does not spell out. Measured against the `@objectstack/formula` CEL engine:
+  // `has(record.viewer) && record.viewer != null && record.viewer.can_act`
+  // still FAULTS on `{viewer: {}}` (`No such key: can_act`) and on
+  // `{viewer: {can_act: null}}` (`Logical operator requires bool operands`).
+  // Guarding the LEAF instead — `has(record.viewer) &&
+  // has(record.viewer.can_act) && record.viewer.can_act == true` — is total
+  // over every binding AND subsumes the parent `!= null` half, because `has()`
+  // on a path whose parent is null answers `false` rather than faulting. So the
+  // leaf `has()` plus the `== true` comparison is the MINIMAL safe form here,
+  // not a longer one: `== true` is load-bearing (a bare truthy read of a null
+  // leaf faults the logical operator), the parent `!= null` is not.
   actions: [
     {
       name: "approval_approve",
@@ -1577,7 +1634,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
         // string[]`; the decision route persists them on `sys_approval_action`.
         { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: "record.viewer.can_act || record.viewer.can_override",
+      visible: "has(record.viewer) && has(record.viewer.can_act) && record.viewer.can_act == true || has(record.viewer) && has(record.viewer.can_override) && record.viewer.can_override == true",
       locations: ["record_section", "list_item"],
       successMessage: "Approved.",
       refreshAfter: true
@@ -1605,7 +1662,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
         { name: "comment", label: "Comment", type: "textarea", required: false },
         { name: "attachments", label: "Attachments", type: "file", multiple: true, required: false }
       ],
-      visible: "record.viewer.can_act || record.viewer.can_override",
+      visible: "has(record.viewer) && has(record.viewer.can_act) && record.viewer.can_act == true || has(record.viewer) && has(record.viewer.can_override) && record.viewer.can_override == true",
       locations: ["record_section", "list_item"],
       successMessage: "Rejected.",
       refreshAfter: true
@@ -1626,7 +1683,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
         { field: "submitter_id", name: "to", label: "New approver", required: true, helpText: "User to hand this step to" },
         { name: "comment", label: "Comment", type: "textarea", required: false }
       ],
-      visible: "record.viewer.can_act || record.viewer.can_override",
+      visible: "has(record.viewer) && has(record.viewer.can_act) && record.viewer.can_act == true || has(record.viewer) && has(record.viewer.can_override) && record.viewer.can_override == true",
       locations: ["record_section"],
       successMessage: "Reassigned.",
       refreshAfter: true
@@ -1645,7 +1702,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "Reason", type: "textarea", required: false }
       ],
-      visible: "record.viewer.can_act",
+      visible: "has(record.viewer) && has(record.viewer.can_act) && record.viewer.can_act == true",
       locations: ["record_section"],
       successMessage: "Sent back for revision.",
       refreshAfter: true
@@ -1660,7 +1717,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "What do you need?", type: "textarea", required: true }
       ],
-      visible: "record.viewer.can_act",
+      visible: "has(record.viewer) && has(record.viewer.can_act) && record.viewer.can_act == true",
       locations: ["record_section"],
       successMessage: "Information requested.",
       refreshAfter: true
@@ -1681,7 +1738,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "Note", type: "textarea", required: false }
       ],
-      visible: 'record.status == "pending" && record.viewer.is_submitter',
+      visible: 'has(record.status) && record.status == "pending" && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true',
       locations: ["record_section"],
       successMessage: "Reminder sent.",
       refreshAfter: true
@@ -1701,7 +1758,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       ],
       // Recall applies while the request is live for the submitter — pending
       // (withdraw) or returned (abandon the revision instead of resubmitting).
-      visible: '(record.status == "pending" || record.status == "returned") && record.viewer.is_submitter',
+      visible: 'has(record.status) && (record.status == "pending" || record.status == "returned") && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true',
       locations: ["record_section"],
       successMessage: "Recalled.",
       refreshAfter: true
@@ -1716,7 +1773,7 @@ var SysApprovalRequest = import_data.ObjectSchema.create({
       params: [
         { name: "comment", label: "What changed?", type: "textarea", required: false }
       ],
-      visible: 'record.status == "returned" && record.viewer.is_submitter',
+      visible: 'has(record.status) && record.status == "returned" && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true',
       locations: ["record_section"],
       successMessage: "Resubmitted.",
       refreshAfter: true
@@ -2178,6 +2235,38 @@ async function filterApproversWhoCanRead(deps, userIds, requestOrgId, context) {
   return userIds.filter((u) => canRead.has(u));
 }
 
+// src/payload-redaction.ts
+function redactSnapshot(payload, readable) {
+  if (readable === void 0) return { payload, redactedKeys: [] };
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    return { payload, redactedKeys: [] };
+  }
+  const allowed = new Set(readable.map((f) => String(f)));
+  const source = payload;
+  const redactedKeys = [];
+  const kept = {};
+  for (const key of Object.keys(source)) {
+    if (allowed.has(key)) kept[key] = source[key];
+    else redactedKeys.push(key);
+  }
+  if (redactedKeys.length === 0) return { payload, redactedKeys: [] };
+  return { payload: kept, redactedKeys: redactedKeys.sort() };
+}
+async function resolveReadableSnapshotFields(security, objectName, context, logger) {
+  if (!security || typeof security.getReadableFields !== "function") return void 0;
+  const object = String(objectName ?? "").trim();
+  if (!object) return void 0;
+  try {
+    return await security.getReadableFields(object, context);
+  } catch (err) {
+    logger?.warn?.("[approvals] payload redaction could not resolve readable fields \u2014 serving the snapshot unredacted", {
+      object,
+      error: err?.message ?? String(err)
+    });
+    return void 0;
+  }
+}
+
 // src/approval-service.ts
 var REMIND_COOLDOWN_MS = 4 * 60 * 60 * 1e3;
 var ESCALATION_JOB_NAME = "approvals-sla-escalation";
@@ -2198,6 +2287,7 @@ function actingUserId(context) {
   return typeof userId === "string" && userId ? userId : null;
 }
 var OOO_MAX_CHAIN = 8;
+var MEMBER_SCREEN_READ_LIMIT = 5e4;
 var GRAPH_APPROVER_TYPES = /* @__PURE__ */ new Set([
   "team",
   "department",
@@ -2350,11 +2440,66 @@ var _ApprovalService = class _ApprovalService {
     this.messaging = opts.messaging;
     this.publicBaseUrl = (opts.publicBaseUrl ?? "").replace(/\/$/, "");
     this.tenancyPosture = opts.tenancyPosture;
+    this.fieldVisibility = opts.fieldVisibility;
+    this.recordReaderVisibleObjects = new Set(
+      (Array.isArray(opts.recordReaderVisibleObjects) ? opts.recordReaderVisibleObjects : []).map((n) => String(n ?? "").trim()).filter(Boolean)
+    );
   }
   /** Attach (or replace) the ADR-0105 D9 posture provider. */
   attachTenancyPosture(provider) {
     this.tenancyPosture = provider;
   }
+  /**
+   * [#10749] Attach (or replace) the field-visibility authority the payload
+   * redaction seam reads. Late-bound: plugin load order does not guarantee the
+   * security service exists when this one is constructed.
+   */
+  attachFieldVisibility(source) {
+    this.fieldVisibility = source;
+  }
+  /**
+   * [#10749] Redact each row's payload snapshot down to the fields the READING
+   * caller may see on that row's subject object.
+   *
+   * Runs BEFORE {@link ApprovalService.enrichRows}, and that ordering is
+   * load-bearing rather than incidental: `enrichRows` derives `payload_display`
+   * (lookup foreign keys inside the snapshot resolved to referenced record
+   * titles) and `payload_labels` (a label per snapshot key) by WALKING THE
+   * SNAPSHOT'S OWN KEYS. Redact first and both derived maps are clean for free;
+   * redact after and a restricted field's name, its authored label and the
+   * title of the record it points at all still ship — the value would be gone
+   * and the disclosure would not.
+   *
+   * Rows are grouped by subject object so one `getReadableFields` call covers a
+   * whole page of same-object requests.
+   */
+  async redactPayloads(rows, context) {
+    const withPayload = rows.filter((r) => r?.payload != null);
+    if (withPayload.length === 0) return;
+    const byObject = /* @__PURE__ */ new Map();
+    for (const r of withPayload) {
+      const key = String(r.object_name ?? "");
+      let list = byObject.get(key);
+      if (!list) {
+        list = [];
+        byObject.set(key, list);
+      }
+      list.push(r);
+    }
+    for (const [object, group] of byObject) {
+      const readable = await resolveReadableSnapshotFields(
+        this.fieldVisibility,
+        object,
+        context,
+        this.logger
+      );
+      if (readable === void 0) continue;
+      for (const r of group) {
+        const { payload } = redactSnapshot(r.payload, readable);
+        r.payload = payload;
+      }
+    }
+  }
   /** Deps bundle for the ADR-0105 D9 org-scope helpers. */
   get orgScopeDeps() {
     return {
@@ -2621,7 +2766,7 @@ var _ApprovalService = class _ApprovalService {
     }) : users;
     try {
       if (type === "team") {
-        const users = await this.expandTeamUsers(String(a.value));
+        const users = await this.expandTeamUsers(String(a.value), organizationId);
         if (users.length) return users;
       } else if (type === "department" || type === "business_unit" || type === "bu") {
         const users = await bounded(await this.expandBusinessUnitUsers(String(a.value), directoryOrg));
@@ -2635,7 +2780,7 @@ var _ApprovalService = class _ApprovalService {
       } else if (type === "manager" && record) {
         const subject = record[a.value] ?? record.owner_id;
         if (subject) {
-          const mgr = await this.lookupManager(String(subject));
+          const mgr = await this.lookupManager(String(subject), organizationId);
           if (mgr) return this.applyOooDelegation(mgr, now, organizationId, substitutions);
         }
       }
@@ -2732,7 +2877,7 @@ var _ApprovalService = class _ApprovalService {
       try {
         if (resolveAs === "department") users = await this.expandBusinessUnitUsers(key, directoryOrg);
         else if (resolveAs === "position") users = await this.expandPositionUsers(key, directoryOrg);
-        else if (resolveAs === "team") users = await this.expandTeamUsers(key);
+        else if (resolveAs === "team") users = await this.expandTeamUsers(key, directoryOrg);
         else {
           throw new Error(
             `VALIDATION_FAILED: expression approver has unknown resolveAs '${resolveAs}' \u2014 use 'user', 'department', 'position', or 'team'`
@@ -2757,9 +2902,50 @@ var _ApprovalService = class _ApprovalService {
     }
     return { slots, raw };
   }
-  /** Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy). */
-  async expandTeamUsers(teamId) {
+  /**
+   * Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy).
+   *
+   * Takes an organization for the reason every sibling expansion does
+   * ({@link expandBusinessUnitUsers}, {@link expandPositionUsers},
+   * {@link expandMembershipTierUsers}): an approver expansion answers "who, in
+   * THIS organization". Before #10230 this one did not ask, and it was the last
+   * expansion that did not — a `team` approver naming ANOTHER organization's
+   * team routed that organization's people an approval over a record they are
+   * not a tenant of.
+   *
+   * TWO screens run here, and they assert different things (#10230, #10547):
+   *
+   *   1. the TEAM must not provably belong to another organization
+   *      ({@link teamIsProvablyOutsideOrg}) — `sys_team` carries
+   *      `organization_id` outright
+   *      (`packages/platform-objects/src/identity/sys-team.object.ts`), so a
+   *      team id transitively names exactly one organization and ONE row
+   *      answers the question;
+   *   2. each expanded MEMBER must not provably hold membership only in other
+   *      organizations ({@link dropMembersProvablyOutsideOrg}) —
+   *      `sys_team_member` carries `team_id` and `user_id` and NO tenancy
+   *      column at all, so passing (1) says nothing whatever about the people
+   *      it lists.
+   *
+   * #10230 landed (1) alone and deferred (2) on purpose. What closed the
+   * deferral is that (1) does not imply (2) even a little: a member removed
+   * from the organization but left on the team, a team re-parented across
+   * organizations (`/organization/update-team` accepts `organizationId` in its
+   * partial body), or a `sys_team_member` row written by a seed rather than
+   * through better-auth all produce a team that passes (1) carrying a user who
+   * is provably a tenant of somewhere else. Measured on this tree, not read off
+   * the schema — the probe is quoted in `team-member-org-screen.test.ts`.
+   *
+   * (2) is the SAME assertion as {@link managerIsProvablyOutsideOrg}, one hop
+   * further out, and it is asserted the same way: `sys_user` carries no tenancy
+   * fact, so `sys_member` rows are the only evidence that a person is placed
+   * anywhere. Like that screen, this one grants no reads and applies no read
+   * screen to any approver type that lacks one today, so it decides nothing
+   * #7497 (does approver routing imply record read visibility?) asks.
+   */
+  async expandTeamUsers(teamId, organizationId) {
     if (!teamId) return [];
+    if (await this.teamIsProvablyOutsideOrg(teamId, organizationId)) return [];
     let rows = [];
     try {
       rows = await this.engine.find("sys_team_member", {
@@ -2771,7 +2957,149 @@ var _ApprovalService = class _ApprovalService {
     } catch {
       rows = [];
     }
-    return Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
+    const users = Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
+    return await this.dropMembersProvablyOutsideOrg(teamId, users, organizationId);
+  }
+  /**
+   * Is `teamId` PROVABLY a team of a DIFFERENT organization? (#10230)
+   *
+   * "Provably" carries the same posture the sibling screen states at length in
+   * {@link managerIsProvablyOutsideOrg}, for the same reasons:
+   *
+   *   - the team row carries an `organization_id` and it is not the request's
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ screen it out;
+   *   - the row carries no `organization_id`, does not exist, or the read failed
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The `organization_id = null` limb is not timidity — it is the reading
+   * {@link businessUnitOrgScope} settled on one screen below, for the identical
+   * shape: null on a platform object means "owned by no organization", which is
+   * what a seed writes because a seed cannot know the organization id the
+   * runtime mints at boot. Treating null as "not mine" would delete every
+   * seeded team approver at once — a larger behaviour change than the hole
+   * being closed. Measured, and not hypothetically: this package's own
+   * `team_ok` expansion fixture is exactly such a stack (it has
+   * `sys_team_member` rows, a request carrying an organization, and no
+   * `sys_team` row at all).
+   *
+   * Screening the TEAM before reading its members is also what keeps the cost
+   * at one row: a team that fails the screen never fans out.
+   */
+  async teamIsProvablyOutsideOrg(teamId, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg) return false;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_team", {
+        where: { id: teamId },
+        fields: ["id", "organization_id"],
+        limit: 1,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return false;
+    }
+    const row = Array.isArray(rows) ? rows[0] : null;
+    const teamOrg = row?.organization_id ? String(row.organization_id) : "";
+    if (!teamOrg) return false;
+    if (teamOrg === requestOrg) return false;
+    this.logger?.warn?.(
+      `[approvals] #10230: team '${teamId}' was dropped from the approver slate \u2014 'sys_team.organization_id' is '${teamOrg}', not the request's organization '${requestOrg}', so routing this approval to its members would put approval authority over the record outside its tenant. Point the approver at a team in this organization, or route this step with an approver type that names someone in it.`,
+      { teamId, teamOrganizationId: teamOrg, requestOrganizationId: requestOrg }
+    );
+    return true;
+  }
+  /**
+   * Drop the expanded team members who are PROVABLY tenants of other
+   * organizations and not of `organizationId`. (#10547)
+   *
+   * Returns the survivors, in the order they were expanded.
+   *
+   * Posture — identical to {@link managerIsProvablyOutsideOrg} and
+   * {@link teamIsProvablyOutsideOrg}, deliberately, because it is the same
+   * assertion about the same table:
+   *
+   *   - membership rows exist for this user, none in `organizationId`
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ drop him;
+   *   - no membership rows at all for him, the read failed, or the request
+   *     carries no organization
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The absent limb is load-bearing rather than timid, and #3807 is the recorded
+   * cost of getting it wrong: a stack that stamps an organization on requests
+   * but never materializes `sys_member` rows would otherwise lose EVERY team
+   * approver at once. This package's own `team_ok` expansion fixture and
+   * #10230's T2/T3 fixtures are exactly such stacks — they carry team rows and
+   * a request organization and no `sys_member` table at all — so the absent
+   * limb is exercised by neighbours on every run of this suite.
+   *
+   * ONE read for the whole slate, never one per person: the expansion is capped
+   * at 10000 members and a per-user query would turn a single team approver
+   * into 10000 round trips.
+   *
+   * ⚠️ A TRUNCATED read fails open, and that is the subtle half. This read is
+   * the only evidence that a member IS a tenant here, so a result cut off at
+   * the limit could be missing the very row that keeps a legitimate approver on
+   * the slate — screening him out on missing evidence, which inverts the
+   * posture into fail-CLOSED precisely where it must not. When the read comes
+   * back at the cap it is treated as no evidence at all.
+   */
+  async dropMembersProvablyOutsideOrg(teamId, userIds, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg || !userIds.length) return userIds;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_member", {
+        where: { user_id: { $in: userIds } },
+        fields: ["user_id", "organization_id"],
+        limit: MEMBER_SCREEN_READ_LIMIT,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return userIds;
+    }
+    if ((rows?.length ?? 0) >= MEMBER_SCREEN_READ_LIMIT) {
+      this.logger?.warn?.(
+        `[approvals] #10547: the membership screen for team '${teamId}' read ${rows.length} 'sys_member' rows, at or above its ${MEMBER_SCREEN_READ_LIMIT}-row cap, so the result may be truncated. Routing is left unchanged rather than risk dropping a member whose proof of membership fell outside the read.`,
+        { teamId, requestOrganizationId: requestOrg, rowsRead: rows.length }
+      );
+      return userIds;
+    }
+    const orgsByUser = /* @__PURE__ */ new Map();
+    for (const r of rows ?? []) {
+      const uid2 = String(r?.user_id ?? "");
+      const org = String(r?.organization_id ?? "");
+      if (!uid2 || !org) continue;
+      const seen = orgsByUser.get(uid2);
+      if (seen) seen.push(org);
+      else orgsByUser.set(uid2, [org]);
+    }
+    const kept = [];
+    const dropped = [];
+    for (const uid2 of userIds) {
+      const orgs = orgsByUser.get(uid2);
+      if (!orgs?.length) {
+        kept.push(uid2);
+        continue;
+      }
+      if (orgs.includes(requestOrg)) {
+        kept.push(uid2);
+        continue;
+      }
+      dropped.push({ userId: uid2, organizationIds: orgs });
+    }
+    if (dropped.length) {
+      this.logger?.warn?.(
+        `[approvals] #10547: ${dropped.length} member(s) of team '${teamId}' were dropped from the approver slate \u2014 ${dropped.map((d) => `'${d.userId}'`).join(", ")} hold membership in other organization(s), none of them the request's organization '${requestOrg}', so routing this approval to them would put approval authority over the record outside its tenant. The TEAM itself belongs to this organization; its 'sys_team_member' rows carry no organization of their own. Remove them from the team, grant them a membership in this organization, or route this step with an approver type that names someone in it.`,
+        {
+          teamId,
+          requestOrganizationId: requestOrg,
+          droppedUserIds: dropped.map((d) => d.userId),
+          droppedMemberOrganizationIds: dropped.map((d) => d.organizationIds)
+        }
+      );
+    }
+    return kept;
   }
   /**
    * Tenant scope for a `sys_business_unit` read that may legitimately be
@@ -2851,9 +3179,48 @@ var _ApprovalService = class _ApprovalService {
    * Position holders (ADR-0090 D3): `sys_user_position` is the platform-owned
    * assignment table, keyed by the position's machine name (ADR-0057 D4),
    * unioned with the better-auth membership string (`sys_member.role`) as a
-   * transition source — the same semantics as `PositionGraphService` in
-   * `plugin-sharing`, so an approval routes to exactly the users the sharing
-   * engine would expand for the same position.
+   * transition source.
+   *
+   * ⚠️ This is a ROUTING read (approver slates and escalation targets), and it
+   * is deliberately NOT the same read as `PositionGraphService` in
+   * `plugin-sharing`, whatever the shared method name suggests. Both answer
+   * "who holds position P"; this one reads the directory RAW — neither the
+   * ADR-0091 D2 validity window nor the `sys_position.active` catalogue flag is
+   * applied. Maintainer ruling, 2026-08-15 (#8710, inheriting #8613), verbatim:
+   *
+   * > Access-conferring paths filter deactivated positions; addressing paths
+   * > do not.
+   *
+   * Routing is an addressing path, so dropping a holder here is fail-OPEN, not
+   * fail-closed: an expansion that comes back empty does not narrow the slate,
+   * it falls through to the literal `position:` slot no user can ever act on —
+   * the permanently stuck request of #3807 / #3424. A step routing to nobody is
+   * worse than one routing to a lapsed holder, so the lapsed holder stays.
+   *
+   * Where the two implementations actually stand, per source. Both limbs are
+   * listed because a statement about one of them is not a statement about this
+   * method:
+   *
+   *  1. `sys_user_position` — sharing projects `valid_from` / `valid_until` and
+   *     drops rows on `isGrantActive` inside its own helper; we project
+   *     `user_id` alone, so an assignment that expired last month still routes.
+   *     This is the one real divergence, and it is the intended one.
+   *  2. `sys_member.role` — raw on BOTH sides (`TeamGraphService.expandRoleUsers`
+   *     projects `user_id` too). The table carries no window columns at all and
+   *     `isGrantActive` reads an absent bound as unbounded, so there is nothing
+   *     a filter could do here; membership tier names have no `sys_position`
+   *     row either (#8710's "a name with no row is untouched" fallback), so no
+   *     catalogue flag either. This limb cannot be brought into parity by
+   *     adding a filter — see {@link expandMembershipTierUsers}.
+   *  3. `sys_position.active` — the sharing engine's gate for it lives at the
+   *     RULE EVALUATOR's call site (`positionConfersAccess` in
+   *     `sharing-rule-service.ts`), not inside `PositionGraphService`; the same
+   *     ruling gives it no counterpart on this path.
+   *
+   * The omission is per-READ, not a missing dependency: `isGrantActive` is
+   * imported in this file and IS applied to `sys_approval_delegation` in
+   * {@link lookupActiveDelegation}. ⛔ So do not "fix" this by adding the window
+   * filter here — that is the option #8710 rejected, on the reasoning above.
    */
   async expandPositionUsers(positionName, organizationId) {
     if (!positionName) return [];
@@ -2881,6 +3248,13 @@ var _ApprovalService = class _ApprovalService {
    * NOT positions. Named for the projection (`org_membership_level`, ADR-0057
    * D7 / ADR-0090 D3), not for better-auth's column: the column name is theirs
    * and stays, the platform-facing word does not.
+   *
+   * Read RAW, like every routing read here, and with nothing available to
+   * filter even if it were not: `sys_member` carries no ADR-0091 D2 window
+   * columns, and a tier name has no `sys_position` row to read `active` off.
+   * {@link expandPositionUsers} carries the ruling both reads inherit
+   * (#8613 / #8710) — this method is also the second limb of that union, so a
+   * change here changes position routing too.
    */
   async expandMembershipTierUsers(tier, organizationId) {
     if (!tier) return [];
@@ -2894,7 +3268,36 @@ var _ApprovalService = class _ApprovalService {
     }
     return Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
   }
-  async lookupManager(userId) {
+  /**
+   * `sys_user.manager_id`, screened to the request's organization (#10153).
+   *
+   * Takes an organization argument for the same reason its siblings do
+   * ({@link expandPositionUsers}, {@link expandMembershipTierUsers}): an
+   * approver expansion answers "who, in THIS organization". Before #10153 this
+   * one did not ask, and it was the only expansion that did not — a
+   * `manager_id` pointing at a person in another organization routed that
+   * person an approval over a record they are not a tenant of.
+   *
+   * ⚠️ The screen reads `sys_member`, which LOOKS like the D2 read-visibility
+   * filter next to it ({@link filterApproversWhoCanRead}). It is not, and this
+   * comment exists so the next reader does not conclude that #7497 (does
+   * approver routing imply record read visibility?) was settled here. It was
+   * not. Two facts make this the SIBLING treatment rather than a
+   * read-visibility ruling:
+   *
+   *   1. Two of the three org-scoped expansions already screen on exactly this
+   *      column — `expandMembershipTierUsers` filters `sys_member.organization_id`
+   *      outright, and it is also the second limb of `expandPositionUsers`. So
+   *      `sys_member.organization_id` is already this file's answer to "which
+   *      organization is this person in", independent of what they may read.
+   *   2. `sys_user` carries no `organization_id` at all. It is a GLOBAL identity
+   *      table, so a membership row is the only tenancy fact that exists for a
+   *      user — there is no other read this screen could have been written with.
+   *
+   * This change grants no reads and applies no read screen to any type that
+   * lacks one today, so it decides nothing #7497 asks.
+   */
+  async lookupManager(userId, organizationId) {
     try {
       const rows = await this.engine.find("sys_user", {
         where: { id: userId },
@@ -2903,11 +3306,64 @@ var _ApprovalService = class _ApprovalService {
         context: SYSTEM_CTX2
       });
       const row = Array.isArray(rows) ? rows[0] : null;
-      return row?.manager_id ? String(row.manager_id) : null;
+      const managerId = row?.manager_id ? String(row.manager_id) : null;
+      if (!managerId) return null;
+      if (await this.managerIsProvablyOutsideOrg(managerId, organizationId)) return null;
+      return managerId;
     } catch {
       return null;
     }
   }
+  /**
+   * Is `managerId` PROVABLY a member of other organizations and not of
+   * `organizationId`? (#10153)
+   *
+   * "Provably" is the whole shape of this screen, and it is deliberate rather
+   * than a weaker version of "must prove membership":
+   *
+   *   - membership rows exist for this user, none in the request's org
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ screen him out;
+   *   - no membership rows at all, or the read failed
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The fail-open half is not timidity, it is this file's ruled posture on
+   * addressing paths, stated twice already: {@link filterApproversWhoCanRead}
+   * refuses to empty a live slate on an infrastructure hiccup, and
+   * {@link expandPositionUsers} carries "a step routing to nobody is worse than
+   * one routing to a lapsed holder". It is also load-bearing in practice — a
+   * stack that stamps an organization on its requests but does not materialize
+   * `sys_member` rows would otherwise lose every manager approver at once,
+   * which is a bigger behaviour change than the hole being closed. Measured:
+   * this repo's own `type:manager` out-of-office fixture is such a stack.
+   *
+   * Screening the MANAGER only, before OOO delegation, is deliberate too: the
+   * delegate arrives from `sys_approval_delegation`, whose rows already carry
+   * (and are already filtered by) an `organization_id` in
+   * {@link lookupActiveDelegation}. This card is about `sys_user.manager_id`.
+   */
+  async managerIsProvablyOutsideOrg(managerId, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg) return false;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_member", {
+        where: { user_id: managerId },
+        fields: ["user_id", "organization_id"],
+        limit: 1e3,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return false;
+    }
+    const orgs = (rows ?? []).map((r) => String(r?.organization_id ?? "")).filter(Boolean);
+    if (!orgs.length) return false;
+    if (orgs.includes(requestOrg)) return false;
+    this.logger?.warn?.(
+      `[approvals] #10153: manager '${managerId}' was dropped from the approver slate \u2014 'sys_user.manager_id' points across an organization boundary. He holds membership in ${orgs.length} organization(s), none of them the request's organization '${requestOrg}', so routing this approval to him would put approval authority over the record outside its tenant. Fix the 'manager_id' link, grant him a membership in this organization, or route this step with an approver type that names someone in it.`,
+      { managerId, requestOrganizationId: requestOrg, managerOrganizationIds: orgs }
+    );
+    return true;
+  }
   /**
    * Out-of-office auto-skip (#1322 M1). Given an individually-routed approver
    * id, follow any active `sys_approval_delegation` chain and return the id the
@@ -5033,8 +5489,70 @@ var _ApprovalService = class _ApprovalService {
     return { requests: desired.size, inserted, deleted };
   }
   // ── Read API ─────────────────────────────────────────────────
+  /**
+   * [#11040] May the free-text pushdown carry an arm on the SNAPSHOT column,
+   * for THIS caller over THIS query's scope?
+   *
+   * `payload_json` is the one searched column whose contents the serve path
+   * masks per reader (`redactPayloads`, #10749). A predicate over it is
+   * evaluated by the driver against the column AT REST — unmasked, before
+   * anything is served — so for a caller whose view of the snapshot is masked,
+   * row membership answers questions about contents that caller may not read.
+   * The other four arms are columns of `sys_approval_request` itself, which
+   * every caller who can see the row reads whole; they are untouched.
+   *
+   * ## The invariant this method exists to hold
+   *
+   * "This caller's view is masked" is read from **the same authority and the
+   * same per-caller call as the serve path** — `resolveReadableSnapshotFields`,
+   * asked as the CALLER (never `SYSTEM_CTX`). A second, independently derived
+   * notion of "redacted" — comparing the readable set against the object's
+   * schema, say — would be a fresh source of drift, and drift between the
+   * serve rule and the filter rule IS the defect this closes, reconstituted one
+   * layer down. So the only "not masked" answer accepted here is the one serve
+   * itself acts on: `undefined`, the seam's documented do-not-narrow branch.
+   * When the seam holds a concrete list the mask is IN FORCE, whether or not it
+   * happens to remove a key from any particular row — a row-dependent question
+   * no predicate can answer before rows exist.
+   *
+   * ## The two predicate-time cases
+   *
+   * Redaction is decided per ROW (each row names its own subject object, hence
+   * its own readable set), but a filter is built before any row exists:
+   *
+   *  - **authority absent** — `resolveReadableSnapshotFields` answers
+   *    `undefined` for EVERY object, so serve hands over every snapshot whole.
+   *    Keeping the arm leaks nothing serve does not already hand over, and this
+   *    is the shape every deployment that has not wired the security plugin
+   *    gets: search is byte-for-byte unchanged. Checked first, and that order
+   *    is load-bearing — see the object-scope note below.
+   *  - **authority wired** — the readable set is per object, so the arm is
+   *    admissible only for a scope of exactly one KNOWN object. With
+   *    `filter.object` present that object is known at predicate time and the
+   *    seam is asked about it directly. Absent, the query spans every object
+   *    and there is nothing sound to ask, so the arm is dropped.
+   *
+   * Dropping an arm is strictly NARROWING: it never refuses a query and never
+   * widens what comes back, so the fail-closed direction is cheap here and is
+   * taken rather than reaching for a per-object predicate machine to avoid it.
+   * Refusing the query outright would be the louder behaviour change, and is
+   * deliberately not what this does.
+   */
+  async freeTextMayMatchSnapshot(objectInScope, context) {
+    const authority = this.fieldVisibility;
+    if (!authority || typeof authority.getReadableFields !== "function") return true;
+    const object = String(objectInScope ?? "").trim();
+    if (!object) return false;
+    const readable = await resolveReadableSnapshotFields(
+      authority,
+      object,
+      context,
+      this.logger
+    );
+    return readable === void 0;
+  }
   /** Filter type accepted by {@link listRequests} / {@link countRequests}. */
-  buildRequestWhere(filter, context) {
+  async buildRequestWhere(filter, context) {
     const f = {};
     if (filter?.object) f.object_name = filter.object;
     if (filter?.recordId) f.record_id = filter.recordId;
@@ -5043,13 +5561,16 @@ var _ApprovalService = class _ApprovalService {
     if (tenantOrg) f.organization_id = tenantOrg;
     const q = filter?.q?.trim();
     if (q) {
-      f.$or = [
+      const arms = [
         { process_name: { $contains: q } },
         { object_name: { $contains: q } },
         { record_id: { $contains: q } },
-        { submitter_id: { $contains: q } },
-        { payload_json: { $contains: q } }
+        { submitter_id: { $contains: q } }
       ];
+      if (await this.freeTextMayMatchSnapshot(filter?.object, context)) {
+        arms.push({ payload_json: { $contains: q } });
+      }
+      f.$or = arms;
     }
     if (Array.isArray(filter?.status)) {
       const statuses = filter.status.filter(Boolean);
@@ -5110,7 +5631,7 @@ var _ApprovalService = class _ApprovalService {
    * is a plain membership test over the resolved ids). So this cannot hide a
    * request from someone who could actually act on it.
    */
-  async visibleRequestIds(context, tenantOrg) {
+  async visibleRequestIds(context, tenantOrg, target) {
     if (this.isOverrideActor(context, tenantOrg)) return null;
     const uid2 = context?.userId != null ? String(context.userId) : "";
     if (!uid2) return /* @__PURE__ */ new Set();
@@ -5152,8 +5673,90 @@ var _ApprovalService = class _ApprovalService {
         error: err instanceof Error ? err.message : String(err)
       });
     }
+    await this.addRecordReaderVisibleIds(ids, context, tenantOrg, target);
     return ids;
   }
+  /**
+   * [#8652] Read-only approval visibility derived from READ ACCESS TO THE
+   * TARGET BUSINESS RECORD.
+   *
+   * Maintainer ruling 2026-08-15: a user who can read the target record may
+   * view that record's approval requests and full action history, read-only,
+   * behind a switch that is default OFF, anchored on the EXISTING record-read
+   * permission. The rejected alternative was a host-injected visibility hook —
+   * a security predicate the platform could neither constrain nor audit.
+   *
+   * ## How the anchor is evaluated
+   *
+   * By asking the engine to read the record AS THE CALLER. That is the whole
+   * check: `engine.find(object, { where: { id }, context })` runs the ordinary
+   * ObjectQL middleware — object CRUD read, then RLS — so a denial throws and a
+   * row the caller may not see comes back empty. Both mean "no". No new
+   * permission, role or grant type is invented, and no second copy of the
+   * access rule exists to drift from the first.
+   *
+   * ⚠️ The caller's context is load-bearing. Probing with {@link SYSTEM_CTX} —
+   * the context every other read in this service uses — would read exactly like
+   * a permission check while admitting every authenticated user in the tenant.
+   *
+   * ## Why it needs a NAMED TARGET, and what that deliberately excludes
+   *
+   * The rule is anchored on one record, so it can only be evaluated where a
+   * record is named: a list filtered by `object` + `recordId` (what a record
+   * page's approval tab sends), or a request loaded by id (whose own row names
+   * its target). An UNTARGETED list — the inbox — is left exactly as it was:
+   * answering it under this tier would mean probing every request in the tenant
+   * for read access, which is unbounded, and would turn a work queue into a
+   * browse surface. The confirmed consumer is the record page; the inbox is not
+   * part of the ruling and is not widened here.
+   *
+   * ## What becomes visible (stated plainly, because the switch is an opt-in)
+   *
+   * The request row — including its `payload` snapshot of the record at
+   * submission time — plus the full action history: actor, decision, timestamp,
+   * the action's COMMENT text, and (through the same gate, via
+   * {@link ApprovalService.authorizeFileRead}) any decision attachments. The
+   * comment text is the ruling's "full action history" read literally; it is
+   * flagged on the card as the one granularity edge worth a second look.
+   *
+   * Read-only is not enforced here and must not be: the decision paths
+   * (`decideNode` / `reassign` / `recall` / `comment`) authorize on the pending
+   * approver slate, the submitter, or {@link ApprovalService.isOverrideActor},
+   * none of which this tier touches. Seeing a request confers nothing.
+   */
+  async addRecordReaderVisibleIds(ids, context, tenantOrg, target) {
+    if (this.recordReaderVisibleObjects.size === 0) return;
+    const object = String(target?.object ?? "").trim();
+    const recordId = String(target?.recordId ?? "").trim();
+    if (!object || !recordId) return;
+    if (!this.recordReaderVisibleObjects.has(object)) return;
+    const uid2 = context?.userId != null ? String(context.userId) : "";
+    if (!uid2) return;
+    try {
+      const readable = await this.engine.find(object, {
+        where: { id: recordId },
+        fields: ["id"],
+        limit: 1,
+        context
+      });
+      if (!Array.isArray(readable) || readable.length === 0) return;
+      const orgWhere = tenantOrg ? { organization_id: tenantOrg } : {};
+      const rows = await this.engine.find("sys_approval_request", {
+        where: { object_name: object, record_id: recordId, ...orgWhere },
+        fields: ["id"],
+        limit: _ApprovalService.APPROVER_INDEX_CAP,
+        context: SYSTEM_CTX2
+      });
+      for (const r of Array.isArray(rows) ? rows : []) {
+        if (r?.id != null) ids.add(String(r.id));
+      }
+    } catch (err) {
+      this.logger?.debug?.("[approvals] record-reader visibility probe declined", {
+        object,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
   /** Intersect an existing `where.id` constraint with the participant set. */
   applyVisibility(where, visible) {
     if (!visible) return true;
@@ -5170,14 +5773,17 @@ var _ApprovalService = class _ApprovalService {
     return true;
   }
   async listRequests(filter, context) {
-    const { where, tenantOrg } = this.buildRequestWhere(filter, context);
+    const { where, tenantOrg } = await this.buildRequestWhere(filter, context);
     const approverTargets = (Array.isArray(filter?.approverId) ? filter.approverId : filter?.approverId ? [filter.approverId] : []).map((t) => String(t).trim()).filter(Boolean);
     const ids = await this.approverRequestIds(approverTargets, tenantOrg);
     if (ids) {
       if (ids.length === 0) return [];
       where.id = ids.length === 1 ? ids[0] : { $in: ids };
     }
-    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg))) return [];
+    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg, {
+      object: filter?.object,
+      recordId: filter?.recordId
+    }))) return [];
     const findOpts = {
       where,
       orderBy: [{ field: "created_at", order: "desc" }],
@@ -5191,19 +5797,23 @@ var _ApprovalService = class _ApprovalService {
     }
     const rows = await this.engine.find("sys_approval_request", findOpts);
     const list = Array.isArray(rows) ? rows.map(rowFromRequest) : [];
+    await this.redactPayloads(list, context);
     await this.enrichRows(list);
     this.attachViewers(list, context);
     return list;
   }
   async countRequests(filter, context) {
-    const { where, tenantOrg } = this.buildRequestWhere(filter, context);
+    const { where, tenantOrg } = await this.buildRequestWhere(filter, context);
     const approverTargets = (Array.isArray(filter?.approverId) ? filter.approverId : filter?.approverId ? [filter.approverId] : []).map((t) => String(t).trim()).filter(Boolean);
     const ids = await this.approverRequestIds(approverTargets, tenantOrg);
     if (ids) {
       if (ids.length === 0) return 0;
       where.id = ids.length === 1 ? ids[0] : { $in: ids };
     }
-    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg))) return 0;
+    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg, {
+      object: filter?.object,
+      recordId: filter?.recordId
+    }))) return 0;
     const countFn = this.engine.count;
     if (typeof countFn === "function") {
       try {
@@ -5249,10 +5859,14 @@ var _ApprovalService = class _ApprovalService {
     });
     if (!Array.isArray(rows) || !rows[0]) return null;
     if (enforceVisibility) {
-      const visible = await this.visibleRequestIds(context, tenantOrg ?? null);
+      const visible = await this.visibleRequestIds(context, tenantOrg ?? null, {
+        object: rows[0].object_name,
+        recordId: rows[0].record_id
+      });
       if (visible && !visible.has(String(rows[0].id))) return null;
     }
     const row = rowFromRequest(rows[0]);
+    await this.redactPayloads([row], context);
     await this.enrichRows([row]);
     await this.attachFlowSteps(row);
     await this.attachDecisionProgress(row, rows[0]);
@@ -5756,6 +6370,52 @@ function unbindAllHooks(engine) {
   return engine.unregisterHooksByPackage(APPROVALS_HOOK_PACKAGE);
 }
 
+// src/payload-redaction-middleware.ts
+var APPROVAL_REQUEST_OBJECT = "sys_approval_request";
+function parseSnapshot(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return { ok: false, value: void 0 };
+  try {
+    return { ok: true, value: JSON.parse(raw) };
+  } catch {
+    return { ok: false, value: void 0 };
+  }
+}
+async function redactRowsInPlace(rows, security, context, logger) {
+  const list = Array.isArray(rows) ? rows : rows ? [rows] : [];
+  if (list.length === 0) return;
+  const cache = /* @__PURE__ */ new Map();
+  for (const row of list) {
+    if (!row || typeof row !== "object") continue;
+    const raw = row.payload_json;
+    const parsed = parseSnapshot(raw);
+    if (!parsed.ok) continue;
+    const object = String(row.object_name ?? "").trim();
+    if (!object) continue;
+    if (!cache.has(object)) {
+      cache.set(object, await resolveReadableSnapshotFields(security, object, context, logger));
+    }
+    const readable = cache.get(object);
+    if (readable === void 0) continue;
+    const { payload, redactedKeys } = redactSnapshot(parsed.value, readable);
+    if (redactedKeys.length === 0) continue;
+    row.payload_json = JSON.stringify(payload);
+  }
+}
+function bindSnapshotRedactionMiddleware(engine, getSecurity, logger) {
+  engine.registerMiddleware(async (opCtx, next) => {
+    await next();
+    if (opCtx?.operation !== "find" && opCtx?.operation !== "findOne") return;
+    if (opCtx?.context?.isSystem) return;
+    try {
+      await redactRowsInPlace(opCtx.result, getSecurity(), opCtx.context, logger);
+    } catch (err) {
+      logger?.warn?.("[approvals] snapshot redaction middleware failed", {
+        error: err?.message ?? String(err)
+      });
+    }
+  }, { object: APPROVAL_REQUEST_OBJECT });
+}
+
 // src/approval-node.ts
 var import_automation3 = require("@objectstack/spec/automation");
 
@@ -6001,6 +6661,9 @@ var ApprovalsServicePlugin = class {
       engine,
       logger: ctx.logger,
       publicBaseUrl: this.options.publicBaseUrl,
+      // [#8652] Read-only record-reader visibility. Default OFF — an absent
+      // declaration reaches the service as an empty set and changes nothing.
+      recordReaderVisibleObjects: this.options.recordReaderVisibleObjects,
       // [ADR-0105 D9] Cross-organization approver targeting is a `group`-posture
       // capability. Read LAZILY (not captured at start) because the tenancy
       // service resolves its posture during its own start, which may not have
@@ -6016,11 +6679,26 @@ var ApprovalsServicePlugin = class {
         }
       }
     });
+    const fieldVisibility = () => {
+      try {
+        const sec = ctx.getService("security");
+        return sec && typeof sec.getReadableFields === "function" ? sec : void 0;
+      } catch {
+        return void 0;
+      }
+    };
+    this.service.attachFieldVisibility({
+      getReadableFields: (object, context) => {
+        const sec = fieldVisibility();
+        return sec ? sec.getReadableFields(object, context) : Promise.resolve(void 0);
+      }
+    });
     if (!this.options.disableAutoHooks) {
       try {
         unbindAllHooks(engine);
         bindApprovalLockHook(engine, ctx.logger);
         bindDelegationWriteGuard(engine, ctx.logger);
+        bindSnapshotRedactionMiddleware(engine, fieldVisibility, ctx.logger);
       } catch (err) {
         ctx.logger.warn?.("[approvals] failed to bind approval hooks", { error: err?.message });
       }
@@ -6060,6 +6738,7 @@ var ApprovalsServicePlugin = class {
           }
         };
         await jobs.schedule(ESCALATION_JOB_NAME, { type: "interval", intervalMs }, sweep);
+        this.jobService = jobs;
         this.escalationJobScheduled = true;
         void sweep().catch((err) => {
           ctx.logger.warn?.("[approvals] boot sweep failed", { error: err?.message });
@@ -6146,14 +6825,32 @@ var ApprovalsServicePlugin = class {
       );
     }
   }
-  async stop(ctx) {
+  /**
+   * The kernel's teardown hook (`Plugin.destroy?()`, core `types.ts`) — the
+   * ONLY teardown entry point `ObjectKernel.performShutdown()` and
+   * `LiteKernel.destroy()` invoke.
+   *
+   * [#10371] IT USED TO BE `stop()`, WHICH NOTHING CALLED. `Plugin` declares
+   * `init()`, `start?()` and `destroy?()` and no `stop()`, so the kernel walked
+   * past this plugin at shutdown: the SLA escalation job stayed scheduled and
+   * this plugin's ObjectQL hooks stayed bound to an engine the kernel had
+   * finished with. `start()` IS on the interface, so the pair read as symmetric
+   * in review — that asymmetry is what let the same shape survive in six
+   * packages at once.
+   *
+   * This member owns no timer of its own (the escalation clock belongs to
+   * `service-job`), so it never cost a merge-queue eviction the way the
+   * `plugin-reports` / `service-messaging` members did (#9371). The class is
+   * the same one either way: a teardown the kernel does not reach.
+   */
+  async destroy() {
     if (this.escalationJobScheduled) {
       try {
-        const jobs = ctx.getService("job");
-        await jobs?.cancel?.(ESCALATION_JOB_NAME);
+        await this.jobService?.cancel?.(ESCALATION_JOB_NAME);
       } catch {
       }
       this.escalationJobScheduled = false;
+      this.jobService = void 0;
     }
     if (this.engine) {
       try {
@@ -6162,6 +6859,17 @@ var ApprovalsServicePlugin = class {
       }
     }
   }
+  /**
+   * Retained alias for {@link destroy}. Kept because it is public API of an
+   * exported class, and removing it would break an embedder who learned to call
+   * it directly precisely BECAUSE the kernel never did. The parameter is now
+   * optional and ignored: `destroy()` takes no context, so teardown uses the
+   * job service captured when the escalation clock was wired. Prefer kernel
+   * shutdown; direct callers keep working unchanged.
+   */
+  async stop(_ctx) {
+    await this.destroy();
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {