@objectstack/plugin-approvals 17.1.0 → 17.3.0

package/dist/index.mjs

@@ -29,7 +29,7 @@ var init_en_objects_generated = __esm({
           },
           organization_id: {
             label: "Organization",
-            help: "Tenant that owns this approval request (propagated from submitter context)"
+            help: "Organization of the record this request is about (falls back to the acting context when the record has none)"
           },
           process_name: {
             label: "Source",
@@ -55,7 +55,15 @@ var init_en_objects_generated = __esm({
               approved: "Approved",
               rejected: "Rejected",
               recalled: "Recalled",
-              returned: "Returned"
+              returned: "Returned",
+              cancelled: "Cancelled"
+            }
+          },
+          cancel_reason: {
+            label: "Cancellation Reason",
+            help: "Why the platform voided this request (set only when the status is cancelled)",
+            options: {
+              record_deleted: "Related record deleted"
             }
           },
           current_step: {
@@ -236,7 +244,8 @@ var init_en_objects_generated = __esm({
               comment: "Comment",
               revise: "Revise",
               resubmit: "Resubmit",
-              ooo_substitute: "Out-of-Office Substitution"
+              ooo_substitute: "Out-of-Office Substitution",
+              cancel: "Cancel"
             }
           },
           actor_id: {
@@ -350,7 +359,7 @@ var init_zh_CN_objects_generated = __esm({
           },
           organization_id: {
             label: "\u7EC4\u7EC7",
-            help: "\u62E5\u6709\u8BE5\u5BA1\u6279\u8BF7\u6C42\u7684\u79DF\u6237\uFF08\u4ECE\u63D0\u4EA4\u65B9\u4E0A\u4E0B\u6587\u4F20\u64AD\uFF09"
+            help: "\u8BE5\u8BF7\u6C42\u6240\u6D89\u8BB0\u5F55\u6240\u5C5E\u7684\u7EC4\u7EC7\uFF08\u8BB0\u5F55\u65E0\u7EC4\u7EC7\u65F6\u56DE\u9000\u5230\u64CD\u4F5C\u4E0A\u4E0B\u6587\uFF09"
           },
           process_name: {
             label: "\u6765\u6E90",
@@ -376,7 +385,15 @@ var init_zh_CN_objects_generated = __esm({
               approved: "\u5DF2\u6279\u51C6",
               rejected: "\u5DF2\u62D2\u7EDD",
               recalled: "\u5DF2\u64A4\u56DE",
-              returned: "\u5DF2\u9000\u56DE\u4FEE\u6539"
+              returned: "\u5DF2\u9000\u56DE\u4FEE\u6539",
+              cancelled: "\u5DF2\u4F5C\u5E9F"
+            }
+          },
+          cancel_reason: {
+            label: "\u4F5C\u5E9F\u539F\u56E0",
+            help: "\u5E73\u53F0\u4F5C\u5E9F\u8BE5\u5BA1\u6279\u5355\u7684\u539F\u56E0(\u4EC5\u5728\u72B6\u6001\u4E3A\u300C\u5DF2\u4F5C\u5E9F\u300D\u65F6\u5199\u5165)",
+            options: {
+              record_deleted: "\u5173\u8054\u8BB0\u5F55\u5DF2\u5220\u9664"
             }
           },
           current_step: {
@@ -557,7 +574,8 @@ var init_zh_CN_objects_generated = __esm({
               comment: "\u8BC4\u8BBA",
               revise: "\u9000\u56DE\u4FEE\u6539",
               resubmit: "\u91CD\u65B0\u63D0\u4EA4",
-              ooo_substitute: "\u4E0D\u5728\u5C97\u6539\u6D3E"
+              ooo_substitute: "\u4E0D\u5728\u5C97\u6539\u6D3E",
+              cancel: "\u4F5C\u5E9F"
             }
           },
           actor_id: {
@@ -671,7 +689,7 @@ var init_ja_JP_objects_generated = __esm({
           },
           organization_id: {
             label: "\u7D44\u7E54",
-            help: "\u3053\u306E\u627F\u8A8D\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u6240\u6709\u3059\u308B\u30C6\u30CA\u30F3\u30C8\uFF08\u9001\u4FE1\u8005\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u304B\u3089\u4F1D\u64AD\uFF09"
+            help: "\u3053\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u5BFE\u8C61\u30EC\u30B3\u30FC\u30C9\u304C\u5C5E\u3059\u308B\u7D44\u7E54\uFF08\u30EC\u30B3\u30FC\u30C9\u306B\u7D44\u7E54\u304C\u306A\u3044\u5834\u5408\u306F\u64CD\u4F5C\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\uFF09"
           },
           process_name: {
             label: "\u30BD\u30FC\u30B9",
@@ -697,7 +715,15 @@ var init_ja_JP_objects_generated = __esm({
               approved: "\u627F\u8A8D\u6E08\u307F",
               rejected: "\u5374\u4E0B\u6E08\u307F",
               recalled: "\u53D6\u308A\u6D88\u3057\u6E08\u307F",
-              returned: "\u5DEE\u3057\u623B\u3057\u6E08\u307F"
+              returned: "\u5DEE\u3057\u623B\u3057\u6E08\u307F",
+              cancelled: "\u7121\u52B9\u5316\u6E08\u307F"
+            }
+          },
+          cancel_reason: {
+            label: "\u7121\u52B9\u5316\u7406\u7531",
+            help: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u304C\u3053\u306E\u7533\u8ACB\u3092\u7121\u52B9\u5316\u3057\u305F\u7406\u7531(\u30B9\u30C6\u30FC\u30BF\u30B9\u304C\u7121\u52B9\u5316\u6E08\u307F\u306E\u5834\u5408\u306E\u307F\u8A2D\u5B9A)",
+            options: {
+              record_deleted: "\u95A2\u9023\u30EC\u30B3\u30FC\u30C9\u304C\u524A\u9664\u3055\u308C\u307E\u3057\u305F"
             }
           },
           current_step: {
@@ -878,7 +904,8 @@ var init_ja_JP_objects_generated = __esm({
               comment: "\u30B3\u30E1\u30F3\u30C8",
               revise: "\u5DEE\u3057\u623B\u3057",
               resubmit: "\u518D\u63D0\u51FA",
-              ooo_substitute: "\u4E0D\u5728\u6642\u4EE3\u7406"
+              ooo_substitute: "\u4E0D\u5728\u6642\u4EE3\u7406",
+              cancel: "\u7121\u52B9\u5316"
             }
           },
           actor_id: {
@@ -992,7 +1019,7 @@ var init_es_ES_objects_generated = __esm({
           },
           organization_id: {
             label: "Organizaci\xF3n",
-            help: "Tenant que posee esta solicitud de aprobaci\xF3n (propagado desde el contexto del solicitante)."
+            help: "Organizaci\xF3n del registro al que se refiere esta solicitud (recurre al contexto del actor cuando el registro no tiene ninguna)."
           },
           process_name: {
             label: "Origen",
@@ -1018,7 +1045,15 @@ var init_es_ES_objects_generated = __esm({
               approved: "Aprobada",
               rejected: "Rechazada",
               recalled: "Retirada",
-              returned: "Devuelta para revisi\xF3n"
+              returned: "Devuelta para revisi\xF3n",
+              cancelled: "Anulada"
+            }
+          },
+          cancel_reason: {
+            label: "Motivo de anulaci\xF3n",
+            help: "Por qu\xE9 la plataforma anul\xF3 esta solicitud (solo se establece cuando el estado es Anulada)",
+            options: {
+              record_deleted: "Registro relacionado eliminado"
             }
           },
           current_step: {
@@ -1199,7 +1234,8 @@ var init_es_ES_objects_generated = __esm({
               comment: "Comentario",
               revise: "Devoluci\xF3n",
               resubmit: "Reenv\xEDo",
-              ooo_substitute: "Sustituci\xF3n por ausencia"
+              ooo_substitute: "Sustituci\xF3n por ausencia",
+              cancel: "Anulaci\xF3n"
             }
           },
           actor_id: {
@@ -1297,12 +1333,104 @@ var init_es_ES_objects_generated = __esm({
   }
 });
 
+// src/translations/zh-CN.source-hashes.generated.ts
+var zhCNGeneratedSourceHashes;
+var init_zh_CN_source_hashes_generated = __esm({
+  "src/translations/zh-CN.source-hashes.generated.ts"() {
+    "use strict";
+    zhCNGeneratedSourceHashes = {
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
+// src/translations/ja-JP.source-hashes.generated.ts
+var jaJPGeneratedSourceHashes;
+var init_ja_JP_source_hashes_generated = __esm({
+  "src/translations/ja-JP.source-hashes.generated.ts"() {
+    "use strict";
+    jaJPGeneratedSourceHashes = {
+      "objects.sys_approval_delegation._views.active.emptyState.message": "1095d61c017b6db2",
+      "objects.sys_approval_delegation._views.active.emptyState.title": "799d28e51d88963e",
+      "objects.sys_approval_delegation._views.active.label": "eee107cf4e466779",
+      "objects.sys_approval_delegation.description": "432b0435aa15f6b9",
+      "objects.sys_approval_delegation.fields.created_at.label": "1f02d416befb595b",
+      "objects.sys_approval_delegation.fields.delegate_id.help": "9cfc641f7b0b04f9",
+      "objects.sys_approval_delegation.fields.delegate_id.label": "afd6d8733dc5bc14",
+      "objects.sys_approval_delegation.fields.delegator_id.help": "c4686c5c9f24e0be",
+      "objects.sys_approval_delegation.fields.delegator_id.label": "f76b1f95f2fdabff",
+      "objects.sys_approval_delegation.fields.id.label": "3383564051b4b76d",
+      "objects.sys_approval_delegation.fields.organization_id.help": "f02982e88229d9ca",
+      "objects.sys_approval_delegation.fields.organization_id.label": "3e55836156e1c1de",
+      "objects.sys_approval_delegation.fields.reason.help": "712516f1461dff2b",
+      "objects.sys_approval_delegation.fields.reason.label": "ac399f03d7f2e64d",
+      "objects.sys_approval_delegation.fields.updated_at.label": "aba63dc2a9c79b8d",
+      "objects.sys_approval_delegation.fields.valid_from.help": "01386010c454bfbd",
+      "objects.sys_approval_delegation.fields.valid_from.label": "02eaf201e57c9eda",
+      "objects.sys_approval_delegation.fields.valid_until.help": "a48ea34e65933e9d",
+      "objects.sys_approval_delegation.fields.valid_until.label": "a68db5bd4fc72a13",
+      "objects.sys_approval_delegation.label": "4389c4fe5f5c9746",
+      "objects.sys_approval_delegation.pluralLabel": "f07fec3ffd74e6db",
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
+// src/translations/es-ES.source-hashes.generated.ts
+var esESGeneratedSourceHashes;
+var init_es_ES_source_hashes_generated = __esm({
+  "src/translations/es-ES.source-hashes.generated.ts"() {
+    "use strict";
+    esESGeneratedSourceHashes = {
+      "objects.sys_approval_action.fields.actor_id.label": "b155813f8a7f06e3",
+      "objects.sys_approval_delegation._views.active.emptyState.message": "1095d61c017b6db2",
+      "objects.sys_approval_delegation._views.active.emptyState.title": "799d28e51d88963e",
+      "objects.sys_approval_delegation._views.active.label": "eee107cf4e466779",
+      "objects.sys_approval_delegation.description": "432b0435aa15f6b9",
+      "objects.sys_approval_delegation.fields.created_at.label": "1f02d416befb595b",
+      "objects.sys_approval_delegation.fields.delegate_id.help": "9cfc641f7b0b04f9",
+      "objects.sys_approval_delegation.fields.delegate_id.label": "afd6d8733dc5bc14",
+      "objects.sys_approval_delegation.fields.delegator_id.help": "c4686c5c9f24e0be",
+      "objects.sys_approval_delegation.fields.delegator_id.label": "f76b1f95f2fdabff",
+      "objects.sys_approval_delegation.fields.id.label": "3383564051b4b76d",
+      "objects.sys_approval_delegation.fields.organization_id.help": "f02982e88229d9ca",
+      "objects.sys_approval_delegation.fields.organization_id.label": "3e55836156e1c1de",
+      "objects.sys_approval_delegation.fields.reason.help": "712516f1461dff2b",
+      "objects.sys_approval_delegation.fields.reason.label": "ac399f03d7f2e64d",
+      "objects.sys_approval_delegation.fields.updated_at.label": "aba63dc2a9c79b8d",
+      "objects.sys_approval_delegation.fields.valid_from.help": "01386010c454bfbd",
+      "objects.sys_approval_delegation.fields.valid_from.label": "02eaf201e57c9eda",
+      "objects.sys_approval_delegation.fields.valid_until.help": "a48ea34e65933e9d",
+      "objects.sys_approval_delegation.fields.valid_until.label": "a68db5bd4fc72a13",
+      "objects.sys_approval_delegation.label": "4389c4fe5f5c9746",
+      "objects.sys_approval_delegation.pluralLabel": "f07fec3ffd74e6db",
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
 // src/translations/index.ts
 var translations_exports = {};
 __export(translations_exports, {
   ApprovalsTranslations: () => ApprovalsTranslations
 });
-var ApprovalsTranslations;
+import { withSourceFallback } from "@objectstack/platform-objects/apps";
+var enSource, ApprovalsTranslations;
 var init_translations = __esm({
   "src/translations/index.ts"() {
     "use strict";
@@ -1310,18 +1438,27 @@ var init_translations = __esm({
     init_zh_CN_objects_generated();
     init_ja_JP_objects_generated();
     init_es_ES_objects_generated();
+    init_zh_CN_source_hashes_generated();
+    init_ja_JP_source_hashes_generated();
+    init_es_ES_source_hashes_generated();
+    enSource = { objects: enObjects };
     ApprovalsTranslations = {
-      en: { objects: enObjects },
-      "zh-CN": { objects: zhCNObjects },
-      "ja-JP": { objects: jaJPObjects },
-      "es-ES": { objects: esESObjects }
+      en: enSource,
+      "zh-CN": withSourceFallback({ objects: zhCNObjects }, enSource, void 0, zhCNGeneratedSourceHashes),
+      "ja-JP": withSourceFallback({ objects: jaJPObjects }, enSource, void 0, jaJPGeneratedSourceHashes),
+      "es-ES": withSourceFallback({ objects: esESObjects }, enSource, void 0, esESGeneratedSourceHashes)
     };
   }
 });
 
 // src/sys-approval-request.object.ts
 import { ObjectSchema, Field } from "@objectstack/spec/data";
-import { APPROVAL_STATUSES, APPROVAL_STATUS_LABELS } from "@objectstack/spec/contracts";
+import {
+  APPROVAL_STATUSES,
+  APPROVAL_STATUS_LABELS,
+  APPROVAL_CANCEL_REASONS,
+  APPROVAL_CANCEL_REASON_LABELS
+} from "@objectstack/spec/contracts";
 var SysApprovalRequest = ObjectSchema.create({
   name: "sys_approval_request",
   label: "Approval Request",
@@ -1368,7 +1505,10 @@ var SysApprovalRequest = ObjectSchema.create({
       label: "Completed",
       data: { provider: "object", object: "sys_approval_request" },
       columns: ["process_name", "object_name", "record_id", "status", "submitter_id", "completed_at"],
-      filter: [{ field: "status", operator: "in", value: ["approved", "rejected", "recalled"] }],
+      // Every terminal state, `cancelled` included (#13568) — a platform-voided
+      // request is kept as audit evidence, and a terminal state absent from the
+      // only curated terminal view is evidence nobody can find.
+      filter: [{ field: "status", operator: "in", value: ["approved", "rejected", "recalled", "cancelled"] }],
       sort: [{ field: "completed_at", order: "desc" }],
       pagination: { pageSize: 25 }
     },
@@ -1384,46 +1524,40 @@ var SysApprovalRequest = ObjectSchema.create({
   },
   fields: {
     id: Field.text({ label: "Request ID", required: true, readonly: true, group: "System" }),
-    // ⚠️ MEASURED DEFECT, cloud#1395 — read this before trusting the column.
-    //
-    // An approval request DOES belong to an organization: it is read through the
-    // organization wall by the approvals inbox, and on a shared-database
-    // deployment a row carrying no organization is not filtered BY that wall —
-    // it is either invisible to everyone or visible to everyone, decided by
-    // whatever filter each surface happens to apply rather than by the data.
+    // [#10101, the cloud#1395 Option A ruling] The SUBJECT record's
+    // organization, with the acting context as fallback — resolved by the
+    // SHARED platform-row resolver (`resolveRecordOrganizationField`,
+    // `@objectstack/metadata-core`) in `openNodeRequest`, the row's only
+    // writer. The same `requestOrg` stamps `sys_approval_action` and the
+    // `sys_approval_approver` index, so all three move together.
     //
-    // The value is resolved from the ACTING CONTEXT only (`openNodeRequest`'s
-    // `ctxOrg`), so it is NULL whenever the flow that opened the request ran
-    // without one — every schedule / time-relative / api triggered run, none of
-    // which sets a tenant. On a walled single-database HotCRM SaaS boot this
-    // measured 27 of 27 rows org-less, each naming an `object_name` /
-    // `record_id` owned by a specific customer.
+    // Why subject-first: an approval request is read through the organization
+    // wall by the approvals inbox, and the acting context is NULL on every
+    // schedule / time-relative / api triggered run (none carries a tenant, by
+    // construction). Stamped from the actor alone — the pre-#10101 behaviour,
+    // measured on cloud#1395 as 27 of 27 rows org-less on a walled HotCRM SaaS
+    // boot — such a request LOCKED the record it was about while being
+    // invisible in every inbox, its owner's included. Subject-first is also
+    // what `sys_audit_log`'s writer already did (#8707 honouring #8287's
+    // ruling), so an approval row and an audit row about the same record now
+    // land behind the same wall instead of two.
     //
-    // ⛔ Do NOT read that as "platform tables do not carry an organization".
-    // `sys_audit_log` (1669 rows) was correctly attributed on the SAME boot,
-    // because its writer takes the organization from the RECORD the row is
-    // about, with the session only as fallback (plugin-audit
-    // `resolveRecordOrganizationField`, #8707 honouring #8287's ruling). Two
-    // writers read the actor; a third reads the subject. That disagreement is
-    // the defect.
-    //
-    // Which of the two a side-table row should follow is an open contract
-    // question on cloud#1395 — the audit resolver is scope-pinned to audit
-    // stamping by the #8778 ruling, so this writer needs its own. The same
-    // `ctxOrg` also stamps `sys_approval_action` and `sys_approval_approver`,
-    // so all three move together.
+    // The `sys_api_key` divergence is deliberate and preserved: its
+    // `tenancy.organizationField: 'active_organization_id'` (stamp-only,
+    // #8778) wins limb 0 of the shared resolver, while the credential table
+    // itself stays unwalled (`tenancy.enabled: false`) — who a row is ABOUT
+    // and what an object is WALLED by remain different questions.
     organization_id: Field.lookup("sys_organization", {
       label: "Organization",
       required: false,
       group: "System",
-      // ⛔ String unchanged on purpose: it is extracted into the generated i18n
-      // bundles (`translations/*.objects.generated.ts`, as `help`), so rewording
-      // it is a translation-regeneration change and not a comment. The
-      // correction it needs — it claims a propagation that measurably does not
-      // happen, and says "Tenant" where ADR-0120 §Terminology requires
-      // "organization" — rides the cloud#1395 write-side fix, which rewrites the
-      // sentence and regenerates the four locales in one pass.
-      description: "Tenant that owns this approval request (propagated from submitter context)"
+      // Reworded with the #10101 write-side fix (was "Tenant that owns this
+      // approval request (propagated from submitter context)" — it claimed a
+      // propagation that measurably did not happen, and said "Tenant" where
+      // ADR-0120 §Terminology requires "organization"). Extracted into the
+      // generated i18n bundles as `help`; the four locales regenerate in the
+      // same pass.
+      description: "Organization of the record this request is about (falls back to the acting context when the record has none)"
     }),
     process_name: Field.text({
       label: "Source",
@@ -1442,7 +1576,38 @@ var SysApprovalRequest = ObjectSchema.create({
       label: "Record ID",
       required: true,
       maxLength: 100,
-      group: "Target"
+      // [#11386] The id half of this object's pointer pair (ADR-0052 §5),
+      // adopting the #11339 carrier. VERIFIED for THIS object: the pair is not
+      // decoration but the key the approval machinery QUERIES ON —
+      // `approval-service.ts` finds a record's pending request with
+      // `where: { object_name, record_id, status: 'pending' }`, and
+      // `lifecycle-hooks.ts` holds the record LOCK on the same pair
+      // (single-record and `$in` batch forms). `submit()` writes it from
+      // `input.object` / `input.recordId`, so a stored value is always a
+      // record id of the object the sibling names.
+      //
+      // Consequence of declaring, sharper here than elsewhere: a seeded
+      // request whose `record_id` stayed a verbatim natural key locked
+      // NOTHING and appeared under no record — it looked like a pending
+      // approval while being invisible to both queries that give the row its
+      // meaning. That is now a loud seed-time refusal. Both halves are
+      // `required: true`, so the un-addressable case (id half authored, type
+      // half empty) is already unreachable on this object.
+      group: "Target",
+      //
+      // ⚠️ ORDERING CONSTRAINT — this id half is `required: true`, and that
+      // makes it ORDER-DEPENDENT in seeds even though a pointer pair
+      // contributes no static ordering edge (#11674, measured against the real
+      // engine in `packages/objectql/src/engine-seed-required-deferral.test.ts`):
+      // the seed loader defers an unresolvable reference by DELETING the column
+      // from the pass-1 insert, required-validation rejects that row, and pass 2
+      // is then left with no row to back-fill. So the pass-2 healing that makes
+      // an OPTIONAL id half order-independent (`sys_audit_log`) does not reach
+      // this one. ⇒ SEED THE TARGET DATASET FIRST. The failure if you do not is
+      // loud in three places — a write error naming this column, a
+      // dropped-deferral error, and `success: false` — and since #11674 the
+      // loader also WARNS at load time, before the engine rejects the row.
+      referenceVia: "object_name"
     }),
     submitter_id: Field.lookup("sys_user", {
       label: "Submitter",
@@ -1470,6 +1635,29 @@ var SysApprovalRequest = ObjectSchema.create({
         group: "State"
       }
     ),
+    // [#13568] Why a `cancelled` request was cancelled — the machine-readable
+    // half of the maintainer's 2026-08-31 ruling ("状态转 cancelled + 机器可读
+    // 原因"). Derived from `APPROVAL_CANCEL_REASONS`, never re-typed, on the
+    // same #3786 rule the `status` column above follows.
+    //
+    // On the ROW rather than on the `sys_approval_action` audit entry, because
+    // the readers are the inbox and the tombstone presentation, which page the
+    // request table: making them join the append-only action log to learn why a
+    // row they already hold is cancelled buys nothing and would make the reason
+    // unavailable to a plain list view. The action row still records the event
+    // (`action: 'cancel'`); this column records the STATE.
+    //
+    // Null on every non-cancelled row, and on rows written before the column
+    // existed — "not recorded", never "cancelled for no reason".
+    cancel_reason: Field.select(
+      APPROVAL_CANCEL_REASONS.map((value) => ({ value, label: APPROVAL_CANCEL_REASON_LABELS[value] })),
+      {
+        label: "Cancellation Reason",
+        required: false,
+        description: "Why the platform voided this request (set only when the status is cancelled)",
+        group: "State"
+      }
+    ),
     current_step: Field.text({
       label: "Current Step",
       required: false,
@@ -1489,6 +1677,22 @@ var SysApprovalRequest = ObjectSchema.create({
       description: "Comma-separated user ids who can act on the current step",
       group: "State"
     }),
+    // The module docstring above used to justify this column with "used by
+    // notifications so they can render before the record is locked or
+    // changed". That consumer does not exist, and the claim was cited as the
+    // reason the column holds a FULL row before anyone checked it. Measured
+    // against every `this.notify(...)` call site in `approval-service.ts` —
+    // all 12 of them: each passes `{ title, message, actionUrl }` (two also
+    // `actions`), built from `object_name` / `record_id` and the caller's
+    // comment. None reads this column or the parsed `payload`. The real
+    // readers are the serve path (`rowFromRequest` -> `payload`, redacted per
+    // reader), the decide-time approver re-resolution and the org backfill,
+    // both under SYSTEM_CTX, and the free-text predicate.
+    //
+    // The `description` below is deliberately UNCHANGED: it is accurate, and
+    // it is extracted into the four generated i18n bundles as `help`. The
+    // false sentence lived only in the JSDoc above, which is not extracted —
+    // so this correction moves no translation leaf.
     payload_json: Field.textarea({
       label: "Snapshot",
       required: false,
@@ -1559,11 +1763,14 @@ var SysApprovalRequest = ObjectSchema.create({
   // per-viewer block (#3310): approver actions on `record.viewer.can_act`
   // (the caller is a current pending approver — same check the service
   // authorizes a decision with, so position/team approvers resolve correctly),
-  // submitter actions on `record.viewer.is_submitter`. The core decision levers
-  // (approve/reject/reassign) additionally OR in `record.viewer.can_override`
-  // (#3424) so a platform/tenant admin can rescue a request routed to an
+  // submitter actions on `record.viewer.is_submitter`. The four levers the
+  // #3424 override covers (approve/reject/reassign, and recall since #12716)
+  // additionally OR in `record.viewer.can_override`
+  // so a platform/tenant admin can rescue a request routed to an
   // unstaffed position — otherwise undecidable, locking the record forever — by
-  // approving, rejecting, or reassigning it to a real approver. `viewer` is
+  // approving, rejecting, reassigning it to a real approver, or recalling it
+  // (the lever that releases the record without recording a decision nobody
+  // made). `viewer` is
   // attached by getRequest/listRequests; where it is absent the predicate fails
   // closed.
   //
@@ -1699,8 +1906,13 @@ var SysApprovalRequest = ObjectSchema.create({
     // Remind / recall (pending) and resubmit / recall (returned). These are the
     // submitter's own levers, so `visible` gates on `record.viewer.is_submitter`
     // (server-computed on the current viewer). The service re-checks ownership;
-    // the predicate keeps a non-submitter from ever seeing a button they cannot
-    // use.
+    // the predicate keeps a plain non-submitter from ever seeing a button they
+    // cannot use.
+    //
+    // `recall` is the one exception, and it is not a widening: it ALSO ORs in
+    // the #3424 admin override (#12716), because an override admin is a caller
+    // `ApprovalService.recall` already authorises. Remind and resubmit keep no
+    // override arm.
     {
       name: "approval_remind",
       label: "Send reminder",
@@ -1731,7 +1943,26 @@ var SysApprovalRequest = ObjectSchema.create({
       ],
       // Recall applies while the request is live for the submitter — pending
       // (withdraw) or returned (abandon the revision instead of resubmitting).
-      visible: 'has(record.status) && (record.status == "pending" || record.status == "returned") && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true',
+      //
+      // The second arm is the #3424 admin override, spelled byte-identically to
+      // the three core decision levers above (#12716). `ApprovalService.recall`
+      // has admitted the override caller since #3424 — `isOverrideActor`'s own
+      // doc block names recall as one of the four levers — so until this arm
+      // landed, recall was the one authorised capability with no button: an
+      // admin could approve or reject their way out of a stuck request (writing
+      // a decision that did not happen) or reassign it, but could not withdraw.
+      //
+      // The override arm carries no status test of its own, on purpose, because
+      // it does not need one and the siblings do not have one either: the flag
+      // is already status-scoped where it is COMPUTED. `attachViewers` in
+      // `approval-service.ts` sets
+      // `can_override: row.status === 'pending' && isOverrideActor(...)` —
+      // ANDed — so `record.viewer.can_override` can never be true off `pending`,
+      // and this arm is pending-only in effect however CEL groups the
+      // expression. Pinned in both directions in
+      // `action-predicate-sparse-face.test.ts`, with the flag's own scoping
+      // pinned against the real service in `approval-revise.test.ts`.
+      visible: 'has(record.status) && (record.status == "pending" || record.status == "returned") && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true || has(record.viewer) && has(record.viewer.can_override) && record.viewer.can_override == true',
       locations: ["record_section"],
       successMessage: "Recalled.",
       refreshAfter: true
@@ -2092,6 +2323,7 @@ import {
   normalizeDecisionOutputs
 } from "@objectstack/spec/automation";
 import { ExpressionEngine, collectCelRootIdentifiers } from "@objectstack/formula";
+import { createRecordOrganizationResolver } from "@objectstack/metadata-core";
 import { keysetWalk } from "@objectstack/types";
 import {
   ADMIN_FULL_ACCESS,
@@ -2102,6 +2334,7 @@ import {
 } from "@objectstack/spec/identity";
 import { RESUME_AUTHORITY_SERVICE } from "@objectstack/spec/contracts";
 import { isFileIdToken } from "@objectstack/spec/data";
+import { renderOperationMessage } from "@objectstack/spec/system";
 import { isGrantActive } from "@objectstack/core";
 
 // src/approver-org-scope.ts
@@ -2220,11 +2453,44 @@ async function filterApproversWhoCanRead(deps, userIds, requestOrgId, context) {
   return userIds.filter((u) => canRead.has(u));
 }
 
+// src/payload-redaction.ts
+function redactSnapshot(payload, readable) {
+  if (readable === void 0) return { payload, redactedKeys: [] };
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    return { payload, redactedKeys: [] };
+  }
+  const allowed = new Set(readable.map((f) => String(f)));
+  const source = payload;
+  const redactedKeys = [];
+  const kept = {};
+  for (const key of Object.keys(source)) {
+    if (allowed.has(key)) kept[key] = source[key];
+    else redactedKeys.push(key);
+  }
+  if (redactedKeys.length === 0) return { payload, redactedKeys: [] };
+  return { payload: kept, redactedKeys: redactedKeys.sort() };
+}
+async function resolveReadableSnapshotFields(security, objectName, context, logger) {
+  if (!security || typeof security.getReadableFields !== "function") return void 0;
+  const object = String(objectName ?? "").trim();
+  if (!object) return void 0;
+  try {
+    return await security.getReadableFields(object, context);
+  } catch (err) {
+    logger?.warn?.("[approvals] payload redaction could not resolve readable fields \u2014 serving the snapshot unredacted", {
+      object,
+      error: err?.message ?? String(err)
+    });
+    return void 0;
+  }
+}
+
 // src/approval-service.ts
 var REMIND_COOLDOWN_MS = 4 * 60 * 60 * 1e3;
 var ESCALATION_JOB_NAME = "approvals-sla-escalation";
 var ESCALATION_SCAN_INTERVAL_MS = 5 * 60 * 1e3;
 var SLA_ACTOR_ID = "system:sla";
+var ESCALATION_ENABLED_FLIP_CUTOFF_MS = Date.parse("2026-08-28T00:00:00Z");
 var DEAD_RUN_ACTOR_ID = "system:dead-run";
 var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set([
   "completed",
@@ -2233,13 +2499,43 @@ var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set([
   "timed_out"
 ]);
 var STRANDABLE_REQUEST_STATUSES = ["approved", "rejected", "returned"];
+function classifyStrandedRunState(run) {
+  if (!run) return "missing";
+  switch (run.status) {
+    // The resume consumed the pause and a downstream node threw. Reported.
+    case "failed":
+      return "failed";
+    // ── The negatives, each for its own reason ──────────────────────────────
+    // The decision advanced the flow and the flow finished. Healthy.
+    case "completed":
+      return void 0;
+    // Deliberately terminated by an operator (`cancelRun`, ADR-0044). The run
+    // stopping is the intended outcome, exactly as `recalled` is on the request
+    // side — reporting it would bury the real findings under expected ones.
+    case "cancelled":
+      return void 0;
+    // The history's last row says `paused` while the suspension store says no
+    // live pause. That is AMBIGUOUS, and the ambiguity is not resolvable from
+    // one scan: a resume in flight right now has consumed the suspension and
+    // not yet written its terminal row, and reads exactly like a process that
+    // died in the same window. Condemning it would name every concurrently
+    // resuming approval — so this stays SKIPPED, the conservative arm this
+    // whole method is built on.
+    case "paused":
+      return void 0;
+    default:
+      return void 0;
+  }
+}
 var ACTION_TOKEN_TTL_MS = 72 * 60 * 60 * 1e3;
 var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+var RECORD_DELETE_CANCEL_LIMIT = 200;
 function actingUserId(context) {
   const userId = context?.userId;
   return typeof userId === "string" && userId ? userId : null;
 }
 var OOO_MAX_CHAIN = 8;
+var MEMBER_SCREEN_READ_LIMIT = 5e4;
 var GRAPH_APPROVER_TYPES = /* @__PURE__ */ new Set([
   "team",
   "department",
@@ -2294,6 +2590,10 @@ function rowFromRequest(row) {
     submitter_id: row.submitter_id ?? void 0,
     submitter_comment: row.submitter_comment ?? void 0,
     status: row.status ?? "pending",
+    // [#13568] Why a cancelled row was cancelled. Surfaced on every read for
+    // the same reason `status` is: a client that can see the terminal state and
+    // not the machine-readable cause is back to guessing from prose.
+    cancel_reason: row.cancel_reason ?? void 0,
     current_step: row.current_step ?? void 0,
     current_step_index: row.current_step_index ?? void 0,
     pending_approvers: csvSplit(row.pending_approvers),
@@ -2386,12 +2686,15 @@ function rowFromAction(row) {
 var _ApprovalService = class _ApprovalService {
   constructor(opts) {
     this.engine = opts.engine;
+    this.recordOrgResolver = createRecordOrganizationResolver(opts.engine);
     this.clock = opts.clock ?? { now: () => /* @__PURE__ */ new Date() };
     this.logger = opts.logger;
     this.automation = opts.automation;
     this.messaging = opts.messaging;
     this.publicBaseUrl = (opts.publicBaseUrl ?? "").replace(/\/$/, "");
     this.tenancyPosture = opts.tenancyPosture;
+    this.fieldVisibility = opts.fieldVisibility;
+    this.messageTranslator = opts.messageTranslator;
     this.recordReaderVisibleObjects = new Set(
       (Array.isArray(opts.recordReaderVisibleObjects) ? opts.recordReaderVisibleObjects : []).map((n) => String(n ?? "").trim()).filter(Boolean)
     );
@@ -2400,6 +2703,57 @@ var _ApprovalService = class _ApprovalService {
   attachTenancyPosture(provider) {
     this.tenancyPosture = provider;
   }
+  /**
+   * [#10749] Attach (or replace) the field-visibility authority the payload
+   * redaction seam reads. Late-bound: plugin load order does not guarantee the
+   * security service exists when this one is constructed.
+   */
+  attachFieldVisibility(source) {
+    this.fieldVisibility = source;
+  }
+  /**
+   * [#10749] Redact each row's payload snapshot down to the fields the READING
+   * caller may see on that row's subject object.
+   *
+   * Runs BEFORE {@link ApprovalService.enrichRows}, and that ordering is
+   * load-bearing rather than incidental: `enrichRows` derives `payload_display`
+   * (lookup foreign keys inside the snapshot resolved to referenced record
+   * titles) and `payload_labels` (a label per snapshot key) by WALKING THE
+   * SNAPSHOT'S OWN KEYS. Redact first and both derived maps are clean for free;
+   * redact after and a restricted field's name, its authored label and the
+   * title of the record it points at all still ship — the value would be gone
+   * and the disclosure would not.
+   *
+   * Rows are grouped by subject object so one `getReadableFields` call covers a
+   * whole page of same-object requests.
+   */
+  async redactPayloads(rows, context) {
+    const withPayload = rows.filter((r) => r?.payload != null);
+    if (withPayload.length === 0) return;
+    const byObject = /* @__PURE__ */ new Map();
+    for (const r of withPayload) {
+      const key = String(r.object_name ?? "");
+      let list = byObject.get(key);
+      if (!list) {
+        list = [];
+        byObject.set(key, list);
+      }
+      list.push(r);
+    }
+    for (const [object, group] of byObject) {
+      const readable = await resolveReadableSnapshotFields(
+        this.fieldVisibility,
+        object,
+        context,
+        this.logger
+      );
+      if (readable === void 0) continue;
+      for (const r of group) {
+        const { payload } = redactSnapshot(r.payload, readable);
+        r.payload = payload;
+      }
+    }
+  }
   /** Deps bundle for the ADR-0105 D9 org-scope helpers. */
   get orgScopeDeps() {
     return {
@@ -2493,6 +2847,41 @@ var _ApprovalService = class _ApprovalService {
     const actorTenant = context.tenantId ?? context.organizationId ?? null;
     return requestOrg == null || actorTenant != null && String(requestOrg) === String(actorTenant);
   }
+  /**
+   * [#11993] The END USER's half of an approval refusal.
+   *
+   * `handleApprovalError` in `@objectstack/rest` maps this service's
+   * `CODE: message` throws onto the wire by testing the prefix for the status
+   * and then STRIPPING it (a leading run of `[A-Z_]` plus a colon and any
+   * following whitespace), shipping what remains as the body's
+   * human-readable `error` — which Console splices under its own localized
+   * label ("撤回审批失败: …"). A hardcoded English reason therefore reaches an
+   * operator in a fully Chinese deployment as a Chinese prefix glued onto an
+   * English sentence they cannot act on.
+   *
+   * Rendered through the SHARED Operation Message Catalog
+   * (`@objectstack/spec/system`), not a second mechanism: same
+   * `errors.<key>` override address, same resolution ladder (deployment
+   * override -> locale catalog -> `en` -> the key), same guarantee that a
+   * misbehaving i18n service cannot turn a 403 into a 500. The catalog's
+   * header names this seat explicitly; `plugin-security`'s
+   * `userFacingDenialMessage` is the sibling consumer this mirrors.
+   *
+   * The CODE PREFIX stays on the message. It is not user copy — it is how the
+   * REST layer derives the status and the ADR-0112 wire code, and it is
+   * stripped before the sentence reaches a body. The developer's half moves
+   * to the log, where the ids it names are legible to an operator and to
+   * nobody else.
+   */
+  userFacingRefusal(messageKey, context) {
+    let translate;
+    try {
+      translate = this.messageTranslator?.();
+    } catch {
+      translate = void 0;
+    }
+    return renderOperationMessage({ messageKey }, { locale: context?.locale, translate });
+  }
   /**
    * Pin the acting identity to the AUTHENTICATED CALLER (#3800).
    *
@@ -2666,7 +3055,7 @@ var _ApprovalService = class _ApprovalService {
     }) : users;
     try {
       if (type === "team") {
-        const users = await this.expandTeamUsers(String(a.value));
+        const users = await this.expandTeamUsers(String(a.value), organizationId);
         if (users.length) return users;
       } else if (type === "department" || type === "business_unit" || type === "bu") {
         const users = await bounded(await this.expandBusinessUnitUsers(String(a.value), directoryOrg));
@@ -2680,7 +3069,7 @@ var _ApprovalService = class _ApprovalService {
       } else if (type === "manager" && record) {
         const subject = record[a.value] ?? record.owner_id;
         if (subject) {
-          const mgr = await this.lookupManager(String(subject));
+          const mgr = await this.lookupManager(String(subject), organizationId);
           if (mgr) return this.applyOooDelegation(mgr, now, organizationId, substitutions);
         }
       }
@@ -2777,7 +3166,7 @@ var _ApprovalService = class _ApprovalService {
       try {
         if (resolveAs === "department") users = await this.expandBusinessUnitUsers(key, directoryOrg);
         else if (resolveAs === "position") users = await this.expandPositionUsers(key, directoryOrg);
-        else if (resolveAs === "team") users = await this.expandTeamUsers(key);
+        else if (resolveAs === "team") users = await this.expandTeamUsers(key, directoryOrg);
         else {
           throw new Error(
             `VALIDATION_FAILED: expression approver has unknown resolveAs '${resolveAs}' \u2014 use 'user', 'department', 'position', or 'team'`
@@ -2802,9 +3191,50 @@ var _ApprovalService = class _ApprovalService {
     }
     return { slots, raw };
   }
-  /** Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy). */
-  async expandTeamUsers(teamId) {
+  /**
+   * Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy).
+   *
+   * Takes an organization for the reason every sibling expansion does
+   * ({@link expandBusinessUnitUsers}, {@link expandPositionUsers},
+   * {@link expandMembershipTierUsers}): an approver expansion answers "who, in
+   * THIS organization". Before #10230 this one did not ask, and it was the last
+   * expansion that did not — a `team` approver naming ANOTHER organization's
+   * team routed that organization's people an approval over a record they are
+   * not a tenant of.
+   *
+   * TWO screens run here, and they assert different things (#10230, #10547):
+   *
+   *   1. the TEAM must not provably belong to another organization
+   *      ({@link teamIsProvablyOutsideOrg}) — `sys_team` carries
+   *      `organization_id` outright
+   *      (`packages/platform-objects/src/identity/sys-team.object.ts`), so a
+   *      team id transitively names exactly one organization and ONE row
+   *      answers the question;
+   *   2. each expanded MEMBER must not provably hold membership only in other
+   *      organizations ({@link dropMembersProvablyOutsideOrg}) —
+   *      `sys_team_member` carries `team_id` and `user_id` and NO tenancy
+   *      column at all, so passing (1) says nothing whatever about the people
+   *      it lists.
+   *
+   * #10230 landed (1) alone and deferred (2) on purpose. What closed the
+   * deferral is that (1) does not imply (2) even a little: a member removed
+   * from the organization but left on the team, a team re-parented across
+   * organizations (`/organization/update-team` accepts `organizationId` in its
+   * partial body), or a `sys_team_member` row written by a seed rather than
+   * through better-auth all produce a team that passes (1) carrying a user who
+   * is provably a tenant of somewhere else. Measured on this tree, not read off
+   * the schema — the probe is quoted in `team-member-org-screen.test.ts`.
+   *
+   * (2) is the SAME assertion as {@link managerIsProvablyOutsideOrg}, one hop
+   * further out, and it is asserted the same way: `sys_user` carries no tenancy
+   * fact, so `sys_member` rows are the only evidence that a person is placed
+   * anywhere. Like that screen, this one grants no reads and applies no read
+   * screen to any approver type that lacks one today, so it decides nothing
+   * #7497 (does approver routing imply record read visibility?) asks.
+   */
+  async expandTeamUsers(teamId, organizationId) {
     if (!teamId) return [];
+    if (await this.teamIsProvablyOutsideOrg(teamId, organizationId)) return [];
     let rows = [];
     try {
       rows = await this.engine.find("sys_team_member", {
@@ -2816,7 +3246,149 @@ var _ApprovalService = class _ApprovalService {
     } catch {
       rows = [];
     }
-    return Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
+    const users = Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
+    return await this.dropMembersProvablyOutsideOrg(teamId, users, organizationId);
+  }
+  /**
+   * Is `teamId` PROVABLY a team of a DIFFERENT organization? (#10230)
+   *
+   * "Provably" carries the same posture the sibling screen states at length in
+   * {@link managerIsProvablyOutsideOrg}, for the same reasons:
+   *
+   *   - the team row carries an `organization_id` and it is not the request's
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ screen it out;
+   *   - the row carries no `organization_id`, does not exist, or the read failed
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The `organization_id = null` limb is not timidity — it is the reading
+   * {@link businessUnitOrgScope} settled on one screen below, for the identical
+   * shape: null on a platform object means "owned by no organization", which is
+   * what a seed writes because a seed cannot know the organization id the
+   * runtime mints at boot. Treating null as "not mine" would delete every
+   * seeded team approver at once — a larger behaviour change than the hole
+   * being closed. Measured, and not hypothetically: this package's own
+   * `team_ok` expansion fixture is exactly such a stack (it has
+   * `sys_team_member` rows, a request carrying an organization, and no
+   * `sys_team` row at all).
+   *
+   * Screening the TEAM before reading its members is also what keeps the cost
+   * at one row: a team that fails the screen never fans out.
+   */
+  async teamIsProvablyOutsideOrg(teamId, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg) return false;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_team", {
+        where: { id: teamId },
+        fields: ["id", "organization_id"],
+        limit: 1,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return false;
+    }
+    const row = Array.isArray(rows) ? rows[0] : null;
+    const teamOrg = row?.organization_id ? String(row.organization_id) : "";
+    if (!teamOrg) return false;
+    if (teamOrg === requestOrg) return false;
+    this.logger?.warn?.(
+      `[approvals] #10230: team '${teamId}' was dropped from the approver slate \u2014 'sys_team.organization_id' is '${teamOrg}', not the request's organization '${requestOrg}', so routing this approval to its members would put approval authority over the record outside its tenant. Point the approver at a team in this organization, or route this step with an approver type that names someone in it.`,
+      { teamId, teamOrganizationId: teamOrg, requestOrganizationId: requestOrg }
+    );
+    return true;
+  }
+  /**
+   * Drop the expanded team members who are PROVABLY tenants of other
+   * organizations and not of `organizationId`. (#10547)
+   *
+   * Returns the survivors, in the order they were expanded.
+   *
+   * Posture — identical to {@link managerIsProvablyOutsideOrg} and
+   * {@link teamIsProvablyOutsideOrg}, deliberately, because it is the same
+   * assertion about the same table:
+   *
+   *   - membership rows exist for this user, none in `organizationId`
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ drop him;
+   *   - no membership rows at all for him, the read failed, or the request
+   *     carries no organization
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The absent limb is load-bearing rather than timid, and #3807 is the recorded
+   * cost of getting it wrong: a stack that stamps an organization on requests
+   * but never materializes `sys_member` rows would otherwise lose EVERY team
+   * approver at once. This package's own `team_ok` expansion fixture and
+   * #10230's T2/T3 fixtures are exactly such stacks — they carry team rows and
+   * a request organization and no `sys_member` table at all — so the absent
+   * limb is exercised by neighbours on every run of this suite.
+   *
+   * ONE read for the whole slate, never one per person: the expansion is capped
+   * at 10000 members and a per-user query would turn a single team approver
+   * into 10000 round trips.
+   *
+   * ⚠️ A TRUNCATED read fails open, and that is the subtle half. This read is
+   * the only evidence that a member IS a tenant here, so a result cut off at
+   * the limit could be missing the very row that keeps a legitimate approver on
+   * the slate — screening him out on missing evidence, which inverts the
+   * posture into fail-CLOSED precisely where it must not. When the read comes
+   * back at the cap it is treated as no evidence at all.
+   */
+  async dropMembersProvablyOutsideOrg(teamId, userIds, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg || !userIds.length) return userIds;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_member", {
+        where: { user_id: { $in: userIds } },
+        fields: ["user_id", "organization_id"],
+        limit: MEMBER_SCREEN_READ_LIMIT,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return userIds;
+    }
+    if ((rows?.length ?? 0) >= MEMBER_SCREEN_READ_LIMIT) {
+      this.logger?.warn?.(
+        `[approvals] #10547: the membership screen for team '${teamId}' read ${rows.length} 'sys_member' rows, at or above its ${MEMBER_SCREEN_READ_LIMIT}-row cap, so the result may be truncated. Routing is left unchanged rather than risk dropping a member whose proof of membership fell outside the read.`,
+        { teamId, requestOrganizationId: requestOrg, rowsRead: rows.length }
+      );
+      return userIds;
+    }
+    const orgsByUser = /* @__PURE__ */ new Map();
+    for (const r of rows ?? []) {
+      const uid2 = String(r?.user_id ?? "");
+      const org = String(r?.organization_id ?? "");
+      if (!uid2 || !org) continue;
+      const seen = orgsByUser.get(uid2);
+      if (seen) seen.push(org);
+      else orgsByUser.set(uid2, [org]);
+    }
+    const kept = [];
+    const dropped = [];
+    for (const uid2 of userIds) {
+      const orgs = orgsByUser.get(uid2);
+      if (!orgs?.length) {
+        kept.push(uid2);
+        continue;
+      }
+      if (orgs.includes(requestOrg)) {
+        kept.push(uid2);
+        continue;
+      }
+      dropped.push({ userId: uid2, organizationIds: orgs });
+    }
+    if (dropped.length) {
+      this.logger?.warn?.(
+        `[approvals] #10547: ${dropped.length} member(s) of team '${teamId}' were dropped from the approver slate \u2014 ${dropped.map((d) => `'${d.userId}'`).join(", ")} hold membership in other organization(s), none of them the request's organization '${requestOrg}', so routing this approval to them would put approval authority over the record outside its tenant. The TEAM itself belongs to this organization; its 'sys_team_member' rows carry no organization of their own. Remove them from the team, grant them a membership in this organization, or route this step with an approver type that names someone in it.`,
+        {
+          teamId,
+          requestOrganizationId: requestOrg,
+          droppedUserIds: dropped.map((d) => d.userId),
+          droppedMemberOrganizationIds: dropped.map((d) => d.organizationIds)
+        }
+      );
+    }
+    return kept;
   }
   /**
    * Tenant scope for a `sys_business_unit` read that may legitimately be
@@ -2985,7 +3557,36 @@ var _ApprovalService = class _ApprovalService {
     }
     return Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
   }
-  async lookupManager(userId) {
+  /**
+   * `sys_user.manager_id`, screened to the request's organization (#10153).
+   *
+   * Takes an organization argument for the same reason its siblings do
+   * ({@link expandPositionUsers}, {@link expandMembershipTierUsers}): an
+   * approver expansion answers "who, in THIS organization". Before #10153 this
+   * one did not ask, and it was the only expansion that did not — a
+   * `manager_id` pointing at a person in another organization routed that
+   * person an approval over a record they are not a tenant of.
+   *
+   * ⚠️ The screen reads `sys_member`, which LOOKS like the D2 read-visibility
+   * filter next to it ({@link filterApproversWhoCanRead}). It is not, and this
+   * comment exists so the next reader does not conclude that #7497 (does
+   * approver routing imply record read visibility?) was settled here. It was
+   * not. Two facts make this the SIBLING treatment rather than a
+   * read-visibility ruling:
+   *
+   *   1. Two of the three org-scoped expansions already screen on exactly this
+   *      column — `expandMembershipTierUsers` filters `sys_member.organization_id`
+   *      outright, and it is also the second limb of `expandPositionUsers`. So
+   *      `sys_member.organization_id` is already this file's answer to "which
+   *      organization is this person in", independent of what they may read.
+   *   2. `sys_user` carries no `organization_id` at all. It is a GLOBAL identity
+   *      table, so a membership row is the only tenancy fact that exists for a
+   *      user — there is no other read this screen could have been written with.
+   *
+   * This change grants no reads and applies no read screen to any type that
+   * lacks one today, so it decides nothing #7497 asks.
+   */
+  async lookupManager(userId, organizationId) {
     try {
       const rows = await this.engine.find("sys_user", {
         where: { id: userId },
@@ -2994,11 +3595,64 @@ var _ApprovalService = class _ApprovalService {
         context: SYSTEM_CTX2
       });
       const row = Array.isArray(rows) ? rows[0] : null;
-      return row?.manager_id ? String(row.manager_id) : null;
+      const managerId = row?.manager_id ? String(row.manager_id) : null;
+      if (!managerId) return null;
+      if (await this.managerIsProvablyOutsideOrg(managerId, organizationId)) return null;
+      return managerId;
     } catch {
       return null;
     }
   }
+  /**
+   * Is `managerId` PROVABLY a member of other organizations and not of
+   * `organizationId`? (#10153)
+   *
+   * "Provably" is the whole shape of this screen, and it is deliberate rather
+   * than a weaker version of "must prove membership":
+   *
+   *   - membership rows exist for this user, none in the request's org
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ screen him out;
+   *   - no membership rows at all, or the read failed
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The fail-open half is not timidity, it is this file's ruled posture on
+   * addressing paths, stated twice already: {@link filterApproversWhoCanRead}
+   * refuses to empty a live slate on an infrastructure hiccup, and
+   * {@link expandPositionUsers} carries "a step routing to nobody is worse than
+   * one routing to a lapsed holder". It is also load-bearing in practice — a
+   * stack that stamps an organization on its requests but does not materialize
+   * `sys_member` rows would otherwise lose every manager approver at once,
+   * which is a bigger behaviour change than the hole being closed. Measured:
+   * this repo's own `type:manager` out-of-office fixture is such a stack.
+   *
+   * Screening the MANAGER only, before OOO delegation, is deliberate too: the
+   * delegate arrives from `sys_approval_delegation`, whose rows already carry
+   * (and are already filtered by) an `organization_id` in
+   * {@link lookupActiveDelegation}. This card is about `sys_user.manager_id`.
+   */
+  async managerIsProvablyOutsideOrg(managerId, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg) return false;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_member", {
+        where: { user_id: managerId },
+        fields: ["user_id", "organization_id"],
+        limit: 1e3,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return false;
+    }
+    const orgs = (rows ?? []).map((r) => String(r?.organization_id ?? "")).filter(Boolean);
+    if (!orgs.length) return false;
+    if (orgs.includes(requestOrg)) return false;
+    this.logger?.warn?.(
+      `[approvals] #10153: manager '${managerId}' was dropped from the approver slate \u2014 'sys_user.manager_id' points across an organization boundary. He holds membership in ${orgs.length} organization(s), none of them the request's organization '${requestOrg}', so routing this approval to him would put approval authority over the record outside its tenant. Fix the 'manager_id' link, grant him a membership in this organization, or route this step with an approver type that names someone in it.`,
+      { managerId, requestOrganizationId: requestOrg, managerOrganizationIds: orgs }
+    );
+    return true;
+  }
   /**
    * Out-of-office auto-skip (#1322 M1). Given an individually-routed approver
    * id, follow any active `sys_approval_delegation` chain and return the id the
@@ -3168,11 +3822,13 @@ var _ApprovalService = class _ApprovalService {
     const substitutions = [];
     const groups = {};
     const liveRecord = await this.loadLiveRecord(input.object, input.recordId, input.record);
+    const subjectOrg = this.recordOrgResolver.organizationOf(input.object, liveRecord, input.record);
+    const requestOrg = subjectOrg ?? ctxOrg;
     const resolvedFrom = {};
     const approvers = await this.expandApprovers(
       { approvers: input.config.approvers },
       liveRecord,
-      ctxOrg,
+      requestOrg,
       {
         now: nowDate.getTime(),
         substitutions,
@@ -3236,16 +3892,16 @@ var _ApprovalService = class _ApprovalService {
       flow_run_id: input.runId,
       flow_node_id: input.nodeId,
       node_config_json: JSON.stringify(configSnapshot),
-      organization_id: ctxOrg,
+      organization_id: requestOrg,
       created_at: now,
       updated_at: now
     };
     await this.engine.insert("sys_approval_request", row, { context: SYSTEM_CTX2 });
-    await this.syncApproverIndex(id, approvers, ctxOrg, now);
+    await this.syncApproverIndex(id, approvers, requestOrg, now);
     await this.engine.insert("sys_approval_action", {
       id: uid("aact"),
       request_id: id,
-      organization_id: ctxOrg,
+      organization_id: requestOrg,
       step_name: input.nodeId,
       step_index: 0,
       action: "submit",
@@ -3257,7 +3913,7 @@ var _ApprovalService = class _ApprovalService {
       await this.engine.insert("sys_approval_action", {
         id: uid("aact"),
         request_id: id,
-        organization_id: ctxOrg,
+        organization_id: requestOrg,
         step_name: input.nodeId,
         step_index: 0,
         action: "ooo_substitute",
@@ -3699,6 +4355,13 @@ var _ApprovalService = class _ApprovalService {
    * is then paused at the revise-window node (no reject edge), so it is
    * terminally cancelled via {@link ApprovalResumeSurface.cancelRun} rather
    * than resumed.
+   *
+   * The #3424 privileged override reaches a PENDING request only (#12775,
+   * maintainer ruling 2026-09-02). On `returned` an override actor is refused
+   * exactly as any other non-submitter: the gate is spelled as `attachViewers`
+   * computes `viewer.can_override`, so the gate, the
+   * {@link ApprovalService.isOverrideActor} doc block and the viewer flag agree
+   * at one point.
    */
   async recall(requestId, input, context) {
     if (!requestId) throw new Error("VALIDATION_FAILED: requestId is required");
@@ -3714,8 +4377,18 @@ var _ApprovalService = class _ApprovalService {
     if (raw.status !== "pending" && !inReviseWindow) {
       throw new Error(`INVALID_STATE: request is ${raw.status}`);
     }
-    if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
-      throw new Error(`FORBIDDEN: only the submitter may recall this request`);
+    const overrideAdmits = raw.status === "pending" && this.isOverrideActor(context, raw.organization_id ?? null);
+    if (!overrideAdmits && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
+      const developerMessage = `[approvals] recall refused: actor '${actorId}' is not the submitter of request '${requestId}' (submitter '${String(raw.submitter_id)}') and holds no #3424 override for a '${raw.status}' request (the override reaches pending requests only)`;
+      this.logger?.warn?.(developerMessage, {
+        request: requestId,
+        actor: actorId,
+        submitter: String(raw.submitter_id),
+        status: raw.status
+      });
+      throw new Error(
+        `FORBIDDEN: ${this.userFacingRefusal("approval_recall_not_submitter", context)}`
+      );
     }
     if (inReviseWindow) await this.assertLatestForRun(raw);
     const config = parseJson(raw.node_config_json, { approvers: [], behavior: "first_response" });
@@ -3791,6 +4464,127 @@ var _ApprovalService = class _ApprovalService {
     const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh, runId, resumed, ...resumeError ? { resumeError } : {} };
   }
+  // ── Record-delete lifecycle linkage (#13568) ─────────────────
+  /**
+   * Void every `pending` request about a record that has just been DELETED
+   * (#13568, maintainer ruling 2026-08-31 「同意」).
+   *
+   * ## What the ruling asked for, and what each half costs
+   *
+   *   status → `cancelled`, a machine-readable `cancel_reason`, the row KEPT
+   *   for audit, and the request out of the pending count and the inbox's
+   *   default view.
+   *
+   * The last clause needs both writes below, not just the status one: the
+   * inbox's "My Pending" tab pages the request table by `status`, but the
+   * approver filter resolves through the normalized `sys_approval_approver`
+   * index (#1745), which is keyed on nothing but `request_id`. Leaving the
+   * index rows behind would keep the request in `approverRequestIds`' answer
+   * for every approver forever — so {@link syncApproverIndex} clears them, the
+   * same call every other exit from `pending` makes.
+   *
+   * ## Three things this deliberately does NOT do
+   *
+   * 1. **No status mirror-back.** Every other terminal transition calls
+   *    {@link mirrorStatusField} to write the outcome onto the subject record's
+   *    `approvalStatusField`. Here the subject record is precisely what no
+   *    longer exists, so that write is guaranteed to fail — it is the very
+   *    `update_record(...) failed: Record ... not found` this card's own
+   *    forensics recorded on the reject door. Skipped by construction, not by a
+   *    swallowed error.
+   *
+   * 2. **No flow resume, and no run cancel.** A cancellation is a status write
+   *    plus a reason; it is not a decision, so there is no branch to resume
+   *    down and no downstream node that should run. The suspended run this
+   *    request gated is reported (below) and left alone — what becomes of an
+   *    approval run whose request was voided is a lifecycle question that
+   *    belongs to the automation service, not to a delete hook, and answering
+   *    it here by guessing would be exactly the kind of consumer-side
+   *    accommodation PD #12 refuses.
+   *
+   * 3. **No refusal of the delete.** The delete has already landed by the time
+   *    this runs, and the "forbid delete while an approval is pending"
+   *    direction was VETOED in the same ruling (`lockRecord` already blocks the
+   *    edit; blocking the delete too locks an author onto a record they cannot
+   *    fix). So nothing here throws — a failure degrades to a warning and the
+   *    stale row, which is the pre-existing state, never to a failed delete.
+   *
+   * Terminal rows are untouched: the `where` below names `status: 'pending'`,
+   * so an `approved` / `rejected` / `recalled` / `returned` request about the
+   * same record keeps its recorded outcome. That is the ruling's second half —
+   * history is kept; only the presentation of its dead record reference is
+   * someone else's card.
+   *
+   * @returns the request ids cancelled and the suspended run ids left behind.
+   */
+  async cancelForDeletedRecord(objectName, recordId) {
+    const empty = { cancelled: [], suspendedRuns: [] };
+    const object = String(objectName ?? "").trim();
+    const record = String(recordId ?? "").trim();
+    if (!object || !record) return empty;
+    let pending;
+    try {
+      const rows = await this.engine.find("sys_approval_request", {
+        where: { object_name: object, record_id: record, status: "pending" },
+        limit: RECORD_DELETE_CANCEL_LIMIT,
+        context: SYSTEM_CTX2
+      });
+      pending = Array.isArray(rows) ? rows : [];
+    } catch (err) {
+      this.logger?.warn?.(
+        "[approvals] could not read the pending requests of a deleted record \u2014 they stay in the inbox until the record is deleted again or an operator finalises them",
+        { object, record, error: err?.message ?? String(err) }
+      );
+      return empty;
+    }
+    if (pending.length === 0) return empty;
+    const now = this.clock.now().toISOString();
+    const cancelled = [];
+    const suspendedRuns = [];
+    for (const raw of pending) {
+      const requestId = String(raw?.id ?? "");
+      if (!requestId) continue;
+      const org = raw?.organization_id ?? null;
+      const nodeId = raw?.flow_node_id ?? raw?.current_step ?? null;
+      try {
+        await this.engine.insert("sys_approval_action", {
+          id: uid("aact"),
+          request_id: requestId,
+          organization_id: org,
+          step_name: nodeId,
+          step_index: 0,
+          action: "cancel",
+          actor_id: null,
+          comment: `Auto-cancelled: the ${object} record '${record}' this request is about was deleted`,
+          created_at: now
+        }, { context: SYSTEM_CTX2 });
+        await this.engine.update("sys_approval_request", {
+          id: requestId,
+          status: "cancelled",
+          cancel_reason: "record_deleted",
+          pending_approvers: null,
+          completed_at: now,
+          updated_at: now
+        }, { context: SYSTEM_CTX2 });
+        await this.syncApproverIndex(requestId, [], org, now);
+        cancelled.push(requestId);
+        const runId = raw?.flow_run_id ? String(raw.flow_run_id) : "";
+        if (runId) suspendedRuns.push(runId);
+      } catch (err) {
+        this.logger?.warn?.(
+          "[approvals] could not auto-cancel a pending request whose record was deleted \u2014 it stays in the inbox pointing at a record that no longer exists",
+          { object, record, request: requestId, error: err?.message ?? String(err) }
+        );
+      }
+    }
+    if (suspendedRuns.length) {
+      this.logger?.warn?.(
+        "[approvals] auto-cancelled approval request(s) for a deleted record \u2014 the automation run(s) they gated stay suspended and are not resumed by a cancellation",
+        { object, record, requests: cancelled, runs: suspendedRuns }
+      );
+    }
+    return { cancelled, suspendedRuns };
+  }
   // ── Send back for revision / resubmit (ADR-0044) ─────────────
   /**
    * ADR-0044 send back for revision. Finalises the pending request as
@@ -4421,7 +5215,10 @@ var _ApprovalService = class _ApprovalService {
    * `escalation.timeoutHours` and whose deadline has passed is escalated
    * **at most once, ever** — the `escalate` audit row is the idempotency
    * marker, written before any mutation (audit-first, like reassign). One
-   * bad row never stops the sweep.
+   * bad row never stops the sweep. A block that explicitly declares
+   * `enabled: false` is skipped (#12278 — the declared switch is enforced;
+   * pre-flip snapshots ride the legacy window on
+   * {@link ESCALATION_ENABLED_FLIP_CUTOFF_MS}).
    */
   async runEscalations() {
     let rows = [];
@@ -4443,6 +5240,7 @@ var _ApprovalService = class _ApprovalService {
         const cfg = parseJson(raw.node_config_json, void 0);
         const esc2 = cfg?.escalation;
         if (!esc2 || typeof esc2.timeoutHours !== "number" || esc2.timeoutHours <= 0) continue;
+        if (esc2.enabled === false && Date.parse(raw.created_at ?? "") >= ESCALATION_ENABLED_FLIP_CUTOFF_MS) continue;
         const due = slaDueAt(raw.created_at, cfg);
         if (!due || Date.parse(due) > this.clock.now().getTime()) continue;
         const prior = await this.engine.find("sys_approval_action", {
@@ -4523,9 +5321,35 @@ var _ApprovalService = class _ApprovalService {
    *    live pause exists. It THROWS when the store cannot be read, and that
    *    case is SKIPPED, never counted as dead: an unreadable store means
    *    "unknown", and a storage outage must not be published as a lost run.
-   *  - `getRun(runId) == null` — no terminal history row either (the `run_`
-   *    prefixed rows in `sys_automation_run`). A run that merely finished is
-   *    not stranded; a request whose run neither waits nor ever completed is.
+   *  - `classifyStrandedRunState` over `getRun(runId)` — the run's own
+   *    history row (the `run_` prefixed rows in `sys_automation_run`). A run
+   *    that merely finished is not stranded; a request whose run neither waits
+   *    nor completed is.
+   *
+   * **The second oracle was widened (#13909), and this is the whole point of
+   * that card's first slice.** It used to be `if (terminal) continue` — the
+   * existence of ANY history row ended the check, on the reading "the run ran to
+   * a terminal state, it is not dangling". That is true of a run that COMPLETED
+   * and false of one that FAILED: the engine consumes a suspension *before*
+   * running the downstream nodes (`AutomationEngine.resumeInternal` calls
+   * `forgetSuspendedRun(run, 'resumed')` and only then `traverseNext`), so a
+   * downstream node that merely threw threw with the pause already gone, and the
+   * catch arm wrote a terminal `failed` row. The decision is durable, the
+   * continuation stopped half-way, `resume` answers `RUN_NOT_FOUND` and
+   * `cancelRun` is a no-op — and the terminal row this oracle used to read as
+   * health is written BY the very failure that stranded it. So this inspection
+   * reported `0` for the one shape an operator most needs to see.
+   *
+   * ⚠️ The widening does NOT reverse the conservatism: `completed`, `cancelled`
+   * and `paused` are each still skipped, for reasons named one at a time in
+   * `classifyStrandedRunState`, and an unrecognised status is skipped too.
+   * What the widening buys is that a `failed` run is now reported with
+   * `runState: 'failed'` instead of counted as healthy.
+   *
+   * ⚠️ **What this can and cannot size.** It makes the condition *visible* in a
+   * deployment; it is not itself a census, and it says nothing about this
+   * repository. How many runs are already in this state can only be answered
+   * against a real deployment's tables — see the card.
    *
    * **Reports; never rewrites.** No status is changed and no run is cancelled.
    * The decision genuinely happened — a human approved or rejected — and
@@ -4583,7 +5407,8 @@ var _ApprovalService = class _ApprovalService {
         });
         continue;
       }
-      if (terminal) continue;
+      const runState = classifyStrandedRunState(terminal);
+      if (!runState) continue;
       const config = parseJson(
         raw.node_config_json,
         { approvers: [], behavior: "first_response" }
@@ -4606,6 +5431,7 @@ var _ApprovalService = class _ApprovalService {
         requestId: String(raw.id),
         status: raw.status,
         runId,
+        runState,
         flowName: typeof raw.process_name === "string" ? raw.process_name.replace(/^flow:/, "") : void 0,
         nodeId: raw.flow_node_id ?? raw.current_step ?? void 0,
         objectName: raw.object_name,
@@ -4617,11 +5443,13 @@ var _ApprovalService = class _ApprovalService {
       });
     }
     if (stranded.length || undetermined) {
-      this.logger?.warn?.("[approvals] stranded terminal requests (decision recorded, flow run gone)", {
+      this.logger?.warn?.("[approvals] stranded terminal requests (decision recorded, flow run unrecoverable)", {
         scanned: rows.length,
         stranded: stranded.length,
         undetermined,
-        requests: stranded.map((s) => `${s.requestId}@${s.nodeId ?? "?"} \u2192 run ${s.runId}`)
+        runMissing: stranded.filter((s) => s.runState === "missing").length,
+        runFailed: stranded.filter((s) => s.runState === "failed").length,
+        requests: stranded.map((s) => `${s.requestId}@${s.nodeId ?? "?"} \u2192 run ${s.runId} (${s.runState})`)
       });
     }
     return { scanned: rows.length, stranded, undetermined };
@@ -5124,8 +5952,70 @@ var _ApprovalService = class _ApprovalService {
     return { requests: desired.size, inserted, deleted };
   }
   // ── Read API ─────────────────────────────────────────────────
+  /**
+   * [#11040] May the free-text pushdown carry an arm on the SNAPSHOT column,
+   * for THIS caller over THIS query's scope?
+   *
+   * `payload_json` is the one searched column whose contents the serve path
+   * masks per reader (`redactPayloads`, #10749). A predicate over it is
+   * evaluated by the driver against the column AT REST — unmasked, before
+   * anything is served — so for a caller whose view of the snapshot is masked,
+   * row membership answers questions about contents that caller may not read.
+   * The other four arms are columns of `sys_approval_request` itself, which
+   * every caller who can see the row reads whole; they are untouched.
+   *
+   * ## The invariant this method exists to hold
+   *
+   * "This caller's view is masked" is read from **the same authority and the
+   * same per-caller call as the serve path** — `resolveReadableSnapshotFields`,
+   * asked as the CALLER (never `SYSTEM_CTX`). A second, independently derived
+   * notion of "redacted" — comparing the readable set against the object's
+   * schema, say — would be a fresh source of drift, and drift between the
+   * serve rule and the filter rule IS the defect this closes, reconstituted one
+   * layer down. So the only "not masked" answer accepted here is the one serve
+   * itself acts on: `undefined`, the seam's documented do-not-narrow branch.
+   * When the seam holds a concrete list the mask is IN FORCE, whether or not it
+   * happens to remove a key from any particular row — a row-dependent question
+   * no predicate can answer before rows exist.
+   *
+   * ## The two predicate-time cases
+   *
+   * Redaction is decided per ROW (each row names its own subject object, hence
+   * its own readable set), but a filter is built before any row exists:
+   *
+   *  - **authority absent** — `resolveReadableSnapshotFields` answers
+   *    `undefined` for EVERY object, so serve hands over every snapshot whole.
+   *    Keeping the arm leaks nothing serve does not already hand over, and this
+   *    is the shape every deployment that has not wired the security plugin
+   *    gets: search is byte-for-byte unchanged. Checked first, and that order
+   *    is load-bearing — see the object-scope note below.
+   *  - **authority wired** — the readable set is per object, so the arm is
+   *    admissible only for a scope of exactly one KNOWN object. With
+   *    `filter.object` present that object is known at predicate time and the
+   *    seam is asked about it directly. Absent, the query spans every object
+   *    and there is nothing sound to ask, so the arm is dropped.
+   *
+   * Dropping an arm is strictly NARROWING: it never refuses a query and never
+   * widens what comes back, so the fail-closed direction is cheap here and is
+   * taken rather than reaching for a per-object predicate machine to avoid it.
+   * Refusing the query outright would be the louder behaviour change, and is
+   * deliberately not what this does.
+   */
+  async freeTextMayMatchSnapshot(objectInScope, context) {
+    const authority = this.fieldVisibility;
+    if (!authority || typeof authority.getReadableFields !== "function") return true;
+    const object = String(objectInScope ?? "").trim();
+    if (!object) return false;
+    const readable = await resolveReadableSnapshotFields(
+      authority,
+      object,
+      context,
+      this.logger
+    );
+    return readable === void 0;
+  }
   /** Filter type accepted by {@link listRequests} / {@link countRequests}. */
-  buildRequestWhere(filter, context) {
+  async buildRequestWhere(filter, context) {
     const f = {};
     if (filter?.object) f.object_name = filter.object;
     if (filter?.recordId) f.record_id = filter.recordId;
@@ -5134,13 +6024,16 @@ var _ApprovalService = class _ApprovalService {
     if (tenantOrg) f.organization_id = tenantOrg;
     const q = filter?.q?.trim();
     if (q) {
-      f.$or = [
+      const arms = [
         { process_name: { $contains: q } },
         { object_name: { $contains: q } },
         { record_id: { $contains: q } },
-        { submitter_id: { $contains: q } },
-        { payload_json: { $contains: q } }
+        { submitter_id: { $contains: q } }
       ];
+      if (await this.freeTextMayMatchSnapshot(filter?.object, context)) {
+        arms.push({ payload_json: { $contains: q } });
+      }
+      f.$or = arms;
     }
     if (Array.isArray(filter?.status)) {
       const statuses = filter.status.filter(Boolean);
@@ -5343,7 +6236,7 @@ var _ApprovalService = class _ApprovalService {
     return true;
   }
   async listRequests(filter, context) {
-    const { where, tenantOrg } = this.buildRequestWhere(filter, context);
+    const { where, tenantOrg } = await this.buildRequestWhere(filter, context);
     const approverTargets = (Array.isArray(filter?.approverId) ? filter.approverId : filter?.approverId ? [filter.approverId] : []).map((t) => String(t).trim()).filter(Boolean);
     const ids = await this.approverRequestIds(approverTargets, tenantOrg);
     if (ids) {
@@ -5367,12 +6260,13 @@ var _ApprovalService = class _ApprovalService {
     }
     const rows = await this.engine.find("sys_approval_request", findOpts);
     const list = Array.isArray(rows) ? rows.map(rowFromRequest) : [];
+    await this.redactPayloads(list, context);
     await this.enrichRows(list);
     this.attachViewers(list, context);
     return list;
   }
   async countRequests(filter, context) {
-    const { where, tenantOrg } = this.buildRequestWhere(filter, context);
+    const { where, tenantOrg } = await this.buildRequestWhere(filter, context);
     const approverTargets = (Array.isArray(filter?.approverId) ? filter.approverId : filter?.approverId ? [filter.approverId] : []).map((t) => String(t).trim()).filter(Boolean);
     const ids = await this.approverRequestIds(approverTargets, tenantOrg);
     if (ids) {
@@ -5409,9 +6303,28 @@ var _ApprovalService = class _ApprovalService {
    * flow-driven resume, a service-to-service call), turning a successful write
    * into a `null` result. Gating belongs on the read API, not on an
    * operation's own return value.
+   *
+   * [#12769] The read still narrows by the CALLER's organization
+   * (`loadRequest` — a deliberate tenancy wall, untouched here), and an
+   * org-less request row is invisible inside an org-scoped caller's narrowing.
+   * Org-less rows arise by construction on every schedule / time-relative /
+   * api trigger run (#10131; #9132 pinned that behaviour rather than repairing
+   * it), so this is a live state, not an edge case: the write IS recorded and
+   * the echo cannot be built. It used to escape as `null` behind the callers'
+   * `fresh!` non-null assertions — a well-formed 200 whose declared-non-null
+   * `request` was `null` on the wire. Now it refuses loudly instead, which
+   * keeps every declared result type true: a result that cannot be built is
+   * never returned. Callers must NOT catch this to fall back to `null` —
+   * that would re-open the type-lie one level up.
    */
   async readBackRequest(requestId, context) {
-    return this.loadRequest(requestId, context, false);
+    const fresh = await this.loadRequest(requestId, context, false);
+    if (!fresh) {
+      throw new Error(
+        `READ_BACK_FAILED: the write to approval request '${requestId}' was recorded, but the updated row is not visible inside the caller's organization scope, so the result envelope cannot be built. The write is NOT rolled back \u2014 read the request back with a system or matching-organization context.`
+      );
+    }
+    return fresh;
   }
   async getRequest(requestId, context) {
     return this.loadRequest(requestId, context, true);
@@ -5435,6 +6348,7 @@ var _ApprovalService = class _ApprovalService {
       if (visible && !visible.has(String(rows[0].id))) return null;
     }
     const row = rowFromRequest(rows[0]);
+    await this.redactPayloads([row], context);
     await this.enrichRows([row]);
     await this.attachFlowSteps(row);
     await this.attachDecisionProgress(row, rows[0]);
@@ -5902,6 +6816,41 @@ function bindApprovalLockHook(engine, logger) {
   }, { packageId: APPROVALS_HOOK_PACKAGE, priority: 50 });
   logger?.info?.("[approvals] record-lock hook bound");
 }
+var APPROVALS_OWN_OBJECTS = [
+  "sys_approval_request",
+  "sys_approval_action",
+  "sys_approval_approver",
+  "sys_approval_token",
+  "sys_approval_delegation"
+];
+function bindRecordDeleteCancelHook(engine, service, logger) {
+  engine.registerHook("afterDelete", async (ctx) => {
+    const object = ctx?.object ?? ctx?.objectName;
+    if (!object) return;
+    const raw = ctx?.previous?.id ?? ctx?.input?.id;
+    const recordId = raw == null ? "" : String(raw);
+    if (!recordId) {
+      logger?.warn?.(
+        "[approvals] a delete reached the approval-cancel hook with no record id \u2014 pending approvals for the deleted record (if any) stay in the inbox",
+        { object }
+      );
+      return;
+    }
+    try {
+      await service.cancelForDeletedRecord(String(object), recordId);
+    } catch (err) {
+      logger?.warn?.(
+        "[approvals] the approval-cancel linkage failed for a deleted record \u2014 its pending approvals stay in the inbox pointing at a record that no longer exists",
+        { object, record: recordId, error: err?.message ?? String(err) }
+      );
+    }
+  }, {
+    excludeObjects: [...APPROVALS_OWN_OBJECTS],
+    packageId: APPROVALS_HOOK_PACKAGE,
+    priority: 50
+  });
+  logger?.info?.("[approvals] record-delete cancel hook bound");
+}
 var DELEGATION_OBJECT = "sys_approval_delegation";
 function bindDelegationWriteGuard(engine, logger) {
   const makeGuard = (isInsert) => async (ctx) => {
@@ -5938,6 +6887,52 @@ function unbindAllHooks(engine) {
   return engine.unregisterHooksByPackage(APPROVALS_HOOK_PACKAGE);
 }
 
+// src/payload-redaction-middleware.ts
+var APPROVAL_REQUEST_OBJECT = "sys_approval_request";
+function parseSnapshot(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return { ok: false, value: void 0 };
+  try {
+    return { ok: true, value: JSON.parse(raw) };
+  } catch {
+    return { ok: false, value: void 0 };
+  }
+}
+async function redactRowsInPlace(rows, security, context, logger) {
+  const list = Array.isArray(rows) ? rows : rows ? [rows] : [];
+  if (list.length === 0) return;
+  const cache = /* @__PURE__ */ new Map();
+  for (const row of list) {
+    if (!row || typeof row !== "object") continue;
+    const raw = row.payload_json;
+    const parsed = parseSnapshot(raw);
+    if (!parsed.ok) continue;
+    const object = String(row.object_name ?? "").trim();
+    if (!object) continue;
+    if (!cache.has(object)) {
+      cache.set(object, await resolveReadableSnapshotFields(security, object, context, logger));
+    }
+    const readable = cache.get(object);
+    if (readable === void 0) continue;
+    const { payload, redactedKeys } = redactSnapshot(parsed.value, readable);
+    if (redactedKeys.length === 0) continue;
+    row.payload_json = JSON.stringify(payload);
+  }
+}
+function bindSnapshotRedactionMiddleware(engine, getSecurity, logger) {
+  engine.registerMiddleware(async (opCtx, next) => {
+    await next();
+    if (opCtx?.operation !== "find" && opCtx?.operation !== "findOne") return;
+    if (opCtx?.context?.isSystem) return;
+    try {
+      await redactRowsInPlace(opCtx.result, getSecurity(), opCtx.context, logger);
+    } catch (err) {
+      logger?.warn?.("[approvals] snapshot redaction middleware failed", {
+        error: err?.message ?? String(err)
+      });
+    }
+  }, { object: APPROVAL_REQUEST_OBJECT });
+}
+
 // src/approval-node.ts
 import {
   defineActionDescriptor as defineActionDescriptor2,
@@ -6207,13 +7202,46 @@ var ApprovalsServicePlugin = class {
         } catch {
           return void 0;
         }
+      },
+      // [#11993] Deployment override lookup for user-facing refusal copy.
+      // Resolved LAZILY for the reason the two providers above are: the i18n
+      // service is contributed by another plugin (ADR-0029 D8) and may start
+      // after this one. Without it the service still renders the built-in
+      // catalog in the caller's locale; with it, a deployment's own
+      // `translation` for `errors.approval_recall_not_submitter` wins — the
+      // override address the catalog documents, made real for this emitter.
+      messageTranslator: () => {
+        try {
+          const i18n = ctx.getService("i18n");
+          const t = i18n?.t;
+          if (typeof t !== "function") return void 0;
+          return (key, locale, params) => t.call(i18n, key, locale, params);
+        } catch {
+          return void 0;
+        }
+      }
+    });
+    const fieldVisibility = () => {
+      try {
+        const sec = ctx.getService("security");
+        return sec && typeof sec.getReadableFields === "function" ? sec : void 0;
+      } catch {
+        return void 0;
+      }
+    };
+    this.service.attachFieldVisibility({
+      getReadableFields: (object, context) => {
+        const sec = fieldVisibility();
+        return sec ? sec.getReadableFields(object, context) : Promise.resolve(void 0);
       }
     });
     if (!this.options.disableAutoHooks) {
       try {
         unbindAllHooks(engine);
         bindApprovalLockHook(engine, ctx.logger);
+        bindRecordDeleteCancelHook(engine, this.service, ctx.logger);
         bindDelegationWriteGuard(engine, ctx.logger);
+        bindSnapshotRedactionMiddleware(engine, fieldVisibility, ctx.logger);
       } catch (err) {
         ctx.logger.warn?.("[approvals] failed to bind approval hooks", { error: err?.message });
       }
@@ -6253,6 +7281,7 @@ var ApprovalsServicePlugin = class {
           }
         };
         await jobs.schedule(ESCALATION_JOB_NAME, { type: "interval", intervalMs }, sweep);
+        this.jobService = jobs;
         this.escalationJobScheduled = true;
         void sweep().catch((err) => {
           ctx.logger.warn?.("[approvals] boot sweep failed", { error: err?.message });
@@ -6339,14 +7368,32 @@ var ApprovalsServicePlugin = class {
       );
     }
   }
-  async stop(ctx) {
+  /**
+   * The kernel's teardown hook (`Plugin.destroy?()`, core `types.ts`) — the
+   * ONLY teardown entry point `ObjectKernel.performShutdown()` and
+   * `LiteKernel.destroy()` invoke.
+   *
+   * [#10371] IT USED TO BE `stop()`, WHICH NOTHING CALLED. `Plugin` declares
+   * `init()`, `start?()` and `destroy?()` and no `stop()`, so the kernel walked
+   * past this plugin at shutdown: the SLA escalation job stayed scheduled and
+   * this plugin's ObjectQL hooks stayed bound to an engine the kernel had
+   * finished with. `start()` IS on the interface, so the pair read as symmetric
+   * in review — that asymmetry is what let the same shape survive in six
+   * packages at once.
+   *
+   * This member owns no timer of its own (the escalation clock belongs to
+   * `service-job`), so it never cost a merge-queue eviction the way the
+   * `plugin-reports` / `service-messaging` members did (#9371). The class is
+   * the same one either way: a teardown the kernel does not reach.
+   */
+  async destroy() {
     if (this.escalationJobScheduled) {
       try {
-        const jobs = ctx.getService("job");
-        await jobs?.cancel?.(ESCALATION_JOB_NAME);
+        await this.jobService?.cancel?.(ESCALATION_JOB_NAME);
       } catch {
       }
       this.escalationJobScheduled = false;
+      this.jobService = void 0;
     }
     if (this.engine) {
       try {
@@ -6355,6 +7402,17 @@ var ApprovalsServicePlugin = class {
       }
     }
   }
+  /**
+   * Retained alias for {@link destroy}. Kept because it is public API of an
+   * exported class, and removing it would break an embedder who learned to call
+   * it directly precisely BECAUSE the kernel never did. The parameter is now
+   * optional and ignored: `destroy()` takes no context, so teardown uses the
+   * job service captured when the escalation clock was wired. Prefer kernel
+   * shutdown; direct callers keep working unchanged.
+   */
+  async stop(_ctx) {
+    await this.destroy();
+  }
 };
 export {
   APPROVAL_REVISE_CORRELATION_PREFIX,