@@ -0,0 +1,17 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+fix(console)!: a decision output declared `multiple: true` is collected as a list and sent as a string array, from the record header and the Approval Center alike
+
+Clause-②: no (narrowing)
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata key or stored shape changes: the Console now sends each decision output in the shape its already-declared `multiple` names, which the approvals decision door judges (`@objectstack/plugin-approvals`, same release). The one deleted key is a message string in the built-in locale packs whose only call site this change removes; it is not metadata, and a host that kept its own text under it keeps it in its own resources. -->
+
+**BREAKING** for a TypeScript caller that names `actions.decisionOutput.helpMultiValue` through the pack-derived key type (`TranslationKeys`): the key leaves all ten packs (ar, de, en, es, fr, ja, ko, pt, ru, zh).
+
+- **Before.** Every decision output without a picker (`text`, a bare key, or a `position` output with no registry reader) rendered as one text box whose help said to comma-separate multiple values, so a list output reached the server as one comma string, which the decision door now refuses.
+- **Now.** Such an output declared `multiple: true` renders as a tags input: each entry is trimmed, a blank or repeated entry is skipped, and the decide body carries a string array. An output without `multiple: true` stays one text box and is sent as one string; a comma in it is literal. Both decision surfaces build their params in `decisionOutputParams`, so the record header and the Approval Center send the same shape. Every output's help now reads `actions.decisionOutput.help`.
+- **Who sees it.** An approver deciding a step with a free-value list output: they add entries one by one (Enter, a comma key, or leaving the box) instead of typing one comma-separated line.
@@ -0,0 +1,27 @@
+---
+'@objectstack/plugin-approvals': patch
+---
+
+fix(plugin-approvals)!: an approval decision whose output does not match its declaration is refused before anything is recorded — a single value where `multiple: true` declares a list, a list where it does not (a bare-key or `text` output included), a list naming one entry twice, or a picker value that resolves to no user, department, team or held position
+
+Clause-②: no (narrowing) — the approve and reject doors refuse a decision output whose shape does not match its declaration's `multiple` (every output, `text` and bare keys included), or whose `user`, `department`, `team` or `position` value does not resolve, which they admitted before. Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type changes: the already-declared `type` and `multiple` of a decision output are now enforced at the decision. The refusal is a VALIDATION_FAILED naming the output, answered to the approver at the decision, so there is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** accept-set narrowing at the approvals decision (`@objectstack/plugin-approvals`), served by `POST /api/v1/approvals/requests/:id/approve` and `/reject` and every door that forwards to them.
+
+- **Before.** A typed decision output was checked for presence only (`required`). A `type: 'user'` output naming an id no account carries was recorded as an approval; a stage-2 `expression` approver reading it then resolved nobody, and with `onEmptyApprovers: 'fail'` the run stranded behind a `500 RESUME_FAILED` while the request read `approved`. A bare string was stored for a `multiple: true` output, and a list could name one person twice. Until #29371 the spec documented that the runtime accepts any value shape for a list output, a CSV string (`'u2,u3'`) included; an API caller that sends that CSV string for a `multiple: true` output is now refused and sends a list (`['u2', 'u3']`) instead.
+- **Now.** Each admitted output is judged against its declaration before any write, on an approve and on a reject alike. `400 VALIDATION_FAILED` names every `outputs.KEY` that does not match; no action row and no output snapshot are written, and the request stays pending for the approver to decide again.
+  - Every output, `text` and every bare-key declaration included: `multiple: true` takes a list and only a list, with no entry twice; `multiple` absent or false takes one value. A bare key (`decisionOutputs: ['note']`) therefore takes one value, as its declaration always said; a list is what an output declared `multiple: true` collects.
+  - `text` is judged on that shape only; its values are free. A picker's values are text and must resolve:
+  - `user`: a record id an account carries (a slot address such as `position:NAME`, or an email, is not one).
+  - `department`: an active department of the request's organization.
+  - `team`: a team that exists and is not another organization's.
+  - `position`: a position machine name someone in the request's organization holds. A `sys_position` record id is refused: the `expression` approver matches holders by name, so an id would route to nobody.
+- **Unchanged.** A `text` value in the declared shape is accepted whatever it says. A blank value is judged only by `required`. A directory read that fails proves nothing and does not refuse the decision.
+- **A request already pending.** The judge reads the declaration snapshotted on the request when it opened. A request pending under a bare-key snapshot (`decisionOutputs: ['note']`) takes one value for that key, so its approver sends one value; nothing about the pending request needs changing. That one value may be a comma-separated string (`'u2,u3'`): a bare key is `text`, judged by shape only, and a downstream `expression` approver still splits a string value into a list, so a pending request meant to route to several people is not stranded.
+- **The Console.** Both decision surfaces send each output in its declared shape: a `text` or untyped output declared `multiple: true` is collected as a list of trimmed, distinct entries and sent as a string array, and a single-value one is sent as one string whose comma is literal (`@object-ui/app-shell`, same release).
+- **Who sees it.** A caller or decision UI that sent an output its declaration does not describe: a wrong picker id, a scalar for a list (the CSV string included), a list for a scalar (a list sent for a bare key included), or a repeated entry. Also an author who pairs a `department`, `team` or `position` picker output with a stage-2 `expression` approver retargeted by `organization` (ADR-0105 D9): the decision resolves the picked value in the request's organization, not in the approver's directory organization, so a value that exists only in that other organization is refused at the decision.
+
+**The remedy.** Send each output in the shape its step declares, with picker values that name a real record (or, for `position`, a held machine name). A bare key takes one value, as its declaration always said; a step that collects several values declares `multiple: true`, and the Console now sends a list for it.
@@ -265,7 +265,8 @@ describe('Approval node bridge (ADR-0019)', () => {
         { id: 'start', type: 'start', label: 'Start' },
         {
           id: 'lead_review', type: 'approval', label: 'Lead Review',
-          config: { approvers: [{ type: 'user', value: 'lead' }], decisionOutputs: ['next_reviewers'] },
+          // A list answer needs `multiple: true`: a bare key takes one value since #28658.
+          config: { approvers: [{ type: 'user', value: 'lead' }], decisionOutputs: [{ key: 'next_reviewers', multiple: true }] },
         },
         {
           id: 'co_sign', type: 'approval', label: 'Co-sign',
@@ -311,6 +312,71 @@ describe('Approval node bridge (ADR-0019)', () => {
     expect(automation.listSuspendedRuns()).toHaveLength(0);
   });
 
+  it('a typed user output naming no account is refused at the decision, and the run waits instead of stranding (#28658)', async () => {
+    // The showcase dynamic approval's shape: stage 1 declares a typed, required
+    // user list; stage 2 resolves it with `onEmptyApprovers: 'fail'`. A wrong
+    // id used to be recorded as an approval and then strand the run at stage 2.
+    automation.registerFlow('typed_two_stage', {
+      name: 'typed_two_stage',
+      label: 'Typed Two Stage',
+      type: 'autolaunched',
+      nodes: [
+        { id: 'start', type: 'start', label: 'Start' },
+        {
+          id: 'lead_review', type: 'approval', label: 'Lead Review',
+          config: {
+            approvers: [{ type: 'user', value: 'lead' }],
+            decisionOutputs: [{ key: 'next_reviewers', type: 'user', multiple: true, required: true }],
+          },
+        },
+        {
+          id: 'co_sign', type: 'approval', label: 'Co-sign',
+          config: {
+            approvers: [{ type: 'expression', value: 'vars.lead_review.next_reviewers' }],
+            behavior: 'unanimous',
+            onEmptyApprovers: 'fail',
+          },
+        },
+        { id: 'on_approved', type: 'mark', label: 'Approved' },
+        { id: 'on_rejected', type: 'mark', label: 'Rejected' },
+      ],
+      edges: [
+        { id: 'e1', source: 'start', target: 'lead_review' },
+        { id: 'e2', source: 'lead_review', target: 'co_sign', label: 'approve' },
+        { id: 'e3', source: 'lead_review', target: 'on_rejected', label: 'reject' },
+        { id: 'e4', source: 'co_sign', target: 'on_approved', label: 'approve' },
+        { id: 'e5', source: 'co_sign', target: 'on_rejected', label: 'reject' },
+      ],
+    });
+    await automation.execute('typed_two_stage', { object: 'crm_deal', record: { id: 'd1' }, userId: 'submitter' });
+    const first = (await fake.find('sys_approval_request', { where: { status: 'pending' } }))[0];
+
+    for (const bad of [['usr_does_not_exist'], 'u2', ['u2', 'u2']]) {
+      await expect(service.decide(first.id, {
+        decision: 'approve', actorId: 'lead', outputs: { next_reviewers: bad },
+      }, SYSTEM_CTX)).rejects.toThrow(/^VALIDATION_FAILED: `outputs\.next_reviewers`/);
+    }
+    // Nothing recorded: stage 1 still pending, no decision row, the run still waiting at stage 1.
+    const stillFirst = (await fake.find('sys_approval_request', { where: { id: first.id } }))[0];
+    expect(stillFirst.status).toBe('pending');
+    expect((await fake.find('sys_approval_action', { where: { request_id: first.id } })).map((a: any) => a.action))
+      .toEqual(['submit']);
+    expect(automation.listSuspendedRuns()).toHaveLength(1);
+    expect(marks).toHaveLength(0);
+
+    // A valid pick goes through, and the run continues to completion.
+    await service.decide(first.id, {
+      decision: 'approve', actorId: 'lead', outputs: { next_reviewers: ['u2', 'u3'] },
+    }, SYSTEM_CTX);
+    const second = (await fake.find('sys_approval_request', { where: { status: 'pending' } }))[0];
+    expect(second.flow_node_id).toBe('co_sign');
+    expect(String(second.pending_approvers).split(',').sort()).toEqual(['u2', 'u3']);
+    await service.decide(second.id, { decision: 'approve', actorId: 'u2' }, SYSTEM_CTX);
+    await service.decide(second.id, { decision: 'approve', actorId: 'u3' }, SYSTEM_CTX);
+    expect(marks).toEqual(['on_approved']);
+    expect(automation.listSuspendedRuns()).toHaveLength(0);
+  });
+
   it('expression current.* resolves against the LIVE row at node entry (#3447 P2)', async () => {
     fake.tables.set('crm_deal', [{ id: 'd1', reviewers: ['u7', 'u8'] }]);
     registerDecisionFlow(automation, [{ type: 'expression', value: 'current.reviewers' }], 'unanimous');