@objectstack/plugin-approvals 17.2.0 → 17.4.0

package/dist/index.mjs

@@ -29,7 +29,7 @@ var init_en_objects_generated = __esm({
           },
           organization_id: {
             label: "Organization",
-            help: "Tenant that owns this approval request (propagated from submitter context)"
+            help: "Organization of the record this request is about (falls back to the acting context when the record has none)"
           },
           process_name: {
             label: "Source",
@@ -55,7 +55,15 @@ var init_en_objects_generated = __esm({
               approved: "Approved",
               rejected: "Rejected",
               recalled: "Recalled",
-              returned: "Returned"
+              returned: "Returned",
+              cancelled: "Cancelled"
+            }
+          },
+          cancel_reason: {
+            label: "Cancellation Reason",
+            help: "Why the platform voided this request (set only when the status is cancelled)",
+            options: {
+              record_deleted: "Related record deleted"
             }
           },
           current_step: {
@@ -236,7 +244,8 @@ var init_en_objects_generated = __esm({
               comment: "Comment",
               revise: "Revise",
               resubmit: "Resubmit",
-              ooo_substitute: "Out-of-Office Substitution"
+              ooo_substitute: "Out-of-Office Substitution",
+              cancel: "Cancel"
             }
           },
           actor_id: {
@@ -350,7 +359,7 @@ var init_zh_CN_objects_generated = __esm({
           },
           organization_id: {
             label: "\u7EC4\u7EC7",
-            help: "\u62E5\u6709\u8BE5\u5BA1\u6279\u8BF7\u6C42\u7684\u79DF\u6237\uFF08\u4ECE\u63D0\u4EA4\u65B9\u4E0A\u4E0B\u6587\u4F20\u64AD\uFF09"
+            help: "\u8BE5\u8BF7\u6C42\u6240\u6D89\u8BB0\u5F55\u6240\u5C5E\u7684\u7EC4\u7EC7\uFF08\u8BB0\u5F55\u65E0\u7EC4\u7EC7\u65F6\u56DE\u9000\u5230\u64CD\u4F5C\u4E0A\u4E0B\u6587\uFF09"
           },
           process_name: {
             label: "\u6765\u6E90",
@@ -376,7 +385,15 @@ var init_zh_CN_objects_generated = __esm({
               approved: "\u5DF2\u6279\u51C6",
               rejected: "\u5DF2\u62D2\u7EDD",
               recalled: "\u5DF2\u64A4\u56DE",
-              returned: "\u5DF2\u9000\u56DE\u4FEE\u6539"
+              returned: "\u5DF2\u9000\u56DE\u4FEE\u6539",
+              cancelled: "\u5DF2\u4F5C\u5E9F"
+            }
+          },
+          cancel_reason: {
+            label: "\u4F5C\u5E9F\u539F\u56E0",
+            help: "\u5E73\u53F0\u4F5C\u5E9F\u8BE5\u5BA1\u6279\u5355\u7684\u539F\u56E0(\u4EC5\u5728\u72B6\u6001\u4E3A\u300C\u5DF2\u4F5C\u5E9F\u300D\u65F6\u5199\u5165)",
+            options: {
+              record_deleted: "\u5173\u8054\u8BB0\u5F55\u5DF2\u5220\u9664"
             }
           },
           current_step: {
@@ -557,7 +574,8 @@ var init_zh_CN_objects_generated = __esm({
               comment: "\u8BC4\u8BBA",
               revise: "\u9000\u56DE\u4FEE\u6539",
               resubmit: "\u91CD\u65B0\u63D0\u4EA4",
-              ooo_substitute: "\u4E0D\u5728\u5C97\u6539\u6D3E"
+              ooo_substitute: "\u4E0D\u5728\u5C97\u6539\u6D3E",
+              cancel: "\u4F5C\u5E9F"
             }
           },
           actor_id: {
@@ -671,7 +689,7 @@ var init_ja_JP_objects_generated = __esm({
           },
           organization_id: {
             label: "\u7D44\u7E54",
-            help: "\u3053\u306E\u627F\u8A8D\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u6240\u6709\u3059\u308B\u30C6\u30CA\u30F3\u30C8\uFF08\u9001\u4FE1\u8005\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u304B\u3089\u4F1D\u64AD\uFF09"
+            help: "\u3053\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u5BFE\u8C61\u30EC\u30B3\u30FC\u30C9\u304C\u5C5E\u3059\u308B\u7D44\u7E54\uFF08\u30EC\u30B3\u30FC\u30C9\u306B\u7D44\u7E54\u304C\u306A\u3044\u5834\u5408\u306F\u64CD\u4F5C\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\uFF09"
           },
           process_name: {
             label: "\u30BD\u30FC\u30B9",
@@ -697,7 +715,15 @@ var init_ja_JP_objects_generated = __esm({
               approved: "\u627F\u8A8D\u6E08\u307F",
               rejected: "\u5374\u4E0B\u6E08\u307F",
               recalled: "\u53D6\u308A\u6D88\u3057\u6E08\u307F",
-              returned: "\u5DEE\u3057\u623B\u3057\u6E08\u307F"
+              returned: "\u5DEE\u3057\u623B\u3057\u6E08\u307F",
+              cancelled: "\u7121\u52B9\u5316\u6E08\u307F"
+            }
+          },
+          cancel_reason: {
+            label: "\u7121\u52B9\u5316\u7406\u7531",
+            help: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u304C\u3053\u306E\u7533\u8ACB\u3092\u7121\u52B9\u5316\u3057\u305F\u7406\u7531(\u30B9\u30C6\u30FC\u30BF\u30B9\u304C\u7121\u52B9\u5316\u6E08\u307F\u306E\u5834\u5408\u306E\u307F\u8A2D\u5B9A)",
+            options: {
+              record_deleted: "\u95A2\u9023\u30EC\u30B3\u30FC\u30C9\u304C\u524A\u9664\u3055\u308C\u307E\u3057\u305F"
             }
           },
           current_step: {
@@ -878,7 +904,8 @@ var init_ja_JP_objects_generated = __esm({
               comment: "\u30B3\u30E1\u30F3\u30C8",
               revise: "\u5DEE\u3057\u623B\u3057",
               resubmit: "\u518D\u63D0\u51FA",
-              ooo_substitute: "\u4E0D\u5728\u6642\u4EE3\u7406"
+              ooo_substitute: "\u4E0D\u5728\u6642\u4EE3\u7406",
+              cancel: "\u7121\u52B9\u5316"
             }
           },
           actor_id: {
@@ -992,7 +1019,7 @@ var init_es_ES_objects_generated = __esm({
           },
           organization_id: {
             label: "Organizaci\xF3n",
-            help: "Tenant que posee esta solicitud de aprobaci\xF3n (propagado desde el contexto del solicitante)."
+            help: "Organizaci\xF3n del registro al que se refiere esta solicitud (recurre al contexto del actor cuando el registro no tiene ninguna)."
           },
           process_name: {
             label: "Origen",
@@ -1018,7 +1045,15 @@ var init_es_ES_objects_generated = __esm({
               approved: "Aprobada",
               rejected: "Rechazada",
               recalled: "Retirada",
-              returned: "Devuelta para revisi\xF3n"
+              returned: "Devuelta para revisi\xF3n",
+              cancelled: "Anulada"
+            }
+          },
+          cancel_reason: {
+            label: "Motivo de anulaci\xF3n",
+            help: "Por qu\xE9 la plataforma anul\xF3 esta solicitud (solo se establece cuando el estado es Anulada)",
+            options: {
+              record_deleted: "Registro relacionado eliminado"
             }
           },
           current_step: {
@@ -1199,7 +1234,8 @@ var init_es_ES_objects_generated = __esm({
               comment: "Comentario",
               revise: "Devoluci\xF3n",
               resubmit: "Reenv\xEDo",
-              ooo_substitute: "Sustituci\xF3n por ausencia"
+              ooo_substitute: "Sustituci\xF3n por ausencia",
+              cancel: "Anulaci\xF3n"
             }
           },
           actor_id: {
@@ -1297,12 +1333,104 @@ var init_es_ES_objects_generated = __esm({
   }
 });
 
+// src/translations/zh-CN.source-hashes.generated.ts
+var zhCNGeneratedSourceHashes;
+var init_zh_CN_source_hashes_generated = __esm({
+  "src/translations/zh-CN.source-hashes.generated.ts"() {
+    "use strict";
+    zhCNGeneratedSourceHashes = {
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
+// src/translations/ja-JP.source-hashes.generated.ts
+var jaJPGeneratedSourceHashes;
+var init_ja_JP_source_hashes_generated = __esm({
+  "src/translations/ja-JP.source-hashes.generated.ts"() {
+    "use strict";
+    jaJPGeneratedSourceHashes = {
+      "objects.sys_approval_delegation._views.active.emptyState.message": "1095d61c017b6db2",
+      "objects.sys_approval_delegation._views.active.emptyState.title": "799d28e51d88963e",
+      "objects.sys_approval_delegation._views.active.label": "eee107cf4e466779",
+      "objects.sys_approval_delegation.description": "432b0435aa15f6b9",
+      "objects.sys_approval_delegation.fields.created_at.label": "1f02d416befb595b",
+      "objects.sys_approval_delegation.fields.delegate_id.help": "9cfc641f7b0b04f9",
+      "objects.sys_approval_delegation.fields.delegate_id.label": "afd6d8733dc5bc14",
+      "objects.sys_approval_delegation.fields.delegator_id.help": "c4686c5c9f24e0be",
+      "objects.sys_approval_delegation.fields.delegator_id.label": "f76b1f95f2fdabff",
+      "objects.sys_approval_delegation.fields.id.label": "3383564051b4b76d",
+      "objects.sys_approval_delegation.fields.organization_id.help": "f02982e88229d9ca",
+      "objects.sys_approval_delegation.fields.organization_id.label": "3e55836156e1c1de",
+      "objects.sys_approval_delegation.fields.reason.help": "712516f1461dff2b",
+      "objects.sys_approval_delegation.fields.reason.label": "ac399f03d7f2e64d",
+      "objects.sys_approval_delegation.fields.updated_at.label": "aba63dc2a9c79b8d",
+      "objects.sys_approval_delegation.fields.valid_from.help": "01386010c454bfbd",
+      "objects.sys_approval_delegation.fields.valid_from.label": "02eaf201e57c9eda",
+      "objects.sys_approval_delegation.fields.valid_until.help": "a48ea34e65933e9d",
+      "objects.sys_approval_delegation.fields.valid_until.label": "a68db5bd4fc72a13",
+      "objects.sys_approval_delegation.label": "4389c4fe5f5c9746",
+      "objects.sys_approval_delegation.pluralLabel": "f07fec3ffd74e6db",
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
+// src/translations/es-ES.source-hashes.generated.ts
+var esESGeneratedSourceHashes;
+var init_es_ES_source_hashes_generated = __esm({
+  "src/translations/es-ES.source-hashes.generated.ts"() {
+    "use strict";
+    esESGeneratedSourceHashes = {
+      "objects.sys_approval_action.fields.actor_id.label": "b155813f8a7f06e3",
+      "objects.sys_approval_delegation._views.active.emptyState.message": "1095d61c017b6db2",
+      "objects.sys_approval_delegation._views.active.emptyState.title": "799d28e51d88963e",
+      "objects.sys_approval_delegation._views.active.label": "eee107cf4e466779",
+      "objects.sys_approval_delegation.description": "432b0435aa15f6b9",
+      "objects.sys_approval_delegation.fields.created_at.label": "1f02d416befb595b",
+      "objects.sys_approval_delegation.fields.delegate_id.help": "9cfc641f7b0b04f9",
+      "objects.sys_approval_delegation.fields.delegate_id.label": "afd6d8733dc5bc14",
+      "objects.sys_approval_delegation.fields.delegator_id.help": "c4686c5c9f24e0be",
+      "objects.sys_approval_delegation.fields.delegator_id.label": "f76b1f95f2fdabff",
+      "objects.sys_approval_delegation.fields.id.label": "3383564051b4b76d",
+      "objects.sys_approval_delegation.fields.organization_id.help": "f02982e88229d9ca",
+      "objects.sys_approval_delegation.fields.organization_id.label": "3e55836156e1c1de",
+      "objects.sys_approval_delegation.fields.reason.help": "712516f1461dff2b",
+      "objects.sys_approval_delegation.fields.reason.label": "ac399f03d7f2e64d",
+      "objects.sys_approval_delegation.fields.updated_at.label": "aba63dc2a9c79b8d",
+      "objects.sys_approval_delegation.fields.valid_from.help": "01386010c454bfbd",
+      "objects.sys_approval_delegation.fields.valid_from.label": "02eaf201e57c9eda",
+      "objects.sys_approval_delegation.fields.valid_until.help": "a48ea34e65933e9d",
+      "objects.sys_approval_delegation.fields.valid_until.label": "a68db5bd4fc72a13",
+      "objects.sys_approval_delegation.label": "4389c4fe5f5c9746",
+      "objects.sys_approval_delegation.pluralLabel": "f07fec3ffd74e6db",
+      "objects.sys_approval_request.fields.flow_node_id.help": "154aa23b4eee4cae",
+      "objects.sys_approval_request.fields.flow_node_id.label": "052ad568aa41227c",
+      "objects.sys_approval_request.fields.flow_run_id.help": "35c92818f5e11090",
+      "objects.sys_approval_request.fields.flow_run_id.label": "d0124e323da966f9",
+      "objects.sys_approval_request.fields.node_config_json.help": "7ee00ef9b3ca7e80",
+      "objects.sys_approval_request.fields.node_config_json.label": "e64eb4bf7d7ea033"
+    };
+  }
+});
+
 // src/translations/index.ts
 var translations_exports = {};
 __export(translations_exports, {
   ApprovalsTranslations: () => ApprovalsTranslations
 });
-var ApprovalsTranslations;
+import { withSourceFallback } from "@objectstack/platform-objects/apps";
+var enSource, ApprovalsTranslations;
 var init_translations = __esm({
   "src/translations/index.ts"() {
     "use strict";
@@ -1310,18 +1438,27 @@ var init_translations = __esm({
     init_zh_CN_objects_generated();
     init_ja_JP_objects_generated();
     init_es_ES_objects_generated();
+    init_zh_CN_source_hashes_generated();
+    init_ja_JP_source_hashes_generated();
+    init_es_ES_source_hashes_generated();
+    enSource = { objects: enObjects };
     ApprovalsTranslations = {
-      en: { objects: enObjects },
-      "zh-CN": { objects: zhCNObjects },
-      "ja-JP": { objects: jaJPObjects },
-      "es-ES": { objects: esESObjects }
+      en: enSource,
+      "zh-CN": withSourceFallback({ objects: zhCNObjects }, enSource, void 0, zhCNGeneratedSourceHashes),
+      "ja-JP": withSourceFallback({ objects: jaJPObjects }, enSource, void 0, jaJPGeneratedSourceHashes),
+      "es-ES": withSourceFallback({ objects: esESObjects }, enSource, void 0, esESGeneratedSourceHashes)
     };
   }
 });
 
 // src/sys-approval-request.object.ts
 import { ObjectSchema, Field } from "@objectstack/spec/data";
-import { APPROVAL_STATUSES, APPROVAL_STATUS_LABELS } from "@objectstack/spec/contracts";
+import {
+  APPROVAL_STATUSES,
+  APPROVAL_STATUS_LABELS,
+  APPROVAL_CANCEL_REASONS,
+  APPROVAL_CANCEL_REASON_LABELS
+} from "@objectstack/spec/contracts";
 var SysApprovalRequest = ObjectSchema.create({
   name: "sys_approval_request",
   label: "Approval Request",
@@ -1368,7 +1505,10 @@ var SysApprovalRequest = ObjectSchema.create({
       label: "Completed",
       data: { provider: "object", object: "sys_approval_request" },
       columns: ["process_name", "object_name", "record_id", "status", "submitter_id", "completed_at"],
-      filter: [{ field: "status", operator: "in", value: ["approved", "rejected", "recalled"] }],
+      // Every terminal state, `cancelled` included (#13568) — a platform-voided
+      // request is kept as audit evidence, and a terminal state absent from the
+      // only curated terminal view is evidence nobody can find.
+      filter: [{ field: "status", operator: "in", value: ["approved", "rejected", "recalled", "cancelled"] }],
       sort: [{ field: "completed_at", order: "desc" }],
       pagination: { pageSize: 25 }
     },
@@ -1384,46 +1524,40 @@ var SysApprovalRequest = ObjectSchema.create({
   },
   fields: {
     id: Field.text({ label: "Request ID", required: true, readonly: true, group: "System" }),
-    // ⚠️ MEASURED DEFECT, cloud#1395 — read this before trusting the column.
+    // [#10101, the cloud#1395 Option A ruling] The SUBJECT record's
+    // organization, with the acting context as fallback — resolved by the
+    // SHARED platform-row resolver (`resolveRecordOrganizationField`,
+    // `@objectstack/metadata-core`) in `openNodeRequest`, the row's only
+    // writer. The same `requestOrg` stamps `sys_approval_action` and the
+    // `sys_approval_approver` index, so all three move together.
     //
-    // An approval request DOES belong to an organization: it is read through the
-    // organization wall by the approvals inbox, and on a shared-database
-    // deployment a row carrying no organization is not filtered BY that wall —
-    // it is either invisible to everyone or visible to everyone, decided by
-    // whatever filter each surface happens to apply rather than by the data.
+    // Why subject-first: an approval request is read through the organization
+    // wall by the approvals inbox, and the acting context is NULL on every
+    // schedule / time-relative / api triggered run (none carries a tenant, by
+    // construction). Stamped from the actor alone — the pre-#10101 behaviour,
+    // measured on cloud#1395 as 27 of 27 rows org-less on a walled HotCRM SaaS
+    // boot — such a request LOCKED the record it was about while being
+    // invisible in every inbox, its owner's included. Subject-first is also
+    // what `sys_audit_log`'s writer already did (#8707 honouring #8287's
+    // ruling), so an approval row and an audit row about the same record now
+    // land behind the same wall instead of two.
     //
-    // The value is resolved from the ACTING CONTEXT only (`openNodeRequest`'s
-    // `ctxOrg`), so it is NULL whenever the flow that opened the request ran
-    // without one — every schedule / time-relative / api triggered run, none of
-    // which sets a tenant. On a walled single-database HotCRM SaaS boot this
-    // measured 27 of 27 rows org-less, each naming an `object_name` /
-    // `record_id` owned by a specific customer.
-    //
-    // ⛔ Do NOT read that as "platform tables do not carry an organization".
-    // `sys_audit_log` (1669 rows) was correctly attributed on the SAME boot,
-    // because its writer takes the organization from the RECORD the row is
-    // about, with the session only as fallback (plugin-audit
-    // `resolveRecordOrganizationField`, #8707 honouring #8287's ruling). Two
-    // writers read the actor; a third reads the subject. That disagreement is
-    // the defect.
-    //
-    // Which of the two a side-table row should follow is an open contract
-    // question on cloud#1395 — the audit resolver is scope-pinned to audit
-    // stamping by the #8778 ruling, so this writer needs its own. The same
-    // `ctxOrg` also stamps `sys_approval_action` and `sys_approval_approver`,
-    // so all three move together.
+    // The `sys_api_key` divergence is deliberate and preserved: its
+    // `tenancy.organizationField: 'active_organization_id'` (stamp-only,
+    // #8778) wins limb 0 of the shared resolver, while the credential table
+    // itself stays unwalled (`tenancy.enabled: false`) — who a row is ABOUT
+    // and what an object is WALLED by remain different questions.
     organization_id: Field.lookup("sys_organization", {
       label: "Organization",
       required: false,
       group: "System",
-      // ⛔ String unchanged on purpose: it is extracted into the generated i18n
-      // bundles (`translations/*.objects.generated.ts`, as `help`), so rewording
-      // it is a translation-regeneration change and not a comment. The
-      // correction it needs — it claims a propagation that measurably does not
-      // happen, and says "Tenant" where ADR-0120 §Terminology requires
-      // "organization" — rides the cloud#1395 write-side fix, which rewrites the
-      // sentence and regenerates the four locales in one pass.
-      description: "Tenant that owns this approval request (propagated from submitter context)"
+      // Reworded with the #10101 write-side fix (was "Tenant that owns this
+      // approval request (propagated from submitter context)" — it claimed a
+      // propagation that measurably did not happen, and said "Tenant" where
+      // ADR-0120 §Terminology requires "organization"). Extracted into the
+      // generated i18n bundles as `help`; the four locales regenerate in the
+      // same pass.
+      description: "Organization of the record this request is about (falls back to the acting context when the record has none)"
     }),
     process_name: Field.text({
       label: "Source",
@@ -1442,7 +1576,38 @@ var SysApprovalRequest = ObjectSchema.create({
       label: "Record ID",
       required: true,
       maxLength: 100,
-      group: "Target"
+      // [#11386] The id half of this object's pointer pair (ADR-0052 §5),
+      // adopting the #11339 carrier. VERIFIED for THIS object: the pair is not
+      // decoration but the key the approval machinery QUERIES ON —
+      // `approval-service.ts` finds a record's pending request with
+      // `where: { object_name, record_id, status: 'pending' }`, and
+      // `lifecycle-hooks.ts` holds the record LOCK on the same pair
+      // (single-record and `$in` batch forms). `submit()` writes it from
+      // `input.object` / `input.recordId`, so a stored value is always a
+      // record id of the object the sibling names.
+      //
+      // Consequence of declaring, sharper here than elsewhere: a seeded
+      // request whose `record_id` stayed a verbatim natural key locked
+      // NOTHING and appeared under no record — it looked like a pending
+      // approval while being invisible to both queries that give the row its
+      // meaning. That is now a loud seed-time refusal. Both halves are
+      // `required: true`, so the un-addressable case (id half authored, type
+      // half empty) is already unreachable on this object.
+      group: "Target",
+      //
+      // ⚠️ ORDERING CONSTRAINT — this id half is `required: true`, and that
+      // makes it ORDER-DEPENDENT in seeds even though a pointer pair
+      // contributes no static ordering edge (#11674, measured against the real
+      // engine in `packages/objectql/src/engine-seed-required-deferral.test.ts`):
+      // the seed loader defers an unresolvable reference by DELETING the column
+      // from the pass-1 insert, required-validation rejects that row, and pass 2
+      // is then left with no row to back-fill. So the pass-2 healing that makes
+      // an OPTIONAL id half order-independent (`sys_audit_log`) does not reach
+      // this one. ⇒ SEED THE TARGET DATASET FIRST. The failure if you do not is
+      // loud in three places — a write error naming this column, a
+      // dropped-deferral error, and `success: false` — and since #11674 the
+      // loader also WARNS at load time, before the engine rejects the row.
+      referenceVia: "object_name"
     }),
     submitter_id: Field.lookup("sys_user", {
       label: "Submitter",
@@ -1470,6 +1635,29 @@ var SysApprovalRequest = ObjectSchema.create({
         group: "State"
       }
     ),
+    // [#13568] Why a `cancelled` request was cancelled — the machine-readable
+    // half of the maintainer's 2026-08-31 ruling ("状态转 cancelled + 机器可读
+    // 原因"). Derived from `APPROVAL_CANCEL_REASONS`, never re-typed, on the
+    // same #3786 rule the `status` column above follows.
+    //
+    // On the ROW rather than on the `sys_approval_action` audit entry, because
+    // the readers are the inbox and the tombstone presentation, which page the
+    // request table: making them join the append-only action log to learn why a
+    // row they already hold is cancelled buys nothing and would make the reason
+    // unavailable to a plain list view. The action row still records the event
+    // (`action: 'cancel'`); this column records the STATE.
+    //
+    // Null on every non-cancelled row, and on rows written before the column
+    // existed — "not recorded", never "cancelled for no reason".
+    cancel_reason: Field.select(
+      APPROVAL_CANCEL_REASONS.map((value) => ({ value, label: APPROVAL_CANCEL_REASON_LABELS[value] })),
+      {
+        label: "Cancellation Reason",
+        required: false,
+        description: "Why the platform voided this request (set only when the status is cancelled)",
+        group: "State"
+      }
+    ),
     current_step: Field.text({
       label: "Current Step",
       required: false,
@@ -1489,6 +1677,22 @@ var SysApprovalRequest = ObjectSchema.create({
       description: "Comma-separated user ids who can act on the current step",
       group: "State"
     }),
+    // The module docstring above used to justify this column with "used by
+    // notifications so they can render before the record is locked or
+    // changed". That consumer does not exist, and the claim was cited as the
+    // reason the column holds a FULL row before anyone checked it. Measured
+    // against every `this.notify(...)` call site in `approval-service.ts` —
+    // all 12 of them: each passes `{ title, message, actionUrl }` (two also
+    // `actions`), built from `object_name` / `record_id` and the caller's
+    // comment. None reads this column or the parsed `payload`. The real
+    // readers are the serve path (`rowFromRequest` -> `payload`, redacted per
+    // reader), the decide-time approver re-resolution and the org backfill,
+    // both under SYSTEM_CTX, and the free-text predicate.
+    //
+    // The `description` below is deliberately UNCHANGED: it is accurate, and
+    // it is extracted into the four generated i18n bundles as `help`. The
+    // false sentence lived only in the JSDoc above, which is not extracted —
+    // so this correction moves no translation leaf.
     payload_json: Field.textarea({
       label: "Snapshot",
       required: false,
@@ -1559,11 +1763,14 @@ var SysApprovalRequest = ObjectSchema.create({
   // per-viewer block (#3310): approver actions on `record.viewer.can_act`
   // (the caller is a current pending approver — same check the service
   // authorizes a decision with, so position/team approvers resolve correctly),
-  // submitter actions on `record.viewer.is_submitter`. The core decision levers
-  // (approve/reject/reassign) additionally OR in `record.viewer.can_override`
-  // (#3424) so a platform/tenant admin can rescue a request routed to an
+  // submitter actions on `record.viewer.is_submitter`. The four levers the
+  // #3424 override covers (approve/reject/reassign, and recall since #12716)
+  // additionally OR in `record.viewer.can_override`
+  // so a platform/tenant admin can rescue a request routed to an
   // unstaffed position — otherwise undecidable, locking the record forever — by
-  // approving, rejecting, or reassigning it to a real approver. `viewer` is
+  // approving, rejecting, reassigning it to a real approver, or recalling it
+  // (the lever that releases the record without recording a decision nobody
+  // made). `viewer` is
   // attached by getRequest/listRequests; where it is absent the predicate fails
   // closed.
   //
@@ -1699,8 +1906,13 @@ var SysApprovalRequest = ObjectSchema.create({
     // Remind / recall (pending) and resubmit / recall (returned). These are the
     // submitter's own levers, so `visible` gates on `record.viewer.is_submitter`
     // (server-computed on the current viewer). The service re-checks ownership;
-    // the predicate keeps a non-submitter from ever seeing a button they cannot
-    // use.
+    // the predicate keeps a plain non-submitter from ever seeing a button they
+    // cannot use.
+    //
+    // `recall` is the one exception, and it is not a widening: it ALSO ORs in
+    // the #3424 admin override (#12716), because an override admin is a caller
+    // `ApprovalService.recall` already authorises. Remind and resubmit keep no
+    // override arm.
     {
       name: "approval_remind",
       label: "Send reminder",
@@ -1731,7 +1943,26 @@ var SysApprovalRequest = ObjectSchema.create({
       ],
       // Recall applies while the request is live for the submitter — pending
       // (withdraw) or returned (abandon the revision instead of resubmitting).
-      visible: 'has(record.status) && (record.status == "pending" || record.status == "returned") && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true',
+      //
+      // The second arm is the #3424 admin override, spelled byte-identically to
+      // the three core decision levers above (#12716). `ApprovalService.recall`
+      // has admitted the override caller since #3424 — `isOverrideActor`'s own
+      // doc block names recall as one of the four levers — so until this arm
+      // landed, recall was the one authorised capability with no button: an
+      // admin could approve or reject their way out of a stuck request (writing
+      // a decision that did not happen) or reassign it, but could not withdraw.
+      //
+      // The override arm carries no status test of its own, on purpose, because
+      // it does not need one and the siblings do not have one either: the flag
+      // is already status-scoped where it is COMPUTED. `attachViewers` in
+      // `approval-service.ts` sets
+      // `can_override: row.status === 'pending' && isOverrideActor(...)` —
+      // ANDed — so `record.viewer.can_override` can never be true off `pending`,
+      // and this arm is pending-only in effect however CEL groups the
+      // expression. Pinned in both directions in
+      // `action-predicate-sparse-face.test.ts`, with the flag's own scoping
+      // pinned against the real service in `approval-revise.test.ts`.
+      visible: 'has(record.status) && (record.status == "pending" || record.status == "returned") && has(record.viewer) && has(record.viewer.is_submitter) && record.viewer.is_submitter == true || has(record.viewer) && has(record.viewer.can_override) && record.viewer.can_override == true',
       locations: ["record_section"],
       successMessage: "Recalled.",
       refreshAfter: true
@@ -2092,16 +2323,17 @@ import {
   normalizeDecisionOutputs
 } from "@objectstack/spec/automation";
 import { ExpressionEngine, collectCelRootIdentifiers } from "@objectstack/formula";
-import { keysetWalk } from "@objectstack/types";
+import { createRecordOrganizationResolver } from "@objectstack/metadata-core";
+import { keysetWalk, strandedDecisionFailure } from "@objectstack/types";
 import {
   ADMIN_FULL_ACCESS,
   ORGANIZATION_ADMIN_GRANTS,
-  BUILTIN_IDENTITY_PLATFORM_ADMIN,
   BUILTIN_IDENTITY_ORG_OWNER,
   BUILTIN_IDENTITY_ORG_ADMIN
 } from "@objectstack/spec/identity";
 import { RESUME_AUTHORITY_SERVICE } from "@objectstack/spec/contracts";
 import { isFileIdToken } from "@objectstack/spec/data";
+import { renderOperationMessage } from "@objectstack/spec/system";
 import { isGrantActive } from "@objectstack/core";
 
 // src/approver-org-scope.ts
@@ -2257,6 +2489,7 @@ var REMIND_COOLDOWN_MS = 4 * 60 * 60 * 1e3;
 var ESCALATION_JOB_NAME = "approvals-sla-escalation";
 var ESCALATION_SCAN_INTERVAL_MS = 5 * 60 * 1e3;
 var SLA_ACTOR_ID = "system:sla";
+var ESCALATION_ENABLED_FLIP_CUTOFF_MS = Date.parse("2026-08-28T00:00:00Z");
 var DEAD_RUN_ACTOR_ID = "system:dead-run";
 var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set([
   "completed",
@@ -2265,8 +2498,71 @@ var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set([
   "timed_out"
 ]);
 var STRANDABLE_REQUEST_STATUSES = ["approved", "rejected", "returned"];
+var STRANDED_CONTINUATION_KEY = "__strandedContinuation";
+var CONTINUATIONS_A_STATUS_CAN_ISSUE = {
+  approved: ["approve"],
+  rejected: ["reject"],
+  returned: ["revise", "resubmit"],
+  recalled: ["recall"]
+};
+function classifyStrandedRunState(run) {
+  if (!run) return "missing";
+  switch (run.status) {
+    // A terminal `failed` row. Reported — and, when the engine can be asked,
+    // refined by the third oracle ({@link refineFailedRunState}) into which of
+    // the three `failed` shapes it is. This arm alone cannot tell them apart:
+    // the row reads identically for a resume that consumed the pause and
+    // threw downstream (repairable) and for an ancestor `failAncestors`
+    // cascade-failed (not). `'failed'` here means "reported, undifferentiated".
+    case "failed":
+      return "failed";
+    // ── The negatives, each for its own reason ──────────────────────────────
+    // The decision advanced the flow and the flow finished. Healthy.
+    case "completed":
+      return void 0;
+    // Deliberately terminated by an operator (`cancelRun`, ADR-0044). The run
+    // stopping is the intended outcome, exactly as `recalled` is on the request
+    // side — reporting it would bury the real findings under expected ones.
+    case "cancelled":
+      return void 0;
+    // The history's last row says `paused` while the suspension store says no
+    // live pause. That is AMBIGUOUS, and the ambiguity is not resolvable from
+    // one scan: a resume in flight right now has consumed the suspension and
+    // not yet written its terminal row, and reads exactly like a process that
+    // died in the same window. Condemning it would name every concurrently
+    // resuming approval — so this stays SKIPPED, the conservative arm this
+    // whole method is built on.
+    case "paused":
+      return void 0;
+    default:
+      return void 0;
+  }
+}
+function refineFailedRunState(verdict) {
+  if (verdict.repairable) return "repairable";
+  switch (verdict.reason) {
+    // The strand happened; the store could not keep the snapshot, and the
+    // engine asked holds no hot copy. Its own class — see the type below.
+    case "SNAPSHOT_DROPPED":
+      return "snapshot_dropped";
+    // Neither witness holds anything: cascade-failed, or never paused.
+    case "NO_CONSUMED_SUSPENSION":
+      return "unrepairable";
+    // Re-armed between the two reads (an operator's restore landed while this
+    // scan was running): the run is alive and resumable, which is what the
+    // first oracle would have said a moment later. Not stranded.
+    case "RUN_SUSPENDED":
+      return void 0;
+    // An answer this build does not know (an engine ahead of this plugin).
+    // Fail-closed exactly as an absent member: reported, undifferentiated —
+    // never condemned on a word this code cannot read.
+    default:
+      return "failed";
+  }
+}
 var ACTION_TOKEN_TTL_MS = 72 * 60 * 60 * 1e3;
 var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+var RECORD_DELETE_CANCEL_LIMIT = 200;
 function actingUserId(context) {
   const userId = context?.userId;
   return typeof userId === "string" && userId ? userId : null;
@@ -2327,6 +2623,10 @@ function rowFromRequest(row) {
     submitter_id: row.submitter_id ?? void 0,
     submitter_comment: row.submitter_comment ?? void 0,
     status: row.status ?? "pending",
+    // [#13568] Why a cancelled row was cancelled. Surfaced on every read for
+    // the same reason `status` is: a client that can see the terminal state and
+    // not the machine-readable cause is back to guessing from prose.
+    cancel_reason: row.cancel_reason ?? void 0,
     current_step: row.current_step ?? void 0,
     current_step_index: row.current_step_index ?? void 0,
     pending_approvers: csvSplit(row.pending_approvers),
@@ -2419,6 +2719,7 @@ function rowFromAction(row) {
 var _ApprovalService = class _ApprovalService {
   constructor(opts) {
     this.engine = opts.engine;
+    this.recordOrgResolver = createRecordOrganizationResolver(opts.engine);
     this.clock = opts.clock ?? { now: () => /* @__PURE__ */ new Date() };
     this.logger = opts.logger;
     this.automation = opts.automation;
@@ -2426,6 +2727,7 @@ var _ApprovalService = class _ApprovalService {
     this.publicBaseUrl = (opts.publicBaseUrl ?? "").replace(/\/$/, "");
     this.tenancyPosture = opts.tenancyPosture;
     this.fieldVisibility = opts.fieldVisibility;
+    this.messageTranslator = opts.messageTranslator;
     this.recordReaderVisibleObjects = new Set(
       (Array.isArray(opts.recordReaderVisibleObjects) ? opts.recordReaderVisibleObjects : []).map((n) => String(n ?? "").trim()).filter(Boolean)
     );
@@ -2571,13 +2873,48 @@ var _ApprovalService = class _ApprovalService {
     const perms = Array.isArray(context.permissions) ? context.permissions : [];
     const positions = Array.isArray(context.positions) ? context.positions : [];
     const posture = context.posture;
-    const isPlatformAdmin = posture === "PLATFORM_ADMIN" || perms.includes(ADMIN_FULL_ACCESS) || positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN);
+    const isPlatformAdmin = posture === "PLATFORM_ADMIN" || perms.includes(ADMIN_FULL_ACCESS);
     if (isPlatformAdmin) return true;
     const isTenantAdmin = posture === "TENANT_ADMIN" || ORGANIZATION_ADMIN_GRANTS.some((n) => perms.includes(n)) || positions.includes(BUILTIN_IDENTITY_ORG_OWNER) || positions.includes(BUILTIN_IDENTITY_ORG_ADMIN);
     if (!isTenantAdmin) return false;
     const actorTenant = context.tenantId ?? context.organizationId ?? null;
     return requestOrg == null || actorTenant != null && String(requestOrg) === String(actorTenant);
   }
+  /**
+   * [#11993] The END USER's half of an approval refusal.
+   *
+   * `handleApprovalError` in `@objectstack/rest` maps this service's
+   * `CODE: message` throws onto the wire by testing the prefix for the status
+   * and then STRIPPING it (a leading run of `[A-Z_]` plus a colon and any
+   * following whitespace), shipping what remains as the body's
+   * human-readable `error` — which Console splices under its own localized
+   * label ("撤回审批失败: …"). A hardcoded English reason therefore reaches an
+   * operator in a fully Chinese deployment as a Chinese prefix glued onto an
+   * English sentence they cannot act on.
+   *
+   * Rendered through the SHARED Operation Message Catalog
+   * (`@objectstack/spec/system`), not a second mechanism: same
+   * `errors.<key>` override address, same resolution ladder (deployment
+   * override -> locale catalog -> `en` -> the key), same guarantee that a
+   * misbehaving i18n service cannot turn a 403 into a 500. The catalog's
+   * header names this seat explicitly; `plugin-security`'s
+   * `userFacingDenialMessage` is the sibling consumer this mirrors.
+   *
+   * The CODE PREFIX stays on the message. It is not user copy — it is how the
+   * REST layer derives the status and the ADR-0112 wire code, and it is
+   * stripped before the sentence reaches a body. The developer's half moves
+   * to the log, where the ids it names are legible to an operator and to
+   * nobody else.
+   */
+  userFacingRefusal(messageKey, context) {
+    let translate;
+    try {
+      translate = this.messageTranslator?.();
+    } catch {
+      translate = void 0;
+    }
+    return renderOperationMessage({ messageKey }, { locale: context?.locale, translate });
+  }
   /**
    * Pin the acting identity to the AUTHENTICATED CALLER (#3800).
    *
@@ -3110,7 +3447,56 @@ var _ApprovalService = class _ApprovalService {
     if (!organizationId) return filter;
     return { ...filter, $or: [{ organization_id: organizationId }, { organization_id: null }] };
   }
-  /** Recursive department — walks `sys_business_unit.parent_business_unit_id`. */
+  /**
+   * Tenant scope for the `sys_business_unit_member` read — a STRICT equality,
+   * deliberately NOT {@link businessUnitOrgScope} (#14946).
+   *
+   * The two screens answer different questions. The UNIT is the anchor the
+   * approver NAMES, and a seeded unit carries `organization_id = null` by
+   * construction (a seed cannot know the id the runtime mints at boot), so
+   * #3807 admits the null there on purpose. The MEMBER rows are the SET BEING
+   * ROUTED TO — enumerated by the platform, never named by anyone — and a
+   * seeded unit id exists identically in every tenant. Before this screen the
+   * member read carried no organization predicate at all, under
+   * {@link SYSTEM_CTX} which carries no tenant either, so tenant A's request
+   * resolved the shared unit and then collected EVERY tenant's membership rows
+   * hanging off it: approval authority over A's record, routed to B's users.
+   *
+   * Why the null arm is NOT copied here — measured on this tree:
+   *   - `sys_business_unit_member` declares no `organization_id`; the column
+   *     is injected (`applySystemFields`) and the tenancy census lists it in;
+   *   - REST / session writes fill it (`SqlDriver.injectTenantOnInsert`);
+   *   - seed replay does NOT (`seed-loader.ts` withholds its `fallbackOrgId`
+   *     from every `sys_` object), and elevated system-context writes do NOT
+   *     (`unclassified` in `PLATFORM_OBJECT_TENANCY`, tracked as #14570).
+   * So a NULL on a member row means UNKNOWN tenancy, not "platform-global",
+   * and unknown tenancy is not a member of this organization. This is the
+   * ruling `plugin-sharing`'s `memberScope` already applies to the same rows
+   * (#14547 / #14949), and the posture this file already takes for
+   * `sys_team_member` and `sys_user_position`.
+   *
+   * The cost is declared, not hidden: an organization whose MEMBERSHIP rows
+   * were seeded or system-written expands to nobody even on a unit it can
+   * see. That is not silent — the graph-type fallback in `expandApprover`
+   * warns `expanded to nobody` (#3807) and `onEmptyApprovers` governs the
+   * request as for any unstaffed target — and the repair is to stamp the
+   * membership rows, never to widen this screen. ⛔ Do not "unify" the two
+   * screens: one method serving both re-opens whichever half it does not
+   * implement.
+   */
+  businessUnitMemberScope(filter, organizationId) {
+    if (!organizationId) return filter;
+    return { ...filter, organization_id: organizationId };
+  }
+  /**
+   * Recursive department — walks `sys_business_unit.parent_business_unit_id`.
+   *
+   * Two tenant screens, and they are different on purpose: the UNIT rows
+   * (seed check and descent) go through the null-inclusive
+   * {@link businessUnitOrgScope}; the MEMBER read goes through the strict
+   * {@link businessUnitMemberScope}. `organizationId` is the DIRECTORY
+   * organization the approver resolves in (ADR-0105 D9), for both.
+   */
   async expandBusinessUnitUsers(businessUnitId, organizationId) {
     if (!businessUnitId) return [];
     try {
@@ -3150,7 +3536,11 @@ var _ApprovalService = class _ApprovalService {
     let rows = [];
     try {
       rows = await this.engine.find("sys_business_unit_member", {
-        where: { business_unit_id: { $in: Array.from(seen) } },
+        // #14946: tenant-screened — {@link businessUnitMemberScope} is STRICT
+        // on purpose and is not {@link businessUnitOrgScope}. The units above
+        // proved their tenancy (or are seeded); these rows have not, and the
+        // shared seeded unit id is exactly where other tenants' rows sit.
+        where: this.businessUnitMemberScope({ business_unit_id: { $in: Array.from(seen) } }, organizationId),
         fields: ["user_id"],
         limit: 1e4,
         context: SYSTEM_CTX2
@@ -3518,11 +3908,13 @@ var _ApprovalService = class _ApprovalService {
     const substitutions = [];
     const groups = {};
     const liveRecord = await this.loadLiveRecord(input.object, input.recordId, input.record);
+    const subjectOrg = this.recordOrgResolver.organizationOf(input.object, liveRecord, input.record);
+    const requestOrg = subjectOrg ?? ctxOrg;
     const resolvedFrom = {};
     const approvers = await this.expandApprovers(
       { approvers: input.config.approvers },
       liveRecord,
-      ctxOrg,
+      requestOrg,
       {
         now: nowDate.getTime(),
         substitutions,
@@ -3586,16 +3978,16 @@ var _ApprovalService = class _ApprovalService {
       flow_run_id: input.runId,
       flow_node_id: input.nodeId,
       node_config_json: JSON.stringify(configSnapshot),
-      organization_id: ctxOrg,
+      organization_id: requestOrg,
       created_at: now,
       updated_at: now
     };
     await this.engine.insert("sys_approval_request", row, { context: SYSTEM_CTX2 });
-    await this.syncApproverIndex(id, approvers, ctxOrg, now);
+    await this.syncApproverIndex(id, approvers, requestOrg, now);
     await this.engine.insert("sys_approval_action", {
       id: uid("aact"),
       request_id: id,
-      organization_id: ctxOrg,
+      organization_id: requestOrg,
       step_name: input.nodeId,
       step_index: 0,
       action: "submit",
@@ -3607,7 +3999,7 @@ var _ApprovalService = class _ApprovalService {
       await this.engine.insert("sys_approval_action", {
         id: uid("aact"),
         request_id: id,
-        organization_id: ctxOrg,
+        organization_id: requestOrg,
         step_name: input.nodeId,
         step_index: 0,
         action: "ooo_substitute",
@@ -3861,6 +4253,7 @@ var _ApprovalService = class _ApprovalService {
         `resume of run '${runId}' failed${reported.code ? ` [${reported.code}]` : ""}: ${reported.error ?? "unknown error"}`
       );
       err.resumeCode = reported.code;
+      err.resumeStatus = reported.status;
       throw err;
     }
   }
@@ -3868,6 +4261,22 @@ var _ApprovalService = class _ApprovalService {
   static resumeCodeOf(err) {
     return err?.resumeCode;
   }
+  /**
+   * The engine's own run-state discriminator behind a {@link serviceResume}
+   * rejection — `AutomationResult.status` — if the engine reported one
+   * (#13807).
+   *
+   * Read as a SIBLING of {@link resumeCodeOf}, never as a substitute: the two
+   * answer different questions and the stranded exit proves they are not
+   * interchangeable. It reports `status: 'stranded'` and **no `code` at all**
+   * (`service-automation` `engine.ts`, the resume catch arm), so a door that
+   * reads only the code sees an unnamed failure and cannot tell a repairable
+   * strand from a dead run — which is how the platform's own repairability
+   * signal had a producer and zero consumers until this call site.
+   */
+  static resumeStatusOf(err) {
+    return err?.resumeStatus;
+  }
   /**
    * Refuse an operation whose whole point is to advance a flow run when that
    * run no longer exists — BEFORE anything is written down (#4420).
@@ -3961,10 +4370,33 @@ var _ApprovalService = class _ApprovalService {
    * which cannot throw without breaking every standalone deployment — it
    * reports through `resumeError` instead.
    *
+   * ## The throw is truthful, not merely loud (#13807)
+   *
+   * Maintainer ruling 2026-09-04 (decision batch #37, option B): this door
+   * KEEPS its status code — the effect landing while the run strands is still
+   * a failure and must still be reported as one — and stops discarding what
+   * the engine said. ⛔ Not "return 200", which the card forbids; ⛔ not
+   * atomic, because rolling a real human decision back is excluded by the
+   * #13937 shape-4 ruling, which binds this door's own writes too (a machine
+   * that re-armed strandings by itself would re-run the node that threw,
+   * forever, with nobody deciding it should).
+   *
+   * So the error carries {@link StrandedDecisionDetails} beside its prose:
+   * `finalized` (the decision stands), `decision`, `runId`, and `repairable`
+   * derived from the engine's `'stranded'` discriminator. Before this a caller
+   * had a 500 and a sentence — and 500 alone reads as "the rejection did not
+   * happen", which is the misreading that makes a caller retry or escalate
+   * against a decision that IS durable.
+   *
    * @param what - how the recorded outcome reads in the error, e.g.
    *   `"the approve decision"`.
+   * @param decision - the outcome label for the machine-readable envelope
+   *   (`'approve'` / `'reject'` / `'revise'` / `'resubmit'`). Passed
+   *   explicitly rather than parsed back out of `what` or the signal: the
+   *   prose is for humans and `output` is the flow's, and neither is a place
+   *   to keep a wire value.
    */
-  async resumeRecordedOutcome(runId, requestId, what, signal) {
+  async resumeRecordedOutcome(runId, requestId, what, signal, decision) {
     const missing = this.missingRunCapability(runId, requestId, what, "resume");
     if (missing) return { resumed: false, resumeError: missing };
     try {
@@ -3980,14 +4412,27 @@ var _ApprovalService = class _ApprovalService {
         });
         return { resumed: false, resumeError: reason };
       }
+      const status = _ApprovalService.resumeStatusOf(err);
+      const repairable = status === "stranded";
       this.logger?.error?.("[approvals] resume failed \u2014 the run is stranded", {
         request: requestId,
         run: runId,
         outcome: what,
-        error: reason
+        error: reason,
+        status,
+        repairable
       });
-      throw new Error(
-        `RESUME_FAILED: ${what} was recorded on request ${requestId}, but its flow run '${runId}' could not be resumed and is now stranded: ${reason}`
+      if (repairable) {
+        await this.journalStrandedContinuation(requestId, {
+          branchLabel: signal.branchLabel,
+          output: signal.output,
+          decision,
+          what
+        });
+      }
+      throw strandedDecisionFailure(
+        `RESUME_FAILED: ${what} was recorded on request ${requestId}, but its flow run '${runId}' could not be resumed and is now stranded: ${reason}`,
+        { finalized: true, decision, runId, repairable }
       );
     }
   }
@@ -4023,7 +4468,8 @@ var _ApprovalService = class _ApprovalService {
           // Reserved keys are spread LAST so no output can shadow them (the
           // whitelist already rejects them; this is defense in depth).
           output: { ...result.outputs ?? {}, decision: result.decision, requestId }
-        }
+        },
+        result.decision
       );
       resumed = outcome.resumed;
       resumeError = outcome.resumeError;
@@ -4038,7 +4484,7 @@ var _ApprovalService = class _ApprovalService {
     };
   }
   /**
-   * Withdraw a pending request (submitter only). Finalises the row as
+   * Withdraw an undecided request. Finalises the row as
    * `recalled`, releases the record lock (keyed on pending status), mirrors
    * the status field when configured, and resumes the owning flow run down
    * the `reject` branch with `output.decision = 'recall'` — leaving the run
@@ -4049,6 +4495,13 @@ var _ApprovalService = class _ApprovalService {
    * is then paused at the revise-window node (no reject edge), so it is
    * terminally cancelled via {@link ApprovalResumeSurface.cancelRun} rather
    * than resumed.
+   *
+   * The #3424 privileged override reaches a PENDING request only (#12775,
+   * maintainer ruling 2026-09-02). On `returned` an override actor is refused
+   * exactly as any other non-submitter: the gate is spelled as `attachViewers`
+   * computes `viewer.can_override`, so the gate, the
+   * {@link ApprovalService.isOverrideActor} doc block and the viewer flag agree
+   * at one point.
    */
   async recall(requestId, input, context) {
     if (!requestId) throw new Error("VALIDATION_FAILED: requestId is required");
@@ -4064,8 +4517,18 @@ var _ApprovalService = class _ApprovalService {
     if (raw.status !== "pending" && !inReviseWindow) {
       throw new Error(`INVALID_STATE: request is ${raw.status}`);
     }
-    if (!this.isOverrideActor(context, raw.organization_id ?? null) && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
-      throw new Error(`FORBIDDEN: only the submitter may recall this request`);
+    const overrideAdmits = raw.status === "pending" && this.isOverrideActor(context, raw.organization_id ?? null);
+    if (!overrideAdmits && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
+      const developerMessage = `[approvals] recall refused: actor '${actorId}' is not the submitter of request '${requestId}' (submitter '${String(raw.submitter_id)}') and holds no #3424 override for a '${raw.status}' request (the override reaches pending requests only)`;
+      this.logger?.warn?.(developerMessage, {
+        request: requestId,
+        actor: actorId,
+        submitter: String(raw.submitter_id),
+        status: raw.status
+      });
+      throw new Error(
+        `FORBIDDEN: ${this.userFacingRefusal("approval_recall_not_submitter", context)}`
+      );
     }
     if (inReviseWindow) await this.assertLatestForRun(raw);
     const config = parseJson(raw.node_config_json, { approvers: [], behavior: "first_response" });
@@ -4135,12 +4598,141 @@ var _ApprovalService = class _ApprovalService {
             run: runId,
             error: resumeError
           });
+          if (_ApprovalService.resumeStatusOf(err) === "stranded") {
+            await this.journalStrandedContinuation(requestId, {
+              branchLabel: APPROVAL_BRANCH_LABELS.reject,
+              output: { decision: "recall", requestId },
+              decision: "recall",
+              what: "the recall"
+            });
+          }
         }
       }
     }
     const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh, runId, resumed, ...resumeError ? { resumeError } : {} };
   }
+  // ── Record-delete lifecycle linkage (#13568) ─────────────────
+  /**
+   * Void every `pending` request about a record that has just been DELETED
+   * (#13568, maintainer ruling 2026-08-31 「同意」).
+   *
+   * ## What the ruling asked for, and what each half costs
+   *
+   *   status → `cancelled`, a machine-readable `cancel_reason`, the row KEPT
+   *   for audit, and the request out of the pending count and the inbox's
+   *   default view.
+   *
+   * The last clause needs both writes below, not just the status one: the
+   * inbox's "My Pending" tab pages the request table by `status`, but the
+   * approver filter resolves through the normalized `sys_approval_approver`
+   * index (#1745), which is keyed on nothing but `request_id`. Leaving the
+   * index rows behind would keep the request in `approverRequestIds`' answer
+   * for every approver forever — so {@link syncApproverIndex} clears them, the
+   * same call every other exit from `pending` makes.
+   *
+   * ## Three things this deliberately does NOT do
+   *
+   * 1. **No status mirror-back.** Every other terminal transition calls
+   *    {@link mirrorStatusField} to write the outcome onto the subject record's
+   *    `approvalStatusField`. Here the subject record is precisely what no
+   *    longer exists, so that write is guaranteed to fail — it is the very
+   *    `update_record(...) failed: Record ... not found` this card's own
+   *    forensics recorded on the reject door. Skipped by construction, not by a
+   *    swallowed error.
+   *
+   * 2. **No flow resume, and no run cancel.** A cancellation is a status write
+   *    plus a reason; it is not a decision, so there is no branch to resume
+   *    down and no downstream node that should run. The suspended run this
+   *    request gated is reported (below) and left alone — what becomes of an
+   *    approval run whose request was voided is a lifecycle question that
+   *    belongs to the automation service, not to a delete hook, and answering
+   *    it here by guessing would be exactly the kind of consumer-side
+   *    accommodation PD #12 refuses.
+   *
+   * 3. **No refusal of the delete.** The delete has already landed by the time
+   *    this runs, and the "forbid delete while an approval is pending"
+   *    direction was VETOED in the same ruling (`lockRecord` already blocks the
+   *    edit; blocking the delete too locks an author onto a record they cannot
+   *    fix). So nothing here throws — a failure degrades to a warning and the
+   *    stale row, which is the pre-existing state, never to a failed delete.
+   *
+   * Terminal rows are untouched: the `where` below names `status: 'pending'`,
+   * so an `approved` / `rejected` / `recalled` / `returned` request about the
+   * same record keeps its recorded outcome. That is the ruling's second half —
+   * history is kept; only the presentation of its dead record reference is
+   * someone else's card.
+   *
+   * @returns the request ids cancelled and the suspended run ids left behind.
+   */
+  async cancelForDeletedRecord(objectName, recordId) {
+    const empty = { cancelled: [], suspendedRuns: [] };
+    const object = String(objectName ?? "").trim();
+    const record = String(recordId ?? "").trim();
+    if (!object || !record) return empty;
+    let pending;
+    try {
+      const rows = await this.engine.find("sys_approval_request", {
+        where: { object_name: object, record_id: record, status: "pending" },
+        limit: RECORD_DELETE_CANCEL_LIMIT,
+        context: SYSTEM_CTX2
+      });
+      pending = Array.isArray(rows) ? rows : [];
+    } catch (err) {
+      this.logger?.warn?.(
+        "[approvals] could not read the pending requests of a deleted record \u2014 they stay in the inbox until the record is deleted again or an operator finalises them",
+        { object, record, error: err?.message ?? String(err) }
+      );
+      return empty;
+    }
+    if (pending.length === 0) return empty;
+    const now = this.clock.now().toISOString();
+    const cancelled = [];
+    const suspendedRuns = [];
+    for (const raw of pending) {
+      const requestId = String(raw?.id ?? "");
+      if (!requestId) continue;
+      const org = raw?.organization_id ?? null;
+      const nodeId = raw?.flow_node_id ?? raw?.current_step ?? null;
+      try {
+        await this.engine.insert("sys_approval_action", {
+          id: uid("aact"),
+          request_id: requestId,
+          organization_id: org,
+          step_name: nodeId,
+          step_index: 0,
+          action: "cancel",
+          actor_id: null,
+          comment: `Auto-cancelled: the ${object} record '${record}' this request is about was deleted`,
+          created_at: now
+        }, { context: SYSTEM_CTX2 });
+        await this.engine.update("sys_approval_request", {
+          id: requestId,
+          status: "cancelled",
+          cancel_reason: "record_deleted",
+          pending_approvers: null,
+          completed_at: now,
+          updated_at: now
+        }, { context: SYSTEM_CTX2 });
+        await this.syncApproverIndex(requestId, [], org, now);
+        cancelled.push(requestId);
+        const runId = raw?.flow_run_id ? String(raw.flow_run_id) : "";
+        if (runId) suspendedRuns.push(runId);
+      } catch (err) {
+        this.logger?.warn?.(
+          "[approvals] could not auto-cancel a pending request whose record was deleted \u2014 it stays in the inbox pointing at a record that no longer exists",
+          { object, record, request: requestId, error: err?.message ?? String(err) }
+        );
+      }
+    }
+    if (suspendedRuns.length) {
+      this.logger?.warn?.(
+        "[approvals] auto-cancelled approval request(s) for a deleted record \u2014 the automation run(s) they gated stay suspended and are not resumed by a cancellation",
+        { object, record, requests: cancelled, runs: suspendedRuns }
+      );
+    }
+    return { cancelled, suspendedRuns };
+  }
   // ── Send back for revision / resubmit (ADR-0044) ─────────────
   /**
    * ADR-0044 send back for revision. Finalises the pending request as
@@ -4229,7 +4821,8 @@ var _ApprovalService = class _ApprovalService {
           {
             branchLabel: APPROVAL_BRANCH_LABELS.reject,
             output: { decision: "reject", autoRejected: true, requestId }
-          }
+          },
+          "reject"
         );
         resumed2 = outcome.resumed;
         resumeError2 = outcome.resumeError;
@@ -4277,7 +4870,8 @@ var _ApprovalService = class _ApprovalService {
         {
           branchLabel: APPROVAL_BRANCH_LABELS.revise,
           output: { decision: "revise", requestId }
-        }
+        },
+        "revise"
       );
       resumed = outcome.resumed;
       resumeError = outcome.resumeError;
@@ -4357,7 +4951,8 @@ var _ApprovalService = class _ApprovalService {
         {
           branchLabel: APPROVAL_BRANCH_LABELS.resubmit,
           output: { resubmitted: true, requestId }
-        }
+        },
+        "resubmit"
       );
       resumed = outcome.resumed;
       resumeError = outcome.resumeError;
@@ -4771,7 +5366,10 @@ var _ApprovalService = class _ApprovalService {
    * `escalation.timeoutHours` and whose deadline has passed is escalated
    * **at most once, ever** — the `escalate` audit row is the idempotency
    * marker, written before any mutation (audit-first, like reassign). One
-   * bad row never stops the sweep.
+   * bad row never stops the sweep. A block that explicitly declares
+   * `enabled: false` is skipped (#12278 — the declared switch is enforced;
+   * pre-flip snapshots ride the legacy window on
+   * {@link ESCALATION_ENABLED_FLIP_CUTOFF_MS}).
    */
   async runEscalations() {
     let rows = [];
@@ -4793,6 +5391,7 @@ var _ApprovalService = class _ApprovalService {
         const cfg = parseJson(raw.node_config_json, void 0);
         const esc2 = cfg?.escalation;
         if (!esc2 || typeof esc2.timeoutHours !== "number" || esc2.timeoutHours <= 0) continue;
+        if (esc2.enabled === false && Date.parse(raw.created_at ?? "") >= ESCALATION_ENABLED_FLIP_CUTOFF_MS) continue;
         const due = slaDueAt(raw.created_at, cfg);
         if (!due || Date.parse(due) > this.clock.now().getTime()) continue;
         const prior = await this.engine.find("sys_approval_action", {
@@ -4873,9 +5472,52 @@ var _ApprovalService = class _ApprovalService {
    *    live pause exists. It THROWS when the store cannot be read, and that
    *    case is SKIPPED, never counted as dead: an unreadable store means
    *    "unknown", and a storage outage must not be published as a lost run.
-   *  - `getRun(runId) == null` — no terminal history row either (the `run_`
-   *    prefixed rows in `sys_automation_run`). A run that merely finished is
-   *    not stranded; a request whose run neither waits nor ever completed is.
+   *  - `classifyStrandedRunState` over `getRun(runId)` — the run's own
+   *    history row (the `run_` prefixed rows in `sys_automation_run`). A run
+   *    that merely finished is not stranded; a request whose run neither waits
+   *    nor completed is.
+   *
+   * **The second oracle was widened (#13909), and this is the whole point of
+   * that card's first slice.** It used to be `if (terminal) continue` — the
+   * existence of ANY history row ended the check, on the reading "the run ran to
+   * a terminal state, it is not dangling". That is true of a run that COMPLETED
+   * and false of one that FAILED: the engine consumes a suspension *before*
+   * running the downstream nodes (`AutomationEngine.resumeInternal` calls
+   * `forgetSuspendedRun(run, 'resumed')` and only then `traverseNext`), so a
+   * downstream node that merely threw threw with the pause already gone, and the
+   * catch arm wrote a terminal `failed` row. The decision is durable, the
+   * continuation stopped half-way, `resume` answers `RUN_NOT_FOUND` and
+   * `cancelRun` is a no-op — and the terminal row this oracle used to read as
+   * health is written BY the very failure that stranded it. So this inspection
+   * reported `0` for the one shape an operator most needs to see.
+   *
+   * ⚠️ The widening does NOT reverse the conservatism: `completed`, `cancelled`
+   * and `paused` are each still skipped, for reasons named one at a time in
+   * `classifyStrandedRunState`, and an unrecognised status is skipped too.
+   * What the widening buys is that a `failed` run is now reported instead of
+   * counted as healthy.
+   *
+   * **A THIRD oracle tells the `failed` rows apart (#15358).** `status ===
+   * 'failed'` over-reports in one specific direction: a cascade-failed run
+   * — an ancestor `failAncestors` failed while it was parked at its `subflow`
+   * node, whose pause `failSuspendedRun` consumed and journalled nothing — has
+   * the same terminal row as the #13909 strand, and `restoreConsumedSuspension`
+   * refuses it. The engine's discriminator (the consumed-suspension snapshot)
+   * is deliberately NOT on the object `getRun` answers, so it is asked through
+   * a dedicated read-only member, `inspectConsumedSuspension`, and only for
+   * `failed` rows: the answer splits `'failed'` into `'repairable'`,
+   * `'snapshot_dropped'` and `'unrepairable'` (see {@link StrandedRunState}).
+   * A surface without that member leaves the row `'failed'` — reported,
+   * undifferentiated — because absence of the discriminator is not evidence
+   * of anything. So does a read that THREW or answered a malformed verdict
+   * (#16709): by the time this oracle is asked the row is already known to be
+   * stranded, so a failure to differentiate it is not a reason to drop it from
+   * a report — it is counted `undetermined` as telemetry AND reported.
+   *
+   * ⚠️ **What this can and cannot size.** It makes the condition *visible* in a
+   * deployment; it is not itself a census, and it says nothing about this
+   * repository. How many runs are already in this state can only be answered
+   * against a real deployment's tables — see the card.
    *
    * **Reports; never rewrites.** No status is changed and no run is cancelled.
    * The decision genuinely happened — a human approved or rejected — and
@@ -4933,7 +5575,27 @@ var _ApprovalService = class _ApprovalService {
         });
         continue;
       }
-      if (terminal) continue;
+      let runState = classifyStrandedRunState(terminal);
+      if (!runState) continue;
+      if (runState === "failed" && typeof this.automation.inspectConsumedSuspension === "function") {
+        let refined;
+        let differentiated = true;
+        try {
+          refined = refineFailedRunState(await this.automation.inspectConsumedSuspension(runId));
+        } catch (err) {
+          differentiated = false;
+          undetermined++;
+          this.logger?.warn?.("[approvals] stranded-request scan could not read the consumed-suspension state", {
+            request: raw?.id,
+            run: runId,
+            error: err?.message ?? String(err)
+          });
+        }
+        if (differentiated) {
+          if (!refined) continue;
+          runState = refined;
+        }
+      }
       const config = parseJson(
         raw.node_config_json,
         { approvers: [], behavior: "first_response" }
@@ -4956,6 +5618,7 @@ var _ApprovalService = class _ApprovalService {
         requestId: String(raw.id),
         status: raw.status,
         runId,
+        runState,
         flowName: typeof raw.process_name === "string" ? raw.process_name.replace(/^flow:/, "") : void 0,
         nodeId: raw.flow_node_id ?? raw.current_step ?? void 0,
         objectName: raw.object_name,
@@ -4967,15 +5630,395 @@ var _ApprovalService = class _ApprovalService {
       });
     }
     if (stranded.length || undetermined) {
-      this.logger?.warn?.("[approvals] stranded terminal requests (decision recorded, flow run gone)", {
+      this.logger?.warn?.("[approvals] stranded terminal requests (decision recorded, flow run unrecoverable)", {
         scanned: rows.length,
         stranded: stranded.length,
         undetermined,
-        requests: stranded.map((s) => `${s.requestId}@${s.nodeId ?? "?"} \u2192 run ${s.runId}`)
+        runMissing: stranded.filter((s) => s.runState === "missing").length,
+        runFailed: stranded.filter((s) => s.runState === "failed").length,
+        runRepairable: stranded.filter((s) => s.runState === "repairable").length,
+        runSnapshotDropped: stranded.filter((s) => s.runState === "snapshot_dropped").length,
+        runUnrepairable: stranded.filter((s) => s.runState === "unrepairable").length,
+        requests: stranded.map((s) => `${s.requestId}@${s.nodeId ?? "?"} \u2192 run ${s.runId} (${s.runState})`)
       });
     }
     return { scanned: rows.length, stranded, undetermined };
   }
+  /**
+   * Stash the continuation a door just failed to deliver, so it can be issued
+   * again after the pause is re-armed (#15389).
+   *
+   * `AutomationEngine.restoreConsumedSuspension` puts a stranded approval run
+   * back on its pause and tells the operator to *re-issue the continuation* —
+   * but for an `approval` node the only issuers are this service's doors, and
+   * every one of them guards on a `pending` request that the stranding call
+   * itself just made terminal. Re-opening the row is excluded (it would let a
+   * decided request be decided again), so what is kept instead is the SIGNAL:
+   * the exact `branchLabel` + `output` the failed resume carried.
+   *
+   * ⚠️ Best-effort by construction, and it must stay that way: the decision is
+   * already durable and its caller is already owed a `RESUME_FAILED` throw. A
+   * failure to write recovery bookkeeping must not replace that throw with a
+   * storage error — {@link ApprovalService.continueRestoredRun} rebuilds the
+   * signal from the row when the stash is absent, so this failing costs
+   * fidelity on one shape, not the repair path.
+   */
+  async journalStrandedContinuation(requestId, signal) {
+    try {
+      const rows = await this.engine.find("sys_approval_request", {
+        where: { id: requestId },
+        limit: 1,
+        context: SYSTEM_CTX2
+      });
+      const raw = Array.isArray(rows) ? rows[0] : null;
+      if (!raw) return;
+      const config = parseJson(raw.node_config_json, {});
+      await this.engine.update("sys_approval_request", {
+        id: requestId,
+        node_config_json: JSON.stringify({ ...config, [STRANDED_CONTINUATION_KEY]: signal })
+      }, { context: SYSTEM_CTX2 });
+    } catch (err) {
+      this.logger?.warn?.(
+        "[approvals] could not journal the stranded continuation \u2014 the repair path falls back to rebuilding it from the row",
+        { request: requestId, error: err?.message ?? String(err) }
+      );
+    }
+  }
+  /**
+   * The continuation to re-issue for a request whose recorded outcome stranded
+   * its run — the journalled one when there is one, otherwise rebuilt from the
+   * row (#15389).
+   *
+   * ## Why a rebuild path exists at all
+   *
+   * The journal only covers runs stranded by a build that HAS it. The card is
+   * explicitly about *"the runs already in this state"*, and one of those can
+   * still be restored whenever the durable run-history row carried its
+   * suspension snapshot — so a repair verb that only served future strands
+   * would miss the population the card was filed for.
+   *
+   * ## Which statuses it rebuilds, which it discriminates, and which it refuses
+   *
+   * ⛔ A status is NOT the same thing as a continuation. Three of the four
+   * terminal statuses have more than one writer or more than one issuer, so
+   * "one status, one signal" is false and is not what this relies on. Each row
+   * below states its own population and its own discriminator:
+   *
+   * | status | writers / issuers | rebuilt as | how it is decided |
+   * |---|---|---|---|
+   * | `approved` | 1 (`decide`; escalation auto-approve routes through it) | `approve` | unambiguous |
+   * | `rejected` | 2 (`decide`; ADR-0044 revision-limit auto-reject) | `reject`, or REFUSED | a `revise` action row means the auto-reject arm is possible |
+   * | `returned` | 1 writer, 2 issuers (`sendBack` → `revise`; a later `resubmit` → `resubmit`, writing no status) | `resubmit` or `revise` | a `resubmit` action row, whose sole writer is `resubmit` |
+   * | `recalled` | 2 writers, 3 behaviours, 2 issuing NO continuation | REFUSED | nothing on the row distinguishes them |
+   *
+   * ⚠️ **Both refusals are deliberate and neither is best-effort.** The failure
+   * mode of a wrong rebuild is a flow advanced down a branch nobody chose —
+   * strictly worse than the dead end this verb exists to open. Where the signal
+   * cannot be proved, this refuses and names what the operator can do instead;
+   * the journal is what makes both shapes recoverable going forward.
+   *
+   * ⛔ `pending` and `cancelled` are refused outright: neither names a recorded
+   * outcome to replay. A `pending` request's continuation is an ordinary
+   * decision through the front door, which is exactly the guard this verb
+   * exists to avoid weakening.
+   */
+  async resolveRecordedContinuation(raw, requestId) {
+    const config = parseJson(raw.node_config_json, {});
+    const status = String(raw.status ?? "");
+    const stashed = config?.[STRANDED_CONTINUATION_KEY];
+    if (stashed && typeof stashed === "object" && typeof stashed.decision === "string") {
+      const issuable = CONTINUATIONS_A_STATUS_CAN_ISSUE[status];
+      const journalled = String(stashed.decision);
+      if (!issuable?.includes(journalled)) {
+        throw new Error(
+          `INVALID_STATE: request ${requestId} is '${status || "unknown"}' and its journalled continuation is the ${journalled}, which a '${status || "unknown"}' request cannot have issued \u2014 ${issuable ? `a '${status}' row is replayable only for ${issuable.map((d) => `'${d}'`).join(" or ")}` : `no continuation is replayable for '${status || "unknown"}'`}. The journal records what the last FAILED resume was carrying, so a later recall (or any other door that moved this row on) leaves a signal behind that the row's own status no longer stands behind, and replaying it would advance a step nobody is waiting on. Refusing to replay it: cancel the run with the engine's cancelRun('${raw.flow_run_id}') if the newer outcome should stand, or resume it by hand with the signal the flow expects.`
+        );
+      }
+      return { signal: stashed, source: "journal" };
+    }
+    const outputs = { ...config?.__decisionOutputs ?? {} };
+    if (status === "approved" || status === "rejected") {
+      if (status === "rejected") {
+        const priorRevise = await this.engine.find("sys_approval_action", {
+          where: { request_id: requestId, action: "revise" },
+          limit: 1,
+          context: SYSTEM_CTX2
+        });
+        if (Array.isArray(priorRevise) && priorRevise.length) {
+          throw new Error(
+            `INVALID_STATE: request ${requestId} is 'rejected' and also carries a 'revise' action, so this service cannot tell a decided rejection from an ADR-0044 revision-limit auto-rejection \u2014 and the two resume the same edge with different flow output (\`autoRejected\`). Refusing to guess: replay it by hand with the signal the flow expects, or cancel the run.`
+          );
+        }
+      }
+      const decision = status === "approved" ? "approve" : "reject";
+      return {
+        source: "reconstructed",
+        signal: {
+          branchLabel: status === "approved" ? APPROVAL_BRANCH_LABELS.approve : APPROVAL_BRANCH_LABELS.reject,
+          output: { ...outputs, decision, requestId },
+          decision,
+          what: `the ${decision} decision`
+        }
+      };
+    }
+    if (status === "returned") {
+      const resubmitted = await this.engine.find("sys_approval_action", {
+        where: { request_id: requestId, action: "resubmit" },
+        limit: 1,
+        context: SYSTEM_CTX2
+      });
+      if (Array.isArray(resubmitted) && resubmitted.length) {
+        return {
+          source: "reconstructed",
+          signal: {
+            branchLabel: APPROVAL_BRANCH_LABELS.resubmit,
+            output: { resubmitted: true, requestId },
+            decision: "resubmit",
+            what: "the resubmit"
+          }
+        };
+      }
+      return {
+        source: "reconstructed",
+        signal: {
+          branchLabel: APPROVAL_BRANCH_LABELS.revise,
+          output: { decision: "revise", requestId },
+          decision: "revise",
+          what: "the send-back"
+        }
+      };
+    }
+    if (status === "recalled") {
+      throw new Error(
+        `INVALID_STATE: request ${requestId} is 'recalled' and carries no journalled continuation, so the signal cannot be rebuilt: a recall reaches this state three ways (resumed down 'reject', terminally cancelled inside a revision window, or swept as a dead run) and two of them issue no continuation at all \u2014 replaying the wrong one would re-open a request that was deliberately withdrawn. Refusing to guess: cancel the run with the engine's cancelRun('${raw.flow_run_id}') if the withdrawal should stand, or resume it by hand with the signal the flow expects.`
+      );
+    }
+    throw new Error(
+      `INVALID_STATE: request is ${status || "unknown"} \u2014 only a request whose recorded outcome already resumed its run can have that continuation re-issued (approved, rejected, returned, recalled)`
+    );
+  }
+  /**
+   * WHERE the pause a recorded continuation was refused on actually sits
+   * (#15389) — the expected node guard 3 compares the run's parked node against.
+   *
+   * ⚠️ This is signal-aware, and that is the whole point of it. "This request's
+   * own node" is the right answer for three of the four signals and the WRONG
+   * answer for the fourth:
+   *
+   * | signal | issued from | why |
+   * |---|---|---|
+   * | `approve` / `reject` | the request's own approval node | the decision is taken at the pause it gates |
+   * | `revise` (send-back) | the request's own approval node | send-back resumes that same pause down the `revise` edge |
+   * | `recall` | the request's own approval node | recall-on-pending resumes that same pause down `reject` |
+   * | `resubmit` | the **revise window** the request's `revise` edge leads to | by construction: a resubmit is only reachable AFTER a send-back moved the run there, and it resumes THAT pause down the `resubmit` back-edge |
+   *
+   * Measured before this existed: a `returned` row whose resubmit stranded was
+   * refused by guard 3 on both the journal and the rebuild paths — the pause
+   * re-armed at the revise window while the row's `flow_node_id` still read the
+   * approval node — and the refusal told the operator the pause was not this
+   * request's when it was exactly this request's. A refusal may ship; a refusal
+   * that names a cause the code did not take may not.
+   *
+   * ⛔ It stays FAIL-CLOSED: the revise window is derived from the flow
+   * definition the same way {@link ApprovalService.assertReviseEdge} derives it
+   * — a `revise` out-edge of this request's node into a node the flow declares
+   * as `{@link APPROVAL_REVISE_NODE_TYPE}`, which is the pause only this service
+   * can continue. No engine, no flow, no such edge, or more than one candidate
+   * ⇒ refuse. It needs no automation surface `assertReviseEdge` did not already
+   * use (`getFlow`), and no engine change.
+   *
+   * ⚠️ It does not widen what guard 3 admits beyond that one signal: for every
+   * other decision the answer is byte-identical to the row's own node.
+   *
+   * ⛔ It is NOT what keeps the recall-in-revise-window shape (row `recalled`,
+   * run at the revise window) refused, and an earlier revision of this comment
+   * claimed it was — on the reasoning that such a row's journalled signal is
+   * `recall` rather than `resubmit`. That is false: a recall taken inside the
+   * revise window calls `cancelRun` and journals NOTHING, so the journal on
+   * such a row is whatever an EARLIER strand left there — a `resubmit`, most
+   * often, since the resubmit is what the window exists to receive. Measured:
+   * with the journal returned before the row's status was looked at, that
+   * stale `resubmit` reached this method, was answered with the revise window,
+   * matched the parked node, and opened a fresh `pending` round on a withdrawn
+   * request. What refuses it is the journal/status compatibility check in
+   * {@link ApprovalService.resolveRecordedContinuation} — see
+   * {@link CONTINUATIONS_A_STATUS_CAN_ISSUE} — which runs BEFORE this method
+   * and never hands it a signal the row's status cannot have issued.
+   */
+  async expectedPauseNode(raw, signal, requestId, runId) {
+    const ownNode = raw.flow_node_id ?? raw.current_step ?? null;
+    if (!ownNode) {
+      throw new Error(
+        `INVALID_STATE: request ${requestId} records no approval node, so the pause on run '${runId}' cannot be proved to be the one ${signal.what} was refused on \u2014 refusing rather than resuming a pause that may belong to another node`
+      );
+    }
+    if (signal.decision !== "resubmit") {
+      return { nodeId: ownNode, describe: `its own approval node '${ownNode}'` };
+    }
+    const processName = String(raw.process_name ?? "");
+    const flowName = processName.startsWith("flow:") ? processName.slice("flow:".length) : "";
+    if (!flowName || typeof this.automation?.getFlow !== "function") {
+      throw new Error(
+        `INVALID_STATE: ${signal.what} on request ${requestId} was issued from the revise window that approval node '${ownNode}' sends back to, and this service cannot read the owning flow definition to say which node that is \u2014 refusing, because continuing a pause it cannot identify advances a step nobody decided`
+      );
+    }
+    const flow = await this.automation.getFlow(flowName);
+    const nodeTypeById = new Map(
+      (Array.isArray(flow?.nodes) ? flow.nodes : []).filter((n) => typeof n?.id === "string").map((n) => [n.id, typeof n.type === "string" ? n.type : ""])
+    );
+    const windows = Array.from(new Set(
+      (Array.isArray(flow?.edges) ? flow.edges : []).filter((e) => e?.source === ownNode && e?.label === APPROVAL_BRANCH_LABELS.revise).map((e) => typeof e?.target === "string" ? e.target : "").filter((t) => t && nodeTypeById.get(t) === APPROVAL_REVISE_NODE_TYPE)
+    ));
+    if (windows.length !== 1) {
+      throw new Error(
+        `INVALID_STATE: ${signal.what} on request ${requestId} was issued from the revise window that approval node '${ownNode}' sends back to, and flow '${flowName}' declares ${windows.length === 0 ? "no such window" : `${windows.length} of them (${windows.join(", ")})`} \u2014 refusing, because a pause this service cannot identify must not be continued`
+      );
+    }
+    return {
+      nodeId: windows[0],
+      describe: `the revise window '${windows[0]}' that its approval node '${ownNode}' sends back to`
+    };
+  }
+  /**
+   * Re-issue the continuation for a run an operator has re-armed with
+   * `AutomationEngine.restoreConsumedSuspension` — the missing half of that
+   * repair verb, for approvals (#15389).
+   *
+   * ## The dead end this exits
+   *
+   * A decision whose downstream node throws strands the run: the suspension is
+   * consumed, the decision is durable, and the caller gets `RESUME_FAILED`
+   * carrying `repairable: true`. `restoreConsumedSuspension` then genuinely
+   * re-arms the pause — measured `restored: true`, `hasSuspendedRun` back to
+   * `true` — and its own reason string tells the operator to *re-issue the
+   * continuation*. For an `approval` node there was then nobody who could:
+   *
+   *  - `decide` / `recall` / `sendBack` / `resubmit` all guard on a `pending`
+   *    request, and the row is terminal — written by the very call that
+   *    stranded the run;
+   *  - the generic `engine.resume` refuses, because the `approval` node
+   *    declares `resumeAuthority: 'service'` and the #3801 gate turns away any
+   *    resume that is not the tail of a decision this service authorized.
+   *
+   * So the only verb left was `cancelRun`, which discards the branch's
+   * downstream work. Measured on the real engine and the real door: the
+   * restored pause IS resumable, and a `resumeAuthority`-marked resume walks
+   * the reject branch to completion. Nothing was missing in the engine — what
+   * was missing was an ISSUER on this side. This is that issuer.
+   *
+   * ## What it deliberately does NOT do
+   *
+   * ⛔ It does not re-open, re-decide, or rewrite the request row: all four
+   * `pending` guards stay exactly as they are, and no status, mirror field or
+   * audit row is written. A person decided this once; this replays what they
+   * decided onto the pause that was put back, and replays nothing else.
+   * ⛔ It does not relax `resumeAuthority: 'service'` — the resume goes through
+   * {@link ApprovalService.serviceResume} like every other, so the marker is
+   * still stamped in exactly one place.
+   * ⛔ It grants no capability that in-process code did not already have:
+   * `RESUME_AUTHORITY_SERVICE` is importable by anything in the host, so the
+   * raw form of this call was always available. What this adds is the GUARDED
+   * form, and the guards are the substance of it — three, each with its own
+   * reverse-control pin, because the raw marker is not a guard and an
+   * unguarded repair verb advances flows nobody decided:
+   *
+   *  1. {@link assertLatestForRun} — this request is still the newest on its
+   *     run, so a superseded row cannot drive a later round or a later node;
+   *  2. `hasSuspendedRun` — a pause exists at all (strict: an unreadable store
+   *     throws rather than reading as "not suspended");
+   *  3. node identity — that pause is parked where THIS request's recorded
+   *     outcome was issued from: its own approval node for `approve`,
+   *     `reject`, `revise` and `recall`, and — for a `resubmit`, which is only
+   *     reachable from a revise window — the `approval_revise` node its own
+   *     `revise` edge leads to. {@link ApprovalService.expectedPauseNode}
+   *     derives it, fail-closed.
+   *
+   * Guard 3 is not redundant with guard 2: existence is not identity, and a
+   * boolean cannot tell this request's re-armed pause from any other live
+   * pause on the same run.
+   *
+   * ## Posture, and why it takes no `ExecutionContext`
+   *
+   * Deliberately shaped like the engine verb it completes: an in-process
+   * operator repair, reachable from a host or a console script, with no REST
+   * route and no entry in the spec `ApprovalService` contract — exactly as
+   * `restoreConsumedSuspension` is a class method on `AutomationEngine` and
+   * appears in no contract. It authorizes nothing new: the decision it replays
+   * was authorized and recorded when it was made, and re-authorizing it here
+   * against a present-day actor would be a different and wrong question (the
+   * original approver may be long gone). `requestedBy` / `reason` ride the log
+   * for the same reason they do on the restore.
+   *
+   * @returns what was replayed and whether the run moved — never a silent
+   *   `false`. A resume that fails again throws the same `RESUME_FAILED`
+   *   envelope the original decision did, `repairable` and all, so a second
+   *   restore-and-continue is possible.
+   */
+  async continueRestoredRun(requestId, options) {
+    if (!requestId) throw new Error("VALIDATION_FAILED: requestId is required");
+    const rows = await this.engine.find("sys_approval_request", {
+      where: { id: requestId },
+      limit: 1,
+      context: SYSTEM_CTX2
+    });
+    const raw = Array.isArray(rows) ? rows[0] : null;
+    if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
+    const runId = raw.flow_run_id ?? null;
+    if (!runId) {
+      throw new Error(
+        `INVALID_STATE: request ${requestId} names no flow run \u2014 there is no continuation to re-issue`
+      );
+    }
+    await this.assertLatestForRun(raw);
+    const { signal, source } = await this.resolveRecordedContinuation(raw, requestId);
+    if (typeof this.automation?.hasSuspendedRun === "function") {
+      const parked = await this.automation.hasSuspendedRun(runId);
+      if (!parked) {
+        throw new Error(
+          `INVALID_STATE: run '${runId}' behind request ${requestId} is not suspended, so there is no re-armed pause to continue \u2014 restore it first with the automation engine's restoreConsumedSuspension('${runId}'), which is what re-arms a consumed approval suspension`
+        );
+      }
+    }
+    const expected = await this.expectedPauseNode(raw, signal, requestId, runId);
+    if (typeof this.automation?.listSuspendedRunsDurable !== "function") {
+      throw new Error(
+        `INVALID_STATE: this automation engine cannot report WHERE run '${runId}' is parked (no listSuspendedRunsDurable), so the pause cannot be proved to be the one ${signal.what} on request ${requestId} was refused on \u2014 refusing, because continuing the wrong pause advances a flow with no decision behind it`
+      );
+    }
+    const parkedAt = (await this.automation.listSuspendedRunsDurable()).find((r) => String(r.runId) === String(runId))?.nodeId;
+    if (parkedAt !== expected.nodeId) {
+      throw new Error(
+        `INVALID_STATE: run '${runId}' is parked at ${parkedAt ? `node '${parkedAt}'` : "no node this engine can see"}, but ${signal.what} on request ${requestId} was issued from ${expected.describe} \u2014 so the pause this verb was asked to continue is not the one that outcome was issued at, and continuing it would advance a step nobody decided`
+      );
+    }
+    this.logger?.warn?.(
+      "[approvals] re-issuing the continuation for a restored approval suspension",
+      {
+        request: requestId,
+        run: runId,
+        decision: signal.decision,
+        branchLabel: signal.branchLabel,
+        source,
+        requestedBy: options?.requestedBy ?? "not recorded",
+        reason: options?.reason ?? "not recorded"
+      }
+    );
+    const outcome = await this.resumeRecordedOutcome(
+      runId,
+      requestId,
+      signal.what,
+      { branchLabel: signal.branchLabel, output: signal.output },
+      signal.decision
+    );
+    return {
+      resumed: outcome.resumed,
+      runId,
+      decision: signal.decision,
+      branchLabel: signal.branchLabel,
+      source,
+      ...outcome.resumeError ? { resumeError: outcome.resumeError } : {}
+    };
+  }
   async releaseDeadRunRequests() {
     if (typeof this.automation?.getRun !== "function") return { scanned: 0, released: 0 };
     let rows = [];
@@ -5825,9 +6868,28 @@ var _ApprovalService = class _ApprovalService {
    * flow-driven resume, a service-to-service call), turning a successful write
    * into a `null` result. Gating belongs on the read API, not on an
    * operation's own return value.
+   *
+   * [#12769] The read still narrows by the CALLER's organization
+   * (`loadRequest` — a deliberate tenancy wall, untouched here), and an
+   * org-less request row is invisible inside an org-scoped caller's narrowing.
+   * Org-less rows arise by construction on every schedule / time-relative /
+   * api trigger run (#10131; #9132 pinned that behaviour rather than repairing
+   * it), so this is a live state, not an edge case: the write IS recorded and
+   * the echo cannot be built. It used to escape as `null` behind the callers'
+   * `fresh!` non-null assertions — a well-formed 200 whose declared-non-null
+   * `request` was `null` on the wire. Now it refuses loudly instead, which
+   * keeps every declared result type true: a result that cannot be built is
+   * never returned. Callers must NOT catch this to fall back to `null` —
+   * that would re-open the type-lie one level up.
    */
   async readBackRequest(requestId, context) {
-    return this.loadRequest(requestId, context, false);
+    const fresh = await this.loadRequest(requestId, context, false);
+    if (!fresh) {
+      throw new Error(
+        `READ_BACK_FAILED: the write to approval request '${requestId}' was recorded, but the updated row is not visible inside the caller's organization scope, so the result envelope cannot be built. The write is NOT rolled back \u2014 read the request back with a system or matching-organization context.`
+      );
+    }
+    return fresh;
   }
   async getRequest(requestId, context) {
     return this.loadRequest(requestId, context, true);
@@ -6319,6 +7381,41 @@ function bindApprovalLockHook(engine, logger) {
   }, { packageId: APPROVALS_HOOK_PACKAGE, priority: 50 });
   logger?.info?.("[approvals] record-lock hook bound");
 }
+var APPROVALS_OWN_OBJECTS = [
+  "sys_approval_request",
+  "sys_approval_action",
+  "sys_approval_approver",
+  "sys_approval_token",
+  "sys_approval_delegation"
+];
+function bindRecordDeleteCancelHook(engine, service, logger) {
+  engine.registerHook("afterDelete", async (ctx) => {
+    const object = ctx?.object ?? ctx?.objectName;
+    if (!object) return;
+    const raw = ctx?.previous?.id ?? ctx?.input?.id;
+    const recordId = raw == null ? "" : String(raw);
+    if (!recordId) {
+      logger?.warn?.(
+        "[approvals] a delete reached the approval-cancel hook with no record id \u2014 pending approvals for the deleted record (if any) stay in the inbox",
+        { object }
+      );
+      return;
+    }
+    try {
+      await service.cancelForDeletedRecord(String(object), recordId);
+    } catch (err) {
+      logger?.warn?.(
+        "[approvals] the approval-cancel linkage failed for a deleted record \u2014 its pending approvals stay in the inbox pointing at a record that no longer exists",
+        { object, record: recordId, error: err?.message ?? String(err) }
+      );
+    }
+  }, {
+    excludeObjects: [...APPROVALS_OWN_OBJECTS],
+    packageId: APPROVALS_HOOK_PACKAGE,
+    priority: 50
+  });
+  logger?.info?.("[approvals] record-delete cancel hook bound");
+}
 var DELEGATION_OBJECT = "sys_approval_delegation";
 function bindDelegationWriteGuard(engine, logger) {
   const makeGuard = (isInsert) => async (ctx) => {
@@ -6670,6 +7767,23 @@ var ApprovalsServicePlugin = class {
         } catch {
           return void 0;
         }
+      },
+      // [#11993] Deployment override lookup for user-facing refusal copy.
+      // Resolved LAZILY for the reason the two providers above are: the i18n
+      // service is contributed by another plugin (ADR-0029 D8) and may start
+      // after this one. Without it the service still renders the built-in
+      // catalog in the caller's locale; with it, a deployment's own
+      // `translation` for `errors.approval_recall_not_submitter` wins — the
+      // override address the catalog documents, made real for this emitter.
+      messageTranslator: () => {
+        try {
+          const i18n = ctx.getService("i18n");
+          const t = i18n?.t;
+          if (typeof t !== "function") return void 0;
+          return (key, locale, params) => t.call(i18n, key, locale, params);
+        } catch {
+          return void 0;
+        }
       }
     });
     const fieldVisibility = () => {
@@ -6690,6 +7804,7 @@ var ApprovalsServicePlugin = class {
       try {
         unbindAllHooks(engine);
         bindApprovalLockHook(engine, ctx.logger);
+        bindRecordDeleteCancelHook(engine, this.service, ctx.logger);
         bindDelegationWriteGuard(engine, ctx.logger);
         bindSnapshotRedactionMiddleware(engine, fieldVisibility, ctx.logger);
       } catch (err) {