approval-service.ts

// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.

import { createHash, randomBytes } from 'node:crypto';
import {
  APPROVAL_BRANCH_LABELS,
  approverTypeIsOrgScoped,
  canonicalApproverType,
  normalizeDecisionOutputs,
  type ApprovalNodeConfig,
} from '@objectstack/spec/automation';
import { ExpressionEngine, collectCelRootIdentifiers } from '@objectstack/formula';
import {
  ADMIN_FULL_ACCESS,
  ORGANIZATION_ADMIN_GRANTS,
  BUILTIN_IDENTITY_PLATFORM_ADMIN,
  BUILTIN_IDENTITY_ORG_OWNER,
  BUILTIN_IDENTITY_ORG_ADMIN,
} from '@objectstack/spec/identity';
import type {
  IApprovalService,
  ApprovalRequestRow,
  ApprovalActionRow,
  ApprovalActionAttachment,
  ApprovalDecisionInput,
  ApprovalDecisionResult,
  ApprovalRecallInput,
  ApprovalRecallResult,
  ApprovalSendBackInput,
  ApprovalSendBackResult,
  ApprovalResubmitInput,
  ApprovalResubmitResult,
  ApprovalStatus,
  SharingExecutionContext,
} from '@objectstack/spec/contracts';
import { RESUME_AUTHORITY_SERVICE } from '@objectstack/spec/contracts';
import { isFileIdToken } from '@objectstack/spec/data';
import { isGrantActive } from '@objectstack/core';
import {
  filterApproversWhoCanRead,
  resolveApproverDirectoryOrg,
  type ApproverOrgScopeDeps,
  type ApproverOrgScopeEngine,
} from './approver-org-scope.js';

/**
 * Node-era approval runtime (ADR-0019).
 *
 * Approval is no longer a standalone engine — it is a **flow node**. A flow's
 * Approval node opens a request via {@link ApprovalService.openNodeRequest} and
 * the run suspends; a human decision via {@link ApprovalService.decide}
 * finalises the request and resumes the owning run down the matching
 * `approve` / `reject` edge.
 *
 * This service owns the durable approval *state* — `sys_approval_request` /
 * `sys_approval_action`, approver resolution (team / department / position /
 * role / manager graph), and the optional status-field mirror — plus the decision
 * API. It does not author processes, submit, or walk multi-step machinery
 * anymore; that orchestration lives on the one automation engine.
 */
export interface ApprovalEngine {
  find(object: string, options?: any): Promise<any[]>;
  insert(object: string, data: any, options?: any): Promise<any>;
  update(object: string, idOrData: any, dataOrOptions?: any, options?: any): Promise<any>;
  delete(object: string, options?: any): Promise<any>;
}

export interface ApprovalClock { now(): Date }

/**
 * Minimal automation surface the service uses to resume a suspended flow run
 * once a decision finalises a node-driven request. Optional — attached by the
 * plugin when an automation engine is present (see `approval-node.ts`).
 */
export interface ApprovalResumeSurface {
  resume?(runId: string, signal?: {
    output?: Record<string, unknown>;
    branchLabel?: string;
    /**
     * #3801: the engine refuses a resume of an `approval` suspension unless
     * the signal carries this marker — the proof that the resume is the tail
     * of a decision THIS service already authorized and recorded, not a raw
     * `POST …/runs/:runId/resume` around it. Every resume below stamps it via
     * {@link ApprovalService.serviceResume}.
     */
    [RESUME_AUTHORITY_SERVICE]?: true;
  }): Promise<unknown>;
  /** Flow definition lookup, used to derive step-progress display data. */
  getFlow?(name: string): Promise<any | null>;
  /**
   * Terminally cancel a suspended run (ADR-0044). Used when a recall lands
   * during a revision window — the run is paused at the revise wait node,
   * which has no reject edge to resume down.
   */
  cancelRun?(runId: string, reason?: string): Promise<unknown>;
  /**
   * Look up a run's recorded outcome (#3456). Used by the dead-run sweep to ask
   * "is the run behind this pending request still alive?".
   *
   * The contract that makes the sweep safe is the answer for a run that is
   * merely SUSPENDED (the normal state of a run waiting on an approval): the
   * engine writes no execution-log entry until a run reaches a terminal state,
   * so a suspended run resolves to `null`, never to a status. The sweep
   * therefore acts only on an explicit terminal-failure status and treats
   * `null` — unknown run, evicted log, no durable store, no automation engine —
   * as "still alive".
   */
  getRun?(runId: string): Promise<{ status?: string } | null>;
}

/**
 * Optional messaging surface (ADR-0012 `messaging` service). When attached,
 * thread interactions (reassign / remind / request-info / comment) notify the
 * affected users; without it they degrade to audit-only.
 */
export interface ApprovalMessagingSurface {
  emit(input: {
    topic: string;
    audience: string[];
    payload?: Record<string, unknown>;
    severity?: string;
    dedupKey?: string;
    source?: { object: string; id: string };
    actorId?: string;
  }): Promise<unknown>;
}

/** Minimum time between submitter reminders on one request. */
export const REMIND_COOLDOWN_MS = 4 * 60 * 60 * 1000;

/** Named job under which the SLA escalation scan is registered (ADR-0042). */
export const ESCALATION_JOB_NAME = 'approvals-sla-escalation';
/** Default interval between SLA escalation scans. */
export const ESCALATION_SCAN_INTERVAL_MS = 5 * 60 * 1000;
/** Reserved actor id for machine decisions made by the SLA scanner. */
export const SLA_ACTOR_ID = 'system:sla';
/** Reserved actor id for requests abandoned because their run died (#3456). */
export const DEAD_RUN_ACTOR_ID = 'system:dead-run';
/**
 * Run statuses that mean "this run will never resume", so a request still
 * pending on it is orphaned (#3456). A CLOSED set, deliberately: the dead-run
 * sweep treats every other answer — `paused` (a run waiting on its approval,
 * the normal case), `running`, an unknown status, or no answer at all — as
 * alive, so an unrecognised state can never cost someone a live approval.
 *
 * `completed` belongs here with the failure states. The approval node only
 * writes a request row on the path where it also suspends the run, and every
 * in-band transition (decide / recall / send-back / resubmit) finalises the
 * request *before* it resumes the run — so a completed run with a still-pending
 * request means the run was resumed out of band and left the request behind.
 */
const TERMINAL_RUN_STATUSES: ReadonlySet<string> = new Set([
  'completed', 'failed', 'cancelled', 'timed_out',
]);

/** Default lifetime of an actionable-link token (ADR-0043). */
export const ACTION_TOKEN_TTL_MS = 72 * 60 * 60 * 1000;

/** Outcome of redeeming (or peeking) an actionable-link token. */
export type ActionTokenOutcome =
  | { ok: true; action: 'approve' | 'reject'; request: ApprovalRequestRow; approverId: string }
  | { ok: false; reason: 'invalid' | 'expired' | 'consumed' | 'not_pending' | 'not_approver'; request?: ApprovalRequestRow };

const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;

/**
 * Who is acting, for the purpose of a data write made on their behalf (#3783).
 *
 * Reads the AUTHENTICATED principal off the execution context — deliberately not
 * `input.actorId`. When this was written the two could still disagree: every
 * public entrypoint took `actorId` from the request body (`body.actorId ??
 * context.userId`, see the REST approval routes) and the service only checked
 * that it named a pending approver, never that it was the caller. That was
 * called tolerable on an audit row — but the same unchecked value was the
 * authorization key, so it was in fact impersonation, and #3800 closed it:
 * {@link ApprovalService.resolveActor} now pins the actor to an identity the
 * server can prove belongs to the caller. This helper stays the separate,
 * stricter answer for a DATA WRITE, which wants the bare human id and never a
 * `type:value` slot literal or a machine sentinel.
 *
 * A caller holding a trustworthy actor with no session behind it — the ADR-0043
 * action link, whose token cryptographically binds exactly one approver — puts
 * that actor ON the context instead of relying on this.
 *
 * `null` for a machine caller (the SLA sweep passes {@link SYSTEM_CTX}), so a
 * reserved sentinel like {@link SLA_ACTOR_ID} can never surface as a `userId`.
 */
function actingUserId(context: SharingExecutionContext | undefined): string | null {
  const userId = (context as { userId?: unknown } | undefined)?.userId;
  return typeof userId === 'string' && userId ? userId : null;
}

/**
 * Max hops when following an OOO delegation chain (#1322 M1): A out → B, B out
 * → C, … Bounds the walk so a mis-configured chain can't loop or resolve
 * unboundedly; a cycle or self-reference also stops it early.
 */
const OOO_MAX_CHAIN = 8;

/**
 * Approver types resolved by QUERYING a graph rather than by taking `value`
 * literally (#3807). Each can legitimately come back empty — an unstaffed
 * position, an emptied team, a mis-pointed unit — and the caller then falls
 * back to a `type:value` literal that no user can act on. They are listed here
 * so that dead end gets one warning instead of passing in silence.
 *
 * `user` / `field` are deliberately absent: they resolve to the id they were
 * given without a lookup, so there is no "expanded to nobody" state to report.
 * `business_unit` / `bu` are the accepted dialects of `department`.
 */
const GRAPH_APPROVER_TYPES: ReadonlySet<string> = new Set([
  'team', 'department', 'business_unit', 'bu', 'position', 'org_membership_level', 'manager',
]);

/** One OOO delegation hop applied while resolving an approver (#1322 M1/M4). */
interface OooSubstitution {
  /** The approver who was skipped (out of office). */
  from: string;
  /** The delegate the slot was routed to. */
  to: string;
  /** The delegator's declared reason, if any. */
  reason: string | null;
}

/**
 * The CLOSED set of namespace roots an `expression` approver may reference
 * (#3447 P2). Three explicit times/sources, no `record`, no bare field names:
 * `record` means "the record at event time" everywhere else on the platform
 * (flow conditions: trigger snapshot; hooks: the write payload), so binding it
 * here — to either time — would silently alias one meaning to the other. The
 * runtime CEL env treats unknown roots as `dyn` (→ `null` → an empty slate),
 * so out-of-contract roots MUST be rejected before evaluation; both this
 * pre-check and the lint rule read the roots via
 * {@link collectCelRootIdentifiers} so they can never drift.
 */
const APPROVER_EXPRESSION_ROOTS = new Set(['current', 'trigger', 'vars']);

/**
 * Evaluation context an approval node hands to `expression` approvers
 * (#3447 P2). `current` (the live record) is supplied by openNodeRequest's
 * re-read; these two carry the other roots.
 */
export interface ApproverExpressionContext {
  /** Submit-time snapshot (the flow's `$record`) — bound as `trigger.*`. */
  trigger?: Record<string, unknown> | null;
  /** Flow variables at node entry (nested by dotted key) — bound as `vars.*`. */
  vars?: Record<string, unknown> | null;
}

/**
 * Non-request outcome of {@link ApprovalService.openNodeRequest}: the node
 * resolved an empty approver slate and its `onEmptyApprovers: 'auto_approve'`
 * policy waved it through (#3447 P2). No `sys_approval_request` row exists —
 * nobody was ever asked — so the node must complete down its `approve` edge
 * instead of suspending.
 */
export interface ApprovalNodeAutoOutcome {
  autoApproved: true;
  reason: 'empty_approvers';
}

function uid(prefix: string): string {
  const g: any = globalThis as any;
  if (g.crypto?.randomUUID) return `${prefix}_${g.crypto.randomUUID()}`;
  return `${prefix}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
}

function parseJson<T = any>(raw: unknown, fallback: T): T {
  if (raw == null || raw === '') return fallback;
  if (typeof raw === 'string') {
    try { return JSON.parse(raw) as T; } catch { return fallback; }
  }
  return raw as T;
}

function csvSplit(raw: unknown): string[] {
  if (!raw) return [];
  if (Array.isArray(raw)) return raw.map(String).filter(Boolean);
  return String(raw).split(',').map(s => s.trim()).filter(Boolean);
}

/**
 * Humanize a machine name for display fallback: strips a `flow:` prefix and
 * title-cases underscore/dash segments (`flow:manager_review` → "Manager
 * Review"). Used only when no authored label was snapshotted on the row.
 */
function prettifyMachineName(raw: string | null | undefined): string | undefined {
  if (!raw) return undefined;
  const base = String(raw).replace(/^flow:/, '').trim();
  if (!base) return undefined;
  return base
    .split(/[_\-\s]+/)
    .filter(Boolean)
    .map(w => w.charAt(0).toUpperCase() + w.slice(1))
    .join(' ');
}

function rowFromRequest(row: any): ApprovalRequestRow {
  // Authored display labels ride the node-config snapshot (`__flowLabel` /
  // `__nodeLabel`) so they survive without a schema migration; fall back to a
  // prettified machine name for rows written before labels were captured.
  const cfg = parseJson<any>(row.node_config_json, undefined);
  return {
    id: String(row.id),
    organization_id: row.organization_id ?? undefined,
    process_name: String(row.process_name ?? ''),
    object_name: String(row.object_name ?? ''),
    record_id: String(row.record_id ?? ''),
    submitter_id: row.submitter_id ?? undefined,
    submitter_comment: row.submitter_comment ?? undefined,
    status: (row.status as ApprovalStatus) ?? 'pending',
    current_step: row.current_step ?? undefined,
    current_step_index: row.current_step_index ?? undefined,
    pending_approvers: csvSplit(row.pending_approvers),
    payload: parseJson(row.payload_json, undefined),
    flow_run_id: row.flow_run_id ?? undefined,
    flow_node_id: row.flow_node_id ?? undefined,
    completed_at: row.completed_at ?? undefined,
    created_at: row.created_at ?? undefined,
    updated_at: row.updated_at ?? undefined,
    // The row is created at submission time; expose the stable inbox-facing name.
    submitted_at: row.created_at ?? undefined,
    process_label: cfg?.__flowLabel ?? prettifyMachineName(row.process_name),
    step_label: cfg?.__nodeLabel ?? prettifyMachineName(row.current_step),
    sla_due_at: slaDueAt(row.created_at, cfg),
    // ADR-0044 revision round (rides the config snapshot; absent ⇒ round 1).
    round: typeof cfg?.__round === 'number' ? cfg.__round : undefined,
    // #3447 P2: the node's author-declared decision outputs, surfaced so a
    // decision UI can render input fields for them and POST `outputs` on
    // approve/reject. Per-request (each node declares its own), which is why
    // this rides the row instead of the static action params. Two shapes for
    // version skew: `decision_outputs` stays the bare KEY list an older
    // console renders as text inputs; `decision_output_defs` carries the
    // normalized typed declarations a picker-aware console prefers.
    ...(() => {
      const defs = normalizeDecisionOutputs(cfg?.decisionOutputs);
      return defs.length
        ? { decision_outputs: defs.map(d => d.key), decision_output_defs: defs }
        : {};
    })(),
  } as any;
}

/** `created_at + escalation.timeoutHours`, when the node declares an SLA. */
function slaDueAt(createdAt: unknown, cfg: any): string | undefined {
  const hours = cfg?.escalation?.timeoutHours;
  if (typeof hours !== 'number' || hours <= 0 || !createdAt) return undefined;
  const t = Date.parse(String(createdAt));
  if (Number.isNaN(t)) return undefined;
  return new Date(t + hours * 3600_000).toISOString();
}

/**
 * Normalize one raw `attachments` entry into an {@link ApprovalActionAttachment}.
 *
 * `sys_approval_action.attachments` is a `Field.file` (multiple), so the column
 * **stores opaque `sys_file` ids** — that is the stored form of every media
 * field (ADR-0104 D3). What arrives here is whichever of three forms the read
 * path produced:
 *
 *  1. the **expanded** `{ id, name, size, mimeType, url }` the ObjectQL read
 *     path resolves a stored id into — the normal case;
 *  2. a **bare id**, when there was nothing to expand it into (storage service
 *     absent, file not committed);
 *  3. a **legacy inline blob** (`{ file_id, name, mime_type, url, … }`) written
 *     before file-as-reference, until the backfill converts it.
 *
 * The original mapping did `String(entry)`, which turned form 1 into the
 * literal `"[object Object]"` — so the inbox timeline showed a nameless,
 * un-openable attachment chip (#3266 follow-up; caught by browser verification).
 *
 * Note the casing: the expanded form carries `mimeType`, the legacy blob
 * `mime_type`. Both are accepted for the duration of the migration window.
 */
function normalizeActionAttachment(entry: any): ApprovalActionAttachment | undefined {
  if (entry == null) return undefined;
  // Form 2 — a bare reference. `isFileIdToken` is the platform's single arbiter
  // of "is this string an opaque file id, or a URL?", shared with the engine's
  // read resolver, so the two cannot disagree about what counts as an id.
  if (typeof entry === 'string') {
    const id = entry.trim();
    if (!id) return undefined;
    return isFileIdToken(id) ? { id } : { id, url: id };
  }
  if (typeof entry === 'object') {
    // Forms 1 and 3 — `file_id` is the legacy blob's key for the same thing.
    const id = entry.id ?? entry.file_id;
    if (id == null || String(id) === '') return undefined;
    const mimeType = entry.mimeType ?? entry.mime_type;
    return {
      id: String(id),
      name: typeof entry.name === 'string' ? entry.name : undefined,
      url: typeof entry.url === 'string' ? entry.url : undefined,
      mimeType: typeof mimeType === 'string' ? mimeType : undefined,
      size: typeof entry.size === 'number' ? entry.size : undefined,
    };
  }
  return undefined;
}

function rowFromAction(row: any): ApprovalActionRow {
  const attachments = Array.isArray(row.attachments)
    ? row.attachments.map(normalizeActionAttachment).filter((a: ApprovalActionAttachment | undefined): a is ApprovalActionAttachment => !!a)
    : [];
  return {
    id: String(row.id),
    request_id: String(row.request_id),
    step_name: row.step_name ?? undefined,
    step_index: row.step_index ?? undefined,
    action: row.action,
    actor_id: row.actor_id ?? undefined,
    comment: row.comment ?? undefined,
    // Decision attachments (#3266): rich descriptors carrying the display name +
    // download URL, so consumers label/open them without reading `sys_file`.
    attachments: attachments.length ? attachments : undefined,
    created_at: row.created_at ?? undefined,
  };
}

export interface ApprovalServiceOptions {
  engine: ApprovalEngine;
  clock?: ApprovalClock;
  logger?: { info?: (msg: any, ...rest: any[]) => void; warn?: (msg: any, ...rest: any[]) => void; error?: (msg: any, ...rest: any[]) => void; debug?: (msg: any, ...rest: any[]) => void };
  /**
   * Optional automation surface used to resume a suspended flow run when a
   * decision finalises a request. Usually attached after construction via
   * {@link ApprovalService.attachAutomation} once the automation engine is
   * available.
   */
  automation?: ApprovalResumeSurface;
  /** Optional messaging service for thread notifications. */
  messaging?: ApprovalMessagingSurface;
  /**
   * Absolute origin prefixed onto actionable links (ADR-0043), e.g.
   * `https://app.example.com`. Defaults to relative URLs, which work inside
   * the Console and IM webviews; outbound email needs the absolute form.
   */
  publicBaseUrl?: string;
  /**
   * [ADR-0105 D9] The tenancy posture in force. Cross-organization approver
   * targeting is a `group`-posture capability; the resolver refuses the
   * declaration under any other posture rather than silently ignoring it.
   * Absent (a stack booted with no tenancy service) reads as "unknown" and the
   * guard stands down.
   */
  tenancyPosture?: () => string | undefined;
}

export class ApprovalService implements IApprovalService {
  private readonly engine: ApprovalEngine;
  private readonly clock: ApprovalClock;
  private readonly logger?: ApprovalServiceOptions['logger'];
  private automation?: ApprovalResumeSurface;
  private messaging?: ApprovalMessagingSurface;
  private publicBaseUrl: string;
  private tenancyPosture?: () => string | undefined;

  constructor(opts: ApprovalServiceOptions) {
    this.engine = opts.engine;
    this.clock = opts.clock ?? { now: () => new Date() };
    this.logger = opts.logger;
    this.automation = opts.automation;
    this.messaging = opts.messaging;
    this.publicBaseUrl = (opts.publicBaseUrl ?? '').replace(/\/$/, '');
    this.tenancyPosture = opts.tenancyPosture;
  }

  /** Attach (or replace) the ADR-0105 D9 posture provider. */
  attachTenancyPosture(provider: () => string | undefined): void {
    this.tenancyPosture = provider;
  }

  /** Deps bundle for the ADR-0105 D9 org-scope helpers. */
  private get orgScopeDeps(): ApproverOrgScopeDeps {
    return {
      engine: this.engine as unknown as ApproverOrgScopeEngine,
      posture: this.tenancyPosture,
      logger: this.logger,
    };
  }

  /**
   * [ADR-0105 D9] Which organization's directory resolves ONE approver spec.
   * Absent declaration ⇒ the request's own organization (unchanged, no reads).
   */
  private async directoryOrgFor(a: any, requestOrgId: string | null | undefined): Promise<string | null | undefined> {
    const rawType = String(a?.type ?? '');
    return resolveApproverDirectoryOrg(
      this.orgScopeDeps,
      a?.organization,
      requestOrgId,
      rawType,
      approverTypeIsOrgScoped(rawType),
    );
  }

  /** Attach (or replace) the automation surface used to resume flow runs. */
  attachAutomation(automation: ApprovalResumeSurface): void {
    this.automation = automation;
  }

  /** Attach (or replace) the messaging surface used for thread notifications. */
  attachMessaging(messaging: ApprovalMessagingSurface): void {
    this.messaging = messaging;
  }

  /** Best-effort notification fan-out — failures only log. */
  private async notify(input: {
    topic: string;
    audience: string[];
    payload?: Record<string, unknown>;
    dedupKey?: string;
    source?: { object: string; id: string };
    actorId?: string;
  }): Promise<number> {
    const audience = input.audience.filter(a => a && !a.includes(':'));
    if (!this.messaging || !audience.length) return 0;
    // Deep-link the inbox (#2678 P1.5): a notification about one request should
    // land on that request, not the bare inbox. Rewritten centrally so every
    // call site — and any future one — inherits it; the query param is read by
    // the console inbox to auto-open the drawer.
    let payload = input.payload;
    if (
      payload?.actionUrl === '/system/approvals'
      && input.source?.object === 'sys_approval_request'
      && input.source.id
    ) {
      payload = { ...payload, actionUrl: `/system/approvals?request=${encodeURIComponent(input.source.id)}` };
    }
    try {
      await this.messaging.emit({ severity: 'info', ...input, payload, audience });
      return audience.length;
    } catch (err: any) {
      this.logger?.warn?.('[approvals] notification failed', {
        topic: input.topic, error: err?.message ?? String(err),
      });
      return 0;
    }
  }

  /** Load a request row and assert it is still pending. */
  private async loadPendingRow(requestId: string): Promise<any> {
    if (!requestId) throw new Error('VALIDATION_FAILED: requestId is required');
    const rows = await this.engine.find('sys_approval_request', {
      where: { id: requestId }, limit: 1, context: SYSTEM_CTX,
    });
    const raw: any = Array.isArray(rows) ? rows[0] : null;
    if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
    if (raw.status !== 'pending') throw new Error(`INVALID_STATE: request is ${raw.status}`);
    return raw;
  }

  /**
   * Privileged-override gate (#3424). A stuck approval — one routed to a
   * position/team with no holders (so its `pending_approvers` is only an
   * unresolvable `type:value` literal) or to approvers who have all since left —
   * is otherwise undecidable: no concrete user is in the slate, so every normal
   * `decide` / `reassign` / `recall` is `FORBIDDEN` and (with `lockRecord`) the
   * record stays locked forever with no in-product recovery. A platform or
   * tenant admin — the same posture the engine's superuser bypass already
   * trusts — may always act on a PENDING request to release it: approve, reject,
   * reassign it to a real approver, or recall it.
   *
   * A platform admin crosses the tenant wall (matching the unscoped
   * `admin_full_access` evidence); a tenant admin may override only within their
   * own org (or an org-less request). A system context always passes. Signals are
   * read defensively off the resolved exec context (`permissions` / `positions` /
   * the derived `posture`, ADR-0095) so any transport that resolves through the
   * shared authz resolver lights this up without extra wiring.
   */
  private isOverrideActor(context: SharingExecutionContext, requestOrg?: string | null): boolean {
    if (!context) return false;
    if (context.isSystem) return true;
    const perms = Array.isArray(context.permissions) ? context.permissions : [];
    const positions = Array.isArray(context.positions) ? context.positions : [];
    const posture = (context as any).posture;
    const isPlatformAdmin = posture === 'PLATFORM_ADMIN'
      || perms.includes(ADMIN_FULL_ACCESS)
      || positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN);
    if (isPlatformAdmin) return true;
    const isTenantAdmin = posture === 'TENANT_ADMIN'
      || ORGANIZATION_ADMIN_GRANTS.some((n) => perms.includes(n))
      || positions.includes(BUILTIN_IDENTITY_ORG_OWNER)
      || positions.includes(BUILTIN_IDENTITY_ORG_ADMIN);
    if (!isTenantAdmin) return false;
    // A tenant admin's authority stops at their own org; a null-org request is
    // global and any admin may release it.
    const actorTenant = (context as any).tenantId ?? (context as any).organizationId ?? null;
    return requestOrg == null || (actorTenant != null && String(requestOrg) === String(actorTenant));
  }

  /**
   * Pin the acting identity to the AUTHENTICATED CALLER (#3800).
   *
   * Every public entrypoint accepts an `actorId`, and the REST routes fill it
   * from `body.actorId ?? body.actor_id ?? context.userId` — so before this
   * gate the body won. The authorization checks downstream all read that value
   * (`pending_approvers.includes(input.actorId)`, `submitter_id === actorId`),
   * which made the body-supplied string not merely the audit label but the key
   * that opens the door: any authenticated user could name a pending approver
   * and have that approver's decision recorded and the owning flow resumed.
   * #3783 drew this line for the data-write identity ({@link actingUserId});
   * this closes the authorization half.
   *
   * A caller may still name an identity OTHER than their bare user id, because
   * a slot legitimately can be keyed by one: `resolveApproverSpec` stores the
   * `type:value` literal when a graph lookup yields nothing, and an author may
   * write an email as a `user` approver. So the rule is not "actorId must equal
   * userId" — it is **"actorId must be an identity the SERVER can prove belongs
   * to the caller"**. Anything else is `FORBIDDEN`.
   *
   * A system context is exempt and keeps its explicit actor: the SLA sweep
   * passes the reserved {@link SLA_ACTOR_ID} sentinel, and the ADR-0043 action
   * link passes the approver its single-use token is cryptographically bound to
   * (having also put them on the context). Those are the only two callers that
   * hold a trustworthy actor with no session behind them.
   *
   * A caller with NO identity at all cannot act. That case is reachable: the
   * REST anonymous-deny only fires when `api.requireAuth` is set, so without it
   * an anonymous request previously decided approvals outright by naming one.
   */
  private async resolveActor(
    actorId: string | undefined,
    context: SharingExecutionContext,
  ): Promise<string> {
    // The machine callers — their actor is server-minted, not caller-supplied.
    if (context?.isSystem) {
      if (!actorId) throw new Error('VALIDATION_FAILED: actorId is required');
      return actorId;
    }
    const uid = actingUserId(context);
    if (!uid) {
      throw new Error('FORBIDDEN: an approval action requires an authenticated caller');
    }
    // The common case: no actor named, or the caller named themselves.
    if (!actorId || String(actorId) === uid) return uid;

    // Named something else — allow it ONLY if the server can prove the caller
    // holds that identity. `positions` is resolved by the shared authz resolver
    // (never client-supplied); `role:` is the ADR-0090 D3 deprecated spelling
    // that 15.x-era slots and the Console's own identity list still carry.
    const named = String(actorId);
    for (const position of context.positions ?? []) {
      if (named === `position:${position}` || named === `role:${position}`) return named;
    }
    // Email last — it costs a read, so only when nothing cheaper matched.
    if (named.includes('@') && await this.callerHasEmail(uid, named)) return named;

    throw new Error(
      `FORBIDDEN: cannot act as '${named}' — an approval action is recorded against the authenticated caller`,
    );
  }

  /** Does `userId`'s own account carry `email`? (Slots keyed by email, #3800.) */
  private async callerHasEmail(userId: string, email: string): Promise<boolean> {
    try {
      const rows = await this.engine.find('sys_user', {
        where: { id: userId }, limit: 1, context: SYSTEM_CTX,
      });
      const row: any = Array.isArray(rows) ? rows[0] : null;
      return !!row?.email && String(row.email).toLowerCase() === email.toLowerCase();
    } catch {
      return false;
    }
  }

  /**
   * Expand the approvers on an Approval node into user IDs by querying the
   * graph tables for `team:` / `department:` / `position:` /
   * `org_membership_level:` / `manager:` approver types. Falls back to a
   * prefixed literal (`type:value`) when graph lookups produce nothing — so
   * existing fixtures and flows that rely on substring matching keep working.
   *
   * **Graph semantics:**
   *   - `team`       → flat members of `sys_team` (better-auth; no BFS)
   *   - `department` → recursive BFS of `sys_business_unit.parent_business_unit_id`
   *                    → members of every descendant via `sys_business_unit_member`
   *   - `position`   → holders via `sys_user_position` ∪ `sys_member.role`
   *                    transition source (ADR-0090 D3 / ADR-0057 D4)
   *   - `org_membership_level`
   *                  → users with `sys_member.role = value` in tenant — the
   *                    better-auth MEMBERSHIP TIER (owner/admin/member), not a
   *                    position; author `position` for org positions
   *   - `manager`    → `sys_user.manager_id` of `record[value] ?? record.owner_id`
   *   - `field`      → literal user id stored in `record[value]`
   *   - `user`       → literal value
   *
   * `role` is accepted as the deprecated spelling of `org_membership_level`
   * (ADR-0090 D3) for one window: it resolves identically and logs a warning.
   *
   * **Out-of-office (#1322 M1):** individually-routed approvers — the ones that
   * resolve to a specific person (`user` / `field` / `manager`) — are passed
   * through {@link ApprovalService.applyOooDelegation}, which reroutes them onto
   * an active delegate when the resolved user has declared OOO. Group/graph
   * approvers (`team` / `department` / `position` / `org_membership_level`) are
   * left untouched: a group still has its other members, and position-routed
   * leave is already covered by ADR-0091 job delegation. Pass an `opts.now` /
   * `opts.substitutions` collector to record the hops for audit + notification.
   */
  private async expandApprovers(
    step: any,
    record?: any,
    organizationId?: string | null,
    opts?: {
      now?: number;
      substitutions?: OooSubstitution[];
      groups?: Record<string, string[]>;
      /** #3447 P2: `trigger`/`vars` roots for `expression` approvers. */
      exprCtx?: ApproverExpressionContext;
      /**
       * #3447 P2 audit collector: what each dynamic spec resolved FROM (the
       * live field value / the expression's intermediate values), snapshotted
       * as `__resolvedFrom` so "why these people" stays answerable later.
       */
      resolvedFrom?: Record<string, unknown>;
    },
  ): Promise<string[]> {
    if (!step || !Array.isArray(step.approvers)) return [];
    const now = opts?.now ?? this.clock.now().getTime();
    const out: string[] = [];
    const specs: any[] = step.approvers;
    for (let idx = 0; idx < specs.length; idx++) {
      const a = specs[idx];
      if (!a) continue;
      // Approvers without an explicit `group` each form their own group keyed
      // by position (#3266), so a plain per-approver list behaves predictably.
      const groupKey = a.group != null && String(a.group) !== '' ? String(a.group) : `#${idx}`;

      // #3447 P2: `expression` approvers resolve OUTSIDE resolveApproverSpec —
      // a graph-expanded expression (resolveAs: department/…) must key each
      // intermediate value as its own per_group group, which the flat string[]
      // contract of resolveApproverSpec cannot carry.
      if (canonicalApproverType(String(a.type)) === 'expression') {
        const resolved = await this.resolveExpressionApprovers(
          a, record, organizationId, now, opts?.substitutions, opts?.exprCtx,
        );
        if (opts?.resolvedFrom) opts.resolvedFrom[`expression#${idx}`] = resolved.raw;
        for (const entry of resolved.slots) {
          if (!entry.id) continue;
          out.push(entry.id);
          if (opts?.groups) {
            (opts.groups[entry.id] ??= []).push(entry.subGroup ? `${groupKey}:${entry.subGroup}` : groupKey);
          }
        }
        continue;
      }

      if (opts?.resolvedFrom && canonicalApproverType(String(a.type)) === 'field' && a.value != null) {
        opts.resolvedFrom[`field:${a.value}`] = (record as any)?.[a.value] ?? null;
      }
      const ids = await this.resolveApproverSpec(a, record, organizationId, now, opts?.substitutions);
      // per_group (#3266): tag each resolved id with this spec's group.
      for (const u of ids) {
        if (!u) continue;
        out.push(u);
        if (opts?.groups) (opts.groups[u] ??= []).push(groupKey);
      }
    }
    return out.filter(Boolean);
  }

  /**
   * Resolve ONE approver spec to concrete approver identities, applying OOO
   * substitution (#1322) to individually-routed types. Extracted from
   * {@link ApprovalService.expandApprovers} so the caller can tag each spec's
   * resolved ids with a group (#3266) without duplicating the resolution logic.
   * Returns the `type:value` literal as a single-element fallback when a graph
   * lookup yields nothing — same behaviour as before the extraction.
   */
  private async resolveApproverSpec(
    a: any,
    record: any,
    organizationId: string | null | undefined,
    now: number,
    substitutions?: OooSubstitution[],
  ): Promise<string[]> {
    // ADR-0090 D3: `role` is the deprecated spelling of `org_membership_level`.
    // Resolve on the canonical type, but keep the AUTHORED spelling in the
    // `type:value` fallback below — stored `sys_approval_approver` rows and
    // `pending_approvers` slots from 15.x carry the old literal.
    const type = canonicalApproverType(String(a.type));
    if (type !== a.type) {
      this.logger?.warn?.(
        `[approvals] approver type '${a.type}' is deprecated (ADR-0090 D3) — author '${type}' instead`,
        { deprecated: a.type, canonical: type },
      );
    }
    if (type === 'user') {
      return this.applyOooDelegation(String(a.value), now, organizationId, substitutions);
    }
    if (type === 'field' && record) {
      // #3447: a record field can name MANY approvers — a multi-select user
      // field arrives as an array (or a legacy CSV string). Fan each out into
      // its own slot and OOO-substitute per person; collapsing to `String(...)`
      // (→ `'u1,u2'`) would mint one bogus approver id and skip every delegate.
      const out: string[] = [];
      for (const id of csvSplit((record as any)[a.value])) {
        out.push(...await this.applyOooDelegation(id, now, organizationId, substitutions));
      }
      return out;
    }
    // [ADR-0105 D9] WHERE this approver is looked up — the request's own
    // organization unless the spec targets another one in the same group.
    // Resolution failures propagate: they are routing bugs, and this call is
    // OUTSIDE the swallowing try below on purpose (see the catch's comment).
    const directoryOrg = await this.directoryOrgFor(a, organizationId);
    const crossOrg = directoryOrg !== organizationId;
    // A cross-org slate is filtered to the people who can actually READ the
    // request (D2 union); same-org routing is untouched and does no extra read.
    const bounded = async (users: string[]): Promise<string[]> => (
      crossOrg
        ? filterApproversWhoCanRead(this.orgScopeDeps, users, organizationId, {
          approverType: type, value: a.value != null ? String(a.value) : undefined,
          directoryOrgId: directoryOrg,
        })
        : users
    );

    try {
      if (type === 'team') {
        const users = await this.expandTeamUsers(String(a.value));
        if (users.length) return users;
      } else if (type === 'department' || type === 'business_unit' || type === 'bu') {
        const users = await bounded(await this.expandBusinessUnitUsers(String(a.value), directoryOrg));
        if (users.length) return users;
      } else if (type === 'position') {
        const users = await bounded(await this.expandPositionUsers(String(a.value), directoryOrg));
        if (users.length) return users;
      } else if (type === 'org_membership_level') {
        const users = await bounded(await this.expandMembershipTierUsers(String(a.value), directoryOrg));
        if (users.length) return users;
      } else if (type === 'manager' && record) {
        const subject = (record as any)[a.value] ?? (record as any).owner_id;
        if (subject) {
          const mgr = await this.lookupManager(String(subject));
          if (mgr) return this.applyOooDelegation(mgr, now, organizationId, substitutions);
        }
      }
    } catch { /* a directory lookup failed → fall through to the literal slot */ }
    // #3508: `queue` is declared-but-unenforced — there is no queue branch
    // above, so a queue approver always lands here and the `queue:<id>` slot
    // routes to nobody. The spec marks it non-authorable
    // (NON_AUTHORABLE_APPROVER_TYPES) so designers stop offering it; warn for
    // the stored flows that still carry one, so the silent dead slot is at
    // least visible to operators.
    if (type === 'queue') {
      this.logger?.warn?.(
        `[approvals] approver type 'queue' is not implemented — the slot resolves to nobody (#3508)`,
        { value: a.value },
      );
    } else if (GRAPH_APPROVER_TYPES.has(type)) {
      // #3807 follow-up — every OTHER way to land here is a graph type whose
      // lookup produced nobody, and the literal below is a slot no user can
      // ever act on. That silence is what let #3807 hide: a `department`
      // approver pointing at a seeded (env-wide) unit resolved to
      // `department:<id>` on every request, the request opened with an empty
      // slate, and nothing in the logs said so — the first symptom was a
      // permanently stuck approval (#3424). The fallback itself stays (a
      // literal keeps 15.x slots and substring fixtures working); it just
      // stops being invisible.
      this.logger?.warn?.(
        `[approvals] approver '${type}:${a.value}' expanded to nobody — the slot routes to no one `
        + `and the request cannot advance until someone is added or the approver is re-pointed (#3807)`,
        { type, value: a.value, organizationId: organizationId ?? null },
      );
    }
    return [`${a.type}:${a.value}`];
  }

  /**
   * Resolve an `expression` approver (#3447 P2): evaluate its CEL source at
   * node entry against the three explicit roots — `current` (live record),
   * `trigger` (submit snapshot), `vars` (flow variables) — then expand the
   * result into people per `resolveAs`.
   *
   * Every failure here THROWS (config/parse errors as `VALIDATION_FAILED`,
   * evaluation faults as `EXPRESSION_FAILED`) so the approval node fails
   * loudly instead of opening a request routed to nobody — an approver
   * expression that cannot run is a routing bug, never "condition not met".
   * Error messages carry the correct spelling because their primary reader is
   * the AI author fixing the flow on the next validate pass.
   *
   * Returns `slots` (approver id + optional per_group sub-key) and `raw` (the
   * expression's own values, pre-expansion) for the `__resolvedFrom` audit.
   */
  private async resolveExpressionApprovers(
    a: any,
    liveRecord: any,
    organizationId: string | null | undefined,
    now: number,
    substitutions?: OooSubstitution[],
    exprCtx?: ApproverExpressionContext,
  ): Promise<{ slots: Array<{ id: string; subGroup?: string }>; raw: string[] }> {
    const source = String(a.value ?? '').trim();
    if (!source) {
      throw new Error('VALIDATION_FAILED: expression approver has an empty expression');
    }

    // Closed-root pre-check. The runtime env resolves ANY unknown root as dyn →
    // null, so `record.x` / a bare field would silently yield an empty slate;
    // reject it here with the correct spelling instead.
    const parsed = collectCelRootIdentifiers(source);
    if (!parsed.ok) {
      throw new Error(`VALIDATION_FAILED: expression approver does not parse: ${parsed.error} — source: \`${source}\``);
    }
    const illegal = parsed.roots.filter(r => !APPROVER_EXPRESSION_ROOTS.has(r));
    if (illegal.length) {
      const hint = illegal.includes('record') || illegal.includes('previous')
        ? `\`record\`/\`previous\` are not bound here — write \`current.<field>\` for the record's live state `
          + `at node entry, or \`trigger.<field>\` for the submit-time snapshot (\`vars.previous\` carries the pre-update row)`
        : `did you mean \`current.<field>\` (live record), \`trigger.<field>\` (submit snapshot), or \`vars.<name>\` (flow variable)?`;
      throw new Error(
        `VALIDATION_FAILED: expression approver references \`${illegal.join('`, `')}\` — `
        + `only \`current.*\`, \`trigger.*\` and \`vars.*\` are available; ${hint}. Source: \`${source}\``,
      );
    }

    const result = ExpressionEngine.evaluate(
      { dialect: 'cel', source },
      { extra: { current: liveRecord ?? {}, trigger: exprCtx?.trigger ?? {}, vars: exprCtx?.vars ?? {} } },
    );
    if (!result.ok) {
      throw new Error(
        `EXPRESSION_FAILED: expression approver failed to evaluate (${result.error.kind}): `
        + `${result.error.message} — source: \`${source}\``,
      );
    }

    // Normalize to a string list: a user-id/CSV string, an array of ids, or
    // null/empty (an EMPTY slate — legal, handled by onEmptyApprovers). Any
    // other shape is a config bug, rejected loudly.
    const value = result.value as unknown;
    let raw: string[];
    if (value == null || value === '') {
      raw = [];
    } else if (typeof value === 'string') {
      raw = csvSplit(value);
    } else if (Array.isArray(value)) {
      const bad = value.find(v => v != null && typeof v !== 'string' && typeof v !== 'number');
      if (bad !== undefined) {
        throw new Error(
          `EXPRESSION_FAILED: expression approver must yield ids (string / CSV / string array), `
          + `got an array containing ${typeof bad} — source: \`${source}\``,
        );
      }
      raw = value.map(v => String(v ?? '').trim()).filter(Boolean);
    } else {
      throw new Error(
        `EXPRESSION_FAILED: expression approver must yield ids (string / CSV / string array), `
        + `got ${typeof value} — source: \`${source}\``,
      );
    }

    // `resolveAs` expansion. `user` (default): each value IS a person —
    // individually routed, so OOO delegation applies (#1322). Graph kinds
    // re-expand each value through the same lookups the static types use; a
    // group still has its other members, so like the static graph types they
    // are NOT OOO-substituted, and with per_group each intermediate value
    // forms its own sub-group (one sign-off per returned department). A value
    // whose expansion is empty keeps a `<kind>:<value>` literal slot — same
    // unstaffed-target behaviour (and #3424 admin rescue) as the static types.
    const resolveAs = String(a.resolveAs ?? 'user');
    if (resolveAs === 'user') {
      const slots: Array<{ id: string }> = [];
      for (const id of raw) {
        for (const routed of await this.applyOooDelegation(id, now, organizationId, substitutions)) {
          slots.push({ id: routed });
        }
      }
      return { slots, raw };
    }
    // [ADR-0105 D9] An expression that re-expands into a graph kind consults the
    // same org-scoped directories the static types do, so it honours the same
    // targeting. Resolved once for the whole slate, before the per-value loop —
    // the declaration is a property of the spec, not of what the CEL returned.
    const directoryOrg = await this.directoryOrgFor(a, organizationId);
    const crossOrg = directoryOrg !== organizationId;
    const slots: Array<{ id: string; subGroup: string }> = [];
    for (const key of raw) {
      let users: string[] = [];
      try {
        if (resolveAs === 'department') users = await this.expandBusinessUnitUsers(key, directoryOrg);
        else if (resolveAs === 'position') users = await this.expandPositionUsers(key, directoryOrg);
        else if (resolveAs === 'team') users = await this.expandTeamUsers(key);
        else {
          throw new Error(
            `VALIDATION_FAILED: expression approver has unknown resolveAs '${resolveAs}' — `
            + `use 'user', 'department', 'position', or 'team'`,
          );
        }
      } catch (err: any) {
        if (String(err?.message ?? '').startsWith('VALIDATION_FAILED')) throw err;
        users = [];
      }
      if (crossOrg && users.length) {
        users = await filterApproversWhoCanRead(this.orgScopeDeps, users, organizationId, {
          approverType: resolveAs, value: key, directoryOrgId: directoryOrg,
        });
      }
      if (!users.length) {
        slots.push({ id: `${resolveAs}:${key}`, subGroup: key });
        continue;
      }
      for (const u of users) slots.push({ id: u, subGroup: key });
    }
    return { slots, raw };
  }

  /** Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy). */
  private async expandTeamUsers(teamId: string): Promise<string[]> {
    if (!teamId) return [];
    let rows: any[] = [];
    try {
      rows = await this.engine.find('sys_team_member', {
        filter: { team_id: teamId },
        fields: ['user_id'],
        limit: 10000,
        context: SYSTEM_CTX,
      } as any);
    } catch { rows = []; }
    return Array.from(new Set((rows ?? []).map((r: any) => String(r.user_id ?? '')).filter(Boolean)));
  }

  /**
   * Tenant scope for a `sys_business_unit` read that may legitimately be
   * env-wide (#3807).
   *
   * `organization_id = null` on a platform object means "owned by no
   * organization" — a row written by a seed, the file layer, or bootstrap,
   * i.e. before (or outside) any org exists. A strict
   * `organization_id = <request org>` equality made every such row invisible:
   * the seed check below found nothing, the whole expansion returned `[]`, and
   * the approver fell back to the dead `department:<id>` literal that routes to
   * nobody. That is not an edge case — an app's org tree is normally seeded
   * (a seed cannot know the org id the runtime mints at boot) while the
   * approval request always carries one, so EVERY department approver a
   * designer could pick resolved to nobody.
   *
   * Widen to "this org ∪ env-wide", the same predicate `sys_metadata`'s
   * pending-draft listing settled on for the identical reason. Another org's
   * unit still fails the match, so the wall between two organizations is
   * unchanged — only rows belonging to no org at all become visible.
   */
  private businessUnitOrgScope(
    filter: Record<string, unknown>,
    organizationId?: string | null,
  ): Record<string, unknown> {
    if (!organizationId) return filter;
    return { ...filter, $or: [{ organization_id: organizationId }, { organization_id: null }] };
  }

  /** Recursive department — walks `sys_business_unit.parent_business_unit_id`. */
  private async expandBusinessUnitUsers(businessUnitId: string, organizationId?: string | null): Promise<string[]> {
    if (!businessUnitId) return [];
    // Seed sanity check: skip if dept doesn't exist or is inactive within tenant.
    try {
      const seed = await this.engine.find('sys_business_unit', {
        filter: this.businessUnitOrgScope({ id: businessUnitId }, organizationId),
        fields: ['id', 'active'],
        limit: 1,
        context: SYSTEM_CTX,
      } as any);
      const seedRow: any = Array.isArray(seed) ? seed[0] : null;
      if (!seedRow || seedRow.active === false) return [];
    } catch { return []; }

    const seen = new Set<string>([businessUnitId]);
    const queue: string[] = [businessUnitId];
    while (queue.length) {
      const parent = queue.shift()!;
      let kids: any[] = [];
      try {
        const filter = this.businessUnitOrgScope(
          { parent_business_unit_id: parent, active: { $ne: false } },
          organizationId,
        );
        kids = await this.engine.find('sys_business_unit', { filter, fields: ['id'], limit: 1000, context: SYSTEM_CTX } as any);
      } catch { kids = []; }
      for (const k of kids ?? []) {
        const kid = String((k as any).id ?? '');
        if (kid && !seen.has(kid)) { seen.add(kid); queue.push(kid); }
      }
    }
    let rows: any[] = [];
    try {
      rows = await this.engine.find('sys_business_unit_member', {
        filter: { business_unit_id: { $in: Array.from(seen) } },
        fields: ['user_id'],
        limit: 10000,
        context: SYSTEM_CTX,
      } as any);
    } catch { rows = []; }
    return Array.from(new Set((rows ?? []).map((r: any) => String(r.user_id ?? '')).filter(Boolean)));
  }

  /**
   * Position holders (ADR-0090 D3): `sys_user_position` is the platform-owned
   * assignment table, keyed by the position's machine name (ADR-0057 D4),
   * unioned with the better-auth membership string (`sys_member.role`) as a
   * transition source — the same semantics as `PositionGraphService` in
   * `plugin-sharing`, so an approval routes to exactly the users the sharing
   * engine would expand for the same position.
   */
  private async expandPositionUsers(positionName: string, organizationId?: string | null): Promise<string[]> {
    if (!positionName) return [];
    const users = new Set<string>();
    const filter: any = { position: positionName };
    if (organizationId) filter.organization_id = organizationId;
    try {
      const rows = await this.engine.find('sys_user_position', {
        filter, fields: ['user_id'], limit: 10000, context: SYSTEM_CTX,
      } as any);
      for (const r of (rows ?? []) as any[]) {
        const uid = String(r.user_id ?? '');
        if (uid) users.add(uid);
      }
    } catch { /* table may not exist on minimal stacks — union source below still applies */ }
    // ADR-0057 D4 transition source: pre-migration stacks still carry the
    // position name in better-auth's `sys_member.role` column, so the same
    // lookup serves a position name here and a membership tier for
    // `org_membership_level` — the column is one, the two concepts are not.
    for (const uid of await this.expandMembershipTierUsers(positionName, organizationId)) users.add(uid);
    return Array.from(users);
  }

  /**
   * better-auth org-membership tier (`sys_member.role`: owner/admin/member) —
   * NOT positions. Named for the projection (`org_membership_level`, ADR-0057
   * D7 / ADR-0090 D3), not for better-auth's column: the column name is theirs
   * and stays, the platform-facing word does not.
   */
  private async expandMembershipTierUsers(tier: string, organizationId?: string | null): Promise<string[]> {
    if (!tier) return [];
    const filter: any = { role: tier };
    if (organizationId) filter.organization_id = organizationId;
    let rows: any[] = [];
    try {
      rows = await this.engine.find('sys_member', { filter, fields: ['user_id'], limit: 10000, context: SYSTEM_CTX } as any);
    } catch { rows = []; }
    return Array.from(new Set((rows ?? []).map((r: any) => String(r.user_id ?? '')).filter(Boolean)));
  }

  private async lookupManager(userId: string): Promise<string | null> {
    try {
      const rows = await this.engine.find('sys_user', {
        filter: { id: userId }, fields: ['id', 'manager_id'], limit: 1, context: SYSTEM_CTX,
      } as any);
      const row: any = Array.isArray(rows) ? rows[0] : null;
      return row?.manager_id ? String(row.manager_id) : null;
    } catch { return null; }
  }

  /**
   * Out-of-office auto-skip (#1322 M1). Given an individually-routed approver
   * id, follow any active `sys_approval_delegation` chain and return the id the
   * slot should actually go to — the delegate acts under their own identity, so
   * no impersonation is involved. Returns `[userId]` unchanged when there is no
   * active delegation. Each hop is appended to `collector` (when supplied) so
   * the caller can audit + notify (M4).
   *
   * The chain (A out → B, B out → C, …) is bounded by {@link OOO_MAX_CHAIN} and
   * stops on a self-reference or a cycle, so a mis-declared loop degrades to the
   * last reachable delegate rather than hanging.
   */
  private async applyOooDelegation(
    userId: string,
    now: number,
    organizationId?: string | null,
    collector?: OooSubstitution[],
  ): Promise<string[]> {
    const start = String(userId ?? '').trim();
    if (!start) return [];
    let current = start;
    const visited = new Set<string>([current]);
    for (let hop = 0; hop < OOO_MAX_CHAIN; hop++) {
      const del = await this.lookupActiveDelegation(current, now, organizationId);
      if (!del) break;
      const to = String(del.delegate_id ?? '').trim();
      if (!to || to === current || visited.has(to)) break; // no-op / self / cycle
      collector?.push({ from: current, to, reason: del.reason != null ? String(del.reason) : null });
      visited.add(to);
      current = to;
    }
    return [current];
  }

  /**
   * The active OOO delegation for a delegator at `now`, or null. Validity is the
   * shared `isGrantActive` half-open window (ADR-0091 D2), enforced here at
   * resolution time — never by a background job. When several rows are active,
   * the one expiring soonest wins (the most specific coverage window).
   */
  private async lookupActiveDelegation(
    delegatorId: string,
    now: number,
    organizationId?: string | null,
  ): Promise<any | null> {
    if (!delegatorId) return null;
    let rows: any[] = [];
    try {
      rows = await this.engine.find('sys_approval_delegation', {
        filter: { delegator_id: delegatorId },
        fields: ['id', 'delegator_id', 'delegate_id', 'valid_from', 'valid_until', 'reason', 'organization_id'],
        limit: 50,
        context: SYSTEM_CTX,
      } as any);
    } catch { return null; } // table absent on minimal stacks — no OOO, resolve as-is
    const active = (rows ?? []).filter((r: any) =>
      isGrantActive(r, now)
      // A null-org rule applies across tenants; a scoped rule only within its tenant.
      && (organizationId == null || r.organization_id == null || String(r.organization_id) === String(organizationId)));
    if (!active.length) return null;
    active.sort((a: any, b: any) => {
      const au = a.valid_until ? Date.parse(String(a.valid_until)) : Number.POSITIVE_INFINITY;
      const bu = b.valid_until ? Date.parse(String(b.valid_until)) : Number.POSITIVE_INFINITY;
      return au - bu;
    });
    return active[0];
  }

  /**
   * Mirror a request status onto a business-object field, if configured.
   *
   * **Elevated, but not anonymous (#3783).** The write stays `isSystem`: the
   * record is normally LOCKED while its approval is live and the submitter
   * cannot edit it, so only a platform write can land the status — that is what
   * the lock hook's system exemption (`lifecycle-hooks.ts`) is for. What it must
   * NOT do is throw away *who* caused the transition. Every status below is
   * something a specific human just did — a submitter submitting or recalling,
   * an approver deciding or sending back — and this write is what fires the
   * target object's record-change flows. With no `userId` on it those cascades
   * inherit no trigger user, and since #3760 a `runAs:'user'` run with no trigger
   * user has its data ops REFUSED — so "when the invoice is approved, do X", the
   * most natural approvals automation there is, had to declare `runAs:'system'`
   * and take blanket elevation for a case where a perfectly good scoped identity
   * existed. Re-attaching the actor lets those cascades run as the deciding user
   * with RLS enforced. Same shape the approval node already uses when it calls
   * into this service (`approval-node.ts`).
   *
   * `actorId` is `null` for the genuinely machine-driven transitions (the SLA
   * escalation's auto-decision, the dead-run sweep). There is no human to name
   * there, and naming a sentinel would put a non-user in `updated_by` and in
   * every downstream flow's identity. Those cascades stay user-less — a flow
   * that wants to react to them still has to declare `runAs:'system'`, which is
   * the honest answer rather than an oversight.
   *
   * Deliberately carries `userId` ONLY, not the request's org. On an
   * ExecutionContext `tenantId` is a driver-scoping knob, not attribution
   * (`buildDriverOptions` turns it into a tenant predicate on the update), so
   * passing it would newly org-scope this write and silently no-op the mirror on
   * a record whose org differs from the request's — while buying nothing: the
   * automation engine back-fills the run's `tenantId` from the resolved user's
   * own grants.
   */
  private async mirrorStatusField(
    object: string,
    recordId: string,
    field: string,
    status: string,
    actorId: string | null,
  ): Promise<void> {
    try {
      const context = actorId ? { ...SYSTEM_CTX, userId: actorId } : SYSTEM_CTX;
      await this.engine.update(object, { id: recordId, [field]: status }, { context });
    } catch (err: any) {
      this.logger?.warn?.(`[approvals] mirrorStatusField failed: ${err?.message ?? err}`);
    }
  }

  /**
   * Re-read a business record's CURRENT state by id so approver resolution binds
   * to live data at node entry, not the trigger snapshot the flow froze into
   * `$record` at submit time (#3447). A `field` / `manager` approver names *who*
   * decides, and an earlier node — or the approver of an earlier step — may have
   * written that routing field after submit (e.g. a lead reviewer picking which
   * departments co-review). Graph approvers (team / position / …) already query
   * live; this brings the in-record types into line.
   *
   * Read under system identity: approver routing is a platform concern and the
   * record is the flow's own subject, so the submitter's RLS/FLS must not narrow
   * it. Degrades to `fallback` (the snapshot) when the record can't be re-read —
   * hard-deleted between submit and node entry, or an object whose backend can't
   * serve a point read — warning rather than throwing so a transient miss can't
   * wedge an approval. That "warn but proceed" stance matches the
   * no-concrete-approver guard (#3424) and the "record is gone" enrichment path
   * that already falls back to the payload snapshot.
   */
  private async loadLiveRecord(object: string, recordId: string, fallback?: any): Promise<any> {
    try {
      const rows = await this.engine.find(object, {
        where: { id: recordId }, limit: 1, context: SYSTEM_CTX,
      } as any);
      const live = Array.isArray(rows) ? rows[0] : rows;
      if (live) return live;
      this.logger?.warn?.(
        `[approvals] live record ${object}/${recordId} not found at node entry — `
        + 'resolving approvers against the trigger snapshot (#3447 fallback).',
        { object, recordId },
      );
    } catch (err: any) {
      this.logger?.warn?.(
        `[approvals] live record re-read failed for ${object}/${recordId}: ${err?.message ?? err} — `
        + 'resolving approvers against the trigger snapshot (#3447 fallback).',
      );
    }
    return fallback ?? {};
  }

  // ── ADR-0019: Approval-as-flow-node ──────────────────────────
  //
  // A flow's Approval node opens a request via `openNodeRequest` (carrying its
  // own approvers/behavior config and the suspended run id), then suspends. A
  // later `decide` finalizes it and resumes the flow run down the matching
  // `approve`/`reject` edge. The record lock is enforced by a beforeUpdate hook
  // keyed on a *pending* request, so finalizing auto-releases it.

  /**
   * Open a pending approval request on behalf of a flow's Approval node. The
   * node config (approvers / behavior / status field) is snapshotted on the row
   * so a decision can be made without any process to resolve against.
   *
   * #3447 P2: may instead return an {@link ApprovalNodeAutoOutcome} — no
   * request opened — when the slate resolves empty and the node's
   * `onEmptyApprovers` policy is `auto_approve`.
   */
  async openNodeRequest(
    input: {
      object: string;
      recordId: string;
      runId: string;
      nodeId: string;
      config: ApprovalNodeConfig;
      flowName?: string;
      /** Authored flow label, snapshotted for inbox display. */
      flowLabel?: string;
      /** Authored node label, snapshotted for inbox display. */
      nodeLabel?: string;
      submitterId?: string | null;
      record?: any;
      organizationId?: string | null;
      /**
       * #3447 P2: flow variables at node entry (nested by dotted key, as the
       * engine's CEL conditions see them) — the `vars.*` root for `expression`
       * approvers. `input.record` doubles as their `trigger.*` root.
       */
      variables?: Record<string, unknown> | null;
    },
    context: SharingExecutionContext,
  ): Promise<ApprovalRequestRow | ApprovalNodeAutoOutcome> {
    if (!input.object) throw new Error('VALIDATION_FAILED: object is required');
    if (!input.recordId) throw new Error('VALIDATION_FAILED: recordId is required');
    if (!input.runId) throw new Error('VALIDATION_FAILED: runId is required');

    // One pending request per (object, record).
    const existing = await this.engine.find('sys_approval_request', {
      where: { object_name: input.object, record_id: input.recordId, status: 'pending' },
      limit: 1, context: SYSTEM_CTX,
    });
    if (Array.isArray(existing) && existing[0]) {
      throw new Error(`DUPLICATE_REQUEST: a pending approval already exists for ${input.object}/${input.recordId}`);
    }

    const ctxOrg = (context as any)?.organizationId ?? (context as any)?.tenantId ?? input.organizationId ?? null;
    const nowDate = this.clock.now();
    // OOO auto-skip (#1322 M1): reroute individually-routed approvers who are
    // out of office. Collected hops drive the audit + notification below (M4).
    const substitutions: OooSubstitution[] = [];
    // Group membership per resolved approver (#3266) — snapshotted so quorum /
    // per_group finalization is decided against the slate resolved at OPEN time
    // (OOO-substituted), not re-resolved live at each decision.
    const groups: Record<string, string[]> = {};
    // #3447: resolve approvers against the record's LIVE state at node entry, not
    // the trigger snapshot carried in `input.record`. This is the whole fix — an
    // earlier step may have written the field this node routes on.
    const liveRecord = await this.loadLiveRecord(input.object, input.recordId, input.record);
    const resolvedFrom: Record<string, unknown> = {};
    const approvers = await this.expandApprovers(
      { approvers: input.config.approvers }, liveRecord, ctxOrg, {
        now: nowDate.getTime(), substitutions, groups,
        exprCtx: { trigger: input.record ?? null, vars: input.variables ?? null },
        resolvedFrom,
      },
    );

    // Empty-slate policy (#3447 P2). "Empty" = no CONCRETE person — an
    // unstaffed position / empty expression result leaves only `type:value`
    // literal slots, decidable by nobody.
    if (!approvers.some(a => a && !a.includes(':'))) {
      const emptyPolicy = (input.config as any).onEmptyApprovers ?? 'admin_rescue';
      if (emptyPolicy === 'fail') {
        throw new Error(
          `NO_APPROVERS: approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no `
          + `concrete approver and its onEmptyApprovers policy is 'fail'. Check that the approver target(s) `
          + `are staffed / the routing field or expression yields user ids at node entry.`,
        );
      }
      if (emptyPolicy === 'auto_approve') {
        this.logger?.warn?.(
          `[approvals] approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no `
          + `concrete approver — auto-approving per onEmptyApprovers: 'auto_approve' (no request opened).`,
          { object: input.object, recordId: input.recordId, node: input.nodeId, resolved: approvers },
        );
        return { autoApproved: true, reason: 'empty_approvers' };
      }
      // #3424 admin_rescue (default): the request is still opened (a privileged
      // admin can override it, and legacy 15.x literal slots stay queryable) —
      // the only option that neither waves the record through nor kills the
      // run — but warn loudly so the misconfiguration surfaces instead of
      // silently locking the record with no obvious cause.
      this.logger?.warn?.(
        `[approvals] approval node '${input.nodeId}' on ${input.object}/${input.recordId} resolved to no concrete approver`
        + ' — the request is decidable only by a privileged admin. Check that the approver target(s) are staffed.',
        { object: input.object, recordId: input.recordId, node: input.nodeId, resolved: approvers },
      );
    }

    const now = nowDate.toISOString();
    const id = uid('areq');
    const processName = `flow:${input.flowName ?? input.nodeId}`;
    // Display labels ride the config snapshot (no schema migration needed);
    // `rowFromRequest` surfaces them as `process_label` / `step_label`.
    const configSnapshot: any = { ...input.config };
    if (input.flowLabel) configSnapshot.__flowLabel = input.flowLabel;
    if (input.nodeLabel) configSnapshot.__nodeLabel = input.nodeLabel;
    // Snapshot the resolved approver→group map for EVERY multi-approver
    // behavior (was quorum/per_group only). #3447 P2 makes this load-bearing
    // for unanimous too: an `expression` approver can only resolve at OPEN
    // time (decide has no flow variables to evaluate against), so the tally
    // must read the open-time slate — which also pins unanimous+field to the
    // slate the approvers actually saw, instead of re-reading a field that may
    // have changed again since.
    if (input.config.behavior && input.config.behavior !== 'first_response') {
      configSnapshot.__approverGroups = groups;
    }
    // #3447 P2: snapshot what the dynamic approver sources resolved FROM (the
    // live routing-field value / the expression's intermediate values) so the
    // audit trail answers "why these people" — the resolution INPUT, pairing
    // the resolution RESULT already persisted as `pending_approvers`.
    if (Object.keys(resolvedFrom).length) {
      configSnapshot.__resolvedFrom = resolvedFrom;
    }
    // ADR-0044 round numbering: rounds of a revise loop share the run — count
    // this (run, node)'s prior requests; the new one is round N+1. Stamped on
    // the snapshot (precedent: __flowLabel), so no schema migration.
    try {
      const prior = await this.engine.find('sys_approval_request', {
        where: { flow_run_id: input.runId, flow_node_id: input.nodeId }, limit: 500, context: SYSTEM_CTX,
      });
      const n = Array.isArray(prior) ? prior.length : 0;
      if (n > 0) configSnapshot.__round = n + 1;
    } catch { /* round display is best-effort */ }
    const row: any = {
      id,
      process_name: processName,
      object_name: input.object,
      record_id: input.recordId,
      submitter_id: input.submitterId ?? context.userId ?? null,
      status: 'pending',
      current_step: input.nodeId,
      current_step_index: 0,
      pending_approvers: approvers.join(','),
      payload_json: input.record != null ? JSON.stringify(input.record) : null,
      flow_run_id: input.runId,
      flow_node_id: input.nodeId,
      node_config_json: JSON.stringify(configSnapshot),
      organization_id: ctxOrg,
      created_at: now,
      updated_at: now,
    };
    await this.engine.insert('sys_approval_request', row, { context: SYSTEM_CTX });
    await this.syncApproverIndex(id, approvers, ctxOrg, now);
    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: id, organization_id: ctxOrg,
      step_name: input.nodeId, step_index: 0, action: 'submit',
      actor_id: input.submitterId ?? context.userId ?? null, comment: null, created_at: now,
    }, { context: SYSTEM_CTX });

    // OOO substitution audit + notification (#1322 M4). Each hop that rerouted
    // an approver away from an out-of-office user is recorded on the request's
    // audit trail (a system action, no human actor) and notified to both the
    // delegate — who now owns the slot — and the skipped approver.
    for (const sub of substitutions) {
      await this.engine.insert('sys_approval_action', {
        id: uid('aact'), request_id: id, organization_id: ctxOrg,
        step_name: input.nodeId, step_index: 0, action: 'ooo_substitute',
        actor_id: null,
        comment: `${sub.from} → ${sub.to}${sub.reason ? ` — ${sub.reason}` : ''}`,
        created_at: now,
      }, { context: SYSTEM_CTX });
      await this.notify({
        topic: 'approval.ooo_substituted',
        audience: [sub.to],
        source: { object: 'sys_approval_request', id },
        dedupKey: `approval-ooo-${id}-${sub.to}`,
        payload: {
          title: 'Approval routed to you (out-of-office cover)',
          message: `You are covering an approval on ${input.object}/${input.recordId} while ${sub.from} is out of office.`,
          actionUrl: '/system/approvals',
        },
      });
      await this.notify({
        topic: 'approval.ooo_skipped',
        audience: [sub.from],
        source: { object: 'sys_approval_request', id },
        dedupKey: `approval-ooo-skip-${id}-${sub.from}`,
        payload: {
          title: 'Approval routed to your delegate',
          message: `An approval on ${input.object}/${input.recordId} was routed to ${sub.to} while you are out of office.`,
          actionUrl: '/system/approvals',
        },
      });
    }

    // Record lock (when `lockRecord !== false`) is enforced by the beforeUpdate
    // hook keyed on the now-pending request; no extra write needed here.
    if (input.config.approvalStatusField) {
      // Attributed to whoever the row itself calls the submitter (#3783), so
      // there is exactly one answer to "who submitted this". Not the
      // {@link actingUserId} route: `submitterId` is server-supplied here (the
      // approval node passes the run's own trigger user) and unreachable from a
      // request body, so it carries none of the caller-controlled risk that rule
      // exists for — and it already resolves to `context.userId` in every
      // first-party path.
      await this.mirrorStatusField(
        input.object, input.recordId, input.config.approvalStatusField, 'pending',
        row.submitter_id ?? null,
      );
    }

    return rowFromRequest(row);
  }

  /**
   * True when the approve tally satisfies the node's `behavior` (#3266):
   *  - `unanimous` — every resolved approver approved.
   *  - `quorum` — at least `minApprovals` distinct approvals (default = all).
   *  - `per_group` — every group reached `minApprovals` approvals (default 1).
   * Thresholds are clamped to the resolvable count / group size, so a mis-set
   * value can never deadlock a request.
   */
  private isApprovalSatisfied(
    behavior: string,
    config: ApprovalNodeConfig,
    original: string[],
    groupMap: Record<string, string[]>,
    approved: Set<string>,
  ): boolean {
    if (behavior === 'unanimous') {
      return original.length > 0 && original.every(a => approved.has(a));
    }
    if (behavior === 'quorum') {
      const n = original.length || 1;
      const need = Math.min(Math.max(1, config.minApprovals ?? n), n);
      // Count distinct approvals (robust to OOO/reassign changing who holds a slot).
      return approved.size >= need;
    }
    if (behavior === 'per_group') {
      const perGroupNeed = Math.max(1, config.minApprovals ?? 1);
      const size: Record<string, number> = {};
      for (const gs of Object.values(groupMap)) for (const g of gs) size[g] = (size[g] ?? 0) + 1;
      const groups = Object.keys(size);
      if (!groups.length) return true; // nothing to gate
      const got: Record<string, number> = {};
      for (const a of approved) for (const g of (groupMap[a] ?? [])) got[g] = (got[g] ?? 0) + 1;
      return groups.every(g => (got[g] ?? 0) >= Math.min(perGroupNeed, size[g]));
    }
    return true; // first_response and unknown → first approval finalizes
  }

  /**
   * Record a decision on a node-driven request. Honours the node's `behavior`
   * (#3266): `first_response` finalizes on the first approval; `unanimous`,
   * `quorum`, and `per_group` hold the request open until their tally is met
   * (see {@link ApprovalService.isApprovalSatisfied}). A rejection always
   * finalizes the node (one veto). When the request finalizes, returns the
   * suspended run id + node id so the caller (or {@link ApprovalService.decide})
   * can resume the flow down the matching branch.
   */
  async decideNode(
    requestId: string,
    input: { decision: 'approve' | 'reject'; actorId: string; comment?: string; attachments?: string[]; outputs?: Record<string, unknown> },
    context: SharingExecutionContext,
  ): Promise<{ request: ApprovalRequestRow; runId: string | null; nodeId: string | null; finalized: boolean; decision: 'approve' | 'reject'; outputs?: Record<string, unknown> }> {
    if (!requestId) throw new Error('VALIDATION_FAILED: requestId is required');
    const actorId = await this.resolveActor(input?.actorId, context);
    if (input.decision !== 'approve' && input.decision !== 'reject') {
      throw new Error('VALIDATION_FAILED: decision must be approve|reject');
    }

    // Read the raw row to reach flow_* correlation + the node config snapshot.
    const rawRows = await this.engine.find('sys_approval_request', {
      where: { id: requestId }, limit: 1, context: SYSTEM_CTX,
    });
    const raw: any = Array.isArray(rawRows) ? rawRows[0] : null;
    if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
    if (raw.status !== 'pending') throw new Error(`INVALID_STATE: request is ${raw.status}`);

    const pendingApprovers = csvSplit(raw.pending_approvers);
    // A privileged admin may override a stuck request (#3424) even when they
    // hold no slot — the escape hatch for an approval routed to an unstaffed
    // position or to approvers who have all left.
    const isOverride = this.isOverrideActor(context, raw.organization_id ?? null);
    const isSlotHolder = pendingApprovers.includes(actorId);
    if (!isSlotHolder && !isOverride) {
      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
    }

    const config = parseJson<ApprovalNodeConfig>(raw.node_config_json, { approvers: [], behavior: 'first_response' } as any);
    const org = raw.organization_id ?? null;
    const nodeId: string | null = raw.flow_node_id ?? raw.current_step ?? null;
    const runId: string | null = raw.flow_run_id ?? null;
    const now = this.clock.now().toISOString();

    // #3447 P2: decision outputs — validated BEFORE any write (audit included)
    // so an out-of-contract payload rejects atomically. The trust model is a
    // `screen` node's: the AUTHOR declares the keys (`config.decisionOutputs`),
    // the approver only fills values. A decision carrying undeclared keys is a
    // caller bug; `decision`/`requestId` are reserved by the resume envelope.
    const outputKeys = input.outputs ? Object.keys(input.outputs) : [];
    let acceptedOutputs: Record<string, unknown> | undefined;
    if (outputKeys.length) {
      // Typed declarations and bare keys whitelist identically — one
      // normalizer (spec) is the single reader of the union shape.
      const declared = normalizeDecisionOutputs((config as any).decisionOutputs).map(d => d.key);
      if (!declared.length) {
        throw new Error(
          `VALIDATION_FAILED: this approval node declares no decisionOutputs — outputs are not accepted. `
          + `Declare the keys on the node config (decisionOutputs: [${outputKeys.map(k => `'${k}'`).join(', ')}]) `
          + `to let approvers hand them to the flow.`,
        );
      }
      const reserved = outputKeys.filter(k => k === 'decision' || k === 'requestId');
      if (reserved.length) {
        throw new Error(
          `VALIDATION_FAILED: decision output key(s) \`${reserved.join('`, `')}\` are reserved by the resume `
          + `envelope — pick different names.`,
        );
      }
      const undeclared = outputKeys.filter(k => !declared.includes(k));
      if (undeclared.length) {
        throw new Error(
          `VALIDATION_FAILED: decision output key(s) \`${undeclared.join('`, `')}\` are not declared on this `
          + `node — declared keys: ${declared.map(k => `'${k}'`).join(', ') || '(none)'}.`,
        );
      }
      acceptedOutputs = { ...input.outputs };
    }

    // Audit the decision first so the quorum/per_group tally below sees it.
    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: requestId, organization_id: org,
      step_name: nodeId, step_index: 0, action: input.decision,
      actor_id: actorId, comment: input.comment ?? null,
      attachments: input.attachments?.length ? input.attachments : null,
      created_at: now,
    }, { context: SYSTEM_CTX });

    // Multi-approver aggregation on approve (#3266). A rejection always
    // finalizes the node (one veto), so only the approve path can hold it open.
    // `first_response` finalizes on the first approval (falls straight through).
    const behavior = config.behavior ?? 'first_response';
    // A privileged override (an admin rescuing a stuck request, #3424) is an
    // authoritative decision, not one vote among the resolved slate — it
    // finalizes the node immediately, regardless of `unanimous`/`quorum`/
    // `per_group`. Only a real slot holder's approval feeds the multi-approver
    // tally below.
    if (input.decision === 'approve' && behavior !== 'first_response' && isSlotHolder) {
      const acts = await this.engine.find('sys_approval_action', {
        where: { request_id: requestId, step_index: 0, action: 'approve' }, limit: 1000, context: SYSTEM_CTX,
      });
      const approved = new Set<string>((acts ?? []).map((a: any) => String(a.actor_id ?? '')).filter(Boolean));

      // Tally against the OPEN-time snapshot (already OOO-substituted) for
      // every behavior that carries one. Re-resolution survives ONLY as the
      // back-compat path for requests opened before the snapshot existed —
      // it cannot ever run for an `expression` approver (#3447 P2: decide has
      // no flow variables to evaluate against; open time is the only
      // resolution point), and those always have a snapshot.
      const snapshotGroups = (config as any).__approverGroups as Record<string, string[]> | undefined;
      let original: string[];
      let groupMap: Record<string, string[]>;
      if (snapshotGroups) {
        groupMap = snapshotGroups;
        original = Object.keys(snapshotGroups);
      } else {
        original = await this.expandApprovers(
          { approvers: config.approvers }, parseJson(raw.payload_json, undefined), org,
        );
        groupMap = {};
      }

      if (!this.isApprovalSatisfied(behavior, config, original, groupMap, approved)) {
        const stillPending = original.filter(a => !approved.has(a));
        await this.engine.update('sys_approval_request', {
          id: requestId, pending_approvers: stillPending.join(','), updated_at: now,
          // #3447 P2: a mid-tally approval may carry outputs too (unanimous /
          // per_group co-sign, each approver contributing their declared keys)
          // — accumulate them on the snapshot so the FINALIZING decision hands
          // the merged set to the flow.
          ...(acceptedOutputs ? {
            node_config_json: JSON.stringify({
              ...config,
              __decisionOutputs: { ...((config as any).__decisionOutputs ?? {}), ...acceptedOutputs },
            }),
          } : {}),
        }, { context: SYSTEM_CTX });
        await this.syncApproverIndex(requestId, stillPending, org, now);
        const fresh = await this.readBackRequest(requestId, context);
        return { request: fresh!, runId, nodeId, finalized: false, decision: input.decision };
      }
    }

    const finalStatus = input.decision === 'approve' ? 'approved' : 'rejected';
    // #3447 P2: the full accumulated output set — earlier co-sign votes' plus
    // this finalizing decision's — resumes the run and stays snapshotted for
    // the audit trail ("what did the approvers hand the flow").
    const mergedOutputs: Record<string, unknown> | undefined =
      acceptedOutputs || (config as any).__decisionOutputs
        ? { ...((config as any).__decisionOutputs ?? {}), ...(acceptedOutputs ?? {}) }
        : undefined;
    await this.engine.update('sys_approval_request', {
      id: requestId, status: finalStatus, pending_approvers: null, completed_at: now, updated_at: now,
      ...(mergedOutputs ? {
        node_config_json: JSON.stringify({ ...config, __decisionOutputs: mergedOutputs }),
      } : {}),
    }, { context: SYSTEM_CTX });
    await this.syncApproverIndex(requestId, [], org, now);
    if (config.approvalStatusField) {
      await this.mirrorStatusField(
        raw.object_name, raw.record_id, config.approvalStatusField, finalStatus,
        actingUserId(context),
      );
    }
    const fresh = await this.readBackRequest(requestId, context);
    return { request: fresh!, runId, nodeId, finalized: true, decision: input.decision, outputs: mergedOutputs };
  }

  /**
   * Continue the owning flow run after an outcome this service has already
   * authorized and written down (#3801).
   *
   * The `approval` node declares `resumeAuthority: 'service'`, so the engine
   * refuses any resume of an approval suspension that does not carry
   * {@link RESUME_AUTHORITY_SERVICE}. Every approvals-side resume goes through
   * here so the marker is stamped in ONE place — a new outcome path cannot
   * quietly ship a resume that the gate then rejects at runtime, and nothing
   * in this file hands the marker to a caller-supplied signal.
   *
   * Callers still guard on `typeof this.automation?.resume === 'function'`
   * (approvals runs fine with no automation attached) and keep their own
   * try/catch, because what a failed resume means differs per path.
   */
  private async serviceResume(
    runId: string,
    signal: { output?: Record<string, unknown>; branchLabel?: string },
  ): Promise<void> {
    await this.automation!.resume!(runId, { ...signal, [RESUME_AUTHORITY_SERVICE]: true });
  }

  /**
   * Public contract entrypoint (ADR-0019). Records a decision on a node-driven
   * request via {@link ApprovalService.decideNode} and, when it finalizes,
   * resumes the owning flow run down the matching `approve` / `reject` edge.
   */
  async decide(
    requestId: string,
    input: ApprovalDecisionInput,
    context: SharingExecutionContext,
  ): Promise<ApprovalDecisionResult> {
    const result = await this.decideNode(requestId, input, context);

    let resumed = false;
    if (result.finalized && result.runId && typeof this.automation?.resume === 'function') {
      const branchLabel = result.decision === 'approve'
        ? APPROVAL_BRANCH_LABELS.approve
        : APPROVAL_BRANCH_LABELS.reject;
      try {
        await this.serviceResume(result.runId, {
          branchLabel,
          // #3447 P2: accepted decision outputs ride the resume envelope and
          // land as `<nodeId>.<key>` flow variables — a later approval node's
          // `expression` approver reads them as `vars.<nodeId>.<key>`.
          // Reserved keys are spread LAST so no output can shadow them (the
          // whitelist already rejects them; this is defense in depth).
          output: { ...(result.outputs ?? {}), decision: result.decision, requestId },
        });
        resumed = true;
      } catch (err: any) {
        this.logger?.warn?.('[approvals] resume after decision failed', {
          request: requestId, run: result.runId, error: err?.message ?? String(err),
        });
      }
    }

    return {
      request: result.request,
      finalized: result.finalized,
      decision: result.decision,
      runId: result.runId,
      resumed,
    };
  }

  /**
   * Withdraw a pending request (submitter only). Finalises the row as
   * `recalled`, releases the record lock (keyed on pending status), mirrors
   * the status field when configured, and resumes the owning flow run down
   * the `reject` branch with `output.decision = 'recall'` — leaving the run
   * suspended forever would leak it.
   *
   * ADR-0044: also valid on the LATEST `returned` request of its run — the
   * submitter abandons the revision window instead of resubmitting. The run
   * is then paused at the revise wait node (no reject edge), so it is
   * terminally cancelled via {@link ApprovalResumeSurface.cancelRun} rather
   * than resumed.
   */
  async recall(
    requestId: string,
    input: ApprovalRecallInput,
    context: SharingExecutionContext,
  ): Promise<ApprovalRecallResult> {
    if (!requestId) throw new Error('VALIDATION_FAILED: requestId is required');
    const actorId = await this.resolveActor(input?.actorId, context);

    const rawRows = await this.engine.find('sys_approval_request', {
      where: { id: requestId }, limit: 1, context: SYSTEM_CTX,
    });
    const raw: any = Array.isArray(rawRows) ? rawRows[0] : null;
    if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
    const inReviseWindow = raw.status === 'returned';
    if (raw.status !== 'pending' && !inReviseWindow) {
      throw new Error(`INVALID_STATE: request is ${raw.status}`);
    }
    // The submitter withdraws their own request; a privileged admin may recall
    // any pending request to release a stuck record (#3424).
    if (!this.isOverrideActor(context, raw.organization_id ?? null)
      && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
      throw new Error(`FORBIDDEN: only the submitter may recall this request`);
    }
    // A returned request is only recallable while it is still the run's live
    // frontier — a resubmitted (or later-node) request supersedes it.
    if (inReviseWindow) await this.assertLatestForRun(raw);

    const config = parseJson<ApprovalNodeConfig>(raw.node_config_json, { approvers: [], behavior: 'first_response' } as any);
    const org = raw.organization_id ?? null;
    const nodeId: string | null = raw.flow_node_id ?? raw.current_step ?? null;
    const runId: string | null = raw.flow_run_id ?? null;
    const now = this.clock.now().toISOString();

    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: requestId, organization_id: org,
      step_name: nodeId, step_index: 0, action: 'recall',
      actor_id: actorId, comment: input.comment ?? null, created_at: now,
    }, { context: SYSTEM_CTX });

    await this.engine.update('sys_approval_request', {
      id: requestId, status: 'recalled', pending_approvers: null, completed_at: now, updated_at: now,
    }, { context: SYSTEM_CTX });
    await this.syncApproverIndex(requestId, [], org, now);
    if (config.approvalStatusField) {
      await this.mirrorStatusField(
        raw.object_name, raw.record_id, config.approvalStatusField, 'recalled',
        actingUserId(context),
      );
    }

    let resumed = false;
    if (inReviseWindow) {
      // ADR-0044: the run is paused at the revise wait node, which has no
      // reject out-edge to resume down — terminally cancel it instead.
      if (runId && typeof this.automation?.cancelRun === 'function') {
        try {
          await this.automation.cancelRun(runId, `approval request ${requestId} recalled during revision`);
        } catch (err: any) {
          this.logger?.warn?.('[approvals] cancelRun after revise-window recall failed', {
            request: requestId, run: runId, error: err?.message ?? String(err),
          });
        }
      }
    } else if (runId && typeof this.automation?.resume === 'function') {
      try {
        await this.serviceResume(runId, {
          branchLabel: APPROVAL_BRANCH_LABELS.reject,
          output: { decision: 'recall', requestId },
        });
        resumed = true;
      } catch (err: any) {
        this.logger?.warn?.('[approvals] resume after recall failed', {
          request: requestId, run: runId, error: err?.message ?? String(err),
        });
      }
    }

    const fresh = await this.readBackRequest(requestId, context);
    return { request: fresh!, runId, resumed };
  }

  // ── Send back for revision / resubmit (ADR-0044) ─────────────

  /**
   * ADR-0044 send back for revision. Finalises the pending request as
   * `returned` (a third terminal state — approver-initiated rework, distinct
   * from submitter-initiated `recalled`) and resumes the owning flow run down
   * its `revise` edge to a wait point: the record lock (keyed on `pending`)
   * releases, the submitter reworks the data, then {@link resubmit}s.
   *
   * Requires the approval node to declare a `revise` out-edge — validated
   * BEFORE any mutation, because resuming with an unmatched `branchLabel`
   * falls back to *all* out-edges. Past the node's `maxRevisions` budget the
   * request auto-rejects instead (resumes down `reject` with
   * `output.autoRejected = true`) so instances cannot orbit forever.
   */
  async sendBack(
    requestId: string,
    input: ApprovalSendBackInput,
    context: SharingExecutionContext,
  ): Promise<ApprovalSendBackResult> {
    const actorId = await this.resolveActor(input?.actorId, context);
    const raw = await this.loadPendingRow(requestId);
    const pending = csvSplit(raw.pending_approvers);
    if (!context.isSystem && !pending.includes(actorId)) {
      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
    }

    const config = parseJson<ApprovalNodeConfig>(raw.node_config_json, { approvers: [], behavior: 'first_response' } as any);
    const org = raw.organization_id ?? null;
    const nodeId: string | null = raw.flow_node_id ?? raw.current_step ?? null;
    const runId: string | null = raw.flow_run_id ?? null;

    await this.assertReviseEdge(raw, nodeId);

    const now = this.clock.now().toISOString();
    const maxRevisions = typeof (config as any).maxRevisions === 'number' ? (config as any).maxRevisions : 3;
    let priorSendBacks = 0;
    if (runId && nodeId) {
      const siblings = await this.engine.find('sys_approval_request', {
        where: { flow_run_id: runId, flow_node_id: nodeId, status: 'returned' }, limit: 500, context: SYSTEM_CTX,
      });
      priorSendBacks = Array.isArray(siblings) ? siblings.length : 0;
    }

    // Audit the revise intent first (audit-first, like decideNode) — on the
    // auto-reject path the trail then reads `revise → reject`, preserving
    // what the approver actually asked for.
    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: requestId, organization_id: org,
      step_name: nodeId, step_index: 0, action: 'revise',
      actor_id: actorId, comment: input.comment ?? null, created_at: now,
    }, { context: SYSTEM_CTX });

    if (priorSendBacks >= maxRevisions) {
      // Revision budget exhausted — auto-reject (ADR-0044 loop guard).
      await this.engine.insert('sys_approval_action', {
        id: uid('aact'), request_id: requestId, organization_id: org,
        step_name: nodeId, step_index: 0, action: 'reject',
        actor_id: actorId,
        comment: `Auto-rejected: revision limit (${maxRevisions}) exceeded`, created_at: now,
      }, { context: SYSTEM_CTX });
      await this.engine.update('sys_approval_request', {
        id: requestId, status: 'rejected', pending_approvers: null, completed_at: now, updated_at: now,
      }, { context: SYSTEM_CTX });
      await this.syncApproverIndex(requestId, [], org, now);
      if (config.approvalStatusField) {
        await this.mirrorStatusField(
          raw.object_name, raw.record_id, config.approvalStatusField, 'rejected',
          actingUserId(context),
        );
      }
      let resumed = false;
      if (runId && typeof this.automation?.resume === 'function') {
        try {
          await this.serviceResume(runId, {
            branchLabel: APPROVAL_BRANCH_LABELS.reject,
            output: { decision: 'reject', autoRejected: true, requestId },
          });
          resumed = true;
        } catch (err: any) {
          this.logger?.warn?.('[approvals] resume after auto-reject failed', {
            request: requestId, run: runId, error: err?.message ?? String(err),
          });
        }
      }
      if (raw.submitter_id) {
        await this.notify({
          topic: 'approval.returned',
          audience: [String(raw.submitter_id)],
          actorId: actorId,
          source: { object: 'sys_approval_request', id: requestId },
          payload: {
            title: 'Approval auto-rejected',
            message: `Your ${raw.object_name}/${raw.record_id} exceeded the revision limit (${maxRevisions}) and was rejected.`,
            actionUrl: '/system/approvals',
          },
        });
      }
      const fresh = await this.readBackRequest(requestId, context);
      return { request: fresh!, runId, resumed, autoRejected: true };
    }

    await this.engine.update('sys_approval_request', {
      id: requestId, status: 'returned', pending_approvers: null, completed_at: now, updated_at: now,
    }, { context: SYSTEM_CTX });
    await this.syncApproverIndex(requestId, [], org, now);
    if (config.approvalStatusField) {
      await this.mirrorStatusField(
        raw.object_name, raw.record_id, config.approvalStatusField, 'returned',
        actingUserId(context),
      );
    }

    let resumed = false;
    if (runId && typeof this.automation?.resume === 'function') {
      try {
        await this.serviceResume(runId, {
          branchLabel: APPROVAL_BRANCH_LABELS.revise,
          output: { decision: 'revise', requestId },
        });
        resumed = true;
      } catch (err: any) {
        this.logger?.warn?.('[approvals] resume after send-back failed', {
          request: requestId, run: runId, error: err?.message ?? String(err),
        });
      }
    }

    if (raw.submitter_id) {
      await this.notify({
        topic: 'approval.returned',
        audience: [String(raw.submitter_id)],
        actorId: actorId,
        source: { object: 'sys_approval_request', id: requestId },
        payload: {
          title: 'Sent back for revision',
          message: input.comment?.trim() || `Your ${raw.object_name}/${raw.record_id} needs rework before it can be approved.`,
          actionUrl: '/system/approvals',
        },
      });
    }

    const fresh = await this.readBackRequest(requestId, context);
    return { request: fresh!, runId, resumed };
  }

  /**
   * ADR-0044 resubmit after rework. Valid on the LATEST `returned` request of
   * its run, submitter-only. Audits `resubmit` on the returned (round-N)
   * request and resumes the run from the revise wait node; traversal walks
   * the declared back-edge into the approval node, whose executor opens the
   * round-N+1 request — fresh approver slate, record re-locks.
   */
  async resubmit(
    requestId: string,
    input: ApprovalResubmitInput,
    context: SharingExecutionContext,
  ): Promise<ApprovalResubmitResult> {
    const actorId = await this.resolveActor(input?.actorId, context);
    const rawRows = await this.engine.find('sys_approval_request', {
      where: { id: requestId }, limit: 1, context: SYSTEM_CTX,
    });
    const raw: any = Array.isArray(rawRows) ? rawRows[0] : null;
    if (!raw) throw new Error(`REQUEST_NOT_FOUND: ${requestId}`);
    if (raw.status !== 'returned') {
      throw new Error(`INVALID_STATE: request is ${raw.status} (resubmit applies to returned requests)`);
    }
    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
      throw new Error('FORBIDDEN: only the submitter may resubmit');
    }
    await this.assertLatestForRun(raw);

    // A colliding pending request on the same record (e.g. a record-change
    // trigger re-fired off an edit made inside the revise window) would make
    // the approval node's re-entry fail AFTER the engine consumed the
    // suspension — permanently killing the run. Refuse up front instead; the
    // submitter resolves the collision (recall the other request) first.
    const colliding = await this.engine.find('sys_approval_request', {
      where: { object_name: raw.object_name, record_id: raw.record_id, status: 'pending' },
      limit: 1, context: SYSTEM_CTX,
    });
    if (Array.isArray(colliding) && colliding[0]) {
      throw new Error(
        `DUPLICATE_REQUEST: another approval request is already pending on ${raw.object_name}/${raw.record_id} — resolve it before resubmitting`,
      );
    }

    const org = raw.organization_id ?? null;
    const nodeId: string | null = raw.flow_node_id ?? raw.current_step ?? null;
    const runId: string | null = raw.flow_run_id ?? null;
    const now = this.clock.now().toISOString();

    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: requestId, organization_id: org,
      step_name: nodeId, step_index: 0, action: 'resubmit',
      actor_id: actorId, comment: input.comment ?? null, created_at: now,
    }, { context: SYSTEM_CTX });

    // The next round only exists if this resume lands — surface `resumed`
    // honestly so a stuck run is visible instead of silently swallowed.
    let resumed = false;
    if (runId && typeof this.automation?.resume === 'function') {
      try {
        await this.serviceResume(runId, {
          branchLabel: APPROVAL_BRANCH_LABELS.resubmit,
          output: { resubmitted: true, requestId },
        });
        resumed = true;
      } catch (err: any) {
        this.logger?.warn?.('[approvals] resume after resubmit failed', {
          request: requestId, run: runId, error: err?.message ?? String(err),
        });
      }
    }

    const fresh = await this.readBackRequest(requestId, context);
    return { request: fresh!, runId, resumed };
  }

  /**
   * ADR-0044 guard: the flow's approval node must declare a `revise`
   * out-edge before send-back is allowed — the engine's branch-label fallback
   * (no matching label ⇒ ALL out-edges) must never be reachable from a user
   * action.
   */
  private async assertReviseEdge(raw: any, nodeId: string | null): Promise<void> {
    const processName = String(raw.process_name ?? '');
    const flowName = processName.startsWith('flow:') ? processName.slice('flow:'.length) : undefined;
    if (!flowName || !nodeId || typeof this.automation?.getFlow !== 'function') {
      throw new Error('VALIDATION_FAILED: send-back requires the owning flow definition (automation engine unavailable)');
    }
    const flow: any = await this.automation.getFlow(flowName);
    const hasRevise = Array.isArray(flow?.edges)
      && flow.edges.some((e: any) => e?.source === nodeId && e?.label === APPROVAL_BRANCH_LABELS.revise);
    if (!hasRevise) {
      throw new Error(
        `VALIDATION_FAILED: approval node '${nodeId}' has no '${APPROVAL_BRANCH_LABELS.revise}' out-edge — ` +
        'the flow does not support send-back for revision',
      );
    }
  }

  /**
   * ADR-0044 guard: a `returned` request is only actionable (resubmit /
   * recall) while it is still the newest request on its run — a later round
   * or a later node's request supersedes it.
   */
  private async assertLatestForRun(raw: any): Promise<void> {
    const runId = raw.flow_run_id;
    if (!runId) return;
    // SortNode's key is `order` (spec/data/query.zod.ts) — `direction` would
    // silently default to ascending and return the OLDEST row.
    const rows = await this.engine.find('sys_approval_request', {
      where: { flow_run_id: runId },
      orderBy: [{ field: 'created_at', order: 'desc' }], limit: 1, context: SYSTEM_CTX,
    });
    const latest: any = Array.isArray(rows) ? rows[0] : null;
    if (latest && String(latest.id) !== String(raw.id)) {
      throw new Error('INVALID_STATE: a newer approval request supersedes this one');
    }
  }

  // ── Thread interactions (no flow movement) ───────────────────

  /**
   * Hand a pending-approver slot to someone else. `from` defaults to the
   * actor itself; the actor must hold the slot being handed over (or be a
   * system caller). A privileged admin (#3424) may reassign a request whose
   * slate holds no real user — an unstaffed-position literal — by handing the
   * whole request to a real approver, rescuing it from the locked dead-end.
   * Audits `reassign` and notifies the new approver.
   */
  async reassign(
    requestId: string,
    input: { actorId: string; to: string; from?: string; comment?: string },
    context: SharingExecutionContext,
  ): Promise<{ request: ApprovalRequestRow }> {
    const actorId = await this.resolveActor(input?.actorId, context);
    const to = String(input?.to ?? '').trim();
    if (!to) throw new Error('VALIDATION_FAILED: `to` (new approver) is required');
    const raw = await this.loadPendingRow(requestId);

    const pending = csvSplit(raw.pending_approvers);
    if (pending.includes(to)) {
      throw new Error(`VALIDATION_FAILED: '${to}' is already a pending approver`);
    }
    const isOverride = this.isOverrideActor(context, raw.organization_id ?? null);
    const from = String(input.from ?? actorId).trim();
    let next: string[];
    if (pending.includes(from)) {
      // Normal hand-off: the actor holds the slot being moved (or is a
      // system/admin caller acting on a real holder's slot).
      if (!context.isSystem && !isOverride && actorId !== from && !pending.includes(actorId)) {
        throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
      }
      next = pending.map(a => (a === from ? to : a));
    } else if (isOverride) {
      // Admin rescue (#3424): the caller holds no slot — the slate is an
      // unstaffed-position literal or a set of departed approvers. Reassign the
      // whole request to a real approver so the normal decision flow can resume.
      next = [to];
    } else {
      throw new Error(`FORBIDDEN: '${from}' is not a pending approver on this request`);
    }
    const now = this.clock.now().toISOString();
    // Audit first, then mutate — mirrors decideNode(), so a failed audit
    // write can never leave a moved slot without a trail.
    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: requestId, organization_id: raw.organization_id ?? null,
      step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'reassign',
      actor_id: actorId, comment: input.comment ?? `${from} → ${to}`, created_at: now,
    }, { context: SYSTEM_CTX });
    // per_group / quorum (#3266): carry the delegated slot's group membership to
    // the new approver in the snapshot, so their approval still counts for the
    // original group.
    let configPatch: Record<string, unknown> = {};
    try {
      const cfg = parseJson<any>(raw.node_config_json, null);
      const groups = cfg?.__approverGroups as Record<string, string[]> | undefined;
      if (groups && groups[from] && !groups[to]) {
        groups[to] = groups[from];
        delete groups[from];
        configPatch = { node_config_json: JSON.stringify(cfg) };
      }
    } catch { /* snapshot left untouched on parse failure */ }
    await this.engine.update('sys_approval_request', {
      id: requestId, pending_approvers: next.join(','), updated_at: now, ...configPatch,
    }, { context: SYSTEM_CTX });
    await this.syncApproverIndex(requestId, next, raw.organization_id ?? null, now);

    await this.notify({
      topic: 'approval.reassigned',
      audience: [to],
      actorId: actorId,
      source: { object: 'sys_approval_request', id: requestId },
      dedupKey: `approval-reassign-${requestId}-${to}`,
      payload: {
        title: 'Approval handed to you',
        message: `You are now an approver on ${raw.object_name}/${raw.record_id}.`,
        actionUrl: '/system/approvals',
      },
    });

    const fresh = await this.readBackRequest(requestId, context);
    return { request: fresh! };
  }

  /**
   * Submitter nudge — notify every pending approver. Throttled to one
   * reminder per {@link REMIND_COOLDOWN_MS} per request.
   */
  async remind(
    requestId: string,
    input: { actorId: string; comment?: string },
    context: SharingExecutionContext,
  ): Promise<{ request: ApprovalRequestRow; notified: number }> {
    const actorId = await this.resolveActor(input?.actorId, context);
    const raw = await this.loadPendingRow(requestId);
    if (!context.isSystem && raw.submitter_id && String(raw.submitter_id) !== String(actorId)) {
      throw new Error('FORBIDDEN: only the submitter may send reminders');
    }

    const acts = await this.engine.find('sys_approval_action', {
      where: { request_id: requestId, action: 'remind' },
      orderBy: [{ field: 'created_at', order: 'desc' }], limit: 1, context: SYSTEM_CTX,
    });
    const last: any = Array.isArray(acts) ? acts[0] : null;
    const now = this.clock.now();
    if (last?.created_at && now.getTime() - Date.parse(last.created_at) < REMIND_COOLDOWN_MS) {
      throw new Error('THROTTLED: a reminder was already sent recently');
    }

    const pending = csvSplit(raw.pending_approvers);
    const nowIso = now.toISOString();
    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: requestId, organization_id: raw.organization_id ?? null,
      step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'remind',
      actor_id: actorId, comment: input.comment ?? null, created_at: nowIso,
    }, { context: SYSTEM_CTX });

    // Per-approver fan-out: concrete identities (user ids / emails) each get
    // their OWN one-tap approve/reject links (ADR-0043); `role:*`-style
    // literals can't carry a personal token and fall back to a plain nudge.
    let notified = 0;
    const concrete = pending.filter(a => a && !a.includes(':'));
    const literals = pending.filter(a => a && a.includes(':'));
    for (const approver of concrete) {
      try {
        const tokens = await this.issueActionTokens(requestId, approver);
        notified += await this.notify({
          topic: 'approval.reminder',
          audience: [approver],
          actorId: actorId,
          source: { object: 'sys_approval_request', id: requestId },
          dedupKey: `approval-remind-${requestId}-${nowIso}-${approver}`,
          payload: {
            title: 'Approval reminder',
            message: `A decision on ${raw.object_name}/${raw.record_id} is still waiting on you.`,
            actionUrl: '/system/approvals',
            actions: [
              { label: 'Approve', url: this.actionLinkUrl(tokens.approve) },
              { label: 'Reject', url: this.actionLinkUrl(tokens.reject) },
            ],
          },
        });
      } catch (err: any) {
        this.logger?.warn?.('[approvals] reminder with action links failed', {
          request: requestId, approver, error: err?.message ?? String(err),
        });
      }
    }
    if (literals.length) {
      notified += await this.notify({
        topic: 'approval.reminder',
        audience: literals,
        actorId: actorId,
        source: { object: 'sys_approval_request', id: requestId },
        dedupKey: `approval-remind-${requestId}-${nowIso}`,
        payload: {
          title: 'Approval reminder',
          message: `A decision on ${raw.object_name}/${raw.record_id} is still waiting on you.`,
          actionUrl: '/system/approvals',
        },
      });
    }

    const fresh = await this.readBackRequest(requestId, context);
    return { request: fresh!, notified };
  }

  // ── Actionable links (ADR-0043) ──────────────────────────────

  /** Build the session-less confirm-page URL for a raw token. */
  actionLinkUrl(rawToken: string): string {
    return `${this.publicBaseUrl}/api/v1/approvals/act?token=${encodeURIComponent(rawToken)}`;
  }

  /**
   * Issue one-tap approve/reject tokens for one approver on one pending
   * request. Raw tokens are returned ONCE; only SHA-256 hashes are stored
   * (`sys_approval_token`), so a DB leak yields no usable links.
   */
  async issueActionTokens(
    requestId: string,
    approverId: string,
    opts?: { ttlMs?: number },
  ): Promise<{ approve: string; reject: string }> {
    if (!approverId?.trim()) throw new Error('VALIDATION_FAILED: approverId is required');
    const raw = await this.loadPendingRow(requestId);
    const pending = csvSplit(raw.pending_approvers);
    if (!pending.includes(approverId)) {
      throw new Error(`FORBIDDEN: '${approverId}' is not a pending approver on this request`);
    }
    const now = this.clock.now();
    const expires = new Date(now.getTime() + (opts?.ttlMs ?? ACTION_TOKEN_TTL_MS)).toISOString();
    const out = { approve: '', reject: '' };
    for (const action of ['approve', 'reject'] as const) {
      const rawToken = randomBytes(32).toString('base64url');
      await this.engine.insert('sys_approval_token', {
        id: uid('atok'),
        organization_id: raw.organization_id ?? null,
        token_hash: createHash('sha256').update(rawToken).digest('hex'),
        request_id: requestId,
        action,
        approver_id: approverId,
        expires_at: expires,
        consumed_at: null,
        created_at: now.toISOString(),
      }, { context: SYSTEM_CTX });
      out[action] = rawToken;
    }
    return out;
  }

  /** Shared validation chain for peek/redeem. Returns the token row when live. */
  private async resolveActionToken(rawToken: string): Promise<
    { ok: true; token: any; request: ApprovalRequestRow } | Extract<ActionTokenOutcome, { ok: false }>
  > {
    const trimmed = rawToken?.trim();
    if (!trimmed) return { ok: false, reason: 'invalid' };
    const hash = createHash('sha256').update(trimmed).digest('hex');
    const rows = await this.engine.find('sys_approval_token', {
      where: { token_hash: hash }, limit: 1, context: SYSTEM_CTX,
    });
    const token: any = Array.isArray(rows) ? rows[0] : null;
    if (!token) return { ok: false, reason: 'invalid' };
    if (token.consumed_at) return { ok: false, reason: 'consumed' };
    if (Date.parse(token.expires_at) < this.clock.now().getTime()) {
      return { ok: false, reason: 'expired' };
    }
    const request = await this.getRequest(token.request_id, SYSTEM_CTX as unknown as SharingExecutionContext);
    if (!request || request.status !== 'pending') {
      return { ok: false, reason: 'not_pending', request: request ?? undefined };
    }
    if (!(request.pending_approvers ?? []).includes(token.approver_id)) {
      // Reassigned away / slot consumed by a unanimous round — the link died
      // with the slot (ADR-0043 invalidation row).
      return { ok: false, reason: 'not_approver', request };
    }
    return { ok: true, token, request };
  }

  /** GET confirm page: validate WITHOUT consuming — never mutates. */
  async peekActionToken(rawToken: string): Promise<ActionTokenOutcome> {
    const res = await this.resolveActionToken(rawToken);
    if (!res.ok) return res;
    return { ok: true, action: res.token.action, request: res.request, approverId: res.token.approver_id };
  }

  /**
   * POST redemption: consume the token FIRST (a failed decide still burns
   * it — replay-safe), then decide as the bound approver.
   */
  async redeemActionToken(rawToken: string): Promise<ActionTokenOutcome> {
    const res = await this.resolveActionToken(rawToken);
    if (!res.ok) return res;
    await this.engine.update('sys_approval_token', {
      id: res.token.id, consumed_at: this.clock.now().toISOString(),
    }, { context: SYSTEM_CTX });
    const out = await this.decide(res.token.request_id, {
      decision: res.token.action,
      actorId: res.token.approver_id,
      comment: 'Via action link',
      // The token IS the authentication (#3783): it is single-use, hashed at
      // rest and bound to one approver, who `resolveActionToken` has just
      // re-checked still holds a pending slot. So this decision has a real
      // acting user even though no session carried it — name them on the
      // context, so the status mirror and every flow it cascades into are
      // attributed exactly like a decision made through the UI. Elevation is
      // unchanged: `isSystem` still stands in for the missing session.
    }, { ...SYSTEM_CTX, userId: res.token.approver_id } as unknown as SharingExecutionContext);
    return { ok: true, action: res.token.action, request: out.request, approverId: res.token.approver_id };
  }

  /**
   * Approver asks the submitter for more information. The request stays
   * pending — a thread interaction, not a flow decision.
   */
  async requestInfo(
    requestId: string,
    input: { actorId: string; comment: string },
    context: SharingExecutionContext,
  ): Promise<{ request: ApprovalRequestRow }> {
    const actorId = await this.resolveActor(input?.actorId, context);
    if (!input?.comment?.trim()) throw new Error('VALIDATION_FAILED: comment is required');
    const raw = await this.loadPendingRow(requestId);
    const pending = csvSplit(raw.pending_approvers);
    if (!context.isSystem && !pending.includes(actorId)) {
      throw new Error(`FORBIDDEN: actor '${actorId}' is not a pending approver`);
    }

    const now = this.clock.now().toISOString();
    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: requestId, organization_id: raw.organization_id ?? null,
      step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'request_info',
      actor_id: actorId, comment: input.comment.trim(), created_at: now,
    }, { context: SYSTEM_CTX });

    if (raw.submitter_id) {
      await this.notify({
        topic: 'approval.request_info',
        audience: [String(raw.submitter_id)],
        actorId: actorId,
        source: { object: 'sys_approval_request', id: requestId },
        payload: {
          title: 'More information requested',
          message: input.comment.trim(),
          actionUrl: '/system/approvals',
        },
      });
    }

    const fresh = await this.readBackRequest(requestId, context);
    return { request: fresh! };
  }

  /** Free-form reply on the thread (submitter or any pending approver). */
  async comment(
    requestId: string,
    input: { actorId: string; comment: string; attachments?: string[] },
    context: SharingExecutionContext,
  ): Promise<{ request: ApprovalRequestRow }> {
    const actorId = await this.resolveActor(input?.actorId, context);
    if (!input?.comment?.trim()) throw new Error('VALIDATION_FAILED: comment is required');
    const raw = await this.loadPendingRow(requestId);
    const pending = csvSplit(raw.pending_approvers);
    const isSubmitter = raw.submitter_id && String(raw.submitter_id) === String(actorId);
    if (!context.isSystem && !isSubmitter && !pending.includes(actorId)) {
      throw new Error(`FORBIDDEN: actor '${actorId}' is not on this request`);
    }

    const now = this.clock.now().toISOString();
    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: requestId, organization_id: raw.organization_id ?? null,
      step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'comment',
      actor_id: actorId, comment: input.comment.trim(),
      attachments: input.attachments?.length ? input.attachments : null,
      created_at: now,
    }, { context: SYSTEM_CTX });

    // Notify the other side of the thread.
    const audience = isSubmitter ? pending : [String(raw.submitter_id ?? '')].filter(Boolean);
    await this.notify({
      topic: 'approval.comment',
      audience,
      actorId: actorId,
      source: { object: 'sys_approval_request', id: requestId },
      payload: {
        title: 'New comment on an approval',
        message: input.comment.trim(),
        actionUrl: '/system/approvals',
      },
    });

    const fresh = await this.readBackRequest(requestId, context);
    return { request: fresh! };
  }

  // ── SLA escalation (ADR-0042) ─────────────────────────────────

  /**
   * One escalation sweep: every *pending* request whose node config declares
   * `escalation.timeoutHours` and whose deadline has passed is escalated
   * **at most once, ever** — the `escalate` audit row is the idempotency
   * marker, written before any mutation (audit-first, like reassign). One
   * bad row never stops the sweep.
   */
  async runEscalations(): Promise<{ scanned: number; escalated: number }> {
    let rows: any[] = [];
    try {
      rows = await this.engine.find('sys_approval_request', {
        where: { status: 'pending' }, limit: 500, context: SYSTEM_CTX,
      }) ?? [];
    } catch (err: any) {
      this.logger?.warn?.('[approvals] escalation scan failed to list requests', {
        error: err?.message ?? String(err),
      });
      return { scanned: 0, escalated: 0 };
    }

    let escalated = 0;
    for (const raw of rows) {
      try {
        const cfg = parseJson<any>(raw.node_config_json, undefined);
        const esc = cfg?.escalation;
        if (!esc || typeof esc.timeoutHours !== 'number' || esc.timeoutHours <= 0) continue;
        const due = slaDueAt(raw.created_at, cfg);
        if (!due || Date.parse(due) > this.clock.now().getTime()) continue;

        // Single-shot: a prior 'escalate' action means this request is done.
        const prior = await this.engine.find('sys_approval_action', {
          where: { request_id: raw.id, action: 'escalate' }, limit: 1, context: SYSTEM_CTX,
        });
        if (Array.isArray(prior) && prior[0]) continue;

        await this.escalateRequest(raw, esc);
        escalated++;
      } catch (err: any) {
        this.logger?.warn?.('[approvals] escalation failed for request', {
          request: raw?.id, error: err?.message ?? String(err),
        });
      }
    }
    if (escalated > 0) {
      this.logger?.info?.('[approvals] SLA escalation sweep', { scanned: rows.length, escalated });
    }
    return { scanned: rows.length, escalated };
  }

  // ── Dead-run release (#3456) ──────────────────────────────────

  /**
   * One dead-run sweep: a pending request whose owning flow run has reached a
   * TERMINAL state can never be decided — nothing is left to resume — so the
   * request is finalised as `recalled` and, with `lockRecord`, the record it was
   * holding is released.
   *
   * This is the recovery half of #3456. The prevention half is the record lock's
   * owning-run exemption (`lifecycle-hooks.ts`), which stops a run from killing
   * itself on its own lock in the first place; this sweep cleans up the runs that
   * still die — for any reason, including a process crash, which no in-band
   * handler can catch because the process that would have run it is gone.
   *
   * **Fail-safe by construction.** It acts only on an explicit terminal status
   * from a closed set. Every other answer — `paused` (the normal state of a run
   * waiting on its approval), `running`, an unrecognised status, `null` (unknown
   * run, evicted log, no durable store), a `getRun` that throws, or no automation
   * engine at all — is read as "still alive" and left strictly alone. The failure
   * mode is therefore "a dead run's lock survives until an admin recalls it"
   * (today's behaviour, #3424), never "a live approval is destroyed".
   *
   * `recalled` is the finalisation because it is the platform's existing terminal
   * state for *a live request that ended without a decision*; the audit row names
   * the real cause and {@link DEAD_RUN_ACTOR_ID} the real actor, so a dead-run
   * release is never mistaken for a submitter's withdrawal.
   */
  async releaseDeadRunRequests(): Promise<{ scanned: number; released: number }> {
    // No liveness oracle → no basis to declare anything dead.
    if (typeof this.automation?.getRun !== 'function') return { scanned: 0, released: 0 };

    let rows: any[] = [];
    try {
      rows = await this.engine.find('sys_approval_request', {
        where: { status: 'pending' }, limit: 500, context: SYSTEM_CTX,
      }) ?? [];
    } catch (err: any) {
      this.logger?.warn?.('[approvals] dead-run sweep failed to list requests', {
        error: err?.message ?? String(err),
      });
      return { scanned: 0, released: 0 };
    }

    let released = 0;
    for (const raw of rows) {
      try {
        const runId = raw?.flow_run_id ? String(raw.flow_run_id) : '';
        if (!runId) continue;   // not node-driven — no run owns it, nothing to check

        let status: string | undefined;
        try {
          const run = await this.automation.getRun!(runId);
          status = typeof run?.status === 'string' ? run.status : undefined;
        } catch (err: any) {
          // Unknown liveness is NOT death — leave the request pending.
          this.logger?.warn?.('[approvals] dead-run sweep could not read run status', {
            request: raw?.id, run: runId, error: err?.message ?? String(err),
          });
          continue;
        }
        if (!status || !TERMINAL_RUN_STATUSES.has(status)) continue;

        await this.abandonForDeadRun(raw, runId, status);
        released++;
      } catch (err: any) {
        // One bad row never stops the sweep (mirrors runEscalations).
        this.logger?.warn?.('[approvals] dead-run release failed for request', {
          request: raw?.id, error: err?.message ?? String(err),
        });
      }
    }
    if (released > 0) {
      this.logger?.info?.('[approvals] dead-run sweep', { scanned: rows.length, released });
    }
    return { scanned: rows.length, released };
  }

  /**
   * Finalise one pending request whose owning run is terminal. Mirrors the
   * shape of {@link recall} — audit row first (so a crash mid-release leaves a
   * trace of the intent), then the status transition, approver-index sync and
   * the optional status-field mirror. No resume/cancel of the run: it is already
   * terminal, which is precisely why we are here.
   */
  private async abandonForDeadRun(raw: any, runId: string, runStatus: string): Promise<void> {
    const org = raw.organization_id ?? null;
    const nodeId: string | null = raw.flow_node_id ?? raw.current_step ?? null;
    const now = this.clock.now().toISOString();

    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: raw.id, organization_id: org,
      step_name: nodeId, step_index: 0, action: 'recall',
      actor_id: DEAD_RUN_ACTOR_ID,
      comment: `owning flow run ${runId} is ${runStatus} — request abandoned and record lock released`,
      created_at: now,
    }, { context: SYSTEM_CTX });

    await this.engine.update('sys_approval_request', {
      id: raw.id, status: 'recalled', pending_approvers: null, completed_at: now, updated_at: now,
    }, { context: SYSTEM_CTX });
    await this.syncApproverIndex(raw.id, [], org, now);

    const config = parseJson<ApprovalNodeConfig>(
      raw.node_config_json, { approvers: [], behavior: 'first_response' } as any,
    );
    if (config.approvalStatusField) {
      // No human did this — a sweep did. Left user-less on purpose (#3783): a
      // flow that wants to react to a dead-run release declares runAs:'system'.
      await this.mirrorStatusField(
        raw.object_name, raw.record_id, config.approvalStatusField, 'recalled', null,
      );
    }

    this.logger?.warn?.('[approvals] released a record held by a dead approval run', {
      request: raw.id, run: runId, runStatus, object: raw.object_name, record: raw.record_id,
    });
  }

  /** Execute the configured escalation action for one overdue request. */
  private async escalateRequest(raw: any, esc: any): Promise<void> {
    const action: string = esc.action ?? 'notify';
    const escalateTo: string | undefined =
      typeof esc.escalateTo === 'string' && esc.escalateTo.trim() ? esc.escalateTo.trim() : undefined;
    const now = this.clock.now().toISOString();
    const pending = csvSplit(raw.pending_approvers);

    // `escalateTo` is a position machine name or a user id (same contract as
    // the `position` ApproverType, ADR-0090 D3). Position holders win; an
    // empty expansion falls back to the literal, so a config naming a
    // specific user id keeps working unchanged.
    let escalatees: string[] = [];
    if (escalateTo) {
      try {
        escalatees = await this.expandPositionUsers(escalateTo, raw.organization_id ?? null);
      } catch { escalatees = []; }
      if (!escalatees.length) escalatees = [escalateTo];
    }

    // Audit first — this row IS the idempotency marker (ADR-0042 §1).
    await this.engine.insert('sys_approval_action', {
      id: uid('aact'), request_id: raw.id, organization_id: raw.organization_id ?? null,
      step_name: raw.flow_node_id ?? raw.current_step ?? null, step_index: 0, action: 'escalate',
      actor_id: SLA_ACTOR_ID,
      comment: `${action}${escalateTo ? ` → ${escalateTo}` : ''}`,
      created_at: now,
    }, { context: SYSTEM_CTX });

    if (action === 'reassign' && escalatees.length) {
      await this.engine.update('sys_approval_request', {
        id: raw.id, pending_approvers: escalatees.join(','), updated_at: now,
      }, { context: SYSTEM_CTX });
      await this.syncApproverIndex(raw.id, escalatees, raw.organization_id ?? null, now);
      await this.notify({
        topic: 'approval.escalated',
        audience: escalatees,
        actorId: SLA_ACTOR_ID,
        source: { object: 'sys_approval_request', id: raw.id },
        payload: {
          title: 'Approval escalated to you',
          message: `An overdue approval on ${raw.object_name}/${raw.record_id} was escalated to you.`,
          actionUrl: '/system/approvals',
        },
      });
    } else if (action === 'auto_approve' || action === 'auto_reject') {
      await this.decide(raw.id, {
        decision: action === 'auto_approve' ? 'approve' : 'reject',
        actorId: SLA_ACTOR_ID,
        comment: 'SLA escalation',
      }, SYSTEM_CTX as unknown as SharingExecutionContext);
    } else {
      // 'notify' (and the reassign-without-target fallback)
      await this.notify({
        topic: 'approval.sla_breached',
        audience: [...pending, ...escalatees],
        actorId: SLA_ACTOR_ID,
        source: { object: 'sys_approval_request', id: raw.id },
        payload: {
          title: 'Approval SLA breached',
          message: `A decision on ${raw.object_name}/${raw.record_id} is overdue.`,
          actionUrl: '/system/approvals',
        },
      });
    }

    if (esc.notifySubmitter !== false && raw.submitter_id) {
      await this.notify({
        topic: 'approval.sla_breached',
        audience: [String(raw.submitter_id)],
        actorId: SLA_ACTOR_ID,
        source: { object: 'sys_approval_request', id: raw.id },
        payload: {
          title: 'Your approval request breached its SLA',
          message: `${raw.object_name}/${raw.record_id}: escalation action '${action}' was taken.`,
          actionUrl: '/system/approvals',
        },
      });
    }
  }

  // ── Display enrichment ───────────────────────────────────────

  /**
   * Resolve the schema-declared display field for an object, when the engine
   * exposes schema metadata (`getSchema`). Falls back to common title-ish
   * field names so plain `ApprovalEngine` fakes still enrich sensibly.
   */
  private resolveDisplayField(object: string): string | undefined {
    try {
      const schema: any = (this.engine as any).getSchema?.(object);
      const fields = schema?.fields ?? {};
      // [ADR-0079] `nameField` is the canonical primary-title pointer;
      // `displayNameField` is the deprecated alias (still honored).
      const declared = schema?.nameField ?? schema?.displayNameField;
      if (declared && declared !== 'id' && fields[declared]) return declared;
      for (const cand of ['name', 'title', 'subject', 'label']) {
        if (fields[cand]) return cand;
      }
    } catch { /* schema unavailable — heuristics below still apply */ }
    return undefined;
  }

  private static pickTitle(rec: any, displayField?: string): string | undefined {
    const candidates = displayField
      ? [displayField, 'name', 'title', 'subject', 'label']
      : ['name', 'title', 'subject', 'label'];
    for (const f of candidates) {
      const v = rec?.[f];
      if (v != null && String(v).trim() && f !== 'id') return String(v);
    }
    return undefined;
  }

  /**
   * Batch-resolve `sys_user` display names for identifiers that may be user
   * ids or emails. Best-effort — failures leave entries unresolved.
   */
  private async resolveUserNames(identifiers: Array<string | null | undefined>): Promise<Map<string, string>> {
    const names = new Map<string, string>();
    const targets = Array.from(new Set(identifiers.filter(Boolean))) as string[];
    if (!targets.length) return names;
    try {
      const users = await this.engine.find('sys_user', {
        where: { id: { $in: targets } }, fields: ['id', 'name', 'email'],
        limit: targets.length, context: SYSTEM_CTX,
      });
      for (const u of (users ?? []) as any[]) {
        if (u?.id && (u.name || u.email)) names.set(String(u.id), String(u.name ?? u.email));
      }
    } catch { /* best-effort */ }
    const unresolvedEmails = targets.filter(t => !names.has(t) && t.includes('@'));
    if (unresolvedEmails.length) {
      try {
        const users = await this.engine.find('sys_user', {
          where: { email: { $in: unresolvedEmails } }, fields: ['email', 'name'],
          limit: unresolvedEmails.length, context: SYSTEM_CTX,
        });
        for (const u of (users ?? []) as any[]) {
          if (u?.email && u.name) names.set(String(u.email), String(u.name));
        }
      } catch { /* best-effort */ }
    }
    return names;
  }

  /** Lookup-typed fields (key + referenced object) of an object's schema. */
  private resolveLookupFields(object: string): Array<{ key: string; reference: string }> {
    try {
      const schema: any = (this.engine as any).getSchema?.(object);
      const fields = schema?.fields ?? {};
      const out: Array<{ key: string; reference: string }> = [];
      for (const [key, f] of Object.entries<any>(fields)) {
        if ((f?.type === 'lookup' || f?.type === 'master_detail' || f?.type === 'user') && f?.reference) {
          out.push({ key, reference: String(f.reference) });
        }
      }
      return out;
    } catch { return []; }
  }

  /**
   * Field key → display label for an object's schema. Lets the inbox summary
   * show a human field name ("考核状态") instead of a title-cased machine key
   * ("Assessment Status"). For a single-locale project the schema label already
   * IS the localized string; symmetric with `resolveDisplayField`/lookup
   * resolution that power `payload_display`.
   */
  private resolveFieldLabels(object: string): Record<string, string> {
    try {
      const schema: any = (this.engine as any).getSchema?.(object);
      const fields = schema?.fields ?? {};
      const out: Record<string, string> = {};
      for (const [key, f] of Object.entries<any>(fields)) {
        if (f?.label) out[key] = String(f.label);
      }
      return out;
    } catch { return {}; }
  }

  /**
   * Attach inbox display fields to rows so clients never render a raw
   * identifier: `record_title`, `submitter_name`, `object_label`,
   * `pending_approver_names` (user-id approvers), `payload_display`
   * (lookup foreign keys in the snapshot → referenced record titles), and
   * `payload_labels` (snapshot field keys → the target object's field labels).
   * Batched: one query per distinct object (target + referenced) plus one
   * `sys_user` lookup. Best-effort — a deleted record falls back to the
   * payload snapshot, and any failure leaves the field unset rather than
   * failing the list.
   */
  private async enrichRows(rows: ApprovalRequestRow[]): Promise<void> {
    if (!rows.length) return;

    // Record titles + object labels, batched per object.
    const byObject = new Map<string, Set<string>>();
    for (const r of rows) {
      if (!r.object_name || !r.record_id) continue;
      let set = byObject.get(r.object_name);
      if (!set) { set = new Set(); byObject.set(r.object_name, set); }
      set.add(r.record_id);
    }
    const titles = new Map<string, string>();
    const objectLabels = new Map<string, string>();
    for (const [object, idSet] of byObject) {
      try {
        const schema: any = (this.engine as any).getSchema?.(object);
        if (schema?.label) objectLabels.set(object, String(schema.label));
      } catch { /* label optional */ }
      const ids = Array.from(idSet);
      const displayField = this.resolveDisplayField(object);
      try {
        const recs = await this.engine.find(object, {
          where: { id: { $in: ids } }, limit: ids.length, context: SYSTEM_CTX,
        });
        for (const rec of (recs ?? []) as any[]) {
          const title = ApprovalService.pickTitle(rec, displayField);
          if (rec?.id && title) titles.set(`${object} ${rec.id}`, title);
        }
      } catch { /* object may be unregistered — payload fallback below */ }
    }

    // Lookup foreign keys inside payload snapshots → referenced record titles.
    const lookupFieldsByObject = new Map<string, Array<{ key: string; reference: string }>>();
    // Field key → label per object, for the snapshot summary's field names.
    const fieldLabelsByObject = new Map<string, Record<string, string>>();
    for (const object of byObject.keys()) {
      const lookups = this.resolveLookupFields(object);
      if (lookups.length) lookupFieldsByObject.set(object, lookups);
      const labels = this.resolveFieldLabels(object);
      if (Object.keys(labels).length) fieldLabelsByObject.set(object, labels);
    }
    const refIds = new Map<string, Set<string>>();
    for (const r of rows) {
      const lookups = lookupFieldsByObject.get(r.object_name);
      const payload: any = r.payload;
      if (!lookups || !payload || typeof payload !== 'object') continue;
      for (const { key, reference } of lookups) {
        const v = payload[key];
        if (v == null || typeof v === 'object' || !String(v).trim()) continue;
        let set = refIds.get(reference);
        if (!set) { set = new Set(); refIds.set(reference, set); }
        set.add(String(v));
      }
    }
    const refTitles = new Map<string, string>();
    for (const [object, idSet] of refIds) {
      const ids = Array.from(idSet);
      const displayField = this.resolveDisplayField(object);
      try {
        const recs = await this.engine.find(object, {
          where: { id: { $in: ids } }, limit: ids.length, context: SYSTEM_CTX,
        });
        for (const rec of (recs ?? []) as any[]) {
          const title = ApprovalService.pickTitle(rec, displayField);
          if (rec?.id && title) refTitles.set(`${object} ${rec.id}`, title);
        }
      } catch { /* referenced object unreadable — leave unresolved */ }
    }

    // Display names for submitters AND user-id approvers in one lookup.
    // `role:<r>` (and other `type:value` literals) are already readable.
    const userIdentifiers: Array<string | null | undefined> = [];
    for (const r of rows) {
      userIdentifiers.push(r.submitter_id);
      for (const a of r.pending_approvers ?? []) {
        if (a && !a.includes(':')) userIdentifiers.push(a);
      }
    }
    const names = await this.resolveUserNames(userIdentifiers);

    for (const r of rows as any[]) {
      const title = titles.get(`${r.object_name} ${r.record_id}`)
        ?? ApprovalService.pickTitle(r.payload, undefined);
      if (title) r.record_title = title;
      const name = r.submitter_id ? names.get(String(r.submitter_id)) : undefined;
      if (name) r.submitter_name = name;
      const label = objectLabels.get(r.object_name);
      if (label) r.object_label = label;

      const approverNames: Record<string, string> = {};
      for (const a of r.pending_approvers ?? []) {
        const n = names.get(String(a));
        if (n) approverNames[a] = n;
      }
      if (Object.keys(approverNames).length) r.pending_approver_names = approverNames;

      const lookups = lookupFieldsByObject.get(r.object_name);
      if (lookups && r.payload && typeof r.payload === 'object') {
        const display: Record<string, string> = {};
        for (const { key, reference } of lookups) {
          const v = (r.payload as any)[key];
          if (v == null) continue;
          const t = refTitles.get(`${reference} ${String(v)}`);
          if (t) display[key] = t;
        }
        if (Object.keys(display).length) r.payload_display = display;
      }

      // Field labels for the snapshot keys the summary renders (only keys
      // actually present in the payload — a deleted field's label is noise).
      const fieldLabels = fieldLabelsByObject.get(r.object_name);
      if (fieldLabels && r.payload && typeof r.payload === 'object') {
        const labels: Record<string, string> = {};
        for (const key of Object.keys(r.payload as Record<string, unknown>)) {
          const l = fieldLabels[key];
          if (l) labels[key] = l;
        }
        if (Object.keys(labels).length) r.payload_labels = labels;
      }
    }
  }

  // ── Pending-approver index (issue #1745) ─────────────────────

  /**
   * Mirror one request's `pending_approvers` CSV into the normalized
   * `sys_approval_approver` index. Called by every write path that changes
   * the approver set; an empty `approvers` clears the request's rows (the
   * request left `pending`). Diff-based so reassign/unanimous churn doesn't
   * rewrite untouched rows.
   */
  private async syncApproverIndex(
    requestId: string,
    approvers: string[],
    org: string | null,
    now: string,
  ): Promise<void> {
    const desired = new Set(approvers.map(a => String(a).trim()).filter(Boolean));
    const existing = await this.engine.find('sys_approval_approver', {
      where: { request_id: requestId }, limit: 500, context: SYSTEM_CTX,
    });
    const rows: any[] = Array.isArray(existing) ? existing : [];
    for (const row of rows) {
      if (desired.has(String(row.approver))) desired.delete(String(row.approver));
      else await this.engine.delete('sys_approval_approver', { where: { id: row.id }, context: SYSTEM_CTX });
    }
    for (const approver of desired) {
      await this.engine.insert('sys_approval_approver', {
        id: uid('aapr'), request_id: requestId, approver,
        organization_id: org, created_at: now,
      }, { context: SYSTEM_CTX });
    }
  }

  /**
   * Rebuild the whole `sys_approval_approver` index from the CSV source of
   * truth. Idempotent; run at plugin start so rows written before the index
   * existed (or drifted past a crashed sync) become queryable. Cost tracks
   * the number of *pending* requests, not the request history.
   */
  async rebuildApproverIndex(): Promise<{ requests: number; inserted: number; deleted: number }> {
    // Desired state: every pending request's CSV entries.
    const desired = new Map<string, { approvers: Set<string>; org: string | null }>();
    const PAGE = 500;
    for (let offset = 0; ; offset += PAGE) {
      const batch = await this.engine.find('sys_approval_request', {
        where: { status: 'pending' },
        fields: ['id', 'pending_approvers', 'organization_id'],
        limit: PAGE, offset, context: SYSTEM_CTX,
      });
      const rows: any[] = Array.isArray(batch) ? batch : [];
      for (const r of rows) {
        desired.set(String(r.id), {
          approvers: new Set(csvSplit(r.pending_approvers)),
          org: r.organization_id ?? null,
        });
      }
      if (rows.length < PAGE) break;
    }

    // Current state: read the whole index first (bounded by the live work
    // queue), THEN mutate — deleting while paginating would shift the cursor.
    const indexRows: any[] = [];
    for (let offset = 0; ; offset += PAGE) {
      const batch = await this.engine.find('sys_approval_approver', {
        orderBy: [{ field: 'created_at', order: 'asc' }],
        limit: PAGE, offset, context: SYSTEM_CTX,
      });
      const rows: any[] = Array.isArray(batch) ? batch : [];
      indexRows.push(...rows);
      if (rows.length < PAGE) break;
    }
    let inserted = 0; let deleted = 0;
    const seen = new Map<string, Set<string>>();
    for (const row of indexRows) {
      const reqId = String(row.request_id);
      const want = desired.get(reqId);
      const have = seen.get(reqId) ?? seen.set(reqId, new Set()).get(reqId)!;
      // Orphan (request no longer pending), stale entry, or duplicate → drop.
      if (!want || !want.approvers.has(String(row.approver)) || have.has(String(row.approver))) {
        await this.engine.delete('sys_approval_approver', { where: { id: row.id }, context: SYSTEM_CTX });
        deleted++;
        continue;
      }
      have.add(String(row.approver));
    }

    const now = this.clock.now().toISOString();
    for (const [reqId, want] of desired) {
      const have = seen.get(reqId);
      for (const approver of want.approvers) {
        if (have?.has(approver)) continue;
        await this.engine.insert('sys_approval_approver', {
          id: uid('aapr'), request_id: reqId, approver,
          organization_id: want.org, created_at: now,
        }, { context: SYSTEM_CTX });
        inserted++;
      }
    }
    return { requests: desired.size, inserted, deleted };
  }

  // ── Read API ─────────────────────────────────────────────────

  /** Filter type accepted by {@link listRequests} / {@link countRequests}. */
  private buildRequestWhere(
    filter: {
      object?: string;
      recordId?: string;
      status?: ApprovalStatus | ApprovalStatus[];
      submitterId?: string;
      q?: string;
    } | undefined,
    context: SharingExecutionContext,
  ): { where: any; tenantOrg: string | null } {
    const f: any = {};
    if (filter?.object) f.object_name = filter.object;
    if (filter?.recordId) f.record_id = filter.recordId;
    if (filter?.submitterId) f.submitter_id = filter.submitterId;
    // Tenant isolation: when a caller context carries a tenant identifier
    // (organizationId / tenantId), scope the query to that tenant. SYSTEM
    // callers (no tenant) see all rows. This prevents the bespoke endpoint
    // from leaking other-tenant rows since we deliberately query with
    // SYSTEM_CTX to bypass RLS on the engine (the approver-visibility rule
    // spans three identity forms, which RLS can't model cleanly).
    const tenantOrg = (context as any)?.organizationId ?? (context as any)?.tenantId ?? null;
    if (tenantOrg) f.organization_id = tenantOrg;
    // Free-text search, pushed down: `payload_json` carries the record
    // snapshot, so record titles match without any join. `$contains` is the
    // driver's escaped-LIKE operator.
    const q = filter?.q?.trim();
    if (q) {
      f.$or = [
        { process_name: { $contains: q } },
        { object_name: { $contains: q } },
        { record_id: { $contains: q } },
        { submitter_id: { $contains: q } },
        { payload_json: { $contains: q } },
      ];
    }
    // Status pushes down whole: `$in` for arrays (all bundled drivers
    // support it), equality for a single value.
    if (Array.isArray(filter?.status)) {
      const statuses = (filter!.status as ApprovalStatus[]).filter(Boolean);
      if (statuses.length === 1) f.status = statuses[0];
      else if (statuses.length > 1) f.status = { $in: statuses };
    } else if (filter?.status) {
      f.status = filter.status;
    }
    return { where: f, tenantOrg };
  }

  /** Window the approver-index probe — pending queues live far below this. */
  private static readonly APPROVER_INDEX_CAP = 10_000;

  /**
   * Resolve an approver filter to matching request ids via the normalized
   * `sys_approval_approver` index — the indexed replacement for the old
   * in-memory CSV scan, and what makes approver-filtered pagination correct
   * past any scan window (issue #1745). A request matches when ANY of the
   * caller's identities (user id / email / role:<r>) holds a pending slot.
   * Returns null when the filter is absent (callers skip the id constraint).
   */
  private async approverRequestIds(
    targets: string[],
    tenantOrg: string | null,
  ): Promise<string[] | null> {
    if (!targets.length) return null;
    const where: any = targets.length === 1
      ? { approver: targets[0] }
      : { approver: { $in: targets } };
    if (tenantOrg) where.organization_id = tenantOrg;
    const rows = await this.engine.find('sys_approval_approver', {
      where, fields: ['request_id'],
      limit: ApprovalService.APPROVER_INDEX_CAP, context: SYSTEM_CTX,
    });
    const list: any[] = Array.isArray(rows) ? rows : [];
    if (list.length >= ApprovalService.APPROVER_INDEX_CAP) {
      this.logger?.warn?.('[approvals] approver index probe hit its window — results may be truncated', {
        cap: ApprovalService.APPROVER_INDEX_CAP, targets: targets.length,
      });
    }
    return [...new Set<string>(list.map(r => String(r.request_id)))];
  }

  /**
   * The request ids this caller is a PARTICIPANT of, or `null` for a caller
   * who may see everything in scope (#3590).
   *
   * These reads deliberately run with `SYSTEM_CTX` to bypass RLS — the
   * approver-visibility rule spans several identity forms that RLS cannot model
   * cleanly, which is why it has to be expressed here. Until now only the
   * TENANT half of that rule was applied, so any authenticated user could read
   * any request in their tenant (and, once attachments derived their access
   * from the request, its files too). This adds the participant half.
   *
   * A participant is the submitter, a current approver, or someone who has
   * already acted on the request (a past approver whose slot has moved on, a
   * commenter). Admins with override authority keep the unrestricted view the
   * "all requests" console surface depends on.
   *
   * Keying on the concrete user id is sufficient rather than an approximation:
   * position/team/manager/field approvers are resolved to concrete user ids at
   * open time, and the `type:value` literal is only the fallback for a spec
   * that resolved to NOBODY — a slot no one can act on either way (`can_act`
   * is a plain membership test over the resolved ids). So this cannot hide a
   * request from someone who could actually act on it.
   */
  private async visibleRequestIds(
    context: SharingExecutionContext,
    tenantOrg: string | null,
  ): Promise<Set<string> | null> {
    if (this.isOverrideActor(context, tenantOrg)) return null;
    const uid = (context as any)?.userId != null ? String((context as any).userId) : '';
    // A tokenless/anonymous caller participates in nothing. Fail closed.
    if (!uid) return new Set<string>();

    const ids = new Set<string>();
    const cap = ApprovalService.APPROVER_INDEX_CAP;
    const add = (rows: unknown, key: string) => {
      const list: any[] = Array.isArray(rows) ? rows : [];
      for (const r of list) if (r?.[key] != null) ids.add(String(r[key]));
      if (list.length >= cap) {
        this.logger?.warn?.(
          '[approvals] participant-visibility probe hit its window — some requests may be hidden from a legitimate participant',
          { cap, key },
        );
      }
    };

    try {
      // Current approver — via the normalized index, so every identity form
      // the write path recorded is covered.
      for (const id of (await this.approverRequestIds([uid], tenantOrg)) ?? []) ids.add(id);

      const orgWhere = tenantOrg ? { organization_id: tenantOrg } : {};
      add(
        await this.engine.find('sys_approval_request', {
          where: { submitter_id: uid, ...orgWhere },
          fields: ['id'], limit: cap, context: SYSTEM_CTX,
        }),
        'id',
      );
      // Already acted on it: a past approver whose slot has moved on, or a
      // commenter. They saw it legitimately; keep it that way.
      add(
        await this.engine.find('sys_approval_action', {
          where: { actor_id: uid },
          fields: ['request_id'], limit: cap, context: SYSTEM_CTX,
        }),
        'request_id',
      );
    } catch (err) {
      // Never widen on error: a failed probe yields whatever was collected.
      this.logger?.warn?.('[approvals] participant-visibility probe failed', {
        error: err instanceof Error ? err.message : String(err),
      });
    }
    return ids;
  }

  /** Intersect an existing `where.id` constraint with the participant set. */
  private applyVisibility(where: any, visible: Set<string> | null): boolean {
    if (!visible) return true;
    if (visible.size === 0) return false;
    let allowed = [...visible];
    const current = where.id;
    if (typeof current === 'string') allowed = allowed.filter((x) => x === current);
    else if (current && typeof current === 'object' && Array.isArray(current.$in)) {
      const set = new Set(current.$in.map((v: unknown) => String(v)));
      allowed = allowed.filter((x) => set.has(x));
    }
    if (allowed.length === 0) return false;
    where.id = allowed.length === 1 ? allowed[0] : { $in: allowed };
    return true;
  }

  async listRequests(
    filter: {
      object?: string;
      recordId?: string;
      status?: ApprovalStatus | ApprovalStatus[];
      approverId?: string | string[];
      submitterId?: string;
      q?: string;
      limit?: number;
      offset?: number;
    } | undefined,
    context: SharingExecutionContext,
  ): Promise<ApprovalRequestRow[]> {
    const { where, tenantOrg } = this.buildRequestWhere(filter, context);
    const approverTargets = (Array.isArray(filter?.approverId) ? filter!.approverId : filter?.approverId ? [filter.approverId] : [])
      .map(t => String(t).trim())
      .filter(Boolean);

    // Every filter now pushes into the engine (issue #1745): approver via
    // the normalized index, status arrays via $in — so the page window is
    // always engine-side and correct at any table size.
    const ids = await this.approverRequestIds(approverTargets, tenantOrg);
    if (ids) {
      if (ids.length === 0) return [];
      where.id = ids.length === 1 ? ids[0] : { $in: ids };
    }

    // #3590: the caller-supplied `approverId` is a FILTER, not authorization —
    // omitting it used to return every request in the tenant. Intersect with
    // what this caller actually participates in.
    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg))) return [];

    const findOpts: any = {
      where,
      orderBy: [{ field: 'created_at', order: 'desc' }],
      context: SYSTEM_CTX,
    };
    if (filter?.limit != null || filter?.offset != null) {
      findOpts.limit = Math.min(Math.max(filter?.limit ?? 50, 1), 200);
      if (filter?.offset) findOpts.offset = Math.max(filter.offset, 0);
    } else {
      // Unpaginated callers keep the legacy bounded window.
      findOpts.limit = 500;
    }

    const rows = await this.engine.find('sys_approval_request', findOpts);
    const list = Array.isArray(rows) ? rows.map(rowFromRequest) : [];
    await this.enrichRows(list);
    this.attachViewers(list, context);
    return list;
  }

  async countRequests(
    filter: Parameters<IApprovalService['listRequests']>[0],
    context: SharingExecutionContext,
  ): Promise<number> {
    const { where, tenantOrg } = this.buildRequestWhere(filter, context);
    const approverTargets = (Array.isArray(filter?.approverId) ? filter!.approverId : filter?.approverId ? [filter.approverId] : [])
      .map(t => String(t).trim())
      .filter(Boolean);

    const ids = await this.approverRequestIds(approverTargets, tenantOrg);
    if (ids) {
      if (ids.length === 0) return 0;
      where.id = ids.length === 1 ? ids[0] : { $in: ids };
    }

    // #3590 — the count must agree with the list it paginates.
    if (!this.applyVisibility(where, await this.visibleRequestIds(context, tenantOrg))) return 0;

    const countFn = (this.engine as any).count;
    if (typeof countFn === 'function') {
      try {
        const n = await countFn.call(this.engine, 'sys_approval_request', { where, context: SYSTEM_CTX });
        if (typeof n === 'number') return n;
      } catch { /* fall through to scan */ }
    }
    // Engine without count(): bounded scan. The approver-filtered case is
    // exact (the id set bounds it); the unfiltered case keeps the legacy
    // 500 window.
    const rows = await this.engine.find('sys_approval_request', {
      where, fields: ['id'], limit: ids ? Math.max(500, ids.length) : 500, context: SYSTEM_CTX,
    });
    return Array.isArray(rows) ? rows.length : 0;
  }

  /**
   * Read the request a write path just changed, to echo back as its result.
   *
   * NOT participant-gated (#3590), deliberately: the operation authorized
   * itself by its own rule before writing, so re-asking "may you see this?"
   * for the echo answers a question that has already been settled — and would
   * answer it WRONG for a caller context that carries no `userId` (a
   * flow-driven resume, a service-to-service call), turning a successful write
   * into a `null` result. Gating belongs on the read API, not on an
   * operation's own return value.
   */
  private async readBackRequest(
    requestId: string,
    context: SharingExecutionContext,
  ): Promise<ApprovalRequestRow | null> {
    return this.loadRequest(requestId, context, false);
  }

  async getRequest(requestId: string, context: SharingExecutionContext): Promise<ApprovalRequestRow | null> {
    return this.loadRequest(requestId, context, true);
  }

  private async loadRequest(
    requestId: string,
    context: SharingExecutionContext,
    enforceVisibility: boolean,
  ): Promise<ApprovalRequestRow | null> {
    if (!requestId) return null;
    const where: any = { id: requestId };
    const tenantOrg = (context as any)?.organizationId ?? (context as any)?.tenantId;
    if (tenantOrg) where.organization_id = tenantOrg;
    const rows = await this.engine.find('sys_approval_request', {
      where, limit: 1, context: SYSTEM_CTX,
    });
    if (!Array.isArray(rows) || !rows[0]) return null;
    // #3590: tenant scoping alone let any authenticated user read any request
    // — and, once decision attachments derived their access from the request
    // (#3580), its files too. Participation is the rest of the rule.
    if (enforceVisibility) {
      const visible = await this.visibleRequestIds(context, tenantOrg ?? null);
      if (visible && !visible.has(String(rows[0].id))) return null;
    }
    const row = rowFromRequest(rows[0]);
    await this.enrichRows([row]);
    await this.attachFlowSteps(row);
    await this.attachDecisionProgress(row, rows[0]);
    this.attachViewers([row], context);
    return row;
  }

  /**
   * Server-computed decision aggregation progress (#3266 / objectui#2678 P1.5).
   * Single-read enrichment only (like {@link ApprovalService.attachFlowSteps}):
   * for a PENDING request whose behavior aggregates multiple approvals
   * (`unanimous` / `quorum` / `per_group`), expose
   * `decision_progress: { behavior, got, need, groups? }` so any client renders
   * "2 of 3" or per-group ticks without re-deriving the engine's tally rules.
   * `first_response` requests carry no progress (one approval finalizes).
   * Display-only and best-effort — errors leave the row untouched.
   */
  private async attachDecisionProgress(row: ApprovalRequestRow, raw: any): Promise<void> {
    try {
      if (row.status !== 'pending') return;
      const cfg = parseJson<any>(raw.node_config_json, undefined);
      const behavior = cfg?.behavior ?? 'first_response';
      if (behavior !== 'unanimous' && behavior !== 'quorum' && behavior !== 'per_group') return;

      const acts = await this.engine.find('sys_approval_action', {
        where: { request_id: row.id, step_index: 0, action: 'approve' }, limit: 1000, context: SYSTEM_CTX,
      });
      const approved = new Set<string>((acts ?? []).map((a: any) => String(a.actor_id ?? '')).filter(Boolean));

      const snapshot = cfg?.__approverGroups as Record<string, string[]> | undefined;
      const slate = snapshot ? Object.keys(snapshot) : [...approved, ...(row.pending_approvers ?? [])];
      const total = slate.length || 1;

      const progress: any = { behavior, got: approved.size, need: total };
      if (behavior === 'quorum') {
        progress.need = Math.min(Math.max(1, cfg?.minApprovals ?? total), total);
      } else if (behavior === 'per_group' && snapshot) {
        const perGroupNeed = Math.max(1, cfg?.minApprovals ?? 1);
        const size: Record<string, number> = {};
        for (const gs of Object.values(snapshot)) for (const g of gs) size[g] = (size[g] ?? 0) + 1;
        const got: Record<string, number> = {};
        for (const a of approved) for (const g of (snapshot[a] ?? [])) got[g] = (got[g] ?? 0) + 1;
        progress.groups = Object.keys(size).sort().map(g => {
          const need = Math.min(perGroupNeed, size[g]);
          return { group: g, got: Math.min(got[g] ?? 0, need), need, satisfied: (got[g] ?? 0) >= need };
        });
        progress.got = progress.groups.filter((g: any) => g.satisfied).length;
        progress.need = progress.groups.length;

        // Approver→group(s) for the STILL-PENDING slots (objectui#2807), so the
        // console can label each "waiting on" chip with the group it represents
        // rather than showing duplicate, context-free names. Only pending slots
        // matter — a resolved approver has dropped out of `pending_approvers`.
        // Synthetic (unnamed, `#N`) group keys are dropped: a `· #0` sub-tag is
        // noise, and the client would have to filter it anyway.
        const pendingGroups: Record<string, string[]> = {};
        for (const a of (row.pending_approvers ?? [])) {
          const named = (snapshot[a] ?? []).filter((g) => !/^#\d+$/.test(g));
          if (named.length) pendingGroups[a] = named;
        }
        if (Object.keys(pendingGroups).length) {
          (row as any).pending_approver_groups = pendingGroups;
        }
      }
      (row as any).decision_progress = progress;
    } catch { /* display-only enrichment */ }
  }

  /**
   * Attach the per-viewer capability block (#3310) from the caller's context.
   * `can_act` mirrors the exact authorization the decision methods enforce — the
   * caller's user id is in the resolved `pending_approvers` while the request is
   * still `pending` (position/team/manager approvers are already resolved to
   * concrete user ids at open time, so a plain membership test is faithful).
   * `is_submitter` is a straight owner check. `can_override` (#3424) is true for
   * a platform/tenant admin on a PENDING request — the recovery path for an
   * approval routed to an unstaffed position or to approvers who have all left;
   * clients OR it into the decision actions' `visible` gate so an admin can act
   * even when they hold no slot. System/tokenless contexts get a both-false
   * `can_act`/`is_submitter` block (system gets `can_override` too — it may act
   * on anything). Cheap + synchronous — safe on list reads.
   */
  private attachViewers(rows: ApprovalRequestRow[], context: SharingExecutionContext): void {
    const uid = (context as any)?.userId != null ? String((context as any).userId) : null;
    for (const row of rows) {
      const pending = row.pending_approvers ?? [];
      (row as any).viewer = {
        can_act: row.status === 'pending' && !!uid && pending.includes(uid),
        is_submitter: !!uid && row.submitter_id != null && String(row.submitter_id) === uid,
        can_override: row.status === 'pending'
          && this.isOverrideActor(context, (row as any).organization_id ?? null),
      };
    }
  }

  /**
   * Derive approval-step progress from the owning flow's graph (single-read
   * enrichment only — list reads skip it). Walks from the start node
   * preferring `approve`/`true` edges, so the result is the flow's main
   * approval trunk; conditional side-steps show as part of the potential
   * path. Display-only and best-effort.
   */
  private async attachFlowSteps(row: ApprovalRequestRow): Promise<void> {
    try {
      const flowName = row.process_name?.startsWith('flow:') ? row.process_name.slice(5) : undefined;
      if (!flowName || typeof this.automation?.getFlow !== 'function') return;
      const flow: any = await this.automation.getFlow(flowName);
      if (!flow?.nodes?.length) return;
      const nodesById = new Map<string, any>(flow.nodes.map((n: any) => [n.id, n]));
      const steps: Array<{ id: string; label: string }> = [];
      const seen = new Set<string>();
      let cur: any = flow.nodes.find((n: any) => n.type === 'start');
      while (cur && !seen.has(cur.id)) {
        seen.add(cur.id);
        if (cur.type === 'approval') steps.push({ id: cur.id, label: cur.label || cur.id });
        const out = (flow.edges ?? []).filter((e: any) => e.source === cur.id);
        if (!out.length) break;
        const pick = out.find((e: any) => e.label === 'approve')
          ?? out.find((e: any) => e.label === 'true')
          ?? out[0];
        cur = nodesById.get(pick.target);
      }
      if (steps.length === 0) return;
      const currentId = row.flow_node_id ?? row.current_step;
      const currentIdx = steps.findIndex(s => s.id === currentId);
      (row as any).flow_steps = steps.map((s, i) => ({
        ...s,
        state: currentIdx < 0 ? 'upcoming'
          : i < currentIdx ? 'done'
          : i === currentIdx ? (row.status === 'approved' ? 'done' : 'current')
          : 'upcoming',
      }));
    } catch { /* display-only — never fail the read */ }
  }

  async listActions(requestId: string, context: SharingExecutionContext): Promise<ApprovalActionRow[]> {
    if (!requestId) return [];
    // Tenant gate: ensure the caller can see the parent request before
    // returning its action history. Skipping this would leak history rows
    // across tenants the same way the unscoped list-requests path did.
    const req = await this.getRequest(requestId, context);
    if (!req) return [];
    const rows = await this.engine.find('sys_approval_action', {
      where: { request_id: requestId },
      limit: 500,
      orderBy: [{ field: 'created_at', order: 'asc' }],
      context: SYSTEM_CTX,
    });
    const actions = Array.isArray(rows) ? rows.map(rowFromAction) : [];
    // Timeline display: resolve actor ids to names so the audit trail never
    // shows a raw identifier. Role/team literals are already readable.
    const names = await this.resolveUserNames(
      actions.map(a => a.actor_id).filter(id => id && !id.includes(':')),
    );
    for (const a of actions as any[]) {
      const n = a.actor_id ? names.get(String(a.actor_id)) : undefined;
      if (n) a.actor_name = n;
    }
    return actions;
  }

  /**
   * `IFileAccessDelegate` — may this caller download a decision attachment?
   * (ADR-0104 D3 wave 2; declared by `sys_approval_action.fileAccessDelegate`.)
   *
   * A file referenced by `sys_approval_action.attachments` is owned by that
   * audit row, so the storage service would otherwise authorize the download by
   * testing whether the caller can READ the row. It cannot: `sys_approval_action`
   * is deliberately closed to ordinary approver positions, so that test denies
   * the very approver the attachment was filed for.
   *
   * The rule that actually governs seeing a decision is the one `listActions`
   * applies — can the caller see the PARENT REQUEST? — so this reuses it
   * exactly, rather than inventing a second, looser rule for the bytes. Fails
   * closed on any error.
   */
  async authorizeFileRead(actionId: string, context: SharingExecutionContext): Promise<boolean> {
    if (!actionId) return false;
    try {
      const rows = await this.engine.find('sys_approval_action', {
        where: { id: actionId },
        limit: 1,
        context: SYSTEM_CTX,
      });
      const requestId = (Array.isArray(rows) ? rows[0] : undefined)?.request_id;
      if (!requestId) return false;
      // Same gate as listActions: visibility of the decision's parent request.
      return !!(await this.getRequest(String(requestId), context));
    } catch {
      return false;
    }
  }
}