@@ -0,0 +1,14 @@
+---
+'@objectstack/lint': patch
+---
+
+fix(lint): two approval-approver warnings no longer say "the request stalls"
+
+Clause-②: no
+Metadata-protocol: none
+
+`approval-approver-not-membership-tier` (an `org_membership_level` approver whose value names no tier) and `approval-approver-type-unsupported` ended on "the request stalls". That has not been true since an approval node's `onEmptyApprovers` default became `admin_rescue`: a slate that names no one opens on the organization's administrators, or takes whatever route the node declares. Both verdicts now state only the slot ("it matches nobody" / "the slot resolves to nobody") and end on "onEmptyApprovers decides an empty slate". That stays true under every policy and whatever the default is, because it names no outcome. The `os explain approval-approver-not-membership-tier` text gets the same correction.
+
+The `approval-approver-type-unsupported` hint now builds its "route to people the engine can expand" list from the approver bindings, so it can never offer a type that is itself unsupported. It used to offer `queue` while `queue` was the one unsupported type. Today `queue` is supported, so it stays in the list. No approver type is unsupported today, so the warning fires on no current type.
+
+No rule fires on anything new or stops firing on anything it fired on before. Only the message and hint text changes.
@@ -57,8 +57,9 @@ defineFlow({
 **`position` vs `org_membership_level`.** `{ type: 'position', value: 'finance_manager' }` routes
 to the holders of a position (`sys_user_position`, ADR-0090 D3). `org_membership_level` is a
 different thing — the better-auth **org-membership tier**, whose only values are
-`owner`/`admin`/`member`. A position name authored there matches nobody and the request stalls;
-`os lint` flags it (`approval-approver-not-membership-tier`).
+`owner`/`admin`/`member`. A position name authored there matches nobody, so that approver adds no one
+to the request, and a slate left naming no one goes to the node's `onEmptyApprovers`; `os lint` flags it
+(`approval-approver-not-membership-tier`).
 
 Authored `type: 'role'` on 15.x? That is the deprecated spelling of `org_membership_level`
 (ADR-0090 D3): it still resolves, warns at runtime, and is removed in the next major. It resolves
 
@@ -2779,8 +2779,9 @@ const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER_EXPLANATION: RuleExplanation = {
       'case-insensitively.',
     'After ADR-0090 D3 renamed `sys_role` to `sys_position`, an approver authored as ' +
       '`{ type: \'role\', value: \'sales_manager\' }` finds no member row: the expansion falls back ' +
-      'to the `role:sales_manager` literal, and the request waits on an approver that can never ' +
-      'act. A business role is always a position, resolved through `sys_user_position`.',
+      'to the `role:sales_manager` literal, a slot no one can act on. A slate that names no one ' +
+      'else is decided by the node\'s `onEmptyApprovers`, as any empty slate is. A business role is ' +
+      'always a position, resolved through `sys_user_position`.',
     'A warning, not an error: the runtime keeps its literal fallback rather than refusing the node. ' +
       'When the value is not a tier, this finding is reported instead of ' +
       '`approval-approver-type-deprecated` on the same approver: the bad value is the more serious ' +
 
@@ -784,11 +784,31 @@ describe('[#22161] one-line verdicts — approval-approvers-may-resolve-empty, a
       stackWithApprovers([{ type: 'org_membership_level', value: 'sales_manager' }]),
     );
     expect(finding.message).toBe(
-      "approver { type: 'org_membership_level', value: 'sales_manager' } names no org-membership tier " +
-        `(${BUILTIN_MEMBERSHIP_ROLES.join('/')}), so it matches nobody and the request stalls`,
+      "approver { type: 'org_membership_level', value: 'sales_manager' } names no membership tier " +
+        `(${BUILTIN_MEMBERSHIP_ROLES.join('/')}), so it matches nobody; onEmptyApprovers decides an empty slate`,
     );
   });
 
+  it('the membership-tier verdict names no empty-slate outcome, so no onEmptyApprovers policy makes it false', () => {
+    // The slot is the verdict's subject; the request's fate is the node's
+    // policy, whose default the verdict must not restate.
+    for (const onEmptyApprovers of [undefined, 'admin_rescue', 'fail', 'auto_approve']) {
+      const [finding] = validateApprovalApprovers({
+        flows: [{
+          name: 'expense_approval',
+          nodes: [{
+            id: 'step1',
+            type: 'approval',
+            config: { approvers: [{ type: 'org_membership_level', value: 'sales_manager' }], onEmptyApprovers },
+          }],
+          edges: [],
+        }],
+      });
+      expect(finding.rule, String(onEmptyApprovers)).toBe(APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER);
+      expect(finding.message, String(onEmptyApprovers)).not.toMatch(/stall|administrators|auto-approv|fails/);
+    }
+  });
+
   it('`os explain` carries what the verdicts no longer say', () => {
     const facts: Record<string, string[]> = {
       [APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY]: [
 
@@ -8,9 +8,10 @@
  * — it is NOT a position. After ADR-0090 D3 renamed `sys_role` → `sys_position`,
  * downstream apps that authored `{ type: 'role', value: 'sales_manager' }`
  * silently route the approval to nobody: the expansion finds no member row,
- * falls back to the `role:sales_manager` literal, and the request waits on an
- * approver that can never act. These rules move that failure from a stuck
- * request at runtime to a located fix-it at author time.
+ * falls back to the `role:sales_manager` literal, a slot no one can act on,
+ * and a slate that names no one else lands on the node's `onEmptyApprovers`
+ * instead of the people the author meant. These rules move that failure from
+ * runtime to a located fix-it at author time.
  *
  * Rules:
  *
@@ -231,6 +232,27 @@ const GROUP_ONLY_FIX =
   "Staff at least one target, add an approver that cannot resolve empty (e.g. { type: 'org_membership_level', " +
   "value: 'owner' }), or name who decides in fallbackApprovers with onEmptyApprovers: 'fallback'";
 
+/**
+ * [#27101] The clause both single-slot verdicts end on — one wording, so the
+ * two arms cannot drift. It states the SLOT, never the request's fate, the
+ * runtime's own rule for its expansion warnings (`resolveApproverSpec` in
+ * plugin-approvals): one approver cannot see the rest of the slate, and what an
+ * empty slate does is the node's `onEmptyApprovers`, whose default can move.
+ * ⛔ Never name an outcome or the default here: "the request stalls" was such
+ * a restated outcome, and it went false when the default became `admin_rescue`.
+ */
+const EMPTY_SLATE_DECIDES = 'onEmptyApprovers decides an empty slate';
+
+/**
+ * [#27101] The routes the unsupported-type hint offers: the group-routed types
+ * whose binding the runtime implements, derived so the hint can never offer a
+ * type that is itself `unsupported` (it offered `queue` while `queue` was the
+ * one unsupported type, ADR-0142 D6).
+ */
+const EXPANDABLE_GROUP_TYPES = [...GROUP_ROUTED_TYPES].filter(
+  (t) => (APPROVER_VALUE_BINDINGS as Record<string, { source: string }>)[t]?.source !== 'unsupported',
+);
+
 export type ApprovalApproverSeverity = 'error' | 'warning' | 'info';
 
 export interface ApprovalApproverFinding {
@@ -458,8 +480,8 @@ export function validateApprovalApprovers(stack: AnyRec): ApprovalApproverFindin
             // [#22161] One verdict; what the type resolves against and why a
             // business role is a position is `os explain` text.
             message:
-              `approver { type: '${type}', value: '${value}' } names no org-membership tier ` +
-              `(${MEMBERSHIP_TIER_LIST}), so it matches nobody and the request stalls`,
+              `approver { type: '${type}', value: '${value}' } names no membership tier ` +
+              `(${MEMBERSHIP_TIER_LIST}), so it matches nobody; ${EMPTY_SLATE_DECIDES}`,
             // [#22161] One remedy line: the verdict already lists the tiers,
             // and why a business role is always a position (the closed
             // ADR-0108 vocabulary, `sys_user_position`) is the explanation's.
@@ -483,19 +505,24 @@ export function validateApprovalApprovers(stack: AnyRec): ApprovalApproverFindin
           (APPROVER_VALUE_BINDINGS as Record<string, { source: string }>)[canonical]?.source === 'unsupported'
         ) {
           // Declared-but-unenforced (#3508): the runtime has no resolution for
-          // this type — the slot degrades to an inert `type:value` literal and
-          // the request routes to nobody. Say it at authoring time instead of
-          // letting the request stall silently (Prime Directive #10).
+          // this type — the slot degrades to an inert `type:value` literal that
+          // names no one, and a slate left naming no one takes the node's
+          // `onEmptyApprovers` route. Say it at authoring time instead of
+          // letting the slot fail silently (Prime Directive #10). No binding is
+          // `unsupported` today (ADR-0142 D6 implemented the last, `queue`);
+          // the arm stays as the guard for the next one.
           findings.push({
             severity: 'warning',
             rule: APPROVAL_APPROVER_TYPE_UNSUPPORTED,
             where,
             path: `${path}.type`,
             message:
               `approver type '${type}' is declared but not implemented by the runtime: it was deprecated ` +
-              `rather than built, and is no longer offered for authoring — the slot resolves to nobody and ` +
-              `the request stalls.`,
-            hint: `Route to people the engine can expand: { type: 'team' | 'department' | 'position' | 'queue', ... }.`,
+              `rather than built, and is no longer offered for authoring — the slot resolves to nobody, and ` +
+              `${EMPTY_SLATE_DECIDES}.`,
+            hint:
+              `Route to people the engine can expand: ` +
+              `{ type: ${EXPANDABLE_GROUP_TYPES.map((t) => `'${t}'`).join(' | ')}, ... }.`,
           });
         }
 
 
@@ -0,0 +1,44 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { describe, expect, it, vi } from 'vitest';
+
+// No approver binding is `unsupported` today (ADR-0142 D6 implemented the
+// last one, `queue`), so the `approval-approver-type-unsupported` arm is
+// reachable only against a binding table that declares one. This file marks
+// `team` unsupported — its own module graph, so the main suite's real table
+// is untouched.
+vi.mock('@objectstack/spec/automation', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@objectstack/spec/automation')>();
+  return {
+    ...actual,
+    APPROVER_VALUE_BINDINGS: { ...actual.APPROVER_VALUE_BINDINGS, team: { source: 'unsupported' } },
+  };
+});
+
+const { validateApprovalApprovers, APPROVAL_APPROVER_TYPE_UNSUPPORTED } = await import(
+  './validate-approval-approvers.js'
+);
+
+describe('approval-approver-type-unsupported', () => {
+  const [finding] = validateApprovalApprovers({
+    flows: [{
+      name: 'expense_approval',
+      nodes: [{ id: 'step1', type: 'approval', config: { approvers: [{ type: 'team', value: 't1' }] } }],
+      edges: [],
+    }],
+  }).filter((f) => f.rule === APPROVAL_APPROVER_TYPE_UNSUPPORTED);
+
+  it('states the slot and hands an empty slate to onEmptyApprovers, naming no outcome', () => {
+    expect(finding.message).toBe(
+      "approver type 'team' is declared but not implemented by the runtime: it was deprecated rather " +
+        'than built, and is no longer offered for authoring — the slot resolves to nobody, and ' +
+        'onEmptyApprovers decides an empty slate.',
+    );
+  });
+
+  it('never offers an unsupported type as the route, the flagged one included', () => {
+    expect(finding.hint).toBe(
+      "Route to people the engine can expand: { type: 'position' | 'department' | 'queue', ... }.",
+    );
+  });
+});