@objectstack/plugin-approvals 17.2.0 → 17.3.0

package/dist/index.mjs

@@ -29,7 +29,7 @@ var init_en_objects_generated = __esm({
           },
           organization_id: {
             label: "Organization",
-            help: "Tenant that owns this approval request (propagated from submitter context)"
+            help: "Organization of the record this request is about (falls back to the acting context when the record has none)"
           },
           process_name: {
             label: "Source",
@@ -55,7 +55,15 @@ var init_en_objects_generated = __esm({
               approved: "Approved",
               rejected: "Rejected",
               recalled: "Recalled",
-              returned: "Returned"
+              returned: "Returned",
+              cancelled: "Cancelled"
+            }
+          },
+          cancel_reason: {
+            label: "Cancellation Reason",
+            help: "Why the platform voided this request (set only when the status is cancelled)",
+            options: {
+              record_deleted: "Related record deleted"
             }
           },
           current_step: {
@@ -236,7 +244,8 @@ var init_en_objects_generated = __esm({
               comment: "Comment",
               revise: "Revise",
               resubmit: "Resubmit",
-              ooo_substitute: "Out-of-Office Substitution"
+              ooo_substitute: "Out-of-Office Substitution",
+              cancel: "Cancel"
             }
           },
           actor_id: {
@@ -350,7 +359,7 @@ var init_zh_CN_objects_generated = __esm({
           },
           organization_id: {
             label: "\u7EC4\u7EC7",
-            help: "\u62E5\u6709\u8BE5\u5BA1\u6279\u8BF7\u6C42\u7684\u79DF\u6237\uFF08\u4ECE\u63D0\u4EA4\u65B9\u4E0A\u4E0B\u6587\u4F20\u64AD\uFF09"
+            help: "\u8BE5\u8BF7\u6C42\u6240\u6D89\u8BB0\u5F55\u6240\u5C5E\u7684\u7EC4\u7EC7\uFF08\u8BB0\u5F55\u65E0\u7EC4\u7EC7\u65F6\u56DE\u9000\u5230\u64CD\u4F5C\u4E0A\u4E0B\u6587\uFF09"
           },
           process_name: {
             label: "\u6765\u6E90",
@@ -376,7 +385,15 @@ var init_zh_CN_objects_generated = __esm({
               approved: "\u5DF2\u6279\u51C6",
               rejected: "\u5DF2\u62D2\u7EDD",
               recalled: "\u5DF2\u64A4\u56DE",
-              returned: "\u5DF2\u9000\u56DE\u4FEE\u6539"
+              returned: "\u5DF2\u9000\u56DE\u4FEE\u6539",
+              cancelled: "\u5DF2\u4F5C\u5E9F"
+            }
+          },
+          cancel_reason: {
+            label: "\u4F5C\u5E9F\u539F\u56E0",
+            help: "\u5E73\u53F0\u4F5C\u5E9F\u8BE5\u5BA1\u6279\u5355\u7684\u539F\u56E0(\u4EC5\u5728\u72B6\u6001\u4E3A\u300C\u5DF2\u4F5C\u5E9F\u300D\u65F6\u5199\u5165)",
+            options: {
+              record_deleted: "\u5173\u8054\u8BB0\u5F55\u5DF2\u5220\u9664"
             }
           },
           current_step: {
@@ -557,7 +574,8 @@ var init_zh_CN_objects_generated = __esm({
               comment: "\u8BC4\u8BBA",
               revise: "\u9000\u56DE\u4FEE\u6539",
               resubmit: "\u91CD\u65B0\u63D0\u4EA4",
-              ooo_substitute: "\u4E0D\u5728\u5C97\u6539\u6D3E"
+              ooo_substitute: "\u4E0D\u5728\u5C97\u6539\u6D3E",
+              cancel: "\u4F5C\u5E9F"
             }
           },
           actor_id: {
@@ -671,7 +689,7 @@ var init_ja_JP_objects_generated = __esm({
           },
           organization_id: {
             label: "\u7D44\u7E54",
-            help: "\u3053\u306E\u627F\u8A8D\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u6240\u6709\u3059\u308B\u30C6\u30CA\u30F3\u30C8\uFF08\u9001\u4FE1\u8005\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u304B\u3089\u4F1D\u64AD\uFF09"
+            help: "\u3053\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u5BFE\u8C61\u30EC\u30B3\u30FC\u30C9\u304C\u5C5E\u3059\u308B\u7D44\u7E54\uFF08\u30EC\u30B3\u30FC\u30C9\u306B\u7D44\u7E54\u304C\u306A\u3044\u5834\u5408\u306F\u64CD\u4F5C\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\uFF09"
           },
           process_name: {
             label: "\u30BD\u30FC\u30B9",
@@ -697,7 +715,15 @@ var init_ja_JP_objects_generated = __esm({
               approved: "\u627F\u8A8D\u6E08\u307F",
               rejected: "\u5374\u4E0B\u6E08\u307F",
               recalled: "\u53D6\u308A\u6D88\u3057\u6E08\u307F",
-              returned: "\u5DEE\u3057\u623B\u3057\u6E08\u307F"
+              returned: "\u5DEE\u3057\u623B\u3057\u6E08\u307F",
+              cancelled: "\u7121\u52B9\u5316\u6E08\u307F"
+            }
+          },
+          cancel_reason: {
+            label: "\u7121\u52B9\u5316\u7406\u7531",
+            help: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u304C\u3053\u306E\u7533\u8ACB\u3092\u7121\u52B9\u5316\u3057\u305F\u7406\u7531(\u30B9\u30C6\u30FC\u30BF\u30B9\u304C\u7121\u52B9\u5316\u6E08\u307F\u306E\u5834\u5408\u306E\u307F\u8A2D\u5B9A)",
+            options: {
+              record_deleted: "\u95A2\u9023\u30EC\u30B3\u30FC\u30C9\u304C\u524A\u9664\u3055\u308C\u307E\u3057\u305F"
             }
           },
           current_step: {
@@ -878,7 +904,8 @@ var init_ja_JP_objects_generated = __esm({
               comment: "\u30B3\u30E1\u30F3\u30C8",
               revise: "\u5DEE\u3057\u623B\u3057",
               resubmit: "\u518D\u63D0\u51FA",
-              ooo_substitute: "\u4E0D\u5728\u6642\u4EE3\u7406"
+              ooo_substitute: "\u4E0D\u5728\u6642\u4EE3\u7406",
+              cancel: "\u7121\u52B9\u5316"
             }
           },
           actor_id: {
@@ -992,7 +1019,7 @@ var init_es_ES_objects_generated = __esm({
           },
           organization_id: {
             label: "Organizaci\xF3n",
-            help: "Tenant que posee esta solicitud de aprobaci\xF3n (propagado desde el contexto del solicitante)."
+            help: "Organizaci\xF3n del registro al que se refiere esta solicitud (recurre al contexto del actor cuando el registro no tiene ninguna)."
           },
           process_name: {
             label: "Origen",
@@ -1018,7 +1045,15 @@ var init_es_ES_objects_generated = __esm({
               approved: "Aprobada",
               rejected: "Rechazada",
               recalled: "Retirada",
-              returned: "Devuelta para revisi\xF3n"
+              returned: "Devuelta para revisi\xF3n",
+              cancelled: "Anulada"
+            }
+          },
+          cancel_reason: {
+            label: "Motivo de anulaci\xF3n",
+            help: "Por qu\xE9 la plataforma anul\xF3 esta solicitud (solo se establece cuando el estado es Anulada)",
+            options: {
+              record_deleted: "Registro relacionado eliminado"
             }
           },
           current_step: {
@@ -1199,7 +1234,8 @@ var init_es_ES_objects_generated = __esm({
               comment: "Comentario",
               revise: "Devoluci\xF3n",
               resubmit: "Reenv\xEDo",
-              ooo_substitute: "Sustituci\xF3n por ausencia"
+              ooo_substitute: "Sustituci\xF3n por ausencia",
+              cancel: "Anulaci\xF3n"
             }
           },
           actor_id: {
@@ -1297,12 +1333,104 @@ var init_es_ES_objects_generated = __esm({
   }
 });
 
+// src/translations/zh-CN.source-hashes.generated.ts
+var zhCNGeneratedSourceHashes;
+var init_zh_CN_source_hashes_generated = __esm({
+  "src/translations/zh-CN.source-hashes.generated.ts"() {
+    "use strict";
+    zhCNGeneratedSourceHashes = {
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
+// src/translations/ja-JP.source-hashes.generated.ts
+var jaJPGeneratedSourceHashes;
+var init_ja_JP_source_hashes_generated = __esm({
+  "src/translations/ja-JP.source-hashes.generated.ts"() {
+    "use strict";
+    jaJPGeneratedSourceHashes = {
+      "objects.sys_approval_delegation._views.active.emptyState.message": "1095d61c017b6db2",
+      "objects.sys_approval_delegation._views.active.emptyState.title": "799d28e51d88963e",
+      "objects.sys_approval_delegation._views.active.label": "eee107cf4e466779",
+      "objects.sys_approval_delegation.description": "432b0435aa15f6b9",
+      "objects.sys_approval_delegation.fields.created_at.label": "1f02d416befb595b",
+      "objects.sys_approval_delegation.fields.delegate_id.help": "9cfc641f7b0b04f9",
+      "objects.sys_approval_delegation.fields.delegate_id.label": "afd6d8733dc5bc14",
+      "objects.sys_approval_delegation.fields.delegator_id.help": "c4686c5c9f24e0be",
+      "objects.sys_approval_delegation.fields.delegator_id.label": "f76b1f95f2fdabff",
+      "objects.sys_approval_delegation.fields.id.label": "3383564051b4b76d",
+      "objects.sys_approval_delegation.fields.organization_id.help": "f02982e88229d9ca",
+      "objects.sys_approval_delegation.fields.organization_id.label": "3e55836156e1c1de",
+      "objects.sys_approval_delegation.fields.reason.help": "712516f1461dff2b",
+      "objects.sys_approval_delegation.fields.reason.label": "ac399f03d7f2e64d",
+      "objects.sys_approval_delegation.fields.updated_at.label": "aba63dc2a9c79b8d",
+      "objects.sys_approval_delegation.fields.valid_from.help": "01386010c454bfbd",
+      "objects.sys_approval_delegation.fields.valid_from.label": "02eaf201e57c9eda",
+      "objects.sys_approval_delegation.fields.valid_until.help": "a48ea34e65933e9d",
+      "objects.sys_approval_delegation.fields.valid_until.label": "a68db5bd4fc72a13",
+      "objects.sys_approval_delegation.label": "4389c4fe5f5c9746",
+      "objects.sys_approval_delegation.pluralLabel": "f07fec3ffd74e6db",
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
+// src/translations/es-ES.source-hashes.generated.ts
+var esESGeneratedSourceHashes;
+var init_es_ES_source_hashes_generated = __esm({
+  "src/translations/es-ES.source-hashes.generated.ts"() {
+    "use strict";
+    esESGeneratedSourceHashes = {
+      "objects.sys_approval_action.fields.actor_id.label": "b155813f8a7f06e3",
+      "objects.sys_approval_delegation._views.active.emptyState.message": "1095d61c017b6db2",
+      "objects.sys_approval_delegation._views.active.emptyState.title": "799d28e51d88963e",
+      "objects.sys_approval_delegation._views.active.label": "eee107cf4e466779",
+      "objects.sys_approval_delegation.description": "432b0435aa15f6b9",
+      "objects.sys_approval_delegation.fields.created_at.label": "1f02d416befb595b",
+      "objects.sys_approval_delegation.fields.delegate_id.help": "9cfc641f7b0b04f9",
+      "objects.sys_approval_delegation.fields.delegate_id.label": "afd6d8733dc5bc14",
+      "objects.sys_approval_delegation.fields.delegator_id.help": "c4686c5c9f24e0be",
+      "objects.sys_approval_delegation.fields.delegator_id.label": "f76b1f95f2fdabff",
+      "objects.sys_approval_delegation.fields.id.label": "3383564051b4b76d",
+      "objects.sys_approval_delegation.fields.organization_id.help": "f02982e88229d9ca",
+      "objects.sys_approval_delegation.fields.organization_id.label": "3e55836156e1c1de",
+      "objects.sys_approval_delegation.fields.reason.help": "712516f1461dff2b",
+      "objects.sys_approval_delegation.fields.reason.label": "ac399f03d7f2e64d",
+      "objects.sys_approval_delegation.fields.updated_at.label": "aba63dc2a9c79b8d",
+      "objects.sys_approval_delegation.fields.valid_from.help": "01386010c454bfbd",
+      "objects.sys_approval_delegation.fields.valid_from.label": "02eaf201e57c9eda",
+      "objects.sys_approval_delegation.fields.valid_until.help": "a48ea34e65933e9d",
+      "objects.sys_approval_delegation.fields.valid_until.label": "a68db5bd4fc72a13",
+      "objects.sys_approval_delegation.label": "4389c4fe5f5c9746",
+      "objects.sys_approval_delegation.pluralLabel": "f07fec3ffd74e6db",
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
 // src/translations/index.ts
 var translations_exports = {};
 __export(translations_exports, {
   ApprovalsTranslations: () => ApprovalsTranslations
 });
-var ApprovalsTranslations;
+import { withSourceFallback } from "@objectstack/platform-objects/apps";
+var enSource, ApprovalsTranslations;
 var init_translations = __esm({
   "src/translations/index.ts"() {
     "use strict";
@@ -1310,18 +1438,27 @@ var init_translations = __esm({
     init_zh_CN_objects_generated();
     init_ja_JP_objects_generated();
     init_es_ES_objects_generated();
+    init_zh_CN_source_hashes_generated();
+    init_ja_JP_source_hashes_generated();
+    init_es_ES_source_hashes_generated();
+    enSource = { objects: enObjects };
     ApprovalsTranslations = {
-      en: { objects: enObjects },
-      "zh-CN": { objects: zhCNObjects },
-      "ja-JP": { objects: jaJPObjects },
-      "es-ES": { objects: esESObjects }
+      en: enSource,
+      "zh-CN": withSourceFallback({ objects: zhCNObjects }, enSource, void 0, zhCNGeneratedSourceHashes),
+      "ja-JP": withSourceFallback({ objects: jaJPObjects }, enSource, void 0, jaJPGeneratedSourceHashes),
+      "es-ES": withSourceFallback({ objects: esESObjects }, enSource, void 0, esESGeneratedSourceHashes)
     };
   }
 });
 
 // src/sys-approval-request.object.ts
 import { ObjectSchema, Field } from "@objectstack/spec/data";
-import { APPROVAL_STATUSES, APPROVAL_STATUS_LABELS } from "@objectstack/spec/contracts";
+import {
+  APPROVAL_STATUSES,
+  APPROVAL_STATUS_LABELS,
+  APPROVAL_CANCEL_REASONS,
+  APPROVAL_CANCEL_REASON_LABELS
+} from "@objectstack/spec/contracts";
 var SysApprovalRequest = ObjectSchema.create({
   name: "sys_approval_request",
   label: "Approval Request",
@@ -1368,7 +1505,10 @@ var SysApprovalRequest = ObjectSchema.create({
       label: "Completed",
       data: { provider: "object", object: "sys_approval_request" },
       columns: ["process_name", "object_name", "record_id", "status", "submitter_id", "completed_at"],
-      filter: [{ field: "status", operator: "in", value: ["approved", "rejected", "recalled"] }],
+      // Every terminal state, `cancelled` included (#13568) — a platform-voided
+      // request is kept as audit evidence, and a terminal state absent from the
+      // only curated terminal view is evidence nobody can find.
+      filter: [{ field: "status", operator: "in", value: ["approved", "rejected", "recalled", "cancelled"] }],
       sort: [{ field: "completed_at", order: "desc" }],
       pagination: { pageSize: 25 }
     },
@@ -1384,46 +1524,40 @@ var SysApprovalRequest = ObjectSchema.create({
   },
   fields: {
     id: Field.text({ label: "Request ID", required: true, readonly: true, group: "System" }),
-    // ⚠️ MEASURED DEFECT, cloud#1395 — read this before trusting the column.
-    //
-    // An approval request DOES belong to an organization: it is read through the
-    // organization wall by the approvals inbox, and on a shared-database
-    // deployment a row carrying no organization is not filtered BY that wall —
-    // it is either invisible to everyone or visible to everyone, decided by
-    // whatever filter each surface happens to apply rather than by the data.
-    //
-    // The value is resolved from the ACTING CONTEXT only (`openNodeRequest`'s
-    // `ctxOrg`), so it is NULL whenever the flow that opened the request ran
-    // without one — every schedule / time-relative / api triggered run, none of
-    // which sets a tenant. On a walled single-database HotCRM SaaS boot this
-    // measured 27 of 27 rows org-less, each naming an `object_name` /
-    // `record_id` owned by a specific customer.
+    // [#10101, the cloud#1395 Option A ruling] The SUBJECT record's
+    // organization, with the acting context as fallback — resolved by the
+    // SHARED platform-row resolver (`resolveRecordOrganizationField`,
+    // `@objectstack/metadata-core`) in `openNodeRequest`, the row's only
+    // writer. The same `requestOrg` stamps `sys_approval_action` and the
+    // `sys_approval_approver` index, so all three move together.
     //
-    // ⛔ Do NOT read that as "platform tables do not carry an organization".
-    // `sys_audit_log` (1669 rows) was correctly attributed on the SAME boot,
-    // because its writer takes the organization from the RECORD the row is
-    // about, with the session only as fallback (plugin-audit
-    // `resolveRecordOrganizationField`, #8707 honouring #8287's ruling). Two
-    // writers read the actor; a third reads the subject. That disagreement is
-    // the defect.
+    // Why subject-first: an approval request is read through the organization
+    // wall by the approvals inbox, and the acting context is NULL on every
+    // schedule / time-relative / api triggered run (none carries a tenant, by
+    // construction). Stamped from the actor alone — the pre-#10101 behaviour,
+    // measured on cloud#1395 as 27 of 27 rows org-less on a walled HotCRM SaaS
+    // boot — such a request LOCKED the record it was about while being
+    // invisible in every inbox, its owner's included. Subject-first is also
+    // what `sys_audit_log`'s writer already did (#8707 honouring #8287's
+    // ruling), so an approval row and an audit row about the same record now
+    // land behind the same wall instead of two.
     //
-    // Which of the two a side-table row should follow is an open contract
-    // question on cloud#1395 — the audit resolver is scope-pinned to audit
-    // stamping by the #8778 ruling, so this writer needs its own. The same
-    // `ctxOrg` also stamps `sys_approval_action` and `sys_approval_approver`,
-    // so all three move together.
+    // The `sys_api_key` divergence is deliberate and preserved: its
+    // `tenancy.organizationField: 'active_organization_id'` (stamp-only,
+    // #8778) wins limb 0 of the shared resolver, while the credential table
+    // itself stays unwalled (`tenancy.enabled: false`) — who a row is ABOUT
+    // and what an object is WALLED by remain different questions.
     organization_id: Field.lookup("sys_organization", {
       label: "Organization",
       required: false,
       group: "System",
-      // ⛔ String unchanged on purpose: it is extracted into the generated i18n
-      // bundles (`translations/*.objects.generated.ts`, as `help`), so rewording
-      // it is a translation-regeneration change and not a comment. The
-      // correction it needs — it claims a propagation that measurably does not
-      // happen, and says "Tenant" where ADR-0120 §Terminology requires
-      // "organization" — rides the cloud#1395 write-side fix, which rewrites the
-      // sentence and regenerates the four locales in one pass.
-      description: "Tenant that owns this approval request (propagated from submitter context)"
+      // Reworded with the #10101 write-side fix (was "Tenant that owns this
+      // approval request (propagated from submitter context)" — it claimed a
+      // propagation that measurably did not happen, and said "Tenant" where
+      // ADR-0120 §Terminology requires "organization"). Extracted into the
+      // generated i18n bundles as `help`; the four locales regenerate in the
+      // same pass.
+      description: "Organization of the record this request is about (falls back to the acting context when the record has none)"
     }),
     process_name: Field.text({
       label: "Source",
@@ -1442,7 +1576,38 @@ var SysApprovalRequest = ObjectSchema.create({
       label: "Record ID",
       required: true,
       maxLength: 100,
-      group: "Target"
+      // [#11386] The id half of this object's pointer pair (ADR-0052 §5),
+      // adopting the #11339 carrier. VERIFIED for THIS object: the pair is not
+      // decoration but the key the approval machinery QUERIES ON —
+      // `approval-service.ts` finds a record's pending request with
+      // `where: { object_name, record_id, status: 'pending' }`, and
+      // `lifecycle-hooks.ts` holds the record LOCK on the same pair
+      // (single-record and `$in` batch forms). `submit()` writes it from
+      // `input.object` / `input.recordId`, so a stored value is always a
+      // record id of the object the sibling names.
+      //
+      // Consequence of declaring, sharper here than elsewhere: a seeded
+      // request whose `record_id` stayed a verbatim natural key locked
+      // NOTHING and appeared under no record — it looked like a pending
+      // approval while being invisible to both queries that give the row its
+      // meaning. That is now a loud seed-time refusal. Both halves are
+      // `required: true`, so the un-addressable case (id half authored, type
+      // half empty) is already unreachable on this object.
+      group: "Target",
+      //
+      // ⚠️ ORDERING CONSTRAINT — this id half is `required: true`, and that
+      // makes it ORDER-DEPENDENT in seeds even though a pointer pair
+      // contributes no static ordering edge (#11674, measured against the real
+      // engine in `packages/objectql/src/engine-seed-required-deferral.test.ts`):
+      // the seed loader defers an unresolvable reference by DELETING the column
+      // from the pass-1 insert, required-validation rejects that row, and pass 2
+      // is then left with no row to back-fill. So the pass-2 healing that makes
+      // an OPTIONAL id half order-independent (`sys_audit_log`) does not reach
+      // this one. ⇒ SEED THE TARGET DATASET FIRST. The failure if you do not is
+      // loud in three places — a write error naming this column, a
+      // dropped-deferral error, and `success: false` — and since #11674 the
+      // loader also WARNS at load time, before the engine rejects the row.
+      referenceVia: "object_name"
     }),
     submitter_id: Field.lookup("sys_user", {
       label: "Submitter",
@@ -1470,6 +1635,29 @@ var SysApprovalRequest = ObjectSchema.create({
         group: "State"
       }
     ),
+    // [#13568] Why a `cancelled` request was cancelled — the machine-readable
+    // half of the maintainer's 2026-08-31 ruling ("状态转 cancelled + 机器可读
+    // 原因"). Derived from `APPROVAL_CANCEL_REASONS`, never re-typed, on the
+    // same #3786 rule the `status` column above follows.
+    //
+    // On the ROW rather than on the `sys_approval_action` audit entry, because
+    // the readers are the inbox and the tombstone presentation, which page the
+    // request table: making them join the append-only action log to learn why a
+    // row they already hold is cancelled buys nothing and would make the reason
+    // unavailable to a plain list view. The action row still records the event
+    // (`action: 'cancel'`); this column records the STATE.
+    //
+    // Null on every non-cancelled row, and on rows written before the column
+    // existed — "not recorded", never "cancelled for no reason".
+    cancel_reason: Field.select(
+      APPROVAL_CANCEL_REASONS.map((value) => ({ value, label: APPROVAL_CANCEL_REASON_LABELS[value] })),
+      {
+        label: "Cancellation Reason",
+        required: false,
+        description: "Why the platform voided this request (set only when the status is cancelled)",
+        group: "State"
+      }
+    ),
     current_step: Field.text({
       label: "Current Step",
       required: false,
@@ -1489,6 +1677,22 @@ var SysApprovalRequest = ObjectSchema.create({
       description: "Comma-separated user ids who can act on the current step",
       group: "State"
     }),
+    // The module docstring above used to justify this column with "used by
+    // notifications so they can render before the record is locked or
+    // changed". That consumer does not exist, and the claim was cited as the
+    // reason the column holds a FULL row before anyone checked it. Measured
+    // against every `this.notify(...)` call site in `approval-service.ts` —
+    // all 12 of them: each passes `{ title, message, actionUrl }` (two also
+    // `actions`), built from `object_name` / `record_id` and the caller's
+    // comment. None reads this column or the parsed `payload`. The real
+    // readers are the serve path (`rowFromRequest` -> `payload`, redacted per
+    // reader), the decide-time approver re-resolution and the org backfill,
+    // both under SYSTEM_CTX, and the free-text predicate.
+    //
+    // The `description` below is deliberately UNCHANGED: it is accurate, and
+    // it is extracted into the four generated i18n bundles as `help`. The
+    // false sentence lived only in the JSDoc above, which is not extracted —
+    // so this correction moves no translation leaf.
     payload_json: Field.textarea({
       label: "Snapshot",
       required: false,
@@ -1559,11 +1763,14 @@ var SysApprovalRequest = ObjectSchema.create({
   // per-viewer block (#3310): approver actions on `record.viewer.can_act`
   // (the caller is a current pending approver — same check the service
   // authorizes a decision with, so position/team approvers resolve correctly),
-  // submitter actions on `record.viewer.is_submitter`. The core decision levers
-  // (approve/reject/reassign) additionally OR in `record.viewer.can_override`
-  // (#3424) so a platform/tenant admin can rescue a request routed to an
+  // submitter actions on `record.viewer.is_submitter`. The four levers the
+  // #3424 override covers (approve/reject/reassign, and recall since #12716)
+  // additionally OR in `record.viewer.can_override`
+  // so a platform/tenant admin can rescue a request routed to an
   // unstaffed position — otherwise undecidable, locking the record forever — by
-  // approving, rejecting, or reassigning it to a real approver. `viewer` is
+  // approving, rejecting, reassigning it to a real approver, or recalling it
+  // (the lever that releases the record without recording a decision nobody
+  // made). `viewer` is
   // attached by getRequest/listRequests; where it is absent the predicate fails
   // closed.
   //
@@ -1699,8 +1906,13 @@ var SysApprovalRequest = ObjectSchema.create({
     // Remind / recall (pending) and resubmit / recall (returned). These are the
     // submitter's own levers, so `visible` gates on `record.viewer.is_submitter`
     // (server-computed on the current viewer). The service re-checks ownership;
-    // the predicate keeps a non-submitter from ever seeing a button they cannot
-    // use.
+    // the predicate keeps a plain non-submitter from ever seeing a button they
+    // cannot use.
+    //
+    // `recall` is the one exception, and it is not a widening: it ALSO ORs in
+    // the #3424 admin override (#12716), because an override admin is a caller
+    // `ApprovalService.recall` already authorises. Remind and resubmit keep no
+    // override arm.
     {
       name: "approval_remind",
       label: "Send reminder",
@@ -1731,7 +1943,26 @@ var SysApprovalRequest = ObjectSchema.create({
       ],
       // Recall applies while the request is live for the submitter — pending
       // (withdraw) or returned (abandon the revision instead of resubmitting).
-      visible: 'has(record.status) && (record.status == "pending" || record.status == "returned") && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true',
+      //
+      // The second arm is the #3424 admin override, spelled byte-identically to
+      // the three core decision levers above (#12716). `ApprovalService.recall`
+      // has admitted the override caller since #3424 — `isOverrideActor`'s own
+      // doc block names recall as one of the four levers — so until this arm
+      // landed, recall was the one authorised capability with no button: an
+      // admin could approve or reject their way out of a stuck request (writing
+      // a decision that did not happen) or reassign it, but could not withdraw.
+      //
+      // The override arm carries no status test of its own, on purpose, because
+      // it does not need one and the siblings do not have one either: the flag
+      // is already status-scoped where it is COMPUTED. `attachViewers` in
+      // `approval-service.ts` sets
+      // `can_override: row.status === 'pending' && isOverrideActor(...)` —
+      // ANDed — so `record.viewer.can_override` can never be true off `pending`,
+      // and this arm is pending-only in effect however CEL groups the
+      // expression. Pinned in both directions in
+      // `action-predicate-sparse-face.test.ts`, with the flag's own scoping
+      // pinned against the real service in `approval-revise.test.ts`.
+      visible: 'has(record.status) && (record.status == "pending" || record.status == "returned") && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true || has(record.viewer) && has(record.viewer.can_override) && record.viewer.can_override == true',
       locations: ["record_section"],
       successMessage: "Recalled.",
       refreshAfter: true
@@ -2092,6 +2323,7 @@ import {
   normalizeDecisionOutputs
 } from "@objectstack/spec/automation";
 import { ExpressionEngine, collectCelRootIdentifiers } from "@objectstack/formula";
+import { createRecordOrganizationResolver } from "@objectstack/metadata-core";
 import { keysetWalk } from "@objectstack/types";
 import {
   ADMIN_FULL_ACCESS,
@@ -2102,6 +2334,7 @@ import {
 } from "@objectstack/spec/identity";
 import { RESUME_AUTHORITY_SERVICE } from "@objectstack/spec/contracts";
 import { isFileIdToken } from "@objectstack/spec/data";
+import { renderOperationMessage } from "@objectstack/spec/system";
 import { isGrantActive } from "@objectstack/core";
 
 // src/approver-org-scope.ts
@@ -2257,6 +2490,7 @@ var REMIND_COOLDOWN_MS = 4 * 60 * 60 * 1e3;
 var ESCALATION_JOB_NAME = "approvals-sla-escalation";
 var ESCALATION_SCAN_INTERVAL_MS = 5 * 60 * 1e3;
 var SLA_ACTOR_ID = "system:sla";
+var ESCALATION_ENABLED_FLIP_CUTOFF_MS = Date.parse("2026-08-28T00:00:00Z");
 var DEAD_RUN_ACTOR_ID = "system:dead-run";
 var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set([
   "completed",
@@ -2265,8 +2499,37 @@ var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set([
   "timed_out"
 ]);
 var STRANDABLE_REQUEST_STATUSES = ["approved", "rejected", "returned"];
+function classifyStrandedRunState(run) {
+  if (!run) return "missing";
+  switch (run.status) {
+    // The resume consumed the pause and a downstream node threw. Reported.
+    case "failed":
+      return "failed";
+    // ── The negatives, each for its own reason ──────────────────────────────
+    // The decision advanced the flow and the flow finished. Healthy.
+    case "completed":
+      return void 0;
+    // Deliberately terminated by an operator (`cancelRun`, ADR-0044). The run
+    // stopping is the intended outcome, exactly as `recalled` is on the request
+    // side — reporting it would bury the real findings under expected ones.
+    case "cancelled":
+      return void 0;
+    // The history's last row says `paused` while the suspension store says no
+    // live pause. That is AMBIGUOUS, and the ambiguity is not resolvable from
+    // one scan: a resume in flight right now has consumed the suspension and
+    // not yet written its terminal row, and reads exactly like a process that
+    // died in the same window. Condemning it would name every concurrently
+    // resuming approval — so this stays SKIPPED, the conservative arm this
+    // whole method is built on.
+    case "paused":
+      return void 0;
+    default:
+      return void 0;
+  }
+}
 var ACTION_TOKEN_TTL_MS = 72 * 60 * 60 * 1e3;
 var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+var RECORD_DELETE_CANCEL_LIMIT = 200;
 function actingUserId(context) {
   const userId = context?.userId;
   return typeof userId === "string" && userId ? userId : null;
@@ -2327,6 +2590,10 @@ function rowFromRequest(row) {
     submitter_id: row.submitter_id ?? void 0,
     submitter_comment: row.submitter_comment ?? void 0,
     status: row.status ?? "pending",
+    // [#13568] Why a cancelled row was cancelled. Surfaced on every read for
+    // the same reason `status` is: a client that can see the terminal state and
+    // not the machine-readable cause is back to guessing from prose.
+    cancel_reason: row.cancel_reason ?? void 0,
     current_step: row.current_step ?? void 0,
     current_step_index: row.current_step_index ?? void 0,
     pending_approvers: csvSplit(row.pending_approvers),
@@ -2419,6 +2686,7 @@ function rowFromAction(row) {
 var _ApprovalService = class _ApprovalService {
   constructor(opts) {
     this.engine = opts.engine;
+    this.recordOrgResolver = createRecordOrganizationResolver(opts.engine);
     this.clock = opts.clock ?? { now: () => /* @__PURE__ */ new Date() };
     this.logger = opts.logger;
     this.automation = opts.automation;
@@ -2426,6 +2694,7 @@ var _ApprovalService = class _ApprovalService {
     this.publicBaseUrl = (opts.publicBaseUrl ?? "").replace(/\/$/, "");
     this.tenancyPosture = opts.tenancyPosture;
     this.fieldVisibility = opts.fieldVisibility;
+    this.messageTranslator = opts.messageTranslator;
     this.recordReaderVisibleObjects = new Set(
       (Array.isArray(opts.recordReaderVisibleObjects) ? opts.recordReaderVisibleObjects : []).map((n) => String(n ?? "").trim()).filter(Boolean)
     );
@@ -2578,6 +2847,41 @@ var _ApprovalService = class _ApprovalService {
     const actorTenant = context.tenantId ?? context.organizationId ?? null;
     return requestOrg == null || actorTenant != null && String(requestOrg) === String(actorTenant);
   }
+  /**
+   * [#11993] The END USER's half of an approval refusal.
+   *
+   * `handleApprovalError` in `@objectstack/rest` maps this service's
+   * `CODE: message` throws onto the wire by testing the prefix for the status
+   * and then STRIPPING it (a leading run of `[A-Z_]` plus a colon and any
+   * following whitespace), shipping what remains as the body's
+   * human-readable `error` — which Console splices under its own localized
+   * label ("撤回审批失败: …"). A hardcoded English reason therefore reaches an
+   * operator in a fully Chinese deployment as a Chinese prefix glued onto an
+   * English sentence they cannot act on.
+   *
+   * Rendered through the SHARED Operation Message Catalog
+   * (`@objectstack/spec/system`), not a second mechanism: same
+   * `errors.<key>` override address, same resolution ladder (deployment
+   * override -> locale catalog -> `en` -> the key), same guarantee that a
+   * misbehaving i18n service cannot turn a 403 into a 500. The catalog's
+   * header names this seat explicitly; `plugin-security`'s
+   * `userFacingDenialMessage` is the sibling consumer this mirrors.
+   *
+   * The CODE PREFIX stays on the message. It is not user copy — it is how the
+   * REST layer derives the status and the ADR-0112 wire code, and it is
+   * stripped before the sentence reaches a body. The developer's half moves
+   * to the log, where the ids it names are legible to an operator and to
+   * nobody else.
+   */
+  userFacingRefusal(messageKey, context) {
+    let translate;
+    try {
+      translate = this.messageTranslator?.();
+    } catch {
+      translate = void 0;
+    }
+    return renderOperationMessage({ messageKey }, { locale: context?.locale, translate });
+  }
   /**
    * Pin the acting identity to the AUTHENTICATED CALLER (#3800).
    *
@@ -3518,11 +3822,13 @@ var _ApprovalService = class _ApprovalService {
     const substitutions = [];
     const groups = {};
     const liveRecord = await this.loadLiveRecord(input.object, input.recordId, input.record);
+    const subjectOrg = this.recordOrgResolver.organizationOf(input.object, liveRecord, input.record);
+    const requestOrg = subjectOrg ?? ctxOrg;
     const resolvedFrom = {};
     const approvers = await this.expandApprovers(
       { approvers: input.config.approvers },
       liveRecord,
-      ctxOrg,
+      requestOrg,
       {
         now: nowDate.getTime(),
         substitutions,
@@ -3586,16 +3892,16 @@ var _ApprovalService = class _ApprovalService {
       flow_run_id: input.runId,
       flow_node_id: input.nodeId,
       node_config_json: JSON.stringify(configSnapshot),
-      organization_id: ctxOrg,
+      organization_id: requestOrg,
       created_at: now,
       updated_at: now
     };
     await this.engine.insert("sys_approval_request", row, { context: SYSTEM_CTX2 });
-    await this.syncApproverIndex(id, approvers, ctxOrg, now);
+    await this.syncApproverIndex(id, approvers, requestOrg, now);
     await this.engine.insert("sys_approval_action", {
       id: uid("aact"),
       request_id: id,
-      organization_id: ctxOrg,
+      organization_id: requestOrg,
       step_name: input.nodeId,
       step_index: 0,
       action: "submit",
@@ -3607,7 +3913,7 @@ var _ApprovalService = class _ApprovalService {
       await this.engine.insert("sys_approval_action", {
         id: uid("aact"),
         request_id: id,
-        organization_id: ctxOrg,
+        organization_id: requestOrg,
         step_name: input.nodeId,
         step_index: 0,
         action: "ooo_substitute",
@@ -4049,6 +4355,13 @@ var _ApprovalService = class _ApprovalService {
    * is then paused at the revise-window node (no reject edge), so it is
    * terminally cancelled via {@link ApprovalResumeSurface.cancelRun} rather
    * than resumed.
+   *
+   * The #3424 privileged override reaches a PENDING request only (#12775,
+   * maintainer ruling 2026-09-02). On `returned` an override actor is refused
+   * exactly as any other non-submitter: the gate is spelled as `attachViewers`
+   * computes `viewer.can_override`, so the gate, the
+   * {@link ApprovalService.isOverrideActor} doc block and the viewer flag agree
+   * at one point.
    */
   async recall(requestId, input, context) {
     if (!requestId) throw new Error("VALIDATION_FAILED: requestId is required");
@@ -4064,8 +4377,18 @@ var _ApprovalService = class _ApprovalService {
     if (raw.status !== "pending" && !inReviseWindow) {
       throw new Error(`INVALID_STATE: request is ${raw.status}`);
     }
-    if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
-      throw new Error(`FORBIDDEN: only the submitter may recall this request`);
+    const overrideAdmits = raw.status === "pending" && this.isOverrideActor(context, raw.organization_id ?? null);
+    if (!overrideAdmits && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
+      const developerMessage = `[approvals] recall refused: actor '${actorId}' is not the submitter of request '${requestId}' (submitter '${String(raw.submitter_id)}') and holds no #3424 override for a '${raw.status}' request (the override reaches pending requests only)`;
+      this.logger?.warn?.(developerMessage, {
+        request: requestId,
+        actor: actorId,
+        submitter: String(raw.submitter_id),
+        status: raw.status
+      });
+      throw new Error(
+        `FORBIDDEN: ${this.userFacingRefusal("approval_recall_not_submitter", context)}`
+      );
     }
     if (inReviseWindow) await this.assertLatestForRun(raw);
     const config = parseJson(raw.node_config_json, { approvers: [], behavior: "first_response" });
@@ -4141,6 +4464,127 @@ var _ApprovalService = class _ApprovalService {
     const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh, runId, resumed, ...resumeError ? { resumeError } : {} };
   }
+  // ── Record-delete lifecycle linkage (#13568) ─────────────────
+  /**
+   * Void every `pending` request about a record that has just been DELETED
+   * (#13568, maintainer ruling 2026-08-31 「同意」).
+   *
+   * ## What the ruling asked for, and what each half costs
+   *
+   *   status → `cancelled`, a machine-readable `cancel_reason`, the row KEPT
+   *   for audit, and the request out of the pending count and the inbox's
+   *   default view.
+   *
+   * The last clause needs both writes below, not just the status one: the
+   * inbox's "My Pending" tab pages the request table by `status`, but the
+   * approver filter resolves through the normalized `sys_approval_approver`
+   * index (#1745), which is keyed on nothing but `request_id`. Leaving the
+   * index rows behind would keep the request in `approverRequestIds`' answer
+   * for every approver forever — so {@link syncApproverIndex} clears them, the
+   * same call every other exit from `pending` makes.
+   *
+   * ## Three things this deliberately does NOT do
+   *
+   * 1. **No status mirror-back.** Every other terminal transition calls
+   *    {@link mirrorStatusField} to write the outcome onto the subject record's
+   *    `approvalStatusField`. Here the subject record is precisely what no
+   *    longer exists, so that write is guaranteed to fail — it is the very
+   *    `update_record(...) failed: Record ... not found` this card's own
+   *    forensics recorded on the reject door. Skipped by construction, not by a
+   *    swallowed error.
+   *
+   * 2. **No flow resume, and no run cancel.** A cancellation is a status write
+   *    plus a reason; it is not a decision, so there is no branch to resume
+   *    down and no downstream node that should run. The suspended run this
+   *    request gated is reported (below) and left alone — what becomes of an
+   *    approval run whose request was voided is a lifecycle question that
+   *    belongs to the automation service, not to a delete hook, and answering
+   *    it here by guessing would be exactly the kind of consumer-side
+   *    accommodation PD #12 refuses.
+   *
+   * 3. **No refusal of the delete.** The delete has already landed by the time
+   *    this runs, and the "forbid delete while an approval is pending"
+   *    direction was VETOED in the same ruling (`lockRecord` already blocks the
+   *    edit; blocking the delete too locks an author onto a record they cannot
+   *    fix). So nothing here throws — a failure degrades to a warning and the
+   *    stale row, which is the pre-existing state, never to a failed delete.
+   *
+   * Terminal rows are untouched: the `where` below names `status: 'pending'`,
+   * so an `approved` / `rejected` / `recalled` / `returned` request about the
+   * same record keeps its recorded outcome. That is the ruling's second half —
+   * history is kept; only the presentation of its dead record reference is
+   * someone else's card.
+   *
+   * @returns the request ids cancelled and the suspended run ids left behind.
+   */
+  async cancelForDeletedRecord(objectName, recordId) {
+    const empty = { cancelled: [], suspendedRuns: [] };
+    const object = String(objectName ?? "").trim();
+    const record = String(recordId ?? "").trim();
+    if (!object || !record) return empty;
+    let pending;
+    try {
+      const rows = await this.engine.find("sys_approval_request", {
+        where: { object_name: object, record_id: record, status: "pending" },
+        limit: RECORD_DELETE_CANCEL_LIMIT,
+        context: SYSTEM_CTX2
+      });
+      pending = Array.isArray(rows) ? rows : [];
+    } catch (err) {
+      this.logger?.warn?.(
+        "[approvals] could not read the pending requests of a deleted record \u2014 they stay in the inbox until the record is deleted again or an operator finalises them",
+        { object, record, error: err?.message ?? String(err) }
+      );
+      return empty;
+    }
+    if (pending.length === 0) return empty;
+    const now = this.clock.now().toISOString();
+    const cancelled = [];
+    const suspendedRuns = [];
+    for (const raw of pending) {
+      const requestId = String(raw?.id ?? "");
+      if (!requestId) continue;
+      const org = raw?.organization_id ?? null;
+      const nodeId = raw?.flow_node_id ?? raw?.current_step ?? null;
+      try {
+        await this.engine.insert("sys_approval_action", {
+          id: uid("aact"),
+          request_id: requestId,
+          organization_id: org,
+          step_name: nodeId,
+          step_index: 0,
+          action: "cancel",
+          actor_id: null,
+          comment: `Auto-cancelled: the ${object} record '${record}' this request is about was deleted`,
+          created_at: now
+        }, { context: SYSTEM_CTX2 });
+        await this.engine.update("sys_approval_request", {
+          id: requestId,
+          status: "cancelled",
+          cancel_reason: "record_deleted",
+          pending_approvers: null,
+          completed_at: now,
+          updated_at: now
+        }, { context: SYSTEM_CTX2 });
+        await this.syncApproverIndex(requestId, [], org, now);
+        cancelled.push(requestId);
+        const runId = raw?.flow_run_id ? String(raw.flow_run_id) : "";
+        if (runId) suspendedRuns.push(runId);
+      } catch (err) {
+        this.logger?.warn?.(
+          "[approvals] could not auto-cancel a pending request whose record was deleted \u2014 it stays in the inbox pointing at a record that no longer exists",
+          { object, record, request: requestId, error: err?.message ?? String(err) }
+        );
+      }
+    }
+    if (suspendedRuns.length) {
+      this.logger?.warn?.(
+        "[approvals] auto-cancelled approval request(s) for a deleted record \u2014 the automation run(s) they gated stay suspended and are not resumed by a cancellation",
+        { object, record, requests: cancelled, runs: suspendedRuns }
+      );
+    }
+    return { cancelled, suspendedRuns };
+  }
   // ── Send back for revision / resubmit (ADR-0044) ─────────────
   /**
    * ADR-0044 send back for revision. Finalises the pending request as
@@ -4771,7 +5215,10 @@ var _ApprovalService = class _ApprovalService {
    * `escalation.timeoutHours` and whose deadline has passed is escalated
    * **at most once, ever** — the `escalate` audit row is the idempotency
    * marker, written before any mutation (audit-first, like reassign). One
-   * bad row never stops the sweep.
+   * bad row never stops the sweep. A block that explicitly declares
+   * `enabled: false` is skipped (#12278 — the declared switch is enforced;
+   * pre-flip snapshots ride the legacy window on
+   * {@link ESCALATION_ENABLED_FLIP_CUTOFF_MS}).
    */
   async runEscalations() {
     let rows = [];
@@ -4793,6 +5240,7 @@ var _ApprovalService = class _ApprovalService {
         const cfg = parseJson(raw.node_config_json, void 0);
         const esc2 = cfg?.escalation;
         if (!esc2 || typeof esc2.timeoutHours !== "number" || esc2.timeoutHours <= 0) continue;
+        if (esc2.enabled === false && Date.parse(raw.created_at ?? "") >= ESCALATION_ENABLED_FLIP_CUTOFF_MS) continue;
         const due = slaDueAt(raw.created_at, cfg);
         if (!due || Date.parse(due) > this.clock.now().getTime()) continue;
         const prior = await this.engine.find("sys_approval_action", {
@@ -4873,9 +5321,35 @@ var _ApprovalService = class _ApprovalService {
    *    live pause exists. It THROWS when the store cannot be read, and that
    *    case is SKIPPED, never counted as dead: an unreadable store means
    *    "unknown", and a storage outage must not be published as a lost run.
-   *  - `getRun(runId) == null` — no terminal history row either (the `run_`
-   *    prefixed rows in `sys_automation_run`). A run that merely finished is
-   *    not stranded; a request whose run neither waits nor ever completed is.
+   *  - `classifyStrandedRunState` over `getRun(runId)` — the run's own
+   *    history row (the `run_` prefixed rows in `sys_automation_run`). A run
+   *    that merely finished is not stranded; a request whose run neither waits
+   *    nor completed is.
+   *
+   * **The second oracle was widened (#13909), and this is the whole point of
+   * that card's first slice.** It used to be `if (terminal) continue` — the
+   * existence of ANY history row ended the check, on the reading "the run ran to
+   * a terminal state, it is not dangling". That is true of a run that COMPLETED
+   * and false of one that FAILED: the engine consumes a suspension *before*
+   * running the downstream nodes (`AutomationEngine.resumeInternal` calls
+   * `forgetSuspendedRun(run, 'resumed')` and only then `traverseNext`), so a
+   * downstream node that merely threw threw with the pause already gone, and the
+   * catch arm wrote a terminal `failed` row. The decision is durable, the
+   * continuation stopped half-way, `resume` answers `RUN_NOT_FOUND` and
+   * `cancelRun` is a no-op — and the terminal row this oracle used to read as
+   * health is written BY the very failure that stranded it. So this inspection
+   * reported `0` for the one shape an operator most needs to see.
+   *
+   * ⚠️ The widening does NOT reverse the conservatism: `completed`, `cancelled`
+   * and `paused` are each still skipped, for reasons named one at a time in
+   * `classifyStrandedRunState`, and an unrecognised status is skipped too.
+   * What the widening buys is that a `failed` run is now reported with
+   * `runState: 'failed'` instead of counted as healthy.
+   *
+   * ⚠️ **What this can and cannot size.** It makes the condition *visible* in a
+   * deployment; it is not itself a census, and it says nothing about this
+   * repository. How many runs are already in this state can only be answered
+   * against a real deployment's tables — see the card.
    *
    * **Reports; never rewrites.** No status is changed and no run is cancelled.
    * The decision genuinely happened — a human approved or rejected — and
@@ -4933,7 +5407,8 @@ var _ApprovalService = class _ApprovalService {
         });
         continue;
       }
-      if (terminal) continue;
+      const runState = classifyStrandedRunState(terminal);
+      if (!runState) continue;
       const config = parseJson(
         raw.node_config_json,
         { approvers: [], behavior: "first_response" }
@@ -4956,6 +5431,7 @@ var _ApprovalService = class _ApprovalService {
         requestId: String(raw.id),
         status: raw.status,
         runId,
+        runState,
         flowName: typeof raw.process_name === "string" ? raw.process_name.replace(/^flow:/, "") : void 0,
         nodeId: raw.flow_node_id ?? raw.current_step ?? void 0,
         objectName: raw.object_name,
@@ -4967,11 +5443,13 @@ var _ApprovalService = class _ApprovalService {
       });
     }
     if (stranded.length || undetermined) {
-      this.logger?.warn?.("[approvals] stranded terminal requests (decision recorded, flow run gone)", {
+      this.logger?.warn?.("[approvals] stranded terminal requests (decision recorded, flow run unrecoverable)", {
         scanned: rows.length,
         stranded: stranded.length,
         undetermined,
-        requests: stranded.map((s) => `${s.requestId}@${s.nodeId ?? "?"} \u2192 run ${s.runId}`)
+        runMissing: stranded.filter((s) => s.runState === "missing").length,
+        runFailed: stranded.filter((s) => s.runState === "failed").length,
+        requests: stranded.map((s) => `${s.requestId}@${s.nodeId ?? "?"} \u2192 run ${s.runId} (${s.runState})`)
       });
     }
     return { scanned: rows.length, stranded, undetermined };
@@ -5825,9 +6303,28 @@ var _ApprovalService = class _ApprovalService {
    * flow-driven resume, a service-to-service call), turning a successful write
    * into a `null` result. Gating belongs on the read API, not on an
    * operation's own return value.
+   *
+   * [#12769] The read still narrows by the CALLER's organization
+   * (`loadRequest` — a deliberate tenancy wall, untouched here), and an
+   * org-less request row is invisible inside an org-scoped caller's narrowing.
+   * Org-less rows arise by construction on every schedule / time-relative /
+   * api trigger run (#10131; #9132 pinned that behaviour rather than repairing
+   * it), so this is a live state, not an edge case: the write IS recorded and
+   * the echo cannot be built. It used to escape as `null` behind the callers'
+   * `fresh!` non-null assertions — a well-formed 200 whose declared-non-null
+   * `request` was `null` on the wire. Now it refuses loudly instead, which
+   * keeps every declared result type true: a result that cannot be built is
+   * never returned. Callers must NOT catch this to fall back to `null` —
+   * that would re-open the type-lie one level up.
    */
   async readBackRequest(requestId, context) {
-    return this.loadRequest(requestId, context, false);
+    const fresh = await this.loadRequest(requestId, context, false);
+    if (!fresh) {
+      throw new Error(
+        `READ_BACK_FAILED: the write to approval request '${requestId}' was recorded, but the updated row is not visible inside the caller's organization scope, so the result envelope cannot be built. The write is NOT rolled back \u2014 read the request back with a system or matching-organization context.`
+      );
+    }
+    return fresh;
   }
   async getRequest(requestId, context) {
     return this.loadRequest(requestId, context, true);
@@ -6319,6 +6816,41 @@ function bindApprovalLockHook(engine, logger) {
   }, { packageId: APPROVALS_HOOK_PACKAGE, priority: 50 });
   logger?.info?.("[approvals] record-lock hook bound");
 }
+var APPROVALS_OWN_OBJECTS = [
+  "sys_approval_request",
+  "sys_approval_action",
+  "sys_approval_approver",
+  "sys_approval_token",
+  "sys_approval_delegation"
+];
+function bindRecordDeleteCancelHook(engine, service, logger) {
+  engine.registerHook("afterDelete", async (ctx) => {
+    const object = ctx?.object ?? ctx?.objectName;
+    if (!object) return;
+    const raw = ctx?.previous?.id ?? ctx?.input?.id;
+    const recordId = raw == null ? "" : String(raw);
+    if (!recordId) {
+      logger?.warn?.(
+        "[approvals] a delete reached the approval-cancel hook with no record id \u2014 pending approvals for the deleted record (if any) stay in the inbox",
+        { object }
+      );
+      return;
+    }
+    try {
+      await service.cancelForDeletedRecord(String(object), recordId);
+    } catch (err) {
+      logger?.warn?.(
+        "[approvals] the approval-cancel linkage failed for a deleted record \u2014 its pending approvals stay in the inbox pointing at a record that no longer exists",
+        { object, record: recordId, error: err?.message ?? String(err) }
+      );
+    }
+  }, {
+    excludeObjects: [...APPROVALS_OWN_OBJECTS],
+    packageId: APPROVALS_HOOK_PACKAGE,
+    priority: 50
+  });
+  logger?.info?.("[approvals] record-delete cancel hook bound");
+}
 var DELEGATION_OBJECT = "sys_approval_delegation";
 function bindDelegationWriteGuard(engine, logger) {
   const makeGuard = (isInsert) => async (ctx) => {
@@ -6670,6 +7202,23 @@ var ApprovalsServicePlugin = class {
         } catch {
           return void 0;
         }
+      },
+      // [#11993] Deployment override lookup for user-facing refusal copy.
+      // Resolved LAZILY for the reason the two providers above are: the i18n
+      // service is contributed by another plugin (ADR-0029 D8) and may start
+      // after this one. Without it the service still renders the built-in
+      // catalog in the caller's locale; with it, a deployment's own
+      // `translation` for `errors.approval_recall_not_submitter` wins — the
+      // override address the catalog documents, made real for this emitter.
+      messageTranslator: () => {
+        try {
+          const i18n = ctx.getService("i18n");
+          const t = i18n?.t;
+          if (typeof t !== "function") return void 0;
+          return (key, locale, params) => t.call(i18n, key, locale, params);
+        } catch {
+          return void 0;
+        }
       }
     });
     const fieldVisibility = () => {
@@ -6690,6 +7239,7 @@ var ApprovalsServicePlugin = class {
       try {
         unbindAllHooks(engine);
         bindApprovalLockHook(engine, ctx.logger);
+        bindRecordDeleteCancelHook(engine, this.service, ctx.logger);
         bindDelegationWriteGuard(engine, ctx.logger);
         bindSnapshotRedactionMiddleware(engine, fieldVisibility, ctx.logger);
       } catch (err) {