@rytass/bpm-core-nestjs-module 0.13.5 → 0.15.0

package/src/lib/workflow-engine/workflow-engine.service.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkflowEngineService = exports.MANUAL_TRANSFER_DELEGATION_REASON = void 0;
+exports.WorkflowEngineService = exports.MANUAL_TRANSFER_DELEGATION_REASON = exports.MAX_APPROVAL_INSTANCE_BUSINESS_KEY_LENGTH = void 0;
 const tslib_1 = require("tslib");
+const class_validator_1 = require("class-validator");
 const form_1 = require("@rytass/bpm-core-shared/form");
 const workflow_graph_1 = require("@rytass/bpm-core-shared/workflow-graph");
 const workflow_webhook_delivery_service_1 = require("../workflow-webhook/workflow-webhook-delivery.service");
@@ -13,6 +14,7 @@ const delegation_service_1 = require("../delegation/delegation.service");
 const form_definition_version_entity_1 = require("../form/form-definition-version.entity");
 const form_enums_1 = require("../form/form.enums");
 const form_data_source_errors_1 = require("../form-data-source/form-data-source.errors");
+const form_member_value_validator_1 = require("../form/form-member-value.validator");
 const form_data_source_types_1 = require("../form-data-source/form-data-source.types");
 const sla_schedule_service_1 = require("../calendar/sla-schedule.service");
 const notification_service_1 = require("../notification/notification.service");
@@ -23,7 +25,9 @@ const condition_service_1 = require("../condition/condition.service");
 const manager_resolution_entity_1 = require("../organization/manager-resolution.entity");
 const membership_entity_1 = require("../organization/membership.entity");
 const org_unit_entity_1 = require("../organization/org-unit.entity");
+const position_entity_1 = require("../organization/position.entity");
 const organization_enums_1 = require("../organization/organization.enums");
+const organization_time_zone_1 = require("../organization/organization-time-zone");
 const approval_template_version_entity_1 = require("../template/approval-template-version.entity");
 const approval_template_entity_1 = require("../template/approval-template.entity");
 const template_enums_1 = require("../template/template.enums");
@@ -31,6 +35,7 @@ const activity_log_entity_1 = require("./activity-log.entity");
 const adhoc_directive_entity_1 = require("./adhoc-directive.entity");
 const adhoc_enums_1 = require("./adhoc.enums");
 const approval_instance_entity_1 = require("./approval-instance.entity");
+const instance_submitter_1 = require("./instance-submitter");
 const task_decision_entity_1 = require("./task-decision.entity");
 const task_candidate_entity_1 = require("./task-candidate.entity");
 const task_entity_1 = require("./task.entity");
@@ -41,6 +46,10 @@ const workflow_service_task_dispatcher_token_1 = require("./workflow-service-tas
 const workflow_token_entity_1 = require("./workflow-token.entity");
 const bpm_root_options_1 = require("../bpm/bpm-root-options");
 const MAX_PROCESSING_STEPS = 500;
+exports.MAX_APPROVAL_INSTANCE_BUSINESS_KEY_LENGTH = 200;
+const APPROVAL_INSTANCE_BUSINESS_KEY_INDEX = 'approval_instances_business_key_key';
+// Guards ORG_MANAGER_CHAIN against misconfigured manager rules that never end.
+const ORG_MANAGER_CHAIN_MAX_HOPS = 20;
 const DEFAULT_APPROVAL_HISTORY_TASK_LIMIT = 50;
 const SYSTEM_DRY_RUN_INSTANCE_ID = 'dry-run-instance';
 /**
@@ -89,9 +98,27 @@ let WorkflowEngineService = class WorkflowEngineService {
             injectedServiceTaskDispatcher ??
                 rootOptions?.workflowServiceTaskDispatcher ??
                 new workflow_service_task_dispatcher_token_1.DefaultWorkflowServiceTaskDispatcher();
+        this.organizationTimeZone = (0, organization_time_zone_1.resolveBPMOrganizationTimeZone)(rootOptions?.organizationTimeZone);
+    }
+    /**
+     * Today's date as the organization sees it (`organizationTimeZone`), for
+     * comparing against the date-only `effectiveFrom` / `effectiveTo` of
+     * memberships and manager resolutions. Not for timestamp columns, which are
+     * compared as instants.
+     */
+    readOrganizationToday() {
+        return (0, organization_time_zone_1.formatDateOnlyInTimeZone)(new Date(), this.organizationTimeZone);
     }
     async submitApprovalInstance(input, authContext) {
+        if (input.submittedByMemberId !== undefined &&
+            input.submittedByMemberId !== null &&
+            (typeof input.submittedByMemberId !== 'string' ||
+                input.submittedByMemberId.trim() === '')) {
+            throw new common_1.BadRequestException('submittedByMemberId must be a non-empty string');
+        }
         const formData = parseJsonObject(input.formDataJson, 'formDataJson');
+        const businessKey = normalizeBusinessKey(input.businessKey);
+        const submittedByMemberId = input.submittedByMemberId ?? input.initiatorMemberId;
         const template = await this.getTemplateOrThrow(input.templateId);
         if (!template.isActive) {
             throw new common_1.ConflictException('Approval template is deactivated');
@@ -114,6 +141,12 @@ let WorkflowEngineService = class WorkflowEngineService {
         if (!this.conditionService.evaluateBoolean(templateVersion.initiatorPolicyCel, buildInitiatorPolicyContext(initiatorMetadataSnapshot), 'initiatorPolicyCel')) {
             throw new common_1.ConflictException('Current member is not allowed to start this approval template');
         }
+        // Named here, before the transaction, so the completion notice that later
+        // says "由 X 代為送出" reads it from the started activity instead of
+        // asking the identity source while an approval holds the instance's locks.
+        const submittedByName = submittedByMemberId === input.initiatorMemberId
+            ? null
+            : await this.notificationService.readMemberDisplayName(submittedByMemberId);
         const startedAt = new Date();
         const startNode = templateVersion.workflowDefinition.nodes.find((node) => node.type === 'startEvent');
         if (!startNode) {
@@ -133,10 +166,12 @@ let WorkflowEngineService = class WorkflowEngineService {
                     uiSchema: formDefinitionVersion.uiSchema,
                     version: formDefinitionVersion.version,
                 },
+                businessKey,
                 initiatorMemberId: input.initiatorMemberId,
                 initiatorMetadataSnapshot,
                 startedAt,
                 state: workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING,
+                submittedByMemberId,
                 templateId: template.id,
                 templateVersionId: templateVersion.id,
                 title: input.title?.trim() || template.name,
@@ -160,6 +195,8 @@ let WorkflowEngineService = class WorkflowEngineService {
                     instanceId: instance.id,
                     nodeId: startNode.id,
                     payload: {
+                        submittedByMemberId,
+                        ...(submittedByName === null ? {} : { submittedByName }),
                         templateId: template.id,
                         templateVersionId: templateVersion.id,
                     },
@@ -178,6 +215,28 @@ let WorkflowEngineService = class WorkflowEngineService {
             ]);
             await this.processRunningInstance(manager, instance);
             return instance;
+        }).catch((error) => 
+        // The insert decides, not a pre-check: two concurrent submits would both
+        // pass a check, and only the unique index sees them as one.
+        throwBusinessKeyConflictOrRethrow(error, businessKey));
+    }
+    /**
+     * The instance a host submitted for `businessKey` on `templateId`, whatever
+     * its state (a cancelled or rejected instance still holds its key), or
+     * `null`. The key is trimmed the way submit trims it, so a lookup finds what
+     * a submit stored.
+     */
+    async findApprovalInstanceByBusinessKey(templateId, businessKey) {
+        const normalizedKey = businessKey.trim();
+        // A template id that is not a uuid cannot match a row, and handing it to
+        // Postgres would raise 22P02 (a 500) instead of "not found".
+        if (!(0, class_validator_1.isUUID)(templateId) ||
+            normalizedKey === '' ||
+            countCodePoints(normalizedKey) > exports.MAX_APPROVAL_INSTANCE_BUSINESS_KEY_LENGTH) {
+            return null;
+        }
+        return this.approvalInstanceRepository.findOne({
+            where: { businessKey: normalizedKey, templateId },
         });
     }
     async resolveFormDataOptionSnapshots({ authContext, formData, previousFormData, previousSnapshots, revalidateAll, schema, }) {
@@ -313,6 +372,35 @@ let WorkflowEngineService = class WorkflowEngineService {
                 taskNode.data.allowTransfer === false) {
                 throw new common_1.ForbiddenException(`Workflow node ${task.nodeId} does not allow transfer`);
             }
+            // Only guards a human picking the target; SLA escalation passes a
+            // `transferReason` and is deliberately left alone.
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED &&
+                options.transferReason === undefined &&
+                isInitiatorExcluded(taskNode) &&
+                transferToMemberId === instance.initiatorMemberId) {
+                throw new common_1.ConflictException(`簽核節點「${taskNode.data.label}」不允許申請人自簽，不能將任務轉交給申請人本人`);
+            }
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED &&
+                options.transferReason === undefined &&
+                isInitiatorExcluded(taskNode) &&
+                transferToMemberId !== null &&
+                transferToMemberId === (0, instance_submitter_1.readDistinctSubmitterMemberId)(instance)) {
+                throw new common_1.ConflictException(`簽核節點「${taskNode.data.label}」不允許代送人簽核，不能將任務轉交給代為送出此單的人`);
+            }
+            // Same carve-out: a human picking the target on a manager-chain node
+            // must pick someone at least as senior as the member being replaced.
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED &&
+                options.transferReason === undefined &&
+                transferToMemberId !== null &&
+                !task.isAdhoc &&
+                isOrgManagerChainNode(taskNode)) {
+                await this.assertTransferTargetGrade(manager, {
+                    actorMemberId: input.decidedByMemberId,
+                    delegationChain: actorCandidate?.delegationChain ?? task.delegationChain,
+                    label: taskNode.data.label,
+                    targetMemberId: transferToMemberId,
+                });
+            }
             const returnToNodeId = input.action === workflow_engine_enums_1.TaskDecisionActionEnum.RETURNED
                 ? readReturnTargetNodeId(instance.workflowSnapshot, task.nodeId, input.returnToNodeId)
                 : null;
@@ -422,6 +510,17 @@ let WorkflowEngineService = class WorkflowEngineService {
                 supersedeOthers: taskEnded,
                 taskId: completedTask.id,
             });
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED &&
+                !shouldCompleteTask) {
+                await this.activateNextSequentialCandidate({
+                    candidates: nextCandidateRows,
+                    instance,
+                    manager,
+                    node: taskNode,
+                    previousMemberId: input.decidedByMemberId,
+                    task: completedTask,
+                });
+            }
             if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED &&
                 shouldCompleteTask) {
                 // Ad-hoc gate: the token may only advance once every task bound to
@@ -592,6 +691,13 @@ let WorkflowEngineService = class WorkflowEngineService {
             const targetValue = buildAdhocTargetValue(target);
             // Rejects WEBHOOK targets — countersigners must be members.
             buildAdhocApproverResolver(targetValue);
+            // The countersign task is only created when a later user task is
+            // reached, against that node's own setting. This checks the target
+            // against the node being decided now, as an early rejection for the
+            // common case; it is not a guarantee about the node it attaches to.
+            if (isInitiatorExcluded(node)) {
+                await this.resolveAdhocTaskCandidates(manager, instance, node, '臨時會簽', targetValue);
+            }
             const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
             const directive = await directiveRepository.save(directiveRepository.create({
                 channels: null,
@@ -707,6 +813,9 @@ let WorkflowEngineService = class WorkflowEngineService {
         if (!isDirectAssignee && !actorCandidate) {
             throw new common_1.ConflictException(`Task ${task.id} is assigned to another member`);
         }
+        if (actorCandidate?.status === workflow_engine_enums_1.TaskCandidateStatusEnum.WAITING) {
+            throw new common_1.ConflictException(`Task ${task.id} is not this member's turn yet`);
+        }
         if (actorCandidate &&
             actorCandidate.status !== workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING &&
             actorCandidate.status !== workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED) {
@@ -771,11 +880,7 @@ let WorkflowEngineService = class WorkflowEngineService {
         const label = directive.type === adhoc_enums_1.AdhocDirectiveTypeEnum.COUNTERSIGN
             ? '臨時會簽'
             : '臨時加簽';
-        const resolvedCandidates = await this.resolveApproverResolver(manager, instance, buildAdhocApproverResolver(readAdhocTargetValue(directive)), `${label}「${node.data.label}」`);
-        const candidates = await this.applyDelegationToResolvedCandidates(instance, node.id, resolvedCandidates);
-        if (candidates.length === 0) {
-            throw new common_1.ConflictException(`${label}「${node.data.label}」 did not resolve to any member id`);
-        }
+        const candidates = await this.resolveAdhocTaskCandidates(manager, instance, node, label, readAdhocTargetValue(directive));
         const primaryCandidate = candidates[0];
         const task = await taskRepository.save(taskRepository.create({
             adhocDirectiveId: directive.id,
@@ -821,6 +926,8 @@ let WorkflowEngineService = class WorkflowEngineService {
             taskId: task.id,
         })));
         task.candidateMemberIds = savedCandidates.map((candidate) => candidate.memberId);
+        task.openCandidateMemberIds = task.candidateMemberIds;
+        task.nodeLabel = readWorkflowNodeLabel(instance.workflowSnapshot, node.id);
         await activityRepository.save(activityRepository.create({
             actorMemberId: directive.createdByMemberId,
             eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_CREATED,
@@ -852,6 +959,21 @@ let WorkflowEngineService = class WorkflowEngineService {
         }, Promise.resolve());
         return task;
     }
+    async resolveAdhocTaskCandidates(manager, instance, node, label, targetValue) {
+        const resolvedCandidates = await this.resolveApproverResolver(manager, instance, buildAdhocApproverResolver(targetValue), `${label}「${node.data.label}」`, '簽核人', isInitiatorExcluded(node) ? readInitiatorAndSubmitter(instance) : []);
+        // Ad-hoc approvers are picked by a person, not walked up a manager chain,
+        // so the chain's grade rule does not apply to them.
+        const delegatedCandidates = await this.delegateResolvedCandidates(manager, instance, node.id, resolvedCandidates, false);
+        const candidates = selectNodeCandidates(delegatedCandidates, isInitiatorExcluded(node), readInitiatorAndSubmitter(instance));
+        if (candidates.length > 0) {
+            return candidates;
+        }
+        throw new common_1.ConflictException(delegatedCandidates.length > 0
+            ? (0, instance_submitter_1.readDistinctSubmitterMemberId)(instance) === null
+                ? `${label}「${node.data.label}」 無法建立任務：指定對象只有申請人本人，此節點不允許申請人簽核。`
+                : `${label}「${node.data.label}」 無法建立任務：指定對象只有申請人或代為送出此單的人，此節點不允許申請人或代送人簽核。`
+            : `${label}「${node.data.label}」 did not resolve to any member id`);
+    }
     async spawnCountersignTasksForNode(manager, instance, token, node, now) {
         const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
         const directives = await directiveRepository.find({
@@ -915,9 +1037,18 @@ let WorkflowEngineService = class WorkflowEngineService {
         const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
         const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
         const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
-        const originTask = task.adhocOriginTaskId
+        const adhocOriginTask = task.adhocOriginTaskId
             ? await taskRepository.findOne({ where: { id: task.adhocOriginTaskId } })
             : null;
+        // transferTask re-points an open pre-approval when its origin is
+        // transferred, but a pre-approval whose origin was transferred by a release
+        // that did not do that yet still points at the TRANSFERRED row, and so does
+        // the pointer on `task` when a transfer commits after decideTask read it
+        // and before it took the instance lock. Following the transfer here hands
+        // the decision to whoever holds the stage now in both cases.
+        const originTask = adhocOriginTask
+            ? await this.readTransferSuccessorTask(manager, adhocOriginTask)
+            : null;
         const originTaskIsOpen = originTask?.status === workflow_engine_enums_1.TaskStatusEnum.PENDING ||
             originTask?.status === workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS;
         // Safety: when there is nobody to hand the decision back to (origin task
@@ -927,21 +1058,43 @@ let WorkflowEngineService = class WorkflowEngineService {
         if (!originTask || (!originTaskIsOpen && !originTask.assigneeMemberId)) {
             return false;
         }
+        const originCandidates = readDecisionPolicySnapshot(originTask).type === 'SEQUENTIAL'
+            ? await taskCandidateRepository.find({
+                where: { taskId: originTask.id },
+            })
+            : [];
+        const isSequentialOrigin = isOrderedSequentialTask(originTask, originCandidates);
         const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, task.nodeId);
         if (!originTaskIsOpen && originTask.assigneeMemberId) {
             // The origin approver already decided — reopen a fresh decision task so
-            // the stage can be re-decided after the rejected pre-approval.
+            // the stage can be re-decided after the rejected pre-approval. A
+            // SEQUENTIAL task's assignee rotates and ends on the last signer, so it
+            // goes back to whoever asked for the pre-approval instead.
+            const requesterCandidate = isSequentialOrigin
+                ? await this.readSequentialRequesterCandidate(manager, originTask, originCandidates, directive.createdByMemberId)
+                : undefined;
+            // A sequential origin always reopens for the requester, even when the
+            // successor of a transferred task has no row for them.
+            const reopenedAssigneeMemberId = isSequentialOrigin
+                ? directive.createdByMemberId
+                : originTask.assigneeMemberId;
+            const reopenedOriginalMemberId = isSequentialOrigin
+                ? (requesterCandidate?.originalMemberId ?? directive.createdByMemberId)
+                : originTask.originalAssigneeMemberId;
+            const reopenedDelegationChain = isSequentialOrigin
+                ? (requesterCandidate?.delegationChain ?? [])
+                : originTask.delegationChain;
             const reopenedTask = await taskRepository.save(taskRepository.create({
-                assigneeMemberId: originTask.assigneeMemberId,
+                assigneeMemberId: reopenedAssigneeMemberId,
                 assignmentType: workflow_engine_enums_1.TaskAssignmentTypeEnum.DIRECT_MEMBER,
                 completedAt: null,
                 createdAt: decidedAt,
                 decisionPolicySnapshot: { type: 'SINGLE' },
-                delegationChain: originTask.delegationChain,
+                delegationChain: reopenedDelegationChain,
                 instanceId: instance.id,
                 nodeId: originTask.nodeId,
                 openedAt: null,
-                originalAssigneeMemberId: originTask.originalAssigneeMemberId,
+                originalAssigneeMemberId: reopenedOriginalMemberId,
                 slaDueAt: null,
                 status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
                 tokenId: originTask.tokenId,
@@ -950,9 +1103,9 @@ let WorkflowEngineService = class WorkflowEngineService {
                 claimedAt: null,
                 createdAt: decidedAt,
                 decidedAt: null,
-                delegationChain: originTask.delegationChain,
-                memberId: originTask.assigneeMemberId,
-                originalMemberId: originTask.originalAssigneeMemberId ?? originTask.assigneeMemberId,
+                delegationChain: reopenedDelegationChain,
+                memberId: reopenedAssigneeMemberId,
+                originalMemberId: reopenedOriginalMemberId ?? reopenedAssigneeMemberId,
                 sourceType: 'DIRECT',
                 status: workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
                 taskId: reopenedTask.id,
@@ -964,7 +1117,7 @@ let WorkflowEngineService = class WorkflowEngineService {
                 nodeId: originTask.nodeId,
                 payload: {
                     adhocDirectiveId: directive.id,
-                    assigneeMemberId: originTask.assigneeMemberId,
+                    assigneeMemberId: reopenedAssigneeMemberId,
                     reopenedFromTaskId: originTask.id,
                     rejectedAdhocTaskId: task.id,
                     tokenId: originTask.tokenId,
@@ -980,7 +1133,14 @@ let WorkflowEngineService = class WorkflowEngineService {
                 });
             }
         }
-        const recipientMemberIds = await this.readOpenTaskRecipientMemberIds(manager, originTask);
+        // On a SEQUENTIAL task the requester has already signed and the task has
+        // moved on to the next signer, so they are told as well. On any other task
+        // the requester is the origin holder (or handed the stage away by a
+        // transfer) and only whoever holds the task now is told.
+        const recipientMemberIds = uniqueTexts([
+            ...(isSequentialOrigin ? [directive.createdByMemberId] : []),
+            ...(await this.readOpenTaskRecipientMemberIds(manager, originTask)),
+        ]);
         if (recipientMemberIds.length > 0) {
             await this.notificationService.createAdhocWorkflowNotifications({
                 channels: null,
@@ -1012,6 +1172,89 @@ let WorkflowEngineService = class WorkflowEngineService {
         }));
         return true;
     }
+    /**
+     * Follows a TRANSFERRED task to the task that replaced it, repeatedly, and
+     * returns the last one reached. A transfer leaves no pointer on either task
+     * row; the link is the `transferredFromTaskId` in the payload of the
+     * TASK_CREATED activity written for the replacement. When the trail stops
+     * (no such activity, or its task is gone) the last task reached is returned,
+     * so a caller sees the transferred row exactly as it did before.
+     */
+    async readTransferSuccessorTask(manager, task) {
+        if (task.status !== workflow_engine_enums_1.TaskStatusEnum.TRANSFERRED) {
+            return task;
+        }
+        const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
+        const taskCreatedActivities = await manager
+            .getRepository(activity_log_entity_1.ActivityLogEntity)
+            .find({
+            where: {
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_CREATED,
+                instanceId: task.instanceId,
+                nodeId: task.nodeId,
+            },
+        });
+        const successorTaskIdByTransferredTaskId = new Map(taskCreatedActivities.flatMap((activity) => {
+            const transferredFromTaskId = activity.payload['transferredFromTaskId'];
+            return typeof transferredFromTaskId === 'string' && activity.taskId
+                ? [[transferredFromTaskId, activity.taskId]]
+                : [];
+        }));
+        const followTransfer = async (currentTask, visitedTaskIds) => {
+            const successorTaskId = currentTask.status === workflow_engine_enums_1.TaskStatusEnum.TRANSFERRED
+                ? successorTaskIdByTransferredTaskId.get(currentTask.id)
+                : undefined;
+            if (!successorTaskId || visitedTaskIds.has(successorTaskId)) {
+                return currentTask;
+            }
+            const successorTask = await taskRepository.findOne({
+                where: { id: successorTaskId },
+            });
+            return successorTask
+                ? followTransfer(successorTask, new Set([...visitedTaskIds, successorTaskId]))
+                : currentTask;
+        };
+        return followTransfer(task, new Set([task.id]));
+    }
+    /**
+     * The requester's candidate row on a SEQUENTIAL origin task. A task that was
+     * transferred mid-order continues as a replacement that carries only the
+     * candidates still to sign, so a requester who already signed is found on an
+     * earlier task of the transfer chain instead.
+     */
+    async readSequentialRequesterCandidate(manager, originTask, originCandidates, requesterMemberId) {
+        const ownCandidate = originCandidates.find((candidate) => candidate.memberId === requesterMemberId);
+        if (ownCandidate) {
+            return ownCandidate;
+        }
+        const taskCreatedActivities = await manager
+            .getRepository(activity_log_entity_1.ActivityLogEntity)
+            .find({
+            where: {
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_CREATED,
+                instanceId: originTask.instanceId,
+                nodeId: originTask.nodeId,
+            },
+        });
+        const transferredFromTaskIdByTaskId = new Map(taskCreatedActivities.flatMap((activity) => {
+            const transferredFromTaskId = activity.payload['transferredFromTaskId'];
+            return typeof transferredFromTaskId === 'string' && activity.taskId
+                ? [[activity.taskId, transferredFromTaskId]]
+                : [];
+        }));
+        const searchEarlierTasks = async (currentTaskId, visitedTaskIds) => {
+            const earlierTaskId = transferredFromTaskIdByTaskId.get(currentTaskId);
+            if (!earlierTaskId || visitedTaskIds.has(earlierTaskId)) {
+                return undefined;
+            }
+            const earlierCandidate = (await manager
+                .getRepository(task_candidate_entity_1.TaskCandidateEntity)
+                .find({ where: { taskId: earlierTaskId } })).find((candidate) => candidate.memberId === requesterMemberId);
+            return (earlierCandidate ??
+                searchEarlierTasks(earlierTaskId, new Set([...visitedTaskIds, earlierTaskId])));
+        };
+        return searchEarlierTasks(originTask.id, new Set([originTask.id]));
+    }
     async readOpenTaskRecipientMemberIds(manager, task) {
         if (task.assigneeMemberId) {
             return [task.assigneeMemberId];
@@ -1116,7 +1359,7 @@ let WorkflowEngineService = class WorkflowEngineService {
             return;
         }
         try {
-            const recipients = await this.resolveApproverResolver(manager, instance, buildAdhocApproverResolver(targetValue), '臨時通知對象');
+            const recipients = await this.resolveApproverResolver(manager, instance, buildAdhocApproverResolver(targetValue), '臨時通知對象', '通知對象');
             await this.notificationService.createAdhocWorkflowNotifications({
                 channels: directive.channels,
                 instance,
@@ -1229,16 +1472,28 @@ let WorkflowEngineService = class WorkflowEngineService {
         }
         const nextVisitedNodeIds = new Set([...input.visitedNodeIds, visitKey]);
         const entryConditionMet = this.conditionService.evaluateBoolean(entryCondition, buildDryRunExpressionContext(input, input.lastDecision), `workflow.nodes.${node.id}.data.entryCondition`);
-        const assigneeMemberId = entryConditionMet && node.type === 'userTask'
-            ? this.resolveDryRunAssigneeMemberId(input, node.data.approverResolver, `workflow.nodes.${node.id}.data.approverResolver`)
+        const assignment = entryConditionMet && node.type === 'userTask'
+            ? this.resolveDryRunAssignment(input, node)
             : null;
-        const nextLastDecision = entryConditionMet && node.type === 'userTask'
+        const assigneeMemberId = assignment?.assigneeMemberId ?? null;
+        const skippedByExclusion = assignment?.outcome === 'SKIPPED';
+        const stoppedByAssignment = assignment?.outcome === 'STOPPED';
+        const nextLastDecision = entryConditionMet && node.type === 'userTask' && !skippedByExclusion
             ? {
                 action: workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED,
                 assigneeMemberId,
                 nodeId: node.id,
             }
             : input.lastDecision;
+        // A node that stops on its assignment, an asynchronous NOTIFY node (at
+        // runtime it consumes its token and never advances) and an end event do
+        // not route any further.
+        const routes = !stoppedByAssignment &&
+            !(0, workflow_graph_1.isAsyncNotifyServiceTask)(node) &&
+            node.type !== 'endEvent';
+        const outgoing = routes
+            ? this.readDryRunOutgoing(input, node, nextLastDecision, entryConditionMet && !skippedByExclusion)
+            : { edges: [], stopMessage: null };
         const nextSteps = [
             ...input.steps,
             createDryRunStep({
@@ -1248,34 +1503,16 @@ let WorkflowEngineService = class WorkflowEngineService {
                 edgeReason: readDryRunEdgeReason(input.incomingEdge),
                 entryCondition,
                 entryConditionMet,
-                message: readDryRunStepMessage(node, entryConditionMet),
+                message: readDryRunStepResultMessage(assignment?.message ?? null, outgoing.stopMessage, readDryRunStepMessage(node, entryConditionMet), !entryConditionMet || skippedByExclusion),
                 node,
-                status: readDryRunStepStatus(node, entryConditionMet),
+                status: outgoing.stopMessage === null
+                    ? (assignment?.outcome ??
+                        readDryRunStepStatus(node, entryConditionMet))
+                    : 'STOPPED',
                 stepIndex: input.steps.length,
             }),
         ];
-        // A NOTIFY node is an asynchronous branch: at runtime it consumes its
-        // token and never advances, so its branch ends here rather than failing
-        // for want of an outgoing edge it is not allowed to have.
-        if ((0, workflow_graph_1.isAsyncNotifyServiceTask)(node)) {
-            return nextSteps;
-        }
-        if (!entryConditionMet || node.type === 'endEvent') {
-            if (node.type === 'endEvent') {
-                return nextSteps;
-            }
-            return readOutgoingEdgesOrThrow(input.workflowDefinition, node.id).reduce((steps, edge) => this.simulateWorkflowPath({
-                ...input,
-                depth: input.depth + 1,
-                incomingEdge: edge,
-                lastDecision: nextLastDecision,
-                nodeId: edge.target,
-                steps,
-                visitedNodeIds: nextVisitedNodeIds,
-            }), nextSteps);
-        }
-        const outgoingEdges = this.readDryRunAvailableOutgoingEdges(input, node, nextLastDecision);
-        return outgoingEdges.reduce((steps, edge) => this.simulateWorkflowPath({
+        return outgoing.edges.reduce((steps, edge) => this.simulateWorkflowPath({
             ...input,
             depth: input.depth + 1,
             incomingEdge: edge,
@@ -1285,28 +1522,45 @@ let WorkflowEngineService = class WorkflowEngineService {
             visitedNodeIds: nextVisitedNodeIds,
         }), nextSteps);
     }
-    readDryRunAvailableOutgoingEdges(input, node, lastDecision) {
-        if (node.type === 'endEvent') {
-            return [];
+    /**
+     * The edges a dry-run step continues along. A node a designer has left
+     * unfinished (nothing drawn out of it, or no branch of a gateway taken) ends
+     * its branch with a readable message instead of failing the whole dry run.
+     */
+    readDryRunOutgoing(input, node, lastDecision, evaluatesConditions) {
+        const nodeName = readDryRunNodeName(node);
+        const outgoingEdges = input.workflowDefinition.edges.filter((edge) => edge.source === node.id);
+        if (outgoingEdges.length === 0) {
+            return {
+                edges: [],
+                stopMessage: `節點「${nodeName}」沒有連到下一個節點，請在流程設計器為此節點接上連線`,
+            };
+        }
+        if (!evaluatesConditions) {
+            return { edges: outgoingEdges, stopMessage: null };
         }
-        const outgoingEdges = readOutgoingEdgesOrThrow(input.workflowDefinition, node.id);
         const conditionalEdges = outgoingEdges.filter((edge) => !edge.data.isDefault && edgeHasCondition(edge));
         if (conditionalEdges.length === 0) {
-            return outgoingEdges;
+            return { edges: outgoingEdges, stopMessage: null };
         }
         const matchingEdges = conditionalEdges.filter((edge) => this.evaluateDryRunEdge(input, edge, lastDecision));
         if (matchingEdges.length > 0) {
-            return node.type === 'exclusiveGateway'
-                ? [matchingEdges[0]]
-                : matchingEdges;
+            return {
+                edges: node.type === 'exclusiveGateway' ? [matchingEdges[0]] : matchingEdges,
+                stopMessage: null,
+            };
         }
         const defaultEdges = outgoingEdges.filter((edge) => edge.data.isDefault);
         if (defaultEdges.length > 0) {
-            return node.type === 'exclusiveGateway'
-                ? [defaultEdges[0]]
-                : defaultEdges;
+            return {
+                edges: node.type === 'exclusiveGateway' ? [defaultEdges[0]] : defaultEdges,
+                stopMessage: null,
+            };
         }
-        throw new common_1.ConflictException(`Workflow node ${node.id} has no matching outgoing edge`);
+        return {
+            edges: [],
+            stopMessage: `節點「${nodeName}」的連出線條件都不符合，且沒有設定預設路徑，請檢查連出線的條件或補上預設路徑`,
+        };
     }
     evaluateDryRunEdge(input, edge, lastDecision) {
         const expression = edge.data.condition?.trim();
@@ -1315,29 +1569,101 @@ let WorkflowEngineService = class WorkflowEngineService {
         }
         return (0, workflow_condition_evaluator_1.evaluateWorkflowEdgeCondition)(edge, { formData: input.formData });
     }
-    resolveDryRunAssigneeMemberId(input, resolver, label) {
-        if (resolver.type === 'DIRECT') {
-            return readMemberIdFromValue(resolver.memberIds, label);
+    /**
+     * The dry-run assignee of a user task. Only resolvers whose dry run yields
+     * real member ids (DIRECT, DYNAMIC_FORM, EXPRESSION and ORG_MANAGER, which
+     * reads the initiator snapshot) can be checked against the initiator; the
+     * others resolve to placeholders and are left as they are.
+     */
+    resolveDryRunAssignment(input, node) {
+        const resolver = node.data.approverResolver;
+        const excludeInitiator = node.data.excludeInitiator;
+        const memberIds = this.readDryRunMemberIds(input, resolver, `workflow.nodes.${node.id}.data.approverResolver`);
+        if (memberIds === null) {
+            return {
+                assigneeMemberId: readDryRunPlaceholderAssignee(resolver),
+                message: null,
+                outcome: null,
+            };
         }
-        if (resolver.type === 'DYNAMIC_FORM') {
-            return readMemberIdFromValue(readValueAtPath(input.formData, resolver.formPath), `${label}.formPath`);
+        // Nobody to ask yet — typically a node whose approver has not been chosen.
+        // The branch ends here and says which node needs attention, rather than
+        // failing the whole dry run.
+        if (memberIds.length === 0) {
+            return {
+                assigneeMemberId: null,
+                message: readDryRunUnresolvedApproverMessage(resolver, readDryRunNodeName(node), input.initiatorMemberId),
+                outcome: 'STOPPED',
+            };
         }
-        if (resolver.type === 'EXPRESSION') {
-            return readMemberIdFromValue(this.conditionService.evaluateValue(resolver.expression, buildDryRunExpressionContext(input, null), `${label}.expression`), `${label}.expression`);
+        if (!excludeInitiator || !memberIds.includes(input.initiatorMemberId)) {
+            return {
+                assigneeMemberId: memberIds[0],
+                message: null,
+                outcome: null,
+            };
         }
-        if (resolver.type === 'POSITION') {
-            return `position:${resolver.positionId}`;
+        const remainingMemberId = memberIds.find((memberId) => memberId !== input.initiatorMemberId);
+        if (remainingMemberId !== undefined) {
+            return {
+                assigneeMemberId: remainingMemberId,
+                message: null,
+                outcome: null,
+            };
         }
-        if (resolver.type === 'ORG_UNIT_MEMBER') {
-            return `orgUnitMember:${resolver.orgUnitId}`;
+        if (excludeInitiator.whenEmpty === 'SKIP_NODE') {
+            return {
+                assigneeMemberId: null,
+                message: '簽核人只有申請人本人，依設定略過節點。',
+                outcome: 'SKIPPED',
+            };
         }
-        if (resolver.type === 'ORG_UNIT_POSITION') {
-            return `orgUnitPosition:${resolver.orgUnitId}:${resolver.positionId}`;
+        // Level 1 is the initiator when they head their unit; like the runtime,
+        // fall through to the next level of the snapshot's manager chain.
+        const managerMemberId = excludeInitiator.whenEmpty === 'INITIATOR_MANAGER'
+            ? [1, 2]
+                .map((levelsUp) => readManagerMemberIdFromInitiatorSnapshot(input.initiatorMetadataSnapshot, levelsUp))
+                .find((memberId) => typeof memberId === 'string' &&
+                memberId.trim() !== '' &&
+                memberId.trim() !== input.initiatorMemberId)
+            : undefined;
+        if (managerMemberId !== undefined) {
+            return {
+                assigneeMemberId: managerMemberId.trim(),
+                message: null,
+                outcome: null,
+            };
         }
-        if (resolver.type === 'ORG_UNIT_MANAGER') {
-            return `orgUnitManager:${resolver.orgUnitId}`;
+        return {
+            assigneeMemberId: null,
+            message: excludeInitiator.whenEmpty === 'INITIATOR_MANAGER'
+                ? '簽核人只有申請人本人，此節點不允許申請人自簽，且找不到申請人的主管可改派。'
+                : '簽核人只有申請人本人，此節點不允許申請人自簽。',
+            outcome: 'STOPPED',
+        };
+    }
+    /**
+     * The member ids a dry run resolves for a user task: an empty list when the
+     * resolver names nobody, `null` for resolvers that only resolve to a
+     * placeholder in a dry run.
+     */
+    readDryRunMemberIds(input, resolver, label) {
+        if (resolver.type === 'DIRECT') {
+            return findMemberIdsInValue(resolver.memberIds);
         }
-        return readMemberIdFromValue(readManagerMemberIdFromInitiatorSnapshot(input.initiatorMetadataSnapshot, resolver.levelsUp), label);
+        if (resolver.type === 'DYNAMIC_FORM') {
+            return findMemberIdsInValue(readValueAtPath(input.formData, resolver.formPath));
+        }
+        if (resolver.type === 'EXPRESSION') {
+            return findMemberIdsInValue(this.conditionService.evaluateValue(resolver.expression, buildDryRunExpressionContext(input, null), `${label}.expression`));
+        }
+        if (resolver.type === 'ORG_MANAGER') {
+            const managerMemberIds = findMemberIdsInValue(readManagerMemberIdFromInitiatorSnapshot(input.initiatorMetadataSnapshot, resolver.levelsUp));
+            return managerMemberIds.length > 0
+                ? managerMemberIds
+                : readDryRunFallbackMemberIds(input, resolver.fallback);
+        }
+        return null;
     }
     async getApprovalInstance(id, scope) {
         const instance = await this.approvalInstanceRepository.findOne({
@@ -1410,7 +1736,11 @@ let WorkflowEngineService = class WorkflowEngineService {
         }
         const view = options.view ?? workflow_engine_enums_1.ApprovalInstanceListViewEnum.ALL;
         if (view === workflow_engine_enums_1.ApprovalInstanceListViewEnum.SENT) {
-            queryBuilder.andWhere('"approvalInstance"."initiator_member_id" = :readableMemberId', {
+            // The assistant who filed on someone's behalf finds it here too.
+            queryBuilder.andWhere(`(
+          "approvalInstance"."initiator_member_id" = :readableMemberId
+          OR "approvalInstance"."submitted_by_member_id" = :readableMemberId
+        )`, {
                 readableMemberId: scope.memberId,
             });
             return true;
@@ -1434,6 +1764,7 @@ let WorkflowEngineService = class WorkflowEngineService {
         queryBuilder.andWhere(`
         (
           "approvalInstance"."initiator_member_id" = :readableMemberId
+          OR "approvalInstance"."submitted_by_member_id" = :readableMemberId
           OR EXISTS (
             SELECT 1
             FROM "tasks" "readableTask"
@@ -1627,7 +1958,11 @@ let WorkflowEngineService = class WorkflowEngineService {
     async listTaskCandidates(taskId, scope) {
         await this.assertTaskReadable(taskId, scope);
         return this.taskCandidateRepository.find({
-            order: { createdAt: 'ASC', id: 'ASC' },
+            order: {
+                sequence: { direction: 'ASC', nulls: 'LAST' },
+                createdAt: 'ASC',
+                id: 'ASC',
+            },
             where: { taskId },
         });
     }
@@ -1636,7 +1971,11 @@ let WorkflowEngineService = class WorkflowEngineService {
             return tasks;
         }
         const candidates = await this.taskCandidateRepository.find({
-            order: { createdAt: 'ASC', id: 'ASC' },
+            order: {
+                sequence: { direction: 'ASC', nulls: 'LAST' },
+                createdAt: 'ASC',
+                id: 'ASC',
+            },
             where: { taskId: (0, typeorm_2.In)(tasks.map((task) => task.id)) },
         });
         const candidatesByTaskId = candidates.reduce((currentMap, candidate) => {
@@ -1645,12 +1984,65 @@ let WorkflowEngineService = class WorkflowEngineService {
             nextMap.set(candidate.taskId, [...memberIds, candidate.memberId]);
             return nextMap;
         }, new Map());
+        const openCandidatesByTaskId = candidates
+            .filter((candidate) => candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING ||
+            candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED)
+            .reduce((currentMap, candidate) => {
+            const nextMap = new Map(currentMap);
+            nextMap.set(candidate.taskId, [
+                ...(nextMap.get(candidate.taskId) ?? []),
+                candidate.memberId,
+            ]);
+            return nextMap;
+        }, new Map());
+        const nodeLabels = await this.readTaskNodeLabels(tasks);
         return tasks.map((task) => Object.assign(new task_entity_1.TaskEntity(), task, {
             candidateMemberIds: candidatesByTaskId.get(task.id) ?? [],
+            nodeLabel: nodeLabels.get(readNodeLabelKey(task.instanceId, task.nodeId)) ??
+                null,
+            openCandidateMemberIds: openCandidatesByTaskId.get(task.id) ?? [],
         }));
     }
+    /**
+     * The display names of the nodes a page of tasks sits on, keyed by
+     * {@link readNodeLabelKey}. One query for the whole page, and Postgres picks
+     * the labels out of the snapshots: a workflow snapshot is a whole workflow
+     * definition, and every inbox, history and instance task list runs this, so
+     * shipping the snapshots to the app just to read one string each would cost
+     * page size × snapshot size on every refresh. A missing instance or node, a
+     * snapshot without a `nodes` array, and a blank or non-string label all
+     * leave the task without a label, as `readWorkflowNodeLabel` does.
+     */
+    async readTaskNodeLabels(tasks) {
+        // The table as the entity reads it, so a configured `schema` is honoured
+        // here exactly as it is by every repository read of the instance.
+        const { metadata } = this.approvalInstanceRepository;
+        const { driver } = this.approvalInstanceRepository.manager.connection;
+        const instanceTable = [metadata.schema, metadata.tableName]
+            .filter((part) => Boolean(part))
+            .map((part) => driver.escape(part))
+            .join('.');
+        const rows = await this.approvalInstanceRepository.query(`SELECT instance.id AS "instanceId",
+              node->>'id' AS "nodeId",
+              CASE WHEN jsonb_typeof(node->'data'->'label') = 'string'
+                   THEN node->'data'->>'label' END AS "label"
+         FROM ${instanceTable} AS instance
+        CROSS JOIN LATERAL jsonb_array_elements(
+              CASE WHEN jsonb_typeof(instance.workflow_snapshot->'nodes') = 'array'
+                   THEN instance.workflow_snapshot->'nodes'
+                   ELSE '[]'::jsonb END
+            ) AS node
+        WHERE instance.id = ANY($1::uuid[])
+          AND node->>'id' = ANY($2::text[])`, [
+            [...new Set(tasks.map((task) => task.instanceId))],
+            [...new Set(tasks.map((task) => task.nodeId))],
+        ]);
+        return new Map(rows.flatMap((row) => typeof row.label === 'string' && row.label.trim()
+            ? [[readNodeLabelKey(row.instanceId, row.nodeId), row.label]]
+            : []));
+    }
     async readDefaultInitiatorMetadataSnapshot(memberId) {
-        const today = toDateOnlyString(new Date());
+        const today = this.readOrganizationToday();
         const memberships = (await this.approvalInstanceRepository.manager
             .getRepository(membership_entity_1.MembershipEntity)
             .find({ where: { memberId } }))
@@ -1685,7 +2077,10 @@ let WorkflowEngineService = class WorkflowEngineService {
         return task;
     }
     async isApprovalInstanceReadableByMember(instance, memberId) {
-        if (instance.initiatorMemberId === memberId) {
+        // The member who filed the document on the applicant's behalf can read it
+        // back; resubmit and cancel stay with the initiator.
+        if (instance.initiatorMemberId === memberId ||
+            (0, instance_submitter_1.readDistinctSubmitterMemberId)(instance) === memberId) {
             return true;
         }
         const tasks = await this.taskRepository.find({
@@ -1882,19 +2277,47 @@ let WorkflowEngineService = class WorkflowEngineService {
         return this.conditionService.evaluateBoolean(entryCondition, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.entryCondition`);
     }
     async skipNodeByEntryCondition(manager, instance, token, node) {
+        await this.skipNode(manager, instance, token, node, {
+            skippedByEntryCondition: true,
+        });
+    }
+    async skipNodeByInitiatorExclusion(manager, instance, token, node) {
+        await this.skipNode(manager, instance, token, node, {
+            skippedByInitiatorExclusion: true,
+        });
+    }
+    async skipNode(manager, instance, token, node, reason) {
+        // A NOTIFY node is an asynchronous branch that may not have an outgoing
+        // edge, so a skipped one ends its branch exactly as an executed one does:
+        // the token is consumed instead of advanced (advancing would throw "has no
+        // outgoing edge" and fail the whole submission). Instance completion is
+        // evaluated by `processRunningInstance` once no ACTIVE token remains.
+        const consumesToken = (0, workflow_graph_1.isAsyncNotifyServiceTask)(node);
         await manager.getRepository(activity_log_entity_1.ActivityLogEntity).save(manager.getRepository(activity_log_entity_1.ActivityLogEntity).create({
             actorMemberId: null,
             eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
             instanceId: instance.id,
             nodeId: node.id,
             payload: {
-                skippedByEntryCondition: true,
+                ...reason,
+                ...(consumesToken ? { consumed: true } : {}),
                 tokenId: token.id,
             },
             taskId: null,
         }));
+        if (consumesToken) {
+            await this.consumeToken(manager, token);
+            return;
+        }
         await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
     }
+    async consumeToken(manager, token) {
+        await manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity).save({
+            ...token,
+            consumedAt: new Date(),
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.CONSUMED,
+        });
+    }
     async readAvailableOutgoingEdges(manager, instance, node) {
         const outgoingEdges = readOutgoingEdgesOrThrow(instance.workflowSnapshot, node.id);
         const conditionalEdges = outgoingEdges.filter((edge) => !edge.data.isDefault && edgeHasCondition(edge));
@@ -2086,43 +2509,66 @@ let WorkflowEngineService = class WorkflowEngineService {
             });
             return;
         }
-        const candidates = await this.resolveRuntimeTaskCandidates(manager, instance, node);
+        const resolvedCandidates = await this.resolveRuntimeTaskCandidates(manager, instance, node);
+        // The initiator was the only approver and the node asks to be skipped in
+        // that case: no task, the token moves on. Pending countersign directives
+        // stay pending for the next user task that actually gets created.
+        if (resolvedCandidates === null) {
+            await this.skipNodeByInitiatorExclusion(manager, instance, token, node);
+            return;
+        }
+        const { candidates, skippedDelegations } = resolvedCandidates;
         const primaryCandidate = candidates[0];
+        // Legacy snapshots may carry no policy at all; they behave as before.
+        const decisionPolicy = node.data.decisionPolicy;
+        const isSequential = decisionPolicy?.type === 'SEQUENTIAL' && candidates.length > 1;
+        // A sequential task is held by exactly one candidate at a time, so it
+        // carries that candidate as its assignee from the start.
+        const assignedCandidate = candidates.length === 1 || isSequential ? primaryCandidate : null;
         const now = new Date();
         const slaDueAt = await this.slaScheduleService.resolveTaskSlaDueAt({
             node,
             now,
         });
         const task = await taskRepository.save(taskRepository.create({
-            assigneeMemberId: candidates.length === 1 ? primaryCandidate.memberId : null,
+            assigneeMemberId: assignedCandidate?.memberId ?? null,
             assignmentType: candidates.length === 1
                 ? workflow_engine_enums_1.TaskAssignmentTypeEnum.DIRECT_MEMBER
                 : workflow_engine_enums_1.TaskAssignmentTypeEnum.CANDIDATE_GROUP,
             completedAt: null,
             createdAt: now,
-            decisionPolicySnapshot: node.data.decisionPolicy,
-            delegationChain: candidates.length === 1 ? primaryCandidate.delegationChain : [],
+            decisionPolicySnapshot: isInitiatorExcluded(node)
+                ? capDecisionPolicyToCandidateCount(decisionPolicy, candidates.length)
+                : decisionPolicy,
+            delegationChain: assignedCandidate?.delegationChain ?? [],
             instanceId: instance.id,
             nodeId: node.id,
             openedAt: null,
-            originalAssigneeMemberId: candidates.length === 1 ? primaryCandidate.originalMemberId : null,
+            originalAssigneeMemberId: assignedCandidate?.originalMemberId ?? null,
             slaDueAt,
             status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
             tokenId: token.id,
         }));
-        const savedCandidates = await taskCandidateRepository.save(candidates.map((candidate) => taskCandidateRepository.create({
+        const savedCandidates = await taskCandidateRepository.save(candidates.map((candidate, index) => taskCandidateRepository.create({
             claimedAt: null,
             createdAt: now,
             decidedAt: null,
             delegationChain: candidate.delegationChain,
             memberId: candidate.memberId,
             originalMemberId: candidate.originalMemberId,
+            sequence: isSequential ? index : null,
             sourceType: candidate.sourceType,
-            status: workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
+            status: isSequential && index > 0
+                ? workflow_engine_enums_1.TaskCandidateStatusEnum.WAITING
+                : workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
             taskId: task.id,
         })));
+        // Display summary of everyone on the task, including the ones whose turn
+        // has not come; who may act now is `status`, not membership of this list.
         task.candidateMemberIds = savedCandidates.map((candidate) => candidate.memberId);
         const singleCandidate = savedCandidates.length === 1 ? savedCandidates[0] : null;
+        const openCandidates = savedCandidates.filter((candidate) => candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING);
+        task.openCandidateMemberIds = openCandidates.map((candidate) => candidate.memberId);
         await tokenRepository.save({
             ...token,
             status: workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING,
@@ -2134,14 +2580,22 @@ let WorkflowEngineService = class WorkflowEngineService {
             nodeId: node.id,
             payload: {
                 assignmentType: task.assignmentType,
-                assigneeMemberId: singleCandidate?.memberId ?? null,
-                candidateMemberIds: savedCandidates.map((candidate) => candidate.memberId),
-                originalAssigneeMemberId: singleCandidate?.originalMemberId ?? null,
+                assigneeMemberId: (isSequential ? openCandidates[0] : singleCandidate)?.memberId ??
+                    null,
+                candidateMemberIds: openCandidates.map((candidate) => candidate.memberId),
+                originalAssigneeMemberId: (isSequential ? openCandidates[0] : singleCandidate)
+                    ?.originalMemberId ?? null,
+                ...(isSequential
+                    ? {
+                        sequentialCandidateMemberIds: savedCandidates.map((candidate) => candidate.memberId),
+                    }
+                    : {}),
+                ...(skippedDelegations.length > 0 ? { skippedDelegations } : {}),
                 tokenId: token.id,
             },
             taskId: task.id,
         }));
-        await savedCandidates.reduce(async (previous, candidate) => {
+        await openCandidates.reduce(async (previous, candidate) => {
             await previous;
             await this.notificationService.createTaskAssignedNotification({
                 instance,
@@ -2158,6 +2612,118 @@ let WorkflowEngineService = class WorkflowEngineService {
         // created after they were requested — spawn their parallel tasks now.
         await this.spawnCountersignTasksForNode(manager, instance, token, node, now);
     }
+    /**
+     * Hands a SEQUENTIAL task to the lowest-`sequence` candidate still WAITING.
+     * A task without a WAITING candidate (every other policy, and SEQUENTIAL
+     * tasks created before candidates were ordered) is left alone.
+     */
+    async activateNextSequentialCandidate({ candidates, instance, manager, node, previousMemberId, task, }) {
+        if (readDecisionPolicySnapshot(task).type !== 'SEQUENTIAL') {
+            return;
+        }
+        const nextCandidate = [...candidates]
+            .filter((candidate) => candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.WAITING &&
+            candidate.sequence !== null)
+            .sort((left, right) => (left.sequence ?? 0) - (right.sequence ?? 0))[0];
+        if (!nextCandidate) {
+            return;
+        }
+        const now = new Date();
+        // Delegation was resolved when the task was created; the candidate may have
+        // gained a delegate while waiting, so resolve it again for the new turn.
+        const { skippedDelegation, ...delegation } = await this.resolveActivationDelegation({
+            candidate: nextCandidate,
+            candidates,
+            excludesInitiator: isInitiatorExcluded(node),
+            gradeGated: isGradeGatedCandidate(node, nextCandidate.sourceType),
+            instance,
+            manager,
+            nodeId: task.nodeId,
+        });
+        const activatedCandidate = await manager
+            .getRepository(task_candidate_entity_1.TaskCandidateEntity)
+            .save(Object.assign(new task_candidate_entity_1.TaskCandidateEntity(), nextCandidate, delegation, {
+            status: workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
+        }));
+        const activatedTask = await manager.getRepository(task_entity_1.TaskEntity).save({
+            ...task,
+            assigneeMemberId: activatedCandidate.memberId,
+            delegationChain: activatedCandidate.delegationChain,
+            openedAt: null,
+            originalAssigneeMemberId: activatedCandidate.originalMemberId,
+            // The new holder gets the node's full SLA window, not what is left of
+            // the previous holder's; the warning is measured from this moment.
+            slaDueAt: await this.slaScheduleService.resolveTaskSlaDueAt({
+                node,
+                now,
+            }),
+            slaStartedAt: now,
+            status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
+        });
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        await activityRepository.save(activityRepository.create({
+            actorMemberId: null,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_CANDIDATE_ACTIVATED,
+            instanceId: instance.id,
+            nodeId: task.nodeId,
+            // Carries the same recipient fields as TASK_CREATED so a consumer can
+            // route this event exactly like a task assignment.
+            payload: {
+                assigneeMemberId: activatedCandidate.memberId,
+                assignmentType: activatedTask.assignmentType,
+                candidateMemberId: activatedCandidate.memberId,
+                candidateMemberIds: [activatedCandidate.memberId],
+                originalAssigneeMemberId: activatedCandidate.originalMemberId,
+                originalMemberId: activatedCandidate.originalMemberId,
+                previousMemberId,
+                sequence: activatedCandidate.sequence,
+                ...(skippedDelegation
+                    ? { skippedDelegations: [skippedDelegation] }
+                    : {}),
+                tokenId: task.tokenId,
+            },
+            taskId: task.id,
+        }));
+        await this.notificationService.createTaskAssignedNotification({
+            instance,
+            manager,
+            node,
+            task: activatedTask,
+        });
+    }
+    /**
+     * Re-resolves the delegation of a candidate whose turn has come. When the
+     * delegate already holds another candidate row on the task, the stored values
+     * are kept: (task_id, member_id) is unique, and that member signs from the
+     * row they already have. On a node that excludes the initiator the stored
+     * values are kept as well when the new delegation path would run through the
+     * initiator or the submitter: creation already filtered such paths out, and a
+     * delegation added while the candidate waited must not bring them back.
+     */
+    async resolveActivationDelegation({ candidate, candidates, excludesInitiator, gradeGated, instance, manager, nodeId, }) {
+        const stored = {
+            delegationChain: candidate.delegationChain,
+            memberId: candidate.memberId,
+        };
+        const { skippedDelegation, ...resolution } = await this.resolveDelegation(manager, candidate.originalMemberId, this.buildDelegationContext(instance, nodeId), gradeGated);
+        const collides = candidates.some((other) => other.id !== candidate.id &&
+            other.memberId === resolution.finalAssigneeMemberId);
+        if (collides ||
+            (excludesInitiator &&
+                isExcludedMemberOnCandidatePath({
+                    delegationChain: resolution.delegationChain,
+                    memberId: resolution.finalAssigneeMemberId,
+                    originalMemberId: candidate.originalMemberId,
+                }, readInitiatorAndSubmitter(instance)))) {
+            // The refusal happened even though the stored values are kept.
+            return { ...stored, ...(skippedDelegation ? { skippedDelegation } : {}) };
+        }
+        return {
+            delegationChain: resolution.delegationChain,
+            memberId: resolution.finalAssigneeMemberId,
+            ...(skippedDelegation ? { skippedDelegation } : {}),
+        };
+    }
     async markTaskCandidateDecision({ action, candidate, candidates, decidedAt, manager, task, }) {
         const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
         if (!candidate && candidates.length === 0 && task.assigneeMemberId) {
@@ -2191,7 +2757,8 @@ let WorkflowEngineService = class WorkflowEngineService {
             }
             if (shouldCancelOpenCandidates &&
                 (currentCandidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING ||
-                    currentCandidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED)) {
+                    currentCandidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED ||
+                    currentCandidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.WAITING)) {
                 return Object.assign(new task_candidate_entity_1.TaskCandidateEntity(), currentCandidate, {
                     decidedAt,
                     status: workflow_engine_enums_1.TaskCandidateStatusEnum.CANCELLED,
@@ -2230,6 +2797,18 @@ let WorkflowEngineService = class WorkflowEngineService {
             delegationChain: nextDelegationChain,
             status: workflow_engine_enums_1.TaskStatusEnum.TRANSFERRED,
         });
+        // Candidates still waiting for their turn move with the task; without this
+        // the replacement SINGLE task would silently drop them from the chain.
+        // A waiting candidate who is also the transfer target takes the active slot
+        // and is not asked a second time later in the order.
+        const waitingCandidates = readDecisionPolicySnapshot(task).type === 'SEQUENTIAL' &&
+            actorCandidate?.sequence != null
+            ? (await taskCandidateRepository.find({ where: { taskId: task.id } }))
+                .filter((candidate) => candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.WAITING)
+                .sort((left, right) => (left.sequence ?? 0) - (right.sequence ?? 0))
+            : [];
+        const isSequentialTransfer = waitingCandidates.length > 0;
+        const carriedCandidates = waitingCandidates.filter((candidate) => candidate.memberId !== transferToMemberId);
         const nextTask = await taskRepository.save(taskRepository.create({
             // A transferred ad-hoc task stays the same ad-hoc task for its new
             // holder: the pre-approval rejection path (RETURN_TO_ORIGIN) reads these
@@ -2239,9 +2818,13 @@ let WorkflowEngineService = class WorkflowEngineService {
             adhocOriginTaskId: task.adhocOriginTaskId,
             adhocType: task.adhocType,
             assigneeMemberId: transferToMemberId,
-            assignmentType: workflow_engine_enums_1.TaskAssignmentTypeEnum.DIRECT_MEMBER,
+            assignmentType: isSequentialTransfer
+                ? task.assignmentType
+                : workflow_engine_enums_1.TaskAssignmentTypeEnum.DIRECT_MEMBER,
             completedAt: null,
-            decisionPolicySnapshot: { type: 'SINGLE' },
+            decisionPolicySnapshot: isSequentialTransfer
+                ? task.decisionPolicySnapshot
+                : { type: 'SINGLE' },
             delegationChain: nextDelegationChain,
             instanceId: task.instanceId,
             isAdhoc: task.isAdhoc,
@@ -2252,6 +2835,29 @@ let WorkflowEngineService = class WorkflowEngineService {
             status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
             tokenId: task.tokenId,
         }));
+        // A pre-approval the previous holder requested still points at the task
+        // being transferred. Its RETURN_TO_ORIGIN rejection hands the decision back
+        // through adhocOriginTaskId, so leaving it on the TRANSFERRED row reopened
+        // a task for the member who had just transferred the stage away. Only open
+        // pre-approvals move; closed ones keep pointing at the task they ran
+        // against, and countersign tasks keep agreeing with directive.originTaskId
+        // because nothing reads their pointer. A pre-approval is always created on
+        // the origin task's instance and node, so those narrow the lookup to the
+        // idx_tasks_instance_node index (adhoc_origin_task_id has none).
+        const openPreApprovalsOnTransferredTask = (await taskRepository.find({
+            where: {
+                adhocOriginTaskId: task.id,
+                adhocType: adhoc_enums_1.AdhocDirectiveTypeEnum.PRE_APPROVAL,
+                instanceId: task.instanceId,
+                nodeId: task.nodeId,
+            },
+        })).filter((adhocTask) => adhocTask.status === workflow_engine_enums_1.TaskStatusEnum.PENDING ||
+            adhocTask.status === workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS);
+        if (openPreApprovalsOnTransferredTask.length > 0) {
+            await taskRepository.save(openPreApprovalsOnTransferredTask.map((adhocTask) => Object.assign(new task_entity_1.TaskEntity(), adhocTask, {
+                adhocOriginTaskId: nextTask.id,
+            })));
+        }
         await taskCandidateRepository.save([
             ...(actorCandidate
                 ? [
@@ -2269,10 +2875,28 @@ let WorkflowEngineService = class WorkflowEngineService {
                 delegationChain: nextDelegationChain,
                 memberId: transferToMemberId,
                 originalMemberId: task.originalAssigneeMemberId ?? transferToMemberId,
+                sequence: isSequentialTransfer
+                    ? (actorCandidate?.sequence ?? null)
+                    : null,
                 sourceType: 'DIRECT',
                 status: workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
                 taskId: nextTask.id,
             }),
+            ...carriedCandidates.map((candidate) => taskCandidateRepository.create({
+                claimedAt: null,
+                createdAt: candidate.createdAt,
+                decidedAt: null,
+                delegationChain: candidate.delegationChain,
+                memberId: candidate.memberId,
+                originalMemberId: candidate.originalMemberId,
+                sequence: candidate.sequence,
+                sourceType: candidate.sourceType,
+                status: workflow_engine_enums_1.TaskCandidateStatusEnum.WAITING,
+                taskId: nextTask.id,
+            })),
+            ...waitingCandidates.map((candidate) => Object.assign(new task_candidate_entity_1.TaskCandidateEntity(), candidate, {
+                status: workflow_engine_enums_1.TaskCandidateStatusEnum.SUPERSEDED,
+            })),
         ]);
         await activityRepository.save([
             activityRepository.create({
@@ -2297,8 +2921,19 @@ let WorkflowEngineService = class WorkflowEngineService {
                 nodeId: task.nodeId,
                 payload: {
                     assigneeMemberId: transferToMemberId,
+                    ...(isSequentialTransfer
+                        ? { candidateMemberIds: [transferToMemberId] }
+                        : {}),
                     delegationChain: nextDelegationChain,
                     originalAssigneeMemberId: task.originalAssigneeMemberId,
+                    ...(isSequentialTransfer
+                        ? {
+                            sequentialCandidateMemberIds: [
+                                transferToMemberId,
+                                ...carriedCandidates.map((candidate) => candidate.memberId),
+                            ],
+                        }
+                        : {}),
                     tokenId: task.tokenId,
                     transferredFromTaskId: task.id,
                 },
@@ -2316,16 +2951,63 @@ let WorkflowEngineService = class WorkflowEngineService {
             });
         }
     }
+    /**
+     * Resolves who gets the node's task. `null` means the node asked to be
+     * skipped (`excludeInitiator.whenEmpty = SKIP_NODE`) because the initiator
+     * was the only approver — the sole caller creates no task and advances the
+     * token instead.
+     */
     async resolveRuntimeTaskCandidates(manager, instance, node) {
-        const resolvedCandidates = await this.resolveApproverResolver(manager, instance, node.data.approverResolver, `簽核節點「${node.data.label}」`);
-        const uniqueCandidates = await this.applyDelegationToResolvedCandidates(instance, node.id, resolvedCandidates);
-        if (uniqueCandidates.length === 0) {
-            throw new common_1.ConflictException(`簽核節點「${node.data.label}」 did not resolve to any member id`);
+        const label = `簽核節點「${node.data.label}」`;
+        const resolvedCandidates = await this.resolveApproverResolver(manager, instance, node.data.approverResolver, label, '簽核人', isInitiatorExcluded(node) ? readInitiatorAndSubmitter(instance) : []);
+        const delegatedCandidates = await this.delegateResolvedCandidates(manager, instance, node.id, resolvedCandidates, isOrgManagerChainNode(node));
+        const excludeInitiator = node.data.excludeInitiator;
+        const hasSubmitter = (0, instance_submitter_1.readDistinctSubmitterMemberId)(instance) !== null;
+        const uniqueCandidates = selectNodeCandidates(delegatedCandidates, isInitiatorExcluded(node), readInitiatorAndSubmitter(instance));
+        if (uniqueCandidates.length > 0) {
+            return {
+                candidates: uniqueCandidates,
+                skippedDelegations: collectSkippedDelegations(delegatedCandidates, isInitiatorExcluded(node), readInitiatorAndSubmitter(instance)),
+            };
+        }
+        // Only the initiator was left — what the node does about it is configured.
+        // Nothing resolved to begin with is the ordinary failure below.
+        if (!excludeInitiator || delegatedCandidates.length === 0) {
+            throw new common_1.ConflictException(`${label} did not resolve to any member id`);
         }
-        return uniqueCandidates;
+        if (excludeInitiator.whenEmpty === 'SKIP_NODE') {
+            return null;
+        }
+        if (excludeInitiator.whenEmpty === 'INITIATOR_MANAGER') {
+            const managerCandidates = await this.resolveInitiatorManagerReplacements(manager, instance, node);
+            if (managerCandidates.candidates.length > 0) {
+                return managerCandidates;
+            }
+            throw new common_1.ConflictException(hasSubmitter
+                ? `${label} 無法建立待簽任務：解析出的簽核人只剩申請人或代為送出此單的人，此節點不允許申請人或代送人簽核，且找不到申請人的主管可改派。`
+                : `${label} 無法建立待簽任務：解析出的簽核人只剩申請人本人，此節點不允許申請人自簽，且找不到申請人的主管可改派。`);
+        }
+        throw new common_1.ConflictException(hasSubmitter
+            ? `${label} 無法建立待簽任務：解析出的簽核人只剩申請人或代為送出此單的人（含委派後的代理人），且此節點不允許申請人或代送人簽核。`
+            : `${label} 無法建立待簽任務：解析出的簽核人只剩申請人本人（含委派後的代理人），且此節點不允許申請人自簽。`);
+    }
+    async resolveInitiatorManagerReplacements(manager, instance, node) {
+        // The initiator's own direct manager: the closest org unit only. The
+        // initiator himself (a unit head) and the member who submitted for him are
+        // skipped before the tier is chosen, so resolution falls through to the
+        // next tier instead of ending on either of them.
+        const managerMemberIds = await this.resolveDirectManagerMemberIds(manager, instance.initiatorMemberId, this.readOrganizationToday(), true, readInitiatorAndSubmitter(instance));
+        const delegatedCandidates = await this.delegateResolvedCandidates(manager, instance, node.id, managerMemberIds.map((memberId) => ({
+            memberId,
+            sourceType: 'EXCLUDE_INITIATOR_MANAGER',
+        })), isOrgManagerChainNode(node));
+        return {
+            candidates: selectNodeCandidates(delegatedCandidates, true, readInitiatorAndSubmitter(instance)),
+            skippedDelegations: collectSkippedDelegations(delegatedCandidates, true, readInitiatorAndSubmitter(instance)),
+        };
     }
-    async applyDelegationToResolvedCandidates(instance, nodeId, resolvedCandidates) {
-        const context = {
+    buildDelegationContext(instance, nodeId) {
+        return {
             formData: instance.formData,
             initiatorMemberId: instance.initiatorMemberId,
             initiatorMetadataSnapshot: instance.initiatorMetadataSnapshot,
@@ -2336,43 +3018,89 @@ let WorkflowEngineService = class WorkflowEngineService {
             templateVersionId: instance.templateVersionId,
             title: instance.title,
         };
-        const delegatedCandidates = await Promise.all(resolvedCandidates.map(async (candidate) => {
-            const delegationResolution = await this.delegationService.resolveAssignee(candidate.memberId, context);
+    }
+    // Not deduplicated: a node that excludes the initiator filters first, so a
+    // first-seen entry that must be dropped cannot shadow a legitimate one.
+    async delegateResolvedCandidates(manager, instance, nodeId, resolvedCandidates, gradeGated) {
+        const context = this.buildDelegationContext(instance, nodeId);
+        const resolved = await Promise.all(resolvedCandidates.map(async (candidate) => ({
+            candidate,
+            resolution: await this.delegationService.resolveAssignee(candidate.memberId, context),
+        })));
+        // One batch of grade lookups for the whole node, not two per delegate.
+        const levels = gradeGated
+            ? await this.readMemberPositionLevels(manager, resolved.flatMap(({ candidate, resolution }) => readGradeGateMemberIds(candidate.memberId, resolution)), this.readOrganizationToday())
+            : new Map();
+        return resolved.map(({ candidate, resolution }) => {
+            const { skippedDelegation, ...delegationResolution } = applyGradeGate(candidate.memberId, resolution, gradeGated, levels);
             return {
                 delegationChain: delegationResolution.delegationChain,
                 memberId: delegationResolution.finalAssigneeMemberId,
                 originalMemberId: candidate.memberId,
+                ...(skippedDelegation ? { skippedDelegation } : {}),
                 sourceType: candidate.sourceType,
             };
-        }));
-        return uniqueRuntimeCandidates(delegatedCandidates);
+        });
+    }
+    /** One member's delegation, grade-gated as {@link applyGradeGate} says. */
+    async resolveDelegation(manager, principalMemberId, context, gradeGated) {
+        const resolution = await this.delegationService.resolveAssignee(principalMemberId, context);
+        const memberIds = gradeGated
+            ? readGradeGateMemberIds(principalMemberId, resolution)
+            : [];
+        const levels = memberIds.length > 0
+            ? await this.readMemberPositionLevels(manager, memberIds, this.readOrganizationToday())
+            : new Map();
+        return applyGradeGate(principalMemberId, resolution, gradeGated, levels);
+    }
+    /**
+     * Manual transfer on a manager-chain node: the target must hold at least the
+     * grade of the member being replaced, i.e. the original principal of the
+     * deciding candidate (the first hop of its delegation chain when it was
+     * delegated, otherwise the actor). No grade on the principal means no
+     * constraint.
+     */
+    async assertTransferTargetGrade(manager, { actorMemberId, delegationChain, label, targetMemberId, }) {
+        const principalMemberId = readDelegationSteps(delegationChain)[0]?.from ?? actorMemberId;
+        const date = this.readOrganizationToday();
+        const requiredLevel = await this.readMemberPositionLevel(manager, principalMemberId, date);
+        if (requiredLevel === null) {
+            return;
+        }
+        const targetLevel = await this.readMemberPositionLevel(manager, targetMemberId, date);
+        if (targetLevel === null || targetLevel < requiredLevel) {
+            throw new common_1.ForbiddenException(`簽核節點「${label}」需由職等 ${requiredLevel} 以上的成員簽核，不能轉簽給職等不足的成員`);
+        }
     }
-    async resolveApproverResolver(manager, instance, resolver, label) {
+    async resolveApproverResolver(manager, instance, resolver, label, subject = '簽核人', skippedChainMemberIds = []) {
         if (resolver.type === 'DIRECT') {
-            return readMemberIdsFromValue(resolver.memberIds, label).map((memberId) => ({ memberId, sourceType: resolver.type }));
+            return readMemberIdsFromValue(resolver.memberIds, label, subject).map((memberId) => ({ memberId, sourceType: resolver.type }));
         }
         if (resolver.type === 'DYNAMIC_FORM') {
-            return readMemberIdsFromValue(readValueAtPath(instance.formData, resolver.formPath), `${label}.formPath`).map((memberId) => ({ memberId, sourceType: resolver.type }));
+            return readMemberIdsFromValue(readValueAtPath(instance.formData, resolver.formPath), label, subject, `依表單欄位「${resolver.formPath}」`).map((memberId) => ({ memberId, sourceType: resolver.type }));
         }
         if (resolver.type === 'EXPRESSION') {
-            return readMemberIdsFromValue(this.conditionService.evaluateValue(resolver.expression, buildWorkflowExpressionContext(instance), `${label}.expression`), `${label}.expression`).map((memberId) => ({ memberId, sourceType: resolver.type }));
+            return readMemberIdsFromValue(this.conditionService.evaluateValue(resolver.expression, buildWorkflowExpressionContext(instance), `${label}.expression`), label, subject, '依運算式').map((memberId) => ({ memberId, sourceType: resolver.type }));
         }
         if (resolver.type === 'POSITION') {
-            return this.resolvePositionCandidates(manager, resolver.positionId, label).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolvePositionCandidates(manager, resolver.positionId, label, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
         }
         if (resolver.type === 'ORG_UNIT_MEMBER') {
-            return this.resolveOrgUnitMemberCandidates(manager, resolver.orgUnitId, Boolean(resolver.includeDescendants), label).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolveOrgUnitMemberCandidates(manager, resolver.orgUnitId, Boolean(resolver.includeDescendants), label, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
         }
         if (resolver.type === 'ORG_UNIT_POSITION') {
-            return this.resolveOrgUnitPositionCandidates(manager, resolver.orgUnitId, resolver.positionId, Boolean(resolver.includeDescendants), label).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolveOrgUnitPositionCandidates(manager, resolver.orgUnitId, resolver.positionId, Boolean(resolver.includeDescendants), label, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
         }
         if (resolver.type === 'ORG_UNIT_MANAGER') {
-            return this.resolveOrgUnitManagerCandidates(manager, instance, resolver.orgUnitId, resolver.fallback, label, resolver.preferClosestOrgUnit === true).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolveOrgUnitManagerCandidates(manager, instance, resolver.orgUnitId, resolver.fallback, label, resolver.preferClosestOrgUnit === true, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
         }
-        return this.resolveInitiatorManagerCandidates(manager, instance, resolver.levelsUp, resolver.fallback, label, resolver.preferClosestOrgUnit === true).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+        if (resolver.type === 'ORG_MANAGER_CHAIN') {
+            return this.resolveOrgManagerChainCandidates(manager, instance, resolver.minPositionLevel, resolver.fallback, label, subject, skippedChainMemberIds).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+        }
+        return this.resolveInitiatorManagerCandidates(manager, instance, resolver.levelsUp, resolver.fallback, label, resolver.preferClosestOrgUnit === true, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
     }
-    async resolvePositionCandidates(manager, positionId, label) {
-        const today = toDateOnlyString(new Date());
+    async resolvePositionCandidates(manager, positionId, label, subject) {
+        const today = this.readOrganizationToday();
         const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
             where: { positionId },
         });
@@ -2386,35 +3114,123 @@ let WorkflowEngineService = class WorkflowEngineService {
             return second.effectiveFrom.localeCompare(first.effectiveFrom);
         });
         if (!activeMemberships.length) {
-            throw new common_1.ConflictException(`${label} position ${positionId} has no active membership`);
+            throw new common_1.ConflictException(`${label} 找不到${subject}：職位「${await this.readPositionName(manager, positionId)}」目前沒有任何有效成員`);
         }
         return uniqueTexts(activeMemberships.map((membership) => membership.memberId));
     }
-    async resolveInitiatorManagerCandidates(manager, instance, levelsUp, fallback, label, preferClosestOrgUnit) {
+    async resolveInitiatorManagerCandidates(manager, instance, levelsUp, fallback, label, preferClosestOrgUnit, subject) {
         const normalizedLevelsUp = Math.max(Math.trunc(levelsUp), 1);
         const resolvedManagerMemberIds = await this.resolveManagerMemberIdsFromOrganization(manager, instance.initiatorMemberId, normalizedLevelsUp, preferClosestOrgUnit);
         if (resolvedManagerMemberIds.length) {
             return resolvedManagerMemberIds;
         }
         return [
-            this.resolveFallbackAssignee(instance, fallback, label, `找不到發起人的第 ${normalizedLevelsUp} 層主管`),
+            this.resolveFallbackAssignee(instance, fallback, label, subject, `找不到發起人的第 ${normalizedLevelsUp} 層主管`),
         ];
     }
-    resolveFallbackAssignee(instance, fallback, label, failureReason) {
+    /**
+     * Walks up the initiator's manager chain, nearest manager first, until a
+     * manager whose position level reaches `minPositionLevel` is added. The
+     * list is returned nearest manager first. Members in `skippedMemberIds` are
+     * walked past without joining the chain or counting as the stopping point.
+     */
+    async resolveOrgManagerChainCandidates(manager, instance, minPositionLevel, fallback, label, subject, skippedMemberIds) {
+        const date = this.readOrganizationToday();
+        const visitedMemberIds = new Set([instance.initiatorMemberId]);
+        const chain = [];
+        let currentMemberId = instance.initiatorMemberId;
+        let lastAddedLevel = null;
+        for (let hop = 0; hop < ORG_MANAGER_CHAIN_MAX_HOPS; hop += 1) {
+            // A chain is a single path, so it always uses closest-org-unit semantics
+            // (merging ancestor-unit rules could only produce ties). The member is
+            // excluded from his own candidates: a unit head belongs to the unit he
+            // heads, so without this his unit rule would name himself and the walk
+            // could never climb past him.
+            const directManagerMemberIds = await this.resolveDirectManagerMemberIds(manager, currentMemberId, date, true, [currentMemberId]);
+            if (directManagerMemberIds.length === 0) {
+                break;
+            }
+            if (directManagerMemberIds.length > 1) {
+                // Picking one silently would route the document by accident.
+                throw new common_1.ConflictException(`${label} 無法沿主管鏈簽核：成員 ${currentMemberId} 的主管規則在同一優先順序出現多位主管（${directManagerMemberIds.join('、')}），無法決定簽核路徑。請聯絡流程管理員調整主管規則。`);
+            }
+            const [managerMemberId] = directManagerMemberIds;
+            if (visitedMemberIds.has(managerMemberId)) {
+                break;
+            }
+            visitedMemberIds.add(managerMemberId);
+            currentMemberId = managerMemberId;
+            // A member the node keeps out (the person who filed the document) is
+            // climbed through, not stopped at: filtering him after the walk would
+            // lose the chain when he is the manager that reaches the level.
+            if (skippedMemberIds.includes(managerMemberId)) {
+                continue;
+            }
+            const level = await this.readMemberPositionLevel(manager, managerMemberId, date);
+            if (level === null ||
+                (lastAddedLevel !== null && level <= lastAddedLevel)) {
+                continue;
+            }
+            chain.push(managerMemberId);
+            lastAddedLevel = level;
+            if (level >= minPositionLevel) {
+                return chain;
+            }
+        }
+        const fallbackMemberId = this.resolveFallbackAssignee(instance, fallback, label, subject, `沿主管鏈找不到職等達 ${minPositionLevel} 的主管`);
+        return chain.includes(fallbackMemberId)
+            ? chain
+            : [...chain, fallbackMemberId];
+    }
+    /** Highest position level over the member's active memberships, or `null`. */
+    async readMemberPositionLevel(manager, memberId, date) {
+        return ((await this.readMemberPositionLevels(manager, [memberId], date)).get(memberId) ?? null);
+    }
+    /**
+     * {@link readMemberPositionLevel} for several members in two queries: every
+     * requested member is in the map, `null` when they hold no graded position.
+     */
+    async readMemberPositionLevels(manager, memberIds, date) {
+        const uniqueMemberIds = uniqueTexts(memberIds);
+        if (uniqueMemberIds.length === 0) {
+            return new Map();
+        }
+        const memberships = (await manager.getRepository(membership_entity_1.MembershipEntity).find({
+            where: { memberId: (0, typeorm_2.In)([...uniqueMemberIds]) },
+        })).filter((membership) => Boolean(membership.positionId) && isDateRangeActive(membership, date));
+        const positionIds = uniqueTexts(memberships.map((membership) => membership.positionId ?? ''));
+        const positions = positionIds.length === 0
+            ? []
+            : await manager.getRepository(position_entity_1.PositionEntity).find({
+                where: { id: (0, typeorm_2.In)([...positionIds]) },
+            });
+        const levelByPositionId = new Map(positions.map((position) => [position.id, position.level]));
+        return new Map(uniqueMemberIds.map((memberId) => {
+            const levels = memberships
+                .filter((membership) => membership.memberId === memberId)
+                .flatMap((membership) => {
+                const level = levelByPositionId.get(membership.positionId ?? '');
+                return level === undefined ? [] : [level];
+            });
+            return [memberId, levels.length === 0 ? null : Math.max(...levels)];
+        }));
+    }
+    resolveFallbackAssignee(instance, fallback, label, subject, failureReason) {
+        const failure = subject === '通知對象' ? '無法建立通知' : '無法建立待簽任務';
         if (!fallback || fallback.type === 'NONE') {
-            throw new common_1.ConflictException(`${label} 無法建立待簽任務：${failureReason}，且未設定改派固定人。請聯絡流程管理員調整主管規則或模板 fallback。`);
+            throw new common_1.ConflictException(`${label} ${failure}：${failureReason}，且未設定改派固定人。請聯絡流程管理員調整主管規則或模板 fallback。`);
         }
         if (!fallback.memberId.trim()) {
-            throw new common_1.ConflictException(`${label} 無法建立待簽任務：改派固定人未設定。`);
+            throw new common_1.ConflictException(`${label} ${failure}：改派固定人未設定。`);
         }
         if (fallback.memberId === instance.initiatorMemberId &&
             !fallback.allowInitiatorSelfApproval) {
-            throw new common_1.ConflictException(`${label} 無法建立待簽任務：改派固定人是申請人本人，且此節點未允許申請人自簽。`);
+            throw new common_1.ConflictException(`${label} ${failure}：改派固定人是申請人本人，且此節點未允許申請人自簽。`);
         }
         return fallback.memberId;
     }
     async resolveManagerMemberIdsFromOrganization(manager, memberId, levelsUp, preferClosestOrgUnit) {
-        return this.resolveManagerMemberIdsAtLevel(manager, memberId, toDateOnlyString(new Date()), levelsUp, preferClosestOrgUnit);
+        return this.resolveManagerMemberIdsAtLevel(manager, memberId, this.readOrganizationToday(), levelsUp, preferClosestOrgUnit);
     }
     async resolveManagerMemberIdsAtLevel(manager, memberId, date, remainingLevels, preferClosestOrgUnit) {
         const directManagerMemberIds = await this.resolveDirectManagerMemberIds(manager, memberId, date, preferClosestOrgUnit);
@@ -2424,7 +3240,7 @@ let WorkflowEngineService = class WorkflowEngineService {
         const nextLevelGroups = await Promise.all(directManagerMemberIds.map((managerMemberId) => this.resolveManagerMemberIdsAtLevel(manager, managerMemberId, date, remainingLevels - 1, preferClosestOrgUnit)));
         return uniqueTexts(nextLevelGroups.flat());
     }
-    async resolveDirectManagerMemberIds(manager, memberId, date, preferClosestOrgUnit) {
+    async resolveDirectManagerMemberIds(manager, memberId, date, preferClosestOrgUnit, excludedManagerMemberIds = []) {
         const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
             where: { memberId },
         });
@@ -2445,10 +3261,10 @@ let WorkflowEngineService = class WorkflowEngineService {
                 scopeType: organization_enums_1.ManagerResolutionScopeTypeEnum.POSITION,
             })),
         ];
-        return this.resolveManagerResolutionCandidates(manager, candidatePairs, date, readOrgUnitDepthMap(orgUnits), preferClosestOrgUnit);
+        return this.resolveManagerResolutionCandidates(manager, candidatePairs, date, readOrgUnitDepthMap(orgUnits), preferClosestOrgUnit, excludedManagerMemberIds);
     }
-    async resolveOrgUnitManagerCandidates(manager, instance, orgUnitId, fallback, label, preferClosestOrgUnit) {
-        const date = toDateOnlyString(new Date());
+    async resolveOrgUnitManagerCandidates(manager, instance, orgUnitId, fallback, label, preferClosestOrgUnit, subject) {
+        const date = this.readOrganizationToday();
         const orgUnits = await this.readOrgUnitAndAncestors(manager, [orgUnitId]);
         const managerMemberIds = await this.resolveManagerResolutionCandidates(manager, orgUnits.map((orgUnit) => ({
             scopeId: orgUnit.id,
@@ -2456,7 +3272,7 @@ let WorkflowEngineService = class WorkflowEngineService {
         })), date, readOrgUnitDepthMap(orgUnits), preferClosestOrgUnit);
         if (!managerMemberIds.length) {
             return [
-                this.resolveFallbackAssignee(instance, fallback, label, `找不到指定組織的主管規則`),
+                this.resolveFallbackAssignee(instance, fallback, label, subject, `找不到指定組織的主管規則`),
             ];
         }
         return managerMemberIds;
@@ -2477,7 +3293,7 @@ let WorkflowEngineService = class WorkflowEngineService {
         const byId = new Map([...directOrgUnits, ...ancestorGroups.flat()].map((orgUnit) => [orgUnit.id, orgUnit]));
         return [...byId.values()];
     }
-    async resolveManagerResolutionCandidates(manager, candidatePairs, date, orgUnitDepths, preferClosestOrgUnit) {
+    async resolveManagerResolutionCandidates(manager, candidatePairs, date, orgUnitDepths, preferClosestOrgUnit, excludedManagerMemberIds = []) {
         const scopeIds = candidatePairs.map((pair) => pair.scopeId);
         if (!scopeIds.length) {
             return [];
@@ -2499,56 +3315,80 @@ let WorkflowEngineService = class WorkflowEngineService {
             .filter((resolution) => candidatePairs.some((pair) => pair.scopeId === resolution.scopeId &&
             pair.scopeType === resolution.scopeType))
             .filter((resolution) => isDateRangeActive(resolution, date))
+            // Dropped before the top-priority tier is chosen, so resolution falls
+            // through to the next tier instead of ending on the excluded member.
+            .filter((resolution) => !excludedManagerMemberIds.includes(resolution.managerMemberId))
             .sort((left, right) => compareManagerResolution(left, right, depthLookup));
         return uniqueTexts(readTopPriorityResolutions(active, depthLookup).map((resolution) => resolution.managerMemberId));
     }
-    async resolveOrgUnitMemberCandidates(manager, orgUnitId, includeDescendants, label) {
-        const orgUnitIds = await this.readOrgUnitScopeIds(manager, orgUnitId, includeDescendants);
-        const today = toDateOnlyString(new Date());
+    async resolveOrgUnitMemberCandidates(manager, orgUnitId, includeDescendants, label, subject) {
+        const scope = await this.readOrgUnitScope(manager, orgUnitId, includeDescendants);
+        if (!scope) {
+            throw new common_1.ConflictException(readMissingOrgUnitMessage(label, subject, orgUnitId));
+        }
+        const today = this.readOrganizationToday();
         const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
-            where: { orgUnitId: (0, typeorm_2.In)([...orgUnitIds]) },
+            where: { orgUnitId: (0, typeorm_2.In)([...scope.orgUnitIds]) },
         });
         const memberIds = memberships
             .filter((membership) => isDateRangeActive(membership, today))
             .sort(compareMembership)
             .map((membership) => membership.memberId);
         if (memberIds.length === 0) {
-            throw new common_1.ConflictException(`${label} orgUnit ${orgUnitId} has no active member`);
+            throw new common_1.ConflictException(`${label} 找不到${subject}：組織「${scope.name}」目前沒有任何有效成員，請先將人員加入該組織`);
         }
         return uniqueTexts(memberIds);
     }
-    async resolveOrgUnitPositionCandidates(manager, orgUnitId, positionId, includeDescendants, label) {
-        const orgUnitIds = await this.readOrgUnitScopeIds(manager, orgUnitId, includeDescendants);
-        const today = toDateOnlyString(new Date());
+    async resolveOrgUnitPositionCandidates(manager, orgUnitId, positionId, includeDescendants, label, subject) {
+        const scope = await this.readOrgUnitScope(manager, orgUnitId, includeDescendants);
+        if (!scope) {
+            throw new common_1.ConflictException(readMissingOrgUnitMessage(label, subject, orgUnitId));
+        }
+        const today = this.readOrganizationToday();
         const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
-            where: { orgUnitId: (0, typeorm_2.In)([...orgUnitIds]), positionId },
+            where: { orgUnitId: (0, typeorm_2.In)([...scope.orgUnitIds]), positionId },
         });
         const memberIds = memberships
             .filter((membership) => isDateRangeActive(membership, today))
             .sort(compareMembership)
             .map((membership) => membership.memberId);
         if (memberIds.length === 0) {
-            throw new common_1.ConflictException(`${label} orgUnit ${orgUnitId} and position ${positionId} has no active membership`);
+            throw new common_1.ConflictException(`${label} 找不到${subject}：組織「${scope.name}」的職位「${await this.readPositionName(manager, positionId)}」目前沒有任何有效成員`);
         }
         return uniqueTexts(memberIds);
     }
-    async readOrgUnitScopeIds(manager, orgUnitId, includeDescendants) {
+    // Names only make an error readable, so a row that has gone missing falls
+    // back to its id instead of hiding the real problem.
+    async readPositionName(manager, positionId) {
+        const position = await manager
+            .getRepository(position_entity_1.PositionEntity)
+            .findOne({ where: { id: positionId } });
+        return position?.name ?? positionId;
+    }
+    /** The org unit's name and the ids it covers, or `null` once it is gone. */
+    async readOrgUnitScope(manager, orgUnitId, includeDescendants) {
         const orgUnitRepository = manager.getRepository(org_unit_entity_1.OrgUnitEntity);
         const orgUnit = await orgUnitRepository.findOne({
             where: { deletedAt: (0, typeorm_2.IsNull)(), id: orgUnitId },
         });
         if (!orgUnit) {
-            throw new common_1.ConflictException(`Org unit ${orgUnitId} was not found`);
+            return null;
         }
         if (!includeDescendants) {
-            return [orgUnit.id];
+            return { name: orgUnit.name, orgUnitIds: [orgUnit.id] };
         }
         const descendants = await orgUnitRepository
             .createQueryBuilder('orgUnit')
             .where('orgUnit.deleted_at IS NULL')
             .andWhere('orgUnit.path <@ :path', { path: orgUnit.path })
             .getMany();
-        return uniqueTexts([orgUnit.id, ...descendants.map((unit) => unit.id)]);
+        return {
+            name: orgUnit.name,
+            orgUnitIds: uniqueTexts([
+                orgUnit.id,
+                ...descendants.map((unit) => unit.id),
+            ]),
+        };
     }
     async processExclusiveGateway(manager, instance, token, node) {
         if (node.data.direction !== 'split') {
@@ -2630,7 +3470,7 @@ let WorkflowEngineService = class WorkflowEngineService {
         const recipients = (0, workflow_graph_1.isNotifyRecipientsEmpty)(action.recipients) &&
             (0, workflow_graph_1.readNotifyWebhookTargets)(action).length > 0
             ? []
-            : await this.resolveApproverResolver(manager, instance, action.recipients, `知會節點「${node.data.label}」`);
+            : await this.resolveApproverResolver(manager, instance, action.recipients, `知會節點「${node.data.label}」`, '通知對象');
         const recipientMemberIds = uniqueTexts(recipients.map((recipient) => recipient.memberId));
         await this.notificationService.createServiceTaskNotifications({
             instance,
@@ -2658,11 +3498,7 @@ let WorkflowEngineService = class WorkflowEngineService {
                 tokenId: token.id,
             }, action.webhooks)
             : [];
-        await manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity).save({
-            ...token,
-            consumedAt: new Date(),
-            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.CONSUMED,
-        });
+        await this.consumeToken(manager, token);
         await activityRepository.save(activityRepository.create({
             actorMemberId: null,
             eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
@@ -2901,7 +3737,8 @@ let WorkflowEngineService = class WorkflowEngineService {
         }
         const candidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
         const candidates = (await candidateRepository.find({ where: { taskId: (0, typeorm_2.In)([...taskIds]) } })).filter((candidate) => candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING ||
-            candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED);
+            candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED ||
+            candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.WAITING);
         if (candidates.length === 0) {
             return;
         }
@@ -3188,6 +4025,58 @@ function buildDryRunExpressionContext(input, lastDecision) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+// The members whose grades decide a grade-gated delegation: none when the
+// delegation leaves the seat with its principal.
+function readGradeGateMemberIds(principalMemberId, resolution) {
+    return resolution.finalAssigneeMemberId === principalMemberId
+        ? []
+        : [principalMemberId, resolution.finalAssigneeMemberId];
+}
+/**
+ * On a manager-chain node the delegate must hold at least the grade of the
+ * member they replace: anything lower is not applied, the member stays and
+ * the refused delegation is returned so it can be recorded. Resolution does
+ * not walk further down the delegation chain once it has been refused. A
+ * member without a grade (or a delegate that stays the member) is never
+ * constrained. `levels` holds the grades of `readGradeGateMemberIds`.
+ */
+function applyGradeGate(principalMemberId, resolution, gradeGated, levels) {
+    if (!gradeGated || resolution.finalAssigneeMemberId === principalMemberId) {
+        return resolution;
+    }
+    const principalLevel = levels.get(principalMemberId) ?? null;
+    if (principalLevel === null) {
+        return resolution;
+    }
+    const agentLevel = levels.get(resolution.finalAssigneeMemberId) ?? null;
+    if (agentLevel !== null && agentLevel >= principalLevel) {
+        return resolution;
+    }
+    return {
+        delegationChain: [],
+        finalAssigneeMemberId: principalMemberId,
+        skippedDelegation: {
+            agentLevel,
+            agentMemberId: resolution.finalAssigneeMemberId,
+            principalLevel,
+            principalMemberId,
+            reason: 'AGENT_POSITION_LEVEL_TOO_LOW',
+        },
+    };
+}
+function readNodeLabelKey(instanceId, nodeId) {
+    return `${instanceId}\u0000${nodeId}`;
+}
+/**
+ * The node's display name from an instance's workflow snapshot, or `null`
+ * when the instance or node is missing, or the node carries no usable label
+ * (older snapshots).
+ */
+function readWorkflowNodeLabel(workflow, nodeId) {
+    const label = workflow?.nodes.find((candidate) => candidate.id === nodeId)
+        ?.data.label;
+    return typeof label === 'string' && label.trim() ? label : null;
+}
 function readWorkflowNodeOrThrow(workflow, nodeId) {
     const node = workflow.nodes.find((candidate) => candidate.id === nodeId);
     if (!node) {
@@ -3288,22 +4177,26 @@ function edgeHasCondition(edge) {
     return Boolean(edge.data.condition?.trim() ||
         (edge.data.conditionFieldKey && edge.data.conditionOperator));
 }
-function readMemberIdFromValue(value, label) {
-    return readMemberIdsFromValue(value, label)[0] ?? '';
+function readMissingOrgUnitMessage(label, subject, orgUnitId) {
+    return `${label} 找不到${subject}：組織（${orgUnitId}）已不存在，請在流程設計器重新選擇組織`;
 }
-function readMemberIdsFromValue(value, label) {
+function findMemberIdsInValue(value) {
     if (typeof value === 'string' && value.trim()) {
         return [value.trim()];
     }
     if (Array.isArray(value)) {
-        const memberIds = value
+        return uniqueTexts(value
             .filter((candidate) => typeof candidate === 'string' && Boolean(candidate.trim()))
-            .map((candidate) => candidate.trim());
-        if (memberIds.length > 0) {
-            return uniqueTexts(memberIds);
-        }
+            .map((candidate) => candidate.trim()));
+    }
+    return [];
+}
+function readMemberIdsFromValue(value, label, subject = '簽核人', source = '') {
+    const memberIds = findMemberIdsInValue(value);
+    if (memberIds.length === 0) {
+        throw new common_1.ConflictException(`${label} ${source}找不到${subject}`);
     }
-    throw new common_1.ConflictException(`${label} did not resolve to a member id`);
+    return memberIds;
 }
 function uniqueTexts(values) {
     return [...new Set(values.filter((value) => value.trim()))];
@@ -3318,6 +4211,85 @@ function uniqueRuntimeCandidates(candidates) {
         return true;
     });
 }
+// A task signs in order only when its snapshot says so and its candidates carry
+// a sequence; a SEQUENTIAL task from before ordering existed behaves as before.
+function isOrderedSequentialTask(task, candidates) {
+    return (readDecisionPolicySnapshot(task).type === 'SEQUENTIAL' &&
+        candidates.some((candidate) => candidate.sequence !== null));
+}
+// Every read of the setting goes through here so an explicit `null` behaves
+// exactly like an absent setting.
+function isInitiatorExcluded(node) {
+    return Boolean(node.data.excludeInitiator);
+}
+// Everyone a node that excludes the initiator keeps out of its approvers: the
+// applicant and, when someone filed the document for them, that person too
+// (authority rule: the creator must not approve what they created).
+function readInitiatorAndSubmitter(instance) {
+    const submitterMemberId = (0, instance_submitter_1.readDistinctSubmitterMemberId)(instance);
+    return submitterMemberId === null
+        ? [instance.initiatorMemberId]
+        : [instance.initiatorMemberId, submitterMemberId];
+}
+function isOrgManagerChainNode(node) {
+    return node.data.approverResolver.type === 'ORG_MANAGER_CHAIN';
+}
+// Candidates of a manager-chain node that came from the chain (or replaced the
+// excluded initiator's seat); ad-hoc approvers are chosen by a person instead.
+function isGradeGatedCandidate(node, sourceType) {
+    return (isOrgManagerChainNode(node) &&
+        (sourceType === 'ORG_MANAGER_CHAIN' ||
+            sourceType === 'EXCLUDE_INITIATOR_MANAGER'));
+}
+// Source of the additive `skippedDelegations` payload field (absent when
+// nothing was refused, so existing payloads stay byte-identical). One record
+// per principal and delegate pair.
+function collectSkippedDelegations(delegatedCandidates, excludeInitiator, excludedMemberIds) {
+    const seen = new Set();
+    return delegatedCandidates.flatMap((candidate) => {
+        const skipped = candidate.skippedDelegation;
+        // A seat the initiator filter removes is not on the task, so a refusal on
+        // it has nothing to report. Rows only the dedupe drops are still on it.
+        if (!skipped ||
+            (excludeInitiator &&
+                isExcludedMemberOnCandidatePath(candidate, excludedMemberIds))) {
+            return [];
+        }
+        const key = `${skipped.principalMemberId}\u0000${skipped.agentMemberId}`;
+        if (seen.has(key)) {
+            return [];
+        }
+        seen.add(key);
+        return [skipped];
+    });
+}
+// A delegate acting for the initiator is still the initiator approving their
+// own document, so the initiator anywhere on the delegation path (the
+// pre-delegation member, any hop, or the final assignee) drops the candidate.
+// The submitter is held to exactly the same rule.
+function isExcludedMemberOnCandidatePath(candidate, excludedMemberIds) {
+    return excludedMemberIds.some((excludedMemberId) => candidate.memberId === excludedMemberId ||
+        candidate.originalMemberId === excludedMemberId ||
+        candidate.delegationChain.some((step) => step.from === excludedMemberId || step.to === excludedMemberId));
+}
+// The initiator filter runs on the delegated list before the dedupe, so a
+// legitimate approver is never shadowed by an excluded entry for the same
+// final assignee. Without the exclusion this is the plain dedupe.
+function selectNodeCandidates(delegatedCandidates, excludeInitiator, excludedMemberIds) {
+    return uniqueRuntimeCandidates(excludeInitiator
+        ? delegatedCandidates.filter((candidate) => !isExcludedMemberOnCandidatePath(candidate, excludedMemberIds))
+        : delegatedCandidates);
+}
+// A COUNT threshold above the people left would never be reached once the
+// initiator is gone, so it is capped at who remains ("everyone else").
+// PERCENTAGE is computed from the actual candidate count and needs nothing.
+function capDecisionPolicyToCandidateCount(policy, candidateCount) {
+    return policy?.type === 'QUORUM' &&
+        policy.thresholdType === 'COUNT' &&
+        policy.threshold > candidateCount
+        ? { ...policy, threshold: Math.max(candidateCount, 1) }
+        : policy;
+}
 function uniqueTasksById(tasks) {
     const seen = new Set();
     return tasks.filter((task) => {
@@ -3734,9 +4706,6 @@ function compareMembership(left, right) {
     }
     return right.effectiveFrom.localeCompare(left.effectiveFrom);
 }
-function toDateOnlyString(value) {
-    return value.toISOString().slice(0, 10);
-}
 function canReadAllWorkflows(scope) {
     return (scope.roles.includes('BPM_ADMIN') ||
         scope.permissions.some((permission) => WORKFLOW_READ_ALL_PERMISSIONS.has(permission)));
@@ -3767,9 +4736,26 @@ function validateSubmittedFormData(schema, formData) {
             .map((field) => field.label || field.fieldKey)
             .join(', ')}`);
     }
-    const tableErrors = visibleFields
-        .filter(form_1.isTableFieldDefinition)
-        .flatMap((field) => validateSubmittedTableValue(field, formData[field.fieldKey], isSubmittedFormFieldRequired(field, schema.fields, formData)));
+    // A `DYNAMIC_FORM` resolver reads a member value whether or not its field is
+    // visible, so a hidden field still holding a value must be well-formed too.
+    // Whether a hidden field is *required* stays a visibility question above.
+    const memberErrors = (0, form_member_value_validator_1.readSubmittedMemberValueErrors)(schema.fields.filter((field) => visibleFields.includes(field) ||
+        isSubmittedFieldValuePresent(formData[field.fieldKey])), formData);
+    if (memberErrors.length > 0) {
+        throw new common_1.BadRequestException(memberErrors.join('; '));
+    }
+    const tableErrors = [
+        ...visibleFields
+            .filter(form_1.isTableFieldDefinition)
+            .flatMap((field) => validateSubmittedTableValue(field, formData[field.fieldKey], isSubmittedFormFieldRequired(field, schema.fields, formData))),
+        // A hidden table is not "visible", but its stored value still has to be a
+        // well-formed table under the row cap: only the required / minimum checks
+        // are skipped, since nobody can fill the table in.
+        ...schema.fields
+            .filter(form_1.isTableFieldDefinition)
+            .filter((field) => field.hidden === true)
+            .flatMap((field) => validateSubmittedTableValue(field, formData[field.fieldKey], false, true)),
+    ];
     if (tableErrors.length > 0) {
         throw new common_1.BadRequestException(tableErrors.join('; '));
     }
@@ -3780,28 +4766,32 @@ function validateSubmittedFormData(schema, formData) {
  * required / shape / row count are enforced server side; `minimum`, `maxLength`
  * and friends stay a frontend hint.
  */
-function validateSubmittedTableValue(field, value, required) {
+function validateSubmittedTableValue(field, value, required, shapeOnly = false) {
     const path = `formData.${field.fieldKey}`;
     if (typeof value === 'undefined' || value === null) {
-        return required || readTableMinRows(field) > 0
-            ? [`${path} must include at least ${readTableRequiredRowCount(field)} row(s)`]
-            : [];
+        return shapeOnly
+            ? []
+            : required || readTableMinRows(field) > 0
+                ? [`${path} must include at least ${readTableRequiredRowCount(field)} row(s)`]
+                : [];
     }
     if (!Array.isArray(value)) {
         return [`${path} must be an array of rows`];
     }
-    const rowErrors = value.flatMap((row, index) => validateSubmittedTableRow(field, row, `${path}[${index}]`));
+    const rowErrors = value.flatMap((row, index) => validateSubmittedTableRow(field, row, `${path}[${index}]`, shapeOnly));
     // A malformed row cannot be counted against min/max meaningfully; report the
     // shape problem first so the submitter fixes the real cause.
     if (rowErrors.length > 0) {
         return rowErrors;
     }
-    return validateSubmittedTableRowCount(field, value.length, required, path);
+    return validateSubmittedTableRowCount(field, value.length, required, path, shapeOnly);
 }
-function validateSubmittedTableRowCount(field, rowCount, required, path) {
-    const minRows = required
-        ? Math.max(readTableMinRows(field), 1)
-        : readTableMinRows(field);
+function validateSubmittedTableRowCount(field, rowCount, required, path, shapeOnly = false) {
+    const minRows = shapeOnly
+        ? 0
+        : required
+            ? Math.max(readTableMinRows(field), 1)
+            : readTableMinRows(field);
     const maxRows = readTableMaxRows(field);
     return [
         ...(rowCount < minRows
@@ -3812,7 +4802,7 @@ function validateSubmittedTableRowCount(field, rowCount, required, path) {
             : []),
     ];
 }
-function validateSubmittedTableRow(field, row, path) {
+function validateSubmittedTableRow(field, row, path, shapeOnly = false) {
     if (!isRecord(row)) {
         return [`${path} must be an object`];
     }
@@ -3823,10 +4813,12 @@ function validateSubmittedTableRow(field, row, path) {
     const cellErrors = Object.entries(row)
         .filter(([columnKey, cellValue]) => columnsByKey.has(columnKey) && !(0, form_1.isFormTableCellValue)(cellValue))
         .map(([columnKey]) => `${path}.${columnKey} is not a valid cell value`);
-    const requiredErrors = field.columns
-        .filter((column) => isSubmittedTableColumnRequired(column) &&
-        !isSubmittedFieldValuePresent(readRowCellValue(row, column.fieldKey)))
-        .map((column) => `${path}.${column.fieldKey} is required`);
+    const requiredErrors = shapeOnly
+        ? []
+        : field.columns
+            .filter((column) => isSubmittedTableColumnRequired(column) &&
+            !isSubmittedFieldValuePresent(readRowCellValue(row, column.fieldKey)))
+            .map((column) => `${path}.${column.fieldKey} is required`);
     return [...unknownKeyErrors, ...cellErrors, ...requiredErrors];
 }
 /**
@@ -3871,6 +4863,11 @@ function isFormDefinitionSchema(value) {
         value.fields.every((field) => isRecord(field)));
 }
 function isSubmittedFormFieldVisible(field, fields, values) {
+    // A hidden (store-only) field is never shown, so nobody can fill it in:
+    // treat it like a false `visibleWhen`. Its submitted value is still kept.
+    if (field.hidden) {
+        return false;
+    }
     return field.visibleWhen
         ? evaluateFormConditionExpression(field.visibleWhen, fields, values, true)
         : true;
@@ -3998,6 +4995,84 @@ function isSubmittedFieldValuePresent(value) {
 function isNumberFormField(field) {
     return field.type === 'number' || field.type === 'money';
 }
+// A node that is skipped and then has nowhere to go keeps saying why it was
+// skipped, then why the branch ends; any other node just says why it ends.
+function readDryRunStepResultMessage(assignmentMessage, stopMessage, defaultMessage, skipped) {
+    const message = assignmentMessage ?? defaultMessage;
+    if (stopMessage === null) {
+        return message;
+    }
+    return skipped ? `${endSentence(message)}${stopMessage}` : stopMessage;
+}
+// The skip reason and the stop reason are two sentences; a reason that does not
+// already end in full-stop punctuation gets one so they do not run together.
+function endSentence(message) {
+    return /[。！？.!?]$/.test(message) ? message : `${message}。`;
+}
+// Why a manager resolver's fixed fallback cannot take over when the initiator
+// has no manager, or `null` when it can: like the runtime, it must exist, name
+// a member, and not be the initiator unless the node allows self-approval.
+function readDryRunFallbackProblem(initiatorMemberId, fallback) {
+    if (!fallback || fallback.type !== 'DIRECT') {
+        return 'NOT_SET';
+    }
+    const memberId = fallback.memberId.trim();
+    if (memberId === '') {
+        return 'BLANK_MEMBER';
+    }
+    return memberId === initiatorMemberId && !fallback.allowInitiatorSelfApproval
+        ? 'IS_INITIATOR'
+        : null;
+}
+function readDryRunFallbackMemberIds(input, fallback) {
+    return readDryRunFallbackProblem(input.initiatorMemberId, fallback) ===
+        null && fallback?.type === 'DIRECT'
+        ? [fallback.memberId.trim()]
+        : [];
+}
+function readDryRunNodeName(node) {
+    return node.data.label?.trim() || node.id;
+}
+// The dry run cannot look the organisation up, so these resolvers stand in
+// with a placeholder that names what the runtime would resolve.
+function readDryRunPlaceholderAssignee(resolver) {
+    if (resolver.type === 'POSITION') {
+        return `position:${resolver.positionId}`;
+    }
+    if (resolver.type === 'ORG_UNIT_MEMBER') {
+        return `orgUnitMember:${resolver.orgUnitId}`;
+    }
+    if (resolver.type === 'ORG_UNIT_POSITION') {
+        return `orgUnitPosition:${resolver.orgUnitId}:${resolver.positionId}`;
+    }
+    if (resolver.type === 'ORG_UNIT_MANAGER') {
+        return `orgUnitManager:${resolver.orgUnitId}`;
+    }
+    return resolver.type === 'ORG_MANAGER_CHAIN'
+        ? `orgManagerChain:${resolver.minPositionLevel}`
+        : resolver.type;
+}
+function readDryRunUnresolvedApproverMessage(resolver, nodeName, initiatorMemberId) {
+    if (resolver.type === 'DIRECT') {
+        return `簽核節點「${nodeName}」尚未選擇簽核人，請在流程設計器點選此節點設定簽核人`;
+    }
+    if (resolver.type === 'DYNAMIC_FORM') {
+        return `簽核節點「${nodeName}」依表單欄位找不到簽核人，請確認試跑資料中該欄位有填人員`;
+    }
+    if (resolver.type === 'EXPRESSION') {
+        return `簽核節點「${nodeName}」依運算式找不到簽核人，請確認運算式的結果`;
+    }
+    const fallbackProblem = resolver.type === 'ORG_MANAGER'
+        ? readDryRunFallbackProblem(initiatorMemberId, resolver.fallback)
+        : null;
+    if (fallbackProblem === 'BLANK_MEMBER') {
+        return `簽核節點「${nodeName}」找不到主管，且改派固定人未設定`;
+    }
+    if (fallbackProblem === 'IS_INITIATOR') {
+        return `簽核節點「${nodeName}」找不到主管，且改派固定人是申請人本人，此節點未允許申請人自簽`;
+    }
+    return `簽核節點「${nodeName}」依申請人的組織找不到主管，請確認試跑時的申請人資料`;
+}
 function createDryRunStep(input) {
     return Object.assign(new workflow_dry_run_object_1.WorkflowDryRunStepObject(), {
         assigneeMemberId: input.assigneeMemberId,
@@ -4074,4 +5149,34 @@ function mapDecisionToResolution(action) {
             return notification_enums_1.NotificationResolutionEnum.TRANSFERRED;
     }
 }
+// The limit is stated in characters, so a character outside the BMP counts
+// once rather than as its two UTF-16 code units.
+function countCodePoints(value) {
+    return Array.from(value).length;
+}
+function normalizeBusinessKey(businessKey) {
+    const trimmed = businessKey?.trim() ?? '';
+    if (trimmed === '') {
+        return null;
+    }
+    if (countCodePoints(trimmed) > exports.MAX_APPROVAL_INSTANCE_BUSINESS_KEY_LENGTH) {
+        throw new common_1.BadRequestException(`業務鍵長度不可超過 ${exports.MAX_APPROVAL_INSTANCE_BUSINESS_KEY_LENGTH} 個字元`);
+    }
+    return trimmed;
+}
+/**
+ * Turns Postgres rejecting a duplicate (template, business key) into a
+ * Conflict. Any other failure, including other unique violations inside the
+ * same transaction, surfaces as it is.
+ */
+function throwBusinessKeyConflictOrRethrow(error, businessKey) {
+    const { code, constraint, driverError } = (error ?? {});
+    if (businessKey !== null &&
+        (code ?? driverError?.code) === '23505' &&
+        (constraint ?? driverError?.constraint) ===
+            APPROVAL_INSTANCE_BUSINESS_KEY_INDEX) {
+        throw new common_1.ConflictException(`此範本已有相同業務鍵（${businessKey}）的簽核單`);
+    }
+    throw error;
+}
 //# sourceMappingURL=workflow-engine.service.js.map