@@ -0,0 +1,13 @@
+---
+'@objectstack/plugin-approvals': patch
+---
+
+harden(approvals): every door that acts on an approval request answers a request the caller may not read the way the read door does
+
+Clause-②: no
+Metadata-protocol: none
+
+The doors that act on one approval request now ask the read door's own visibility rule first, before any check that depends on the request.
+
+- **What changes.** `approve`, `reject`, `recall`, `revise`, `resubmit`, `reassign`, `remind`, `request-info` and `comment` on `/api/v1/approvals/requests/:id/…` (and `IApprovalService.decide`, `recall`, `sendBack`, `resubmit`, `reassign`, `remind`, `requestInfo`, `comment` for an embedder calling the service) answer a caller who may not read the request — no participant of it, or outside its organization — with `404 REQUEST_NOT_FOUND`, exactly the answer an id that names no request gets. The rule is the one `GET /api/v1/approvals/requests/:id` serves by — the caller's organization, the participant set, the override actor's view and the opt-in record-reader tier — read from one place, not a copy. Nothing is written for such a caller.
+- **What does not change.** A caller who can read the request keeps the door's own answer: a submitter is still `403 FORBIDDEN` on the approver's verbs, an approver on the submitter's, and a decided request is `409 INVALID_STATE`. Pending approvers decide, submitters recall, remind and resubmit, as before. An administrator's override — the platform administrator's across organizations included — and system contexts (the SLA sweep, the email action link) act as before.
@@ -653,10 +653,13 @@ hold (the literal left by a position nobody held when the request opened, once
 someone is staffed into it). A named `actorId` must be one of those identities,
 and a named `position:<name>` takes that position's slot; the deprecated
 pre-rename prefix is not one of them (ADR-0090 D3) and returns 403
-(`FORBIDDEN: cannot act as '…'`). No
-such slot and no admin override returns 403 (`FORBIDDEN: actor '…' is
-not a pending approver`); a request that isn't pending returns 409
-(`INVALID_STATE`). The decision records two facts on its `sys_approval_action`
+(`FORBIDDEN: cannot act as '…'`). A request the caller may not read, and
+no admin override covers, returns 404 (`REQUEST_NOT_FOUND`), exactly as an id
+that names no request does — on every door that acts on a request, before any
+other check of it.
+For a caller who can read it, no such slot and no admin override returns 403
+(`FORBIDDEN: actor '…' is not a pending approver`); a request that isn't
+pending returns 409 (`INVALID_STATE`). The decision records two facts on its `sys_approval_action`
 row: `actor_id` is the user who decided, and `acted_as` is the slot the decision
 took, in that slot's stored spelling — the multi-approver tally counts approvals
 by matching `acted_as` against the slate. A `reassign` row records the slot it
@@ -987,8 +990,8 @@ in-flight request, `reassign` hands one slot to another user directly.
 | Code | HTTP | Meaning |
 |:---|:---|:---|
 | `VALIDATION_FAILED` | 400 | Malformed request |
-| `FORBIDDEN` | 403 | Actor may not take this action (not a pending approver, or not the submitter for a submitter-only verb) |
-| `REQUEST_NOT_FOUND` | 404 | No such request |
+| `FORBIDDEN` | 403 | Actor can read the request but may not take this action (not a pending approver, or not the submitter for a submitter-only verb) |
+| `REQUEST_NOT_FOUND` | 404 | No such request — or one the caller may not read: every door that reads or acts on a request gives both the same answer |
 | `DUPLICATE_REQUEST` | 409 | A pending request already exists for this record |
 | `INVALID_STATE` | 409 | The request is no longer pending |
 | `THROTTLED` | 429 | Rate limited |
 
@@ -322,15 +322,20 @@ describe('#4839 evidence — the sanctioned admin path covers an unavailable app
   it('a NON-privileged member gets none of this — the override is a real gate, not an open door', async () => {
     const req = await svc.openNodeRequest(staffedInput(), SUBMITTER);
     const member = { userId: 'nobody', tenantId: 't1', positions: [], permissions: [] } as any;
-    await expect(svc.reassign(req.id, { actorId: 'nobody', to: 'u7', from: 'u9' }, member)).rejects.toThrow(/FORBIDDEN/);
-    await expect(svc.decideNode(req.id, { decision: 'approve', actorId: 'nobody' }, member)).rejects.toThrow(/FORBIDDEN/);
+    // No participant of the request, so not a reader of it either: every door
+    // that acts on it answers as it answers an id that names no request.
+    await expect(svc.reassign(req.id, { actorId: 'nobody', to: 'u7', from: 'u9' }, member)).rejects.toThrow(/^REQUEST_NOT_FOUND: /);
+    await expect(svc.decideNode(req.id, { decision: 'approve', actorId: 'nobody' }, member)).rejects.toThrow(/^REQUEST_NOT_FOUND: /);
+    expect((await svc.getRequest((req as { id: string }).id, SYS))?.status).toBe('pending');
   });
 
   it('a `roles: [admin]` session gets none of it either — the retired dialect grants nothing anywhere', async () => {
     const req = await svc.openNodeRequest(staffedInput(), SUBMITTER);
     const fakeAdmin = { userId: 'pretender', tenantId: 't1', positions: [], permissions: [], roles: ['admin'] } as any;
-    await expect(svc.reassign(req.id, { actorId: 'pretender', to: 'u7', from: 'u9' }, fakeAdmin)).rejects.toThrow(/FORBIDDEN/);
-    await expect(svc.decideNode(req.id, { decision: 'approve', actorId: 'pretender' }, fakeAdmin)).rejects.toThrow(/FORBIDDEN/);
+    // Answered exactly as the plain member above: no reader of the request.
+    await expect(svc.reassign(req.id, { actorId: 'pretender', to: 'u7', from: 'u9' }, fakeAdmin)).rejects.toThrow(/^REQUEST_NOT_FOUND: /);
+    await expect(svc.decideNode(req.id, { decision: 'approve', actorId: 'pretender' }, fakeAdmin)).rejects.toThrow(/^REQUEST_NOT_FOUND: /);
+    expect((await svc.getRequest((req as { id: string }).id, SYS))?.status).toBe('pending');
   });
 });
 
 
@@ -242,6 +242,9 @@ describe('#23889 — the approval lists read engine-written display columns', ()
       }),
       created_at: stamp, updated_at: stamp,
     }, { context: SYSTEM } as any);
+    // The approver index as the plugin's boot backfill leaves it for such a row
+    // — what makes its approver a reader of it, and so able to act on it.
+    await svc.rebuildApproverIndex();
 
     await svc.comment('areq_legacy', { actorId: 'u_alice', comment: 'looking' }, asUser('u_alice'));
     const comment = (await actionsOf('areq_legacy')).find((a) => a.action === 'comment');
 
@@ -326,7 +326,9 @@ describe('[#15981] a D4 `sys_user_position` row spelling `platform_admin` confer
 
     const outcome = await attemptDecide(context, req.id);
 
-    expect(outcome.threw).toBe('FORBIDDEN');
+    // Another tenant's request is behind the wall the read door keeps, so a
+    // caller the override does not admit is answered as for a missing id.
+    expect(outcome.threw).toBe('REQUEST_NOT_FOUND');
     // The state half, asserted because a refusal that still moved the request
     // would be no refusal at all — and because `READ_BACK_FAILED` is exactly
     // what an ADMITTED cross-tenant write throws.
@@ -345,9 +347,10 @@ describe('[#15981] a D4 `sys_user_position` row spelling `platform_admin` confer
     const b = await openVictimRequest();
     const viaPlain = await attemptDecide(plain.context, b.id);
 
-    // The floor: a plain member of another tenant is refused. If this arm ever
-    // stops being FORBIDDEN, the comparison above is measuring nothing.
-    expect(viaPlain).toEqual({ threw: 'FORBIDDEN', status: 'pending', decided: false });
+    // The floor: a plain member of another tenant is refused — answered as for
+    // a missing id, since the request is behind the tenancy wall for them. If
+    // this arm ever stops being refused, the comparison above is measuring nothing.
+    expect(viaPlain).toEqual({ threw: 'REQUEST_NOT_FOUND', status: 'pending', decided: false });
     expect(viaName).toEqual(viaPlain);
   });
 });
@@ -431,9 +434,10 @@ describe('[#15981] CONTROL — a genuine Default Organization admin_full_access
     expect(orgless.grants.posture).not.toBe('PLATFORM_ADMIN');
     expect(orgless.rung).toBe(false);
 
+    // No override, and no reader of another tenant's request: answered as for a missing id.
     await expect(
       svc.decideNode(req.id, { decision: 'approve', actorId: ATTACKER }, orgless.context),
-    ).rejects.toThrow(/^FORBIDDEN/);
+    ).rejects.toThrow(/^REQUEST_NOT_FOUND/);
     const [row] = await engine.find('sys_approval_request', { where: { id: req.id } });
     const actions = (await svc.listActions(req.id, SYS)).filter((a: any) => a.actor_id === ATTACKER);
     expect({ status: row?.status, decided: actions.length > 0 }).toEqual({ status: 'pending', decided: false });
 
@@ -44,7 +44,10 @@ const ROUTED_USERS = ['u1', 'u2'];
 function makeFakeEngine() {
   const tables = new Map<string, any[]>([['sys_user', ROUTED_USERS.map((id) => ({ id }))]]);
   const rows = (o: string) => (tables.get(o) ?? (tables.set(o, []), tables.get(o)!));
-  const matches = (row: any, where: any) => Object.entries(where ?? {}).every(([k, v]) => {
+  const matches = (row: any, where: any): boolean => Object.entries(where ?? {}).every(([k, v]) => {
+    // The participant probe behind the read door asks "acted on it" as one
+    // `$or` (the person, or a slot they act under) — the real engine composes it.
+    if (k === '$or') return (v as any[]).some((sub) => matches(row, sub));
     if (k.startsWith('$')) throw new Error(`fake engine: unsupported filter operator ${k}`);
     if (v && typeof v === 'object' && '$in' in (v as any)) return (v as any).$in.includes(row[k]);
     if (v && typeof v === 'object' && '$ne' in (v as any)) return row[k] !== (v as any).$ne;
@@ -565,7 +568,8 @@ describe('Send back for revision (ADR-0044)', () => {
     registerReviseFlow();
     const { req } = await startFlow();
 
-    await expect(service.sendBack(req.id, { actorId: 'intruder' }, asUser('intruder'))).rejects.toThrow(/FORBIDDEN/);
+    // No participant, so no reader of the request: answered as for a missing id.
+    await expect(service.sendBack(req.id, { actorId: 'intruder' }, asUser('intruder'))).rejects.toThrow(/^REQUEST_NOT_FOUND: /);
     await expect(service.sendBack(req.id, { actorId: 'submitter' }, asUser('submitter'))).rejects.toThrow(/FORBIDDEN/);
 
     await service.sendBack(req.id, { actorId: 'u1' }, asUser('u1'));