@@ -11,7 +11,9 @@
 
 import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { APPROVAL_REVISE_NODE_TYPE, templateSlotSource } from '@objectstack/spec/automation';
-import { ApprovalService, REMIND_COOLDOWN_MS, ESCALATION_ENABLED_FLIP_CUTOFF_MS, SLA_ACTOR_ID } from './approval-service.js';
+import {
+  ApprovalService, ApproverDirectoryUnreadableError, REMIND_COOLDOWN_MS, ESCALATION_ENABLED_FLIP_CUTOFF_MS, SLA_ACTOR_ID,
+} from './approval-service.js';
 import { bindApprovalLockHook, bindDelegationWriteGuard, unbindAllHooks } from './lifecycle-hooks.js';
 import { celEngine } from '@objectstack/formula';
 import { SysApprovalRequest } from './sys-approval-request.object.js';
@@ -4207,6 +4209,138 @@ describe('ApprovalService — a queue approver routes to the queue\'s members (A
   });
 });
 
+// [ADR-0142 D6 as amended; ruling record 6599731698 on #29604, letter B] A
+// directory read behind a `team`, `position` or `queue` approver that FAILS is
+// not an empty slate: the node refuses to open under every `onEmptyApprovers`
+// policy, on its own retryable error class, naming the read — and writes
+// nothing. Before, the slot fell back to its literal and the policy acted on a
+// slate missing the people who could not be read.
+describe('ApprovalService — a team, position or queue approver whose directory read fails refuses the node (ADR-0142 D6)', () => {
+  const POLICIES = ['admin_rescue', 'auto_approve', 'fail', 'fallback'] as const;
+
+  /** A service over `engine` whose reads of `failing` throw, as a driver outage does. */
+  const outage = (failing: string[], queues?: () => any) => {
+    const engine = makeFakeEngine();
+    engine._tables['sys_team_member'] = [{ id: 'tm1', team_id: 't_ops', user_id: 'u5' }];
+    engine._tables['sys_user_position'] = [{ id: 'up1', position: 'cfo', user_id: 'u9', organization_id: 't1' }];
+    const real = engine.find.bind(engine);
+    engine.find = async (object: string, options?: any) => {
+      if (failing.includes(object)) throw new Error(`SQLITE_IOERR: disk I/O error reading ${object}`);
+      return real(object, options);
+    };
+    const warnings: any[] = [];
+    let n = 0;
+    const svc = new ApprovalService({
+      engine,
+      clock: { now: () => new Date(1757000000000 + (n++) * 1000) },
+      logger: { warn: (msg: any, meta: any) => warnings.push([msg, meta]) },
+      ...(queues ? { ownershipQueues: queues } : {}),
+    });
+    return { engine, svc, warnings };
+  };
+  const node = (approvers: any[], configExtra: Record<string, any> = {}) => ({
+    ...openInput([]),
+    config: { approvers, behavior: 'first_response' as const, lockRecord: false, ...configExtra },
+  });
+  const policy = (p: (typeof POLICIES)[number]) => (
+    p === 'fallback' ? { onEmptyApprovers: p, fallbackApprovers: [{ type: 'user', value: 'u_backstop' }] } : { onEmptyApprovers: p }
+  );
+  const refusalOf = (p: Promise<unknown>) => p.then(() => null, (e: unknown) => e);
+  const nothingWritten = (engine: ReturnType<typeof makeFakeEngine>) => {
+    expect(engine._tables['sys_approval_request'] ?? []).toEqual([]);
+    expect(engine._tables['sys_approval_approver'] ?? []).toEqual([]);
+    expect(engine._tables['sys_approval_action'] ?? []).toEqual([]);
+  };
+
+  for (const [type, value, table] of [['team', 't_ops', 'sys_team_member'], ['position', 'cfo', 'sys_user_position']] as const) {
+    for (const p of POLICIES) {
+      it(`a ${type} approver whose ${table} read fails: onEmptyApprovers '${p}' opens nothing and approves nothing`, async () => {
+        const { engine, svc } = outage([table]);
+        const refusal = await refusalOf(svc.openNodeRequest(node([{ type, value }], policy(p)), CTX));
+
+        expect(refusal).toBeInstanceOf(ApproverDirectoryUnreadableError);
+        expect(refusal).toMatchObject({ approverType: type, approverValue: value, retryable: true });
+        expect((refusal as Error).message).toMatch(new RegExp(`^APPROVER_DIRECTORY_UNREADABLE: approver '${type}:${value}'`));
+        expect((refusal as ApproverDirectoryUnreadableError).failedRead).toMatch(/SQLITE_IOERR/);
+        expect((refusal as Error).message).not.toMatch(/NO_APPROVERS|expanded to nobody/);
+        nothingWritten(engine);
+      });
+    }
+  }
+
+  it('beside a staffed person, the node still refuses: no slate shortened to the people who could be read', async () => {
+    const { engine, svc } = outage(['sys_team_member']);
+    const refusal = await refusalOf(svc.openNodeRequest(
+      node([{ type: 'user', value: 'u2' }, { type: 'team', value: 't_ops' }]), CTX,
+    ));
+
+    expect(refusal).toBeInstanceOf(ApproverDirectoryUnreadableError);
+    nothingWritten(engine);
+  });
+
+  it('a fallback slate whose directory read fails refuses too, rather than degrade to the administrators', async () => {
+    // The primary slate reads fine and is empty (an unstaffed position); the
+    // declared fallback names a team whose read fails.
+    const { engine, svc } = outage(['sys_team_member']);
+    const refusal = await refusalOf(svc.openNodeRequest(node([{ type: 'position', value: 'nobody_holds_this' }], {
+      onEmptyApprovers: 'fallback', fallbackApprovers: [{ type: 'team', value: 't_ops' }],
+    }), CTX));
+
+    expect(refusal).toBeInstanceOf(ApproverDirectoryUnreadableError);
+    expect(refusal).toMatchObject({ approverType: 'team', approverValue: 't_ops' });
+    nothingWritten(engine);
+  });
+
+  it('a queue whose expansion fails refuses before its "expanded to nobody" answer', async () => {
+    const { engine, svc, warnings } = outage([], () => ({
+      expandMembers: async () => { throw new Error('ownership-queue read failed'); },
+    }));
+    const refusal = await refusalOf(svc.openNodeRequest(node([{ type: 'queue', value: 'billing' }]), CTX));
+
+    expect(refusal).toBeInstanceOf(ApproverDirectoryUnreadableError);
+    expect(refusal).toMatchObject({ approverType: 'queue', approverValue: 'billing' });
+    expect(warnings.some(([msg]) => String(msg).includes("approver 'queue:billing' expanded to nobody"))).toBe(false);
+    nothingWritten(engine);
+  });
+
+  it('control — the readable slate opens as before', async () => {
+    const { svc } = outage([]);
+    const req = await svc.openNodeRequest(node([{ type: 'team', value: 't_ops' }, { type: 'position', value: 'cfo' }]), CTX) as any;
+
+    expect(req.status).toBe('pending');
+    expect([...req.pending_approvers].sort()).toEqual(['u5', 'u9']);
+  });
+
+  it('control — a department read that fails is not named by the ruling: the node still opens, as before', async () => {
+    const { engine, svc } = outage(['sys_business_unit', 'sys_business_unit_member']);
+    const outcome = await refusalOf(svc.openNodeRequest(
+      node([{ type: 'department', value: 'bu_x' }], { onEmptyApprovers: 'fallback', fallbackApprovers: [{ type: 'user', value: 'u_backstop' }] }),
+      CTX,
+    ));
+
+    expect(outcome).toBeNull();
+    expect(engine._tables['sys_approval_request']).toHaveLength(1);
+  });
+
+  it("decide's pre-snapshot re-resolution keeps the literal: a recorded decision is never failed by the outage", async () => {
+    // A unanimous request opened while the directory read, then stripped of
+    // its open-time snapshot as a request opened before the snapshot existed.
+    const failing: string[] = [];
+    const { engine, svc } = outage(failing);
+    const req = await svc.openNodeRequest(
+      node([{ type: 'user', value: 'u2' }, { type: 'team', value: 't_ops' }], { behavior: 'unanimous' }), CTX,
+    ) as any;
+    const row = engine._tables['sys_approval_request'].find((r: any) => r.id === req.id);
+    const config = JSON.parse(row.node_config_json);
+    delete config.__approverGroups;
+    row.node_config_json = JSON.stringify(config);
+
+    failing.push('sys_team_member');
+    const decided = await svc.decideNode(req.id, { decision: 'approve', actorId: 'u2' }, SYS);
+    expect(decided.decision).toBe('approve');
+  });
+});
+
 // #3807 follow-up: `queue` was not the only way to end up with a slot nobody
 // can act on — every GRAPH approver type falls back to the same literal when
 // its lookup finds no one, and that fallback used to happen in total silence.
 
@@ -30,7 +30,7 @@ import { SqlDriver } from '@objectstack/driver-sql';
 import {
   SysBusinessUnit, SysBusinessUnitMember, SysMember, SysOrganization, SysTeamMember,
 } from '@objectstack/platform-objects/identity';
-import { ApprovalService } from './approval-service.js';
+import { ApprovalService, ApproverDirectoryUnreadableError } from './approval-service.js';
 
 const ORG = 'org_large';
 const ELSEWHERE = 'org_elsewhere';
@@ -129,8 +129,8 @@ const department = (rig: Rig, value = ROOT) =>
   (rig.svc as any).expandBusinessUnitUsers(value, ORG) as Promise<string[]>;
 const resolveSpec = (rig: Rig, a: { type: string; value: string }) =>
   (rig.svc as any).resolveApproverSpec(a, undefined, ORG, Date.now()) as Promise<string[]>;
-const resolveExpression = (rig: Rig, a: { type: string; value: string; resolveAs: string }) =>
-  (rig.svc as any).resolveExpressionApprovers(a, {}, ORG, Date.now()) as Promise<{
+const resolveExpression = (rig: Rig, a: { type: string; value: string; resolveAs: string }, onDirectoryFailure?: 'refuse' | 'literal') =>
+  (rig.svc as any).resolveExpressionApprovers(a, {}, ORG, Date.now(), undefined, undefined, onDirectoryFailure) as Promise<{
     slots: Array<{ id: string; subGroup?: string }>;
     raw: string[];
   }>;
@@ -220,10 +220,18 @@ describe('[#29606] item 3 — an expression approver whose resolveAs expansion f
     expect(failed[0][1].error).toMatch(/SQLITE_IOERR/);
   });
 
-  it('⛔ a failed team read through resolveAs warns the same way', async () => {
+  it('⛔ a failed team read through resolveAs refuses the node as a team approver does; the literal reader warns the same way', async () => {
     const rig = await boot(0);
     rig.failReadsOf('sys_team_member');
-    const { slots } = await resolveExpression(rig, { type: 'expression', value: `'team_x'`, resolveAs: 'team' });
+    // [ADR-0142 D6 as amended, #29604] The value is read through the team
+    // expander, so its failure refuses the node like a static `team` approver's.
+    const refusal = await resolveExpression(rig, { type: 'expression', value: `'team_x'`, resolveAs: 'team' })
+      .then(() => null, (e: unknown) => e);
+    expect(refusal).toBeInstanceOf(ApproverDirectoryUnreadableError);
+    expect(refusal).toMatchObject({ approverType: 'team', approverValue: 'team_x', retryable: true });
+    expect((refusal as Error).message).toMatch(/^APPROVER_DIRECTORY_UNREADABLE: approver 'expression' \(resolveAs 'team', value 'team_x'\)/);
+
+    const { slots } = await resolveExpression(rig, { type: 'expression', value: `'team_x'`, resolveAs: 'team' }, 'literal');
 
     expect(slots).toEqual([{ id: 'team:team_x', subGroup: 'team_x' }]);
     const failed = failureWarnings(rig);
 
@@ -17,12 +17,15 @@
  *     and an `org_membership_level` approver logged "expanded to nobody",
  *     indistinguishable from a tier nobody holds.
  *
- * What a caller sees now: a failed read throws out of the expansion, the
- * approver-spec resolver's directory catch takes it, and the slot falls back
- * to its literal (`position:<p>`, acted on by whoever holds the position at
- * decision time; `org_membership_level:<t>`, decided by the override) with a
- * warning that names the failed read and carries its `error` — never a slate
- * cut down to the part that happened to read.
+ * What a caller sees now: a failed read throws out of the expansion and the
+ * approver-spec resolver's directory catch takes it. An `org_membership_level`
+ * slot falls back to its literal (`org_membership_level:<t>`, decided by the
+ * override) with a warning that names the failed read and carries its `error`.
+ * [ADR-0142 D6 as amended, #29604] A `position` approver, whose transition limb
+ * this read is, refuses the approval node instead
+ * (`ApproverDirectoryUnreadableError`); only the `'literal'` reader keeps its
+ * `position:<p>` literal. Never a slate cut down to the part that happened to
+ * read.
  *
  * Measured on a REAL engine (ObjectQL + SqlDriver over in-memory SQLite)
  * carrying the shipped `SysMember`, because the completion is a keyset read
@@ -33,7 +36,7 @@ import { describe, it, expect, afterEach, vi } from 'vitest';
 import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { SysMember, SysOrganization } from '@objectstack/platform-objects/identity';
-import { ApprovalService } from './approval-service.js';
+import { ApprovalService, ApproverDirectoryUnreadableError } from './approval-service.js';
 
 const ORG = 'org_large';
 const ELSEWHERE = 'org_elsewhere';
@@ -112,8 +115,8 @@ async function boot(n: number, opts: { registerMember?: boolean } = {}): Promise
 /** The private expansions, as the approver-spec resolver calls them. */
 const tier = (rig: Rig, value: string) => (rig.svc as any).expandMembershipTierUsers(value, ORG) as Promise<string[]>;
 const position = (rig: Rig, value: string) => (rig.svc as any).expandPositionUsers(value, ORG) as Promise<string[]>;
-const resolveSpec = (rig: Rig, a: { type: string; value: string }) =>
-  (rig.svc as any).resolveApproverSpec(a, undefined, ORG, Date.now()) as Promise<string[]>;
+const resolveSpec = (rig: Rig, a: { type: string; value: string }, onDirectoryFailure?: 'refuse' | 'literal') =>
+  (rig.svc as any).resolveApproverSpec(a, undefined, ORG, Date.now(), undefined, onDirectoryFailure) as Promise<string[]>;
 
 const failMemberReads = (rig: Rig, fault: Error) => {
   const memberDriver = (rig.engine as any).getDriverForObject('sys_member');
@@ -168,11 +171,18 @@ describe('[#29362] approvals membership-tier expansion reads every holder (drive
     expect(rig.warn.mock.calls.some(([, meta]) => typeof meta?.error === 'string')).toBe(false);
   });
 
-  it('⛔ what the caller sees: the slot falls back to its literal, and the warning names the failed read', async () => {
+  it('⛔ what the caller sees: a position refuses the node on its sys_member limb; the tier slot keeps its literal', async () => {
     const rig = await boot(3);
     failMemberReads(rig, new Error('SQLITE_IOERR: disk I/O error'));
 
-    expect(await resolveSpec(rig, { type: 'position', value: TIER })).toEqual([`position:${TIER}`]);
+    // [#29604] The ADR-0057 D4 transition limb is a read behind the position:
+    // its failure is a failed read, and the node refuses on it.
+    const refusal = await resolveSpec(rig, { type: 'position', value: TIER }).then(() => null, (e: unknown) => e);
+    expect(refusal).toBeInstanceOf(ApproverDirectoryUnreadableError);
+    expect(refusal).toMatchObject({ approverType: 'position', approverValue: TIER, retryable: true });
+    expect((refusal as ApproverDirectoryUnreadableError).failedRead).toMatch(/SQLITE_IOERR/);
+
+    expect(await resolveSpec(rig, { type: 'position', value: TIER }, 'literal')).toEqual([`position:${TIER}`]);
     expect(await resolveSpec(rig, { type: 'org_membership_level', value: TIER })).toEqual([`org_membership_level:${TIER}`]);
     const failed = rig.warn.mock.calls.filter(([, meta]) => typeof meta?.error === 'string');
     expect(failed.map(([, meta]) => meta.type)).toEqual(['position', 'org_membership_level']);