From ef873507de489e20bf545f35d5df644e25376bd5 Mon Sep 17 00:00:00 2001
From: Bindy-lbb <70745012+Bindy-lbb@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:42:31 +0800
Subject: [PATCH 1/2] feat(approvals): deliver atomic policy-gated batch
 decisions

---
 apps/desktop/renderer/src/App.tsx             |   2 +
 .../renderer/src/approvals/ApprovalQueue.tsx  |  70 +++++--
 apps/desktop/renderer/src/approvals/types.ts  |   4 +
 .../renderer/src/approvals/useApprovals.ts    |  41 +++-
 apps/desktop/renderer/src/owb.d.ts            |   1 +
 .../renderer/test/approval-queue.test.tsx     |  16 ++
 apps/desktop/src/approvals-center-ipc.cjs     |  15 +-
 apps/desktop/src/main.js                      |   6 +-
 apps/desktop/src/preload.js                   |   1 +
 .../test/approvals-center-ipc.test.cjs        |  13 +-
 apps/server/src/approvals/policy.ts           |  10 +-
 apps/server/src/approvals/service.ts          | 188 +++++++++++++++++-
 apps/server/src/approvals/store.ts            |   6 +-
 apps/server/src/routes/approvals.ts           |  12 +-
 apps/server/src/routes/turns.ts               |   5 +
 apps/server/src/turns/envelope.ts             |   4 +
 apps/server/test/approvals-center.test.ts     | 136 ++++++++++++-
 docs/approvals-p0.md                          |  31 ++-
 packages/shared/src/approvals.ts              |  33 +++
 packages/shared/src/turns.ts                  |   3 +
 packages/ui/src/locales/en.ts                 |   5 +
 packages/ui/src/locales/zh.ts                 |   5 +
 22 files changed, 563 insertions(+), 44 deletions(-)

diff --git a/apps/desktop/renderer/src/App.tsx b/apps/desktop/renderer/src/App.tsx
index 02ee266f..cdaed0a3 100644
--- a/apps/desktop/renderer/src/App.tsx
+++ b/apps/desktop/renderer/src/App.tsx
@@ -355,6 +355,7 @@ function AppInner({
     requestedAt: a.requestedAt, expiresAt: a.expiresAt,
     decision: a.status === "granted" ? { kind: "granted", scope: a.decision?.scope ?? "once", decidedAt: a.decision?.decidedAt, decidedBy: a.decision?.decidedBy, reason: a.decision?.reason } : a.status === "denied" ? { kind: "denied", reason: a.decision?.reason, decidedAt: a.decision?.decidedAt, decidedBy: a.decision?.decidedBy } : { kind: a.status },
     scopeAllowed: a.context?.scope.allowed ?? ["once"],
+    batchMaxItems: a.batch?.maxItems,
     canDecide: a.canDecide, busy: approvalState.busy.has(a.id), error: approvalState.errors[a.id],
     unavailableReason: a.unavailableReason, executionPhase: a.execution.phase,
     requestReason: a.requestReason, context: a.context, policyProgress: a.progress, source: a.source, executionTurnId: a.execution.turnId, executionErrorCode: a.execution.errorCode,
@@ -2064,6 +2065,7 @@ function AppInner({
             onNavigateToOrg={() => setActiveModule("org")}
             onApprove={(id, reason, scope) => { void approvalState.decide(id, "granted", reason, scope); }}
             onDeny={(id, reason) => { void approvalState.decide(id, "denied", reason); }}
+            onApproveBatch={(ids) => { void approvalState.decideBatch(ids); }}
             onOpenSource={openApprovalSource}
             onOpenEvidence={openApprovalEvidence}
           />
diff --git a/apps/desktop/renderer/src/approvals/ApprovalQueue.tsx b/apps/desktop/renderer/src/approvals/ApprovalQueue.tsx
index 2e2a1ea3..8d60aef5 100644
--- a/apps/desktop/renderer/src/approvals/ApprovalQueue.tsx
+++ b/apps/desktop/renderer/src/approvals/ApprovalQueue.tsx
@@ -7,7 +7,7 @@
  * conversation and constructs the resume turn; the UI never chooses it.
  */
 import { useEffect, useMemo, useRef, useState } from "react";
-import { Alert, Button, Input, List, Select, Segmented, Tag, Tooltip } from "antd";
+import { Alert, Button, Checkbox, Input, List, Select, Segmented, Tag, Tooltip } from "antd";
 import { ArrowRight, Clock3, ShieldAlert, ShieldCheck } from "lucide-react";
 import { useOwbLocale, useT, type OwbT } from "@roleweave/ui";
 import {
@@ -105,6 +105,7 @@ export function ApprovalQueue({
   onDeny,
   onOpenSource,
   onOpenEvidence,
+  onApproveBatch,
 }: ApprovalQueueProps) {
   const t = useT();
   const [filter, setFilter] = useState<ApprovalQueueFilter>(defaultFilter);
@@ -116,6 +117,7 @@ export function ApprovalQueue({
   const [fromDate, setFromDate] = useState("");
   const [toDate, setToDate] = useState("");
   const [selectedId, setSelectedId] = useState<string | null>(null);
+  const [batchSelection, setBatchSelection] = useState<ReadonlySet<string>>(new Set());
   const [now, setNow] = useState(() => Date.now());
   const [notificationPermission, setNotificationPermission] = useState<DesktopNotificationPermission>(desktopNotificationPermission);
   const notificationSnapshot = useRef<Map<string, { status: ApprovalQueueItem["decision"]["kind"]; expiry: ReturnType<typeof approvalExpiryState> }>>();
@@ -207,6 +209,23 @@ export function ApprovalQueue({
     () => items.find((item) => item.approvalId === selectedId) ?? null,
     [items, selectedId],
   );
+  const batchSelectedItems = useMemo(() => items.filter(item => batchSelection.has(item.approvalId)), [batchSelection, items]);
+  const batchSource = batchSelectedItems[0]?.source;
+  const batchSourceLabel = batchSource ? `${batchSource.positionId} · ${batchSource.conversationId}` : "";
+  const canBatchItem = (item: ApprovalQueueItem) => item.batchMaxItems !== undefined && item.canDecide !== false &&
+    item.busy !== true && isActionablePending(item, now) && item.source !== undefined && item.source.kind !== "group";
+  const selectBatchItem = (item: ApprovalQueueItem, checked: boolean) => {
+    if (!canBatchItem(item)) return;
+    setBatchSelection(current => {
+      const next = new Set(current);
+      if (!checked) { next.delete(item.approvalId); return next; }
+      const selected = items.find(candidate => current.has(candidate.approvalId));
+      if (selected?.source && item.source && (selected.source.kind !== item.source.kind || selected.source.positionId !== item.source.positionId || selected.source.conversationId !== item.source.conversationId || selected.source.turnId !== item.source.turnId || selected.source.runId !== item.source.runId || selected.source.engine !== item.source.engine)) return current;
+      const maximum = Math.min(item.batchMaxItems ?? 0, ...(selected ? [selected.batchMaxItems ?? 0] : []));
+      if (next.size >= maximum) return current;
+      next.add(item.approvalId); return next;
+    });
+  };
 
   return (
     <section className="owb-approval-queue" aria-label={t("apr.center")}>
@@ -354,20 +373,35 @@ export function ApprovalQueue({
           onNavigateToOrg={onNavigateToOrg}
         />
       ) : (
-        <List
-          className="owb-approval-queue__list"
-          dataSource={visible}
-          rowKey={(item) => item.approvalId}
-          renderItem={(item) => (
-            <List.Item className="owb-approval-queue__item">
-              <ApprovalCard
-                item={item}
-                now={now}
-                onOpen={() => setSelectedId(item.approvalId)}
-              />
-            </List.Item>
-          )}
-        />
+        <>
+          {batchSelectedItems.length > 0 ? (
+            <Alert
+              className="owb-approval-queue__batch-summary"
+              type="info"
+              showIcon
+              message={t("apr.batchSummary", { count: batchSelectedItems.length, source: batchSourceLabel })}
+              description={batchSelectedItems.length < 2 ? t("apr.batchNeedMore") : t("apr.batchBoundary")}
+              action={<Button type="primary" size="small" disabled={batchSelectedItems.length < 2 || !onApproveBatch} onClick={() => onApproveBatch?.(batchSelectedItems.map(item => item.approvalId))}>{t("apr.batchApprove")}</Button>}
+            />
+          ) : null}
+          <List
+            className="owb-approval-queue__list"
+            dataSource={visible}
+            rowKey={(item) => item.approvalId}
+            renderItem={(item) => (
+              <List.Item className="owb-approval-queue__item">
+                <ApprovalCard
+                  item={item}
+                  now={now}
+                  batchSelected={batchSelection.has(item.approvalId)}
+                  batchDisabled={!canBatchItem(item) || (batchSelectedItems.length > 0 && batchSource !== undefined && (!item.source || item.source.kind !== batchSource.kind || item.source.positionId !== batchSource.positionId || item.source.conversationId !== batchSource.conversationId || item.source.turnId !== batchSource.turnId || item.source.runId !== batchSource.runId || item.source.engine !== batchSource.engine))}
+                  onBatchChange={(checked) => selectBatchItem(item, checked)}
+                  onOpen={() => setSelectedId(item.approvalId)}
+                />
+              </List.Item>
+            )}
+          />
+        </>
       )}
 
       <ApprovalDetailDrawer
@@ -440,9 +474,12 @@ interface ApprovalCardProps {
   item: ApprovalQueueItem;
   now: number;
   onOpen: () => void;
+  batchSelected: boolean;
+  batchDisabled: boolean;
+  onBatchChange: (checked: boolean) => void;
 }
 
-function ApprovalCard({ item, now, onOpen }: ApprovalCardProps) {
+function ApprovalCard({ item, now, onOpen, batchSelected, batchDisabled, onBatchChange }: ApprovalCardProps) {
   const t = useT();
   const localeTag = useOwbLocale() === "en" ? "en-US" : "zh-CN";
   const positionName = decodeEscapedUnicode(item.positionName ?? t("apr.unknownPosition"));
@@ -475,6 +512,7 @@ function ApprovalCard({ item, now, onOpen }: ApprovalCardProps) {
       data-decided={decided ? "true" : "false"}
       onClick={onOpen}
     >
+      {item.batchMaxItems !== undefined ? <Checkbox className="owb-approval-card__batch-select" checked={batchSelected} disabled={batchDisabled} onClick={(event) => event.stopPropagation()} onChange={(event) => onBatchChange(event.target.checked)} aria-label={t("apr.batchSelect")} /> : null}
       <button
         type="button"
         className="owb-approval-card__row"
diff --git a/apps/desktop/renderer/src/approvals/types.ts b/apps/desktop/renderer/src/approvals/types.ts
index 76be2ef7..b905916c 100644
--- a/apps/desktop/renderer/src/approvals/types.ts
+++ b/apps/desktop/renderer/src/approvals/types.ts
@@ -52,6 +52,9 @@ export interface ApprovalQueueItem {
   target?: string;
   /** The server's projection of the engine-declared eligible grant scopes. */
   scopeAllowed?: Array<"once" | "run">;
+  /** Non-sensitive server projection: this member is policy-classified for a
+   * low-risk batch, subject to final source/version checks at submit time. */
+  batchMaxItems?: number;
   requestedAt?: string;
   expiresAt?: string;
   /** Snapshot of the position permissions.toolDeny list; only used for the
@@ -69,6 +72,7 @@ export interface ApprovalQueueCallbacks {
   onApprove: (approvalId: string, reason?: string, scope?: "once" | "run") => void;
   /** denied MUST allow an empty reason (contract permits absent reason). */
   onDeny: (approvalId: string, reason?: string) => void;
+  onApproveBatch?: (approvalIds: string[]) => void;
   /** Open the persisted source conversation when the source is addressable. */
   onOpenSource?: (item: ApprovalQueueItem) => void;
   /** Open the reports surface; it may still be empty when no receipt exists. */
diff --git a/apps/desktop/renderer/src/approvals/useApprovals.ts b/apps/desktop/renderer/src/approvals/useApprovals.ts
index a92d6125..17ac3408 100644
--- a/apps/desktop/renderer/src/approvals/useApprovals.ts
+++ b/apps/desktop/renderer/src/approvals/useApprovals.ts
@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useRef, useState } from "react";
-import type { ApprovalDecisionRequest, ApprovalList, ApprovalView } from "@roleweave/shared";
+import type { ApprovalBatchDecisionRequest, ApprovalDecisionRequest, ApprovalList, ApprovalView } from "@roleweave/shared";
 import { useT } from "@roleweave/ui";
 
 function errorText(body: unknown, fallback: string): string {
@@ -20,13 +20,14 @@ export function useApprovals(workspacePath: string | undefined) {
   const cache = useRef<{ items: ApprovalView[]; token?: string }>({ items: [] });
   const pending = useRef(new Map<string, ApprovalDecisionRequest>());
   const inFlight = useRef(new Set<string>());
+  const batchPending = useRef(new Map<string, ApprovalBatchDecisionRequest>());
   const [errors, setErrors] = useState<Record<string, string>>({});
 
   useEffect(() => {
     const generation = {};
     owner.current = generation;
     let running = false, again = false;
-    cache.current = { items: [] }; pending.current.clear(); inFlight.current.clear();
+    cache.current = { items: [] }; pending.current.clear(); batchPending.current.clear(); inFlight.current.clear();
     setItems([]); setReady(false); setError(undefined); setErrors({}); setBusy(new Set());
     const current = () => owner.current === generation;
     const refresh = async () => {
@@ -90,6 +91,40 @@ export function useApprovals(workspacePath: string | undefined) {
       if (owner.current === generation) { inFlight.current.delete(id); setBusy(new Set(inFlight.current)); await refreshRef.current(); }
     }
   }, [t]);
+  const decideBatch = useCallback(async (ids: string[], reason?: string) => {
+    const generation = owner.current;
+    const unique = [...new Set(ids)].sort();
+    const selected = unique.map(id => cache.current.items.find(item => item.id === id));
+    if (unique.length < 2 || selected.some(item => !item || !item.canDecide) || !cache.current.token || unique.some(id => inFlight.current.has(id))) return;
+    const key = unique.join(",");
+    const previous = batchPending.current.get(key);
+    if (previous && previous.reason !== reason) {
+      setErrors(errors => Object.fromEntries(unique.map(id => [id, t("apr.retrySameDecision")]))); return;
+    }
+    const request = previous ?? {
+      requestId: crypto.randomUUID(), decision: "granted" as const,
+      ...(reason ? { reason } : {}),
+      items: selected.map(item => ({ id: item!.id, expectedVersion: item!.version })),
+    };
+    batchPending.current.set(key, request); unique.forEach(id => inFlight.current.add(id)); setBusy(new Set(inFlight.current));
+    setErrors(errors => { const next = { ...errors }; unique.forEach(id => delete next[id]); return next; });
+    try {
+      const response = await window.owb.decideApprovalsBatch({ ...request, workspaceToken: cache.current.token });
+      if (owner.current !== generation) return;
+      if (response.status !== 200 && response.status !== 202) throw new Error(errorText(response.body, t("apr.submitFailed")));
+      const body = response.body;
+      const updates = new Map(body.items.filter(item => item.status === "accepted" && item.record).map(item => [item.id, item.record!]));
+      cache.current.items = cache.current.items.map(item => updates.get(item.id) ?? item);
+      setItems([...cache.current.items]);
+      const rejected = body.items.filter(item => item.status === "rejected");
+      if (rejected.length) setErrors(errors => ({ ...errors, ...Object.fromEntries(rejected.map(item => [item.id, item.message ?? t("apr.submitFailed")])) }));
+      else batchPending.current.delete(key);
+    } catch (error) {
+      if (owner.current === generation) setErrors(errors => ({ ...errors, ...Object.fromEntries(unique.map(id => [id, error instanceof Error ? error.message : t("apr.submitFailed")])) }));
+    } finally {
+      if (owner.current === generation) { unique.forEach(id => inFlight.current.delete(id)); setBusy(new Set(inFlight.current)); await refreshRef.current(); }
+    }
+  }, [t]);
   const refresh = useCallback(() => refreshRef.current(), []);
-  return { items, loading, ready, error, errors, busy, decide, refresh };
+  return { items, loading, ready, error, errors, busy, decide, decideBatch, refresh };
 }
diff --git a/apps/desktop/renderer/src/owb.d.ts b/apps/desktop/renderer/src/owb.d.ts
index f0827691..2d2a9663 100644
--- a/apps/desktop/renderer/src/owb.d.ts
+++ b/apps/desktop/renderer/src/owb.d.ts
@@ -106,6 +106,7 @@ export interface OwbBridge {
   reports(): Promise<OwbApiResponse<ReportsResponse>>;
   listApprovals(request: { workspacePath: string; cursor?: string }): Promise<OwbApiResponse<import("@roleweave/shared").ApprovalList>>;
   decideApproval(request: import("@roleweave/shared").ApprovalDecisionRequest & { id: string; workspaceToken: string }): Promise<OwbApiResponse<import("@roleweave/shared").ApprovalView>>;
+  decideApprovalsBatch(request: import("@roleweave/shared").ApprovalBatchDecisionRequest & { workspaceToken: string }): Promise<OwbApiResponse<import("@roleweave/shared").ApprovalBatchDecisionResponse>>;
   position(positionId: string, engine?: TurnEngine): Promise<OwbApiResponse>;
   positionDocs(positionId: string): Promise<OwbApiResponse<DocsFileListResponse>>;
   positionDocFile(positionId: string, filePath: string): Promise<OwbApiResponse<DocsFileResponse>>;
diff --git a/apps/desktop/renderer/test/approval-queue.test.tsx b/apps/desktop/renderer/test/approval-queue.test.tsx
index 098b0961..8dd86009 100644
--- a/apps/desktop/renderer/test/approval-queue.test.tsx
+++ b/apps/desktop/renderer/test/approval-queue.test.tsx
@@ -145,6 +145,22 @@ describe("P0 \u5ba1\u6279\u961f\u5217 (\u2461)", () => {
     expect(onApprove).toHaveBeenCalledWith("appr-abc", undefined, "run");
   });
 
+  it("#403 shows the exact same-source low-risk selection before one batch callback", () => {
+    const onApproveBatch = vi.fn();
+    const source = { kind: "session" as const, positionId: "writer-1", conversationId: "session-1", turnId: "turn-1", runId: "run-1", engine: "qoder" as const };
+    render(<ApprovalQueue items={[
+      makeItem({ approvalId: "batch-a", category: "tool", source, batchMaxItems: 3, canDecide: true }),
+      makeItem({ approvalId: "batch-b", category: "tool", source, batchMaxItems: 3, canDecide: true }),
+      makeItem({ approvalId: "other-source", category: "tool", source: { ...source, runId: "run-2" }, batchMaxItems: 3, canDecide: true }),
+    ]} onApprove={noop} onDeny={noop} onApproveBatch={onApproveBatch} />);
+    const selectors = screen.getAllByRole("checkbox", { name: "选择加入策略受控批量批准" });
+    fireEvent.click(selectors[0]!); fireEvent.click(selectors[1]!);
+    expect(screen.getByText(/已从 writer-1 · session-1 选择 2 项低风险审批/)).toBeInTheDocument();
+    expect(selectors[2]).toBeDisabled();
+    fireEvent.click(screen.getByRole("button", { name: "批准所选项" }));
+    expect(onApproveBatch).toHaveBeenCalledWith(["batch-a", "batch-b"]);
+  });
+
   it("\u5df2\u88c1\u51b3\u9879\u9501\u5b9a\uff1a\u4e0d\u80fd\u91cd\u590d\u88c1\u51b3\uff0c\u62d2\u7edd\u8bc1\u636e\u63d0\u793a\u4fdd\u7559", async () => {
     const onApprove = vi.fn();
     const onDeny = vi.fn();
diff --git a/apps/desktop/src/approvals-center-ipc.cjs b/apps/desktop/src/approvals-center-ipc.cjs
index 260b1f4b..e1d1be6e 100644
--- a/apps/desktop/src/approvals-center-ipc.cjs
+++ b/apps/desktop/src/approvals-center-ipc.cjs
@@ -10,14 +10,25 @@ async function approvalList(request, apiRequest) {
   return apiRequest(`/approvals?${query}`);
 }
 async function approvalDecision(request, apiRequest) {
-  if (!object(request) || Object.keys(request).some(k => !["id", "workspaceToken", "requestId", "expectedVersion", "decision", "reason", "delegatedFrom"].includes(k)) ||
+  if (!object(request) || Object.keys(request).some(k => !["id", "workspaceToken", "requestId", "expectedVersion", "decision", "reason", "scope", "delegatedFrom"].includes(k)) ||
       typeof request.id !== "string" || !/^[a-f0-9]{64}$/.test(request.id) ||
       typeof request.workspaceToken !== "string" || !UUID.test(request.workspaceToken) ||
       typeof request.requestId !== "string" || !UUID.test(request.requestId) ||
       !Number.isSafeInteger(request.expectedVersion) || request.expectedVersion < 1 || !["granted", "denied"].includes(request.decision) ||
+      (request.scope !== undefined && !["once", "run"].includes(request.scope)) ||
       (request.reason !== undefined && (typeof request.reason !== "string" || !request.reason.trim() || Buffer.byteLength(request.reason, "utf8") > 1024)) ||
       (request.delegatedFrom !== undefined && (typeof request.delegatedFrom !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(request.delegatedFrom)))) return invalid();
   const { id, ...body } = request;
   return apiRequest(`/approvals/${id}/decision`, { method: "POST", body });
 }
-module.exports = { approvalList, approvalDecision };
+async function approvalBatchDecision(request, apiRequest) {
+  if (!object(request) || Object.keys(request).some(k => !["workspaceToken", "requestId", "decision", "reason", "items"].includes(k)) ||
+      typeof request.workspaceToken !== "string" || !UUID.test(request.workspaceToken) ||
+      typeof request.requestId !== "string" || !UUID.test(request.requestId) || request.decision !== "granted" ||
+      (request.reason !== undefined && (typeof request.reason !== "string" || !request.reason.trim() || Buffer.byteLength(request.reason, "utf8") > 1024)) ||
+      !Array.isArray(request.items) || request.items.length < 2 || request.items.length > 32 ||
+      request.items.some(item => !object(item) || Object.keys(item).some(k => !["id", "expectedVersion"].includes(k) || typeof item.id !== "string" || !/^[a-f0-9]{64}$/.test(item.id) || !Number.isSafeInteger(item.expectedVersion) || item.expectedVersion < 1)) ||
+      new Set(request.items.map(item => item.id)).size !== request.items.length) return invalid();
+  return apiRequest("/approvals/batch/decision", { method: "POST", body: request });
+}
+module.exports = { approvalList, approvalDecision, approvalBatchDecision };
diff --git a/apps/desktop/src/main.js b/apps/desktop/src/main.js
index 6077de6d..33dedfa1 100644
--- a/apps/desktop/src/main.js
+++ b/apps/desktop/src/main.js
@@ -444,7 +444,7 @@ ipcMain.handle("owb:hire:create", async (_event, request) => {
 });
 
 ipcMain.handle("owb:reports:get", async () => apiRequest("/reports"));
-const { approvalList, approvalDecision } = require("./approvals-center-ipc.cjs");
+const { approvalList, approvalDecision, approvalBatchDecision } = require("./approvals-center-ipc.cjs");
 ipcMain.handle("owb:approvals:list", async (event, request) => {
   if (!isTrustedWindowSender(event, mainWindow, trustedRendererUrl)) return { status: 403, body: { message: "Untrusted sender" } };
   return approvalList(request, apiRequest);
@@ -453,6 +453,10 @@ ipcMain.handle("owb:approvals:decide", async (event, request) => {
   if (!isTrustedWindowSender(event, mainWindow, trustedRendererUrl)) return { status: 403, body: { message: "Untrusted sender" } };
   return approvalDecision(request, apiRequest);
 });
+ipcMain.handle("owb:approvals:batch-decide", async (event, request) => {
+  if (!isTrustedWindowSender(event, mainWindow, trustedRendererUrl)) return { status: 403, body: { message: "Untrusted sender" } };
+  return approvalBatchDecision(request, apiRequest);
+});
 
 ipcMain.handle("owb:position:get", async (_event, positionId, engine) => {
   if (typeof positionId !== "string" || positionId.length === 0) {
diff --git a/apps/desktop/src/preload.js b/apps/desktop/src/preload.js
index cd33fe16..fc2be147 100644
--- a/apps/desktop/src/preload.js
+++ b/apps/desktop/src/preload.js
@@ -41,6 +41,7 @@ contextBridge.exposeInMainWorld("owb", {
   reports: () => ipcRenderer.invoke("owb:reports:get"),
   listApprovals: (request) => ipcRenderer.invoke("owb:approvals:list", request),
   decideApproval: (request) => ipcRenderer.invoke("owb:approvals:decide", request),
+  decideApprovalsBatch: (request) => ipcRenderer.invoke("owb:approvals:batch-decide", request),
   position: (positionId, engine) => ipcRenderer.invoke("owb:position:get", positionId, engine),
   setPositionAgentEngine: (request) => ipcRenderer.invoke("owb:position:agent-engine", request),
   updatePositionProfile: (request) => ipcRenderer.invoke("owb:position:profile", request),
diff --git a/apps/desktop/test/approvals-center-ipc.test.cjs b/apps/desktop/test/approvals-center-ipc.test.cjs
index 005025f2..4d44f90b 100644
--- a/apps/desktop/test/approvals-center-ipc.test.cjs
+++ b/apps/desktop/test/approvals-center-ipc.test.cjs
@@ -1,14 +1,23 @@
 const assert = require("node:assert/strict");
 const test = require("node:test");
-const { approvalList, approvalDecision } = require("../src/approvals-center-ipc.cjs");
+const { approvalList, approvalDecision, approvalBatchDecision } = require("../src/approvals-center-ipc.cjs");
 const request = { id: "a".repeat(64), workspaceToken: "00000000-0000-4000-8000-000000000001", requestId: "00000000-0000-4000-8000-000000000002", expectedVersion: 1, decision: "granted" };
 test("approval IPC rejects arbitrary source overrides and UTF-8 overflow before HTTP", async () => {
   let called = 0;
-  for (const bad of [null, { ...request, sessionId: "other" }, { ...request, reason: "字".repeat(342) }, { ...request, id: "../escape" }, { ...request, scope: "run" }]) {
+  for (const bad of [null, { ...request, sessionId: "other" }, { ...request, reason: "字".repeat(342) }, { ...request, id: "../escape" }, { ...request, scope: "workspace" }]) {
     assert.equal((await approvalDecision(bad, async () => { called++; })).status, 400);
   }
   assert.equal(called, 0);
 });
+test("#403 batch IPC forwards only bounded per-item versions", async () => {
+  const batch = { workspaceToken: request.workspaceToken, requestId: request.requestId, decision: "granted", items: [{ id: "a".repeat(64), expectedVersion: 1 }, { id: "b".repeat(64), expectedVersion: 2 }] };
+  await approvalBatchDecision(batch, async (route, options) => {
+    assert.equal(route, "/approvals/batch/decision");
+    assert.deepEqual(options.body.items, batch.items); return { status: 202 };
+  });
+  assert.equal((await approvalBatchDecision({ ...batch, items: [batch.items[0]] }, async () => { throw new Error("must not call"); })).status, 400);
+  assert.equal((await approvalBatchDecision({ ...batch, items: [batch.items[0], { ...batch.items[0] }] }, async () => { throw new Error("must not call"); })).status, 400);
+});
 test("approval IPC forwards a bounded decision and encodes workspace path", async () => {
   await approvalDecision(request, async (route, options) => {
     assert.equal(route, `/approvals/${request.id}/decision`);
diff --git a/apps/server/src/approvals/policy.ts b/apps/server/src/approvals/policy.ts
index 43291eb9..b05d26ee 100644
--- a/apps/server/src/approvals/policy.ts
+++ b/apps/server/src/approvals/policy.ts
@@ -13,6 +13,9 @@ type Rule = {
   threshold: number;
   delegations?: Record<string, string[]>;
   escalation?: { afterMs: number; eligibleApprovers: string[]; threshold: number };
+  /** Explicit #403 classification: only medium-risk tools may opt into a
+   * homogeneous recovery batch. */
+  batch?: { maxItems: number; actionKinds: Array<"tool"> };
 };
 type PolicyFile = { schemaVersion: "roleweave-approval-policy.v1"; version: string; default: Rule; rules?: Rule[] };
 
@@ -23,12 +26,13 @@ function validPeople(value: unknown): value is string[] {
 function validRule(value: unknown): value is Rule {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const r = value as Rule;
-  return Object.keys(r).every(k => ["positionId", "actionKinds", "eligibleApprovers", "threshold", "delegations", "escalation"].includes(k)) &&
+  return Object.keys(r).every(k => ["positionId", "actionKinds", "eligibleApprovers", "threshold", "delegations", "escalation", "batch"].includes(k)) &&
     (r.positionId === undefined || (typeof r.positionId === "string" && ACTOR.test(r.positionId))) &&
     (r.actionKinds === undefined || (Array.isArray(r.actionKinds) && r.actionKinds.length > 0 && r.actionKinds.every(k => ["write", "exec", "network", "tool"].includes(k)))) &&
     validPeople(r.eligibleApprovers) && Number.isSafeInteger(r.threshold) && r.threshold >= 1 && r.threshold <= r.eligibleApprovers.length &&
     (r.delegations === undefined || (typeof r.delegations === "object" && !Array.isArray(r.delegations) && Object.entries(r.delegations).every(([from, to]) => ACTOR.test(from) && validPeople(to)))) &&
-    (r.escalation === undefined || (typeof r.escalation === "object" && Number.isSafeInteger(r.escalation.afterMs) && r.escalation.afterMs > 0 && r.escalation.afterMs <= 31_536_000_000 && validPeople(r.escalation.eligibleApprovers) && Number.isSafeInteger(r.escalation.threshold) && r.escalation.threshold >= 1 && r.escalation.threshold <= r.escalation.eligibleApprovers.length));
+    (r.escalation === undefined || (typeof r.escalation === "object" && Number.isSafeInteger(r.escalation.afterMs) && r.escalation.afterMs > 0 && r.escalation.afterMs <= 31_536_000_000 && validPeople(r.escalation.eligibleApprovers) && Number.isSafeInteger(r.escalation.threshold) && r.escalation.threshold >= 1 && r.escalation.threshold <= r.escalation.eligibleApprovers.length)) &&
+    (r.batch === undefined || (typeof r.batch === "object" && !Array.isArray(r.batch) && Object.keys(r.batch).every(k => ["maxItems", "actionKinds"].includes(k)) && Number.isSafeInteger(r.batch.maxItems) && r.batch.maxItems >= 2 && r.batch.maxItems <= 32 && Array.isArray(r.batch.actionKinds) && r.batch.actionKinds.length === 1 && r.batch.actionKinds[0] === "tool"));
 }
 
 function defaultFile(): PolicyFile {
@@ -67,7 +71,7 @@ export async function resolveApprovalPolicy(workspace: string, record: Pick<Appr
     threshold: selected.escalation.threshold,
   } : undefined;
   const snapshot = { version: policy.version, eligibleApprovers: selected.eligibleApprovers, threshold: selected.threshold,
-    delegations: selected.delegations ?? {}, ...(escalation ? { escalation } : {}) };
+    delegations: selected.delegations ?? {}, ...(selected.batch ? { batch: selected.batch } : {}), ...(escalation ? { escalation } : {}) };
   return { ...snapshot, digest: approvalPolicyDigest(snapshot) };
 }
 
diff --git a/apps/server/src/approvals/service.ts b/apps/server/src/approvals/service.ts
index 8518c671..4fec9ffd 100644
--- a/apps/server/src/approvals/service.ts
+++ b/apps/server/src/approvals/service.ts
@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { OrgApiError, approvalRunScopeBindingInput, errorCodes, validatePendingApproval, type ApprovalRecord, type ApprovalView, type ApprovalDecisionRequest, type TurnRecord, type WorkbenchSession } from "@roleweave/shared";
+import { OrgApiError, approvalRunScopeBindingInput, errorCodes, validatePendingApproval, type ApprovalRecord, type ApprovalView, type ApprovalDecisionRequest, type ApprovalBatchDecisionRequest, type ApprovalBatchDecisionResponse, type TurnRecord, type WorkbenchSession } from "@roleweave/shared";
 import type { ControlPlaneContext } from "../context.js";
 import type { OpenWorkspace } from "../workspace-state.js";
 import { assertTurnWorkspace, executeTurn } from "../routes/turns.js";
@@ -29,6 +29,35 @@ export function parseDecision(value: unknown): ApprovalDecisionRequest {
   return { ...d, scope: d.scope ?? "once" };
 }
 
+const batchUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function parseBatchDecision(value: unknown): ApprovalBatchDecisionRequest {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new OrgApiError(errorCodes.approval_request_invalid, 400, "Invalid batch decision");
+  const request = value as ApprovalBatchDecisionRequest;
+  if (Object.keys(request).some(key => !["requestId", "decision", "reason", "items"].includes(key)) ||
+      typeof request.requestId !== "string" || !batchUuid.test(request.requestId) || request.decision !== "granted" ||
+      !validatePendingApproval({ approvalId: "validation", decision: request.decision, decidedBy: "operator", ...(request.reason === undefined ? {} : { reason: request.reason }) }).ok ||
+      !Array.isArray(request.items) || request.items.length < 2 || request.items.length > 32 ||
+      request.items.some(item => !item || typeof item !== "object" || Array.isArray(item) || Object.keys(item).some(key => !["id", "expectedVersion"].includes(key)) || typeof item.id !== "string" || !/^[a-f0-9]{64}$/.test(item.id) || !Number.isSafeInteger(item.expectedVersion) || item.expectedVersion < 1) ||
+      new Set(request.items.map(item => item.id)).size !== request.items.length) {
+    throw new OrgApiError(errorCodes.approval_request_invalid, 400, "Invalid batch decision");
+  }
+  return request;
+}
+
+/** UUID-shaped deterministic member key: a retry of one batch operation
+ * reaches the same per-record idempotency slot without reusing that key for
+ * a different member. */
+function batchMemberRequestId(batchId: string, approvalId: string): string {
+  const digest = crypto.createHash("sha256").update(`${batchId}\0${approvalId}`).digest("hex");
+  const variant = ((Number.parseInt(digest[16]!, 16) & 0x3) | 0x8).toString(16);
+  return `${digest.slice(0, 8)}-${digest.slice(8, 12)}-5${digest.slice(13, 16)}-${variant}${digest.slice(17, 20)}-${digest.slice(20, 32)}`;
+}
+
+function sourceSignature(record: ApprovalRecord): string {
+  const source = record.source;
+  return JSON.stringify([source.kind, source.positionId, source.conversationId, source.turnId, source.runId, source.engine]);
+}
+
 function validRunScopeBinding(record: ApprovalRecord): boolean {
   const offer = record.action.scope;
   if (!offer?.allowed.includes("run") || !offer.runBinding) return false;
@@ -209,7 +238,10 @@ export class ApprovalService {
         else throw error;
       }
     }
-    return { ...publicView(a), canDecide: !unavailableReason, ...(unavailableReason ? { unavailableReason } : {}) };
+    const batch = a.status === "pending" && a.action.kind === "tool" && a.context?.risk === "medium" && a.policy?.batch
+      ? { maxItems: a.policy.batch.maxItems }
+      : undefined;
+    return { ...publicView(a), canDecide: !unavailableReason, ...(batch ? { batch } : {}), ...(unavailableReason ? { unavailableReason } : {}) };
   }
 
   async list(ws: OpenWorkspace): Promise<ApprovalView[]> {
@@ -324,6 +356,158 @@ export class ApprovalService {
     });
   }
 
+  /**
+   * Settle a policy-classified group through one recovery turn.  This is not
+   * a convenience loop around `decide`: all members are checked before any
+   * record changes, share one source/run reservation, and reach the engine as
+   * `pendingApprovals` so an expired member cannot leave a partially resumed
+   * batch behind.
+   */
+  async decideBatch(ws: OpenWorkspace, token: unknown, request: ApprovalBatchDecisionRequest, actor: string): Promise<{ status: number; response: ApprovalBatchDecisionResponse }> {
+    return this.serial(async () => {
+      if (this.closed) throw conflict("Approval service is closing");
+      this.assertToken(ws, token);
+      const { items, turns } = await this.synchronize(ws);
+      this.assertToken(ws, token);
+      const requestedById = new Map(request.items.map(item => [item.id, item]));
+      const prior = items.filter(item => item.decisions?.some(decision => decision.batchId === request.requestId));
+      if (prior.length) {
+        const same = prior.length === request.items.length && prior.every(item => {
+          const input = requestedById.get(item.id);
+          const decision = item.decisions?.find(entry => entry.batchId === request.requestId);
+          return input !== undefined && decision?.decision === "granted" && decision.scope === "once" &&
+            decision.expectedVersion === input.expectedVersion && decision.reason === request.reason;
+        });
+        if (!same) throw conflict("Batch request id was already used for another decision");
+        return { status: 200, response: { requestId: request.requestId, items: await Promise.all(request.items.map(async item => ({ id: item.id, status: "accepted" as const, record: await this.view(ws, items.find(entry => entry.id === item.id)!) }))) } };
+      }
+
+      const candidates = request.items.map(item => ({ input: item, record: items.find(entry => entry.id === item.id) }));
+      const errors = new Map<string, string>();
+      const firstSource = candidates[0]?.record;
+      for (const candidate of candidates) {
+        const a = candidate.record;
+        if (!a) { errors.set(candidate.input.id, "Approval not found"); continue; }
+        if (a.version !== candidate.input.expectedVersion) { errors.set(a.id, "Approval changed; refresh before deciding"); continue; }
+        const view = await this.view(ws, a);
+        if (!view.canDecide) { errors.set(a.id, view.unavailableReason ?? "Approval is unavailable"); continue; }
+        // Classification is explicit and frozen on each request. No default
+        // policy permits batching, and only medium-risk restricted tools may
+        // opt in; write/exec/network are structurally excluded.
+        if (a.action.kind !== "tool" || a.context?.risk !== "medium" || a.action.scope?.allowed.includes("run") || !a.policy?.batch || !a.policy.batch.actionKinds.includes("tool") || a.policy.batch.maxItems < request.items.length) {
+          errors.set(a.id, "Approval is not eligible for a low-risk batch"); continue;
+        }
+        if (!a.decisions || !a.progress || a.progress.pending !== 1 || !canActForPolicy(a.policy, actor, undefined)) {
+          errors.set(a.id, "Approval policy does not permit this batch decision"); continue;
+        }
+        if (!firstSource || sourceSignature(a) !== sourceSignature(firstSource)) {
+          errors.set(a.id, "Batch approvals must have the same source run"); continue;
+        }
+        const source = turns.find(turn => turn.turnId === a.source.turnId && turn.positionId === a.source.positionId && (turn.conversationRef ?? turn.conversationId) === a.source.conversationId);
+        if (!source || source.error?.code !== "engine.approval_required" || !source.events.some(event => event.type === "approval.requested" && event.approvalId === a.approvalId && event.runId === a.source.runId && JSON.stringify(event.action) === JSON.stringify(a.action) && event.expiresAt === a.expiresAt)) {
+          errors.set(a.id, "Approval source no longer matches");
+        }
+      }
+      if (errors.size) {
+        return {
+          status: 200,
+          response: {
+            requestId: request.requestId,
+            items: request.items.map(item => ({ id: item.id, status: "rejected" as const, code: errorCodes.approval_conflict, message: errors.get(item.id) ?? "Batch contains an ineligible approval; nothing was decided" })),
+          },
+        };
+      }
+
+      const members = candidates.map(candidate => ({ record: candidate.record!, input: candidate.input, requestId: batchMemberRequestId(request.requestId, candidate.input.id) }));
+      // Keep an exact before-image until every member has reached durable
+      // storage. The preflight above is intentionally all-or-nothing; a
+      // storage failure must not turn it into a partially granted batch.
+      const originals = new Map(members.map(member => [member.record.id, structuredClone(member.record)]));
+      const sourceRecord = members[0]!.record;
+      const source = turns.find(turn => turn.turnId === sourceRecord.source.turnId && turn.positionId === sourceRecord.source.positionId && (turn.conversationRef ?? turn.conversationId) === sourceRecord.source.conversationId)!;
+      const turnId = crypto.randomUUID();
+      const reservation = this.ctx.runningTurns.reserve(ws.dir, sourceRecord.source.positionId, turnId);
+      let session: WorkbenchSession | undefined;
+      const decidedAt = new Date().toISOString();
+      try {
+        if (sourceRecord.source.kind === "session") session = await this.ctx.sessionStore.reserveTurn(ws.dir, sourceRecord.source.conversationId);
+        const engine = await resolvePositionAgentEngine(ws, sourceRecord.source.positionId, sourceRecord.source.engine, this.ctx.turnStore, this.ctx.sessionStore);
+        if (engine !== sourceRecord.source.engine) throw conflict("Employee engine changed; request new approvals");
+        this.assertToken(ws, token);
+        if (members.some(member => member.record.expiresAt && Date.now() >= Date.parse(member.record.expiresAt))) throw new OrgApiError(errorCodes.approval_expired, 410, "One or more approvals expired");
+        for (const member of members) {
+          const a = member.record;
+          a.decisions!.push({ requestId: member.requestId, expectedVersion: member.input.expectedVersion, decision: "granted", scope: "once", actor, ...(request.reason ? { reason: request.reason } : {}), decidedAt, batchId: request.requestId });
+          a.progress = policyProgress(a.policy!, a.decisions!);
+          // A batch is valid only when this vote completes every member.
+          if (a.progress.pending !== 0) throw conflict("Approval policy did not settle the batch member");
+          a.status = "granted";
+          a.decision = { requestId: member.requestId, expectedVersion: member.input.expectedVersion, decision: "granted", scope: "once", ...(request.reason ? { reason: request.reason } : {}), decidedBy: "operator", decidedAt };
+          a.execution = { phase: "starting", turnId };
+          a.version++; a.updatedAt = decidedAt;
+        }
+        // Audit is append-only, so make every durable audit append succeed
+        // before publishing any approval record. A retry recognizes the same
+        // member request ids and reuses these entries.
+        for (const member of members) {
+          const a = member.record;
+          await this.store.appendAudit(ws.dir, { approvalId: a.id, requestId: member.requestId, batchId: request.requestId, timestamp: decidedAt, type: "decision", actor, decision: "granted", scope: "once", policyVersion: a.policy!.version, policyDigest: a.policy!.digest });
+        }
+        try {
+          for (const member of members) {
+            await this.save(ws, member.record);
+          }
+        } catch (error) {
+          // `atomicWriteJson` prevents a torn individual record. Restore all
+          // members nevertheless, including the write that reported failure,
+          // so neither a failed loop nor a subsequent retry exposes a subset.
+          await Promise.all(members.map(async member => {
+            const original = originals.get(member.record.id)!;
+            await this.save(ws, original);
+            Object.assign(member.record, structuredClone(original));
+          })).catch(() => undefined);
+          throw error;
+        }
+      } catch (error) {
+        reservation.release();
+        if (session) this.ctx.sessionStore.releaseTurn(ws.dir, session.sessionId);
+        throw error;
+      }
+      const activeKeys = members.map(member => `${ws.dir}\0${member.record.id}`);
+      activeKeys.forEach(key => this.active.add(key));
+      const accepted = await Promise.all(members.map(async member => ({ id: member.record.id, status: "accepted" as const, record: await this.view(ws, structuredClone(member.record)) })));
+      const job = (async () => {
+        try {
+          const result = await executeTurn(this.ctx, undefined, {
+            positionId: sourceRecord.source.positionId, engine: sourceRecord.source.engine,
+            input: `[审批批量裁决] 请继续执行原任务中这一组已批准的低风险动作\n${source.input}`,
+            pendingApprovals: members.map(member => ({ approvalId: member.record.approvalId, decision: "granted" as const, decidedBy: "operator" as const, scope: "once" as const, ...(request.reason ? { reason: request.reason } : {}), ...(member.record.expiresAt ? { expiresAt: member.record.expiresAt } : {}) })),
+          }, session, undefined, undefined, ws, {
+            turnId, reservation,
+            beforeRun: async () => {
+              if (members.some(member => member.record.expiresAt && Date.now() >= Date.parse(member.record.expiresAt))) throw new OrgApiError(errorCodes.approval_expired, 410, "Approval expired before execution");
+              for (const member of members) { member.record.execution.phase = "running"; member.record.version++; member.record.updatedAt = new Date().toISOString(); await this.serial(() => this.save(ws, member.record)); }
+            },
+          });
+          for (const member of members) member.record.execution = { turnId, ...this.outcome(member.record, result) };
+        } catch (error) {
+          for (const member of members) member.record.execution = { turnId, phase: "indeterminate", errorCode: error instanceof OrgApiError ? error.code : "approval_execution_unknown" };
+        } finally {
+          reservation.release();
+          if (session) this.ctx.sessionStore.releaseTurn(ws.dir, session.sessionId);
+        }
+        await this.serial(async () => {
+          try {
+            for (const member of members) { member.record.version++; member.record.updatedAt = new Date().toISOString(); await this.save(ws, member.record); }
+          } finally { activeKeys.forEach(key => this.active.delete(key)); }
+        });
+      })();
+      this.jobs.add(job);
+      void job.catch(() => { activeKeys.forEach(key => this.active.delete(key)); }).finally(() => this.jobs.delete(job));
+      return { status: 202, response: { requestId: request.requestId, items: accepted } };
+    });
+  }
+
   close(): Promise<void> {
     return this.closePromise ??= (async () => {
       this.closed = true;
diff --git a/apps/server/src/approvals/store.ts b/apps/server/src/approvals/store.ts
index 76d7c667..6d2da6df 100644
--- a/apps/server/src/approvals/store.ts
+++ b/apps/server/src/approvals/store.ts
@@ -99,7 +99,7 @@ function valid(value: unknown): value is ApprovalRecord {
   if (a.schemaVersion === "workbench-approval.v2") {
     const p = a.policy;
     const actor = (v: unknown) => typeof v === "string" && /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(v);
-    if (!p || !actor(p.version) || !/^sha256:[a-f0-9]{64}$/.test(p.digest) || !Array.isArray(p.eligibleApprovers) || !p.eligibleApprovers.every(actor) || !Number.isSafeInteger(p.threshold) || p.threshold < 1 || p.threshold > p.eligibleApprovers.length || !p.delegations || typeof p.delegations !== "object" || Array.isArray(p.delegations) || !Object.entries(p.delegations).every(([from, to]) => actor(from) && Array.isArray(to) && to.every(actor)) || (p.escalation !== undefined && (!time(p.escalation.at) || !Array.isArray(p.escalation.eligibleApprovers) || !p.escalation.eligibleApprovers.every(actor) || !Number.isSafeInteger(p.escalation.threshold) || p.escalation.threshold < 1 || p.escalation.threshold > p.escalation.eligibleApprovers.length)) || !Array.isArray(a.decisions) || a.decisions.length > 64 || !a.decisions.every(d => /^[a-f0-9-]{36}$/.test(d.requestId) && Number.isSafeInteger(d.expectedVersion) && d.expectedVersion >= 1 && ["granted", "denied"].includes(d.decision) && (d.scope === "once" || d.scope === "run") && actor(d.actor) && time(d.decidedAt) && (d.delegatedFrom === undefined || actor(d.delegatedFrom)) && (d.reason === undefined || text(d.reason))) || !a.progress || !Number.isSafeInteger(a.progress.required) || !Number.isSafeInteger(a.progress.granted) || !Number.isSafeInteger(a.progress.pending) || typeof a.progress.escalated !== "boolean") return false;
+    if (!p || !actor(p.version) || !/^sha256:[a-f0-9]{64}$/.test(p.digest) || !Array.isArray(p.eligibleApprovers) || !p.eligibleApprovers.every(actor) || !Number.isSafeInteger(p.threshold) || p.threshold < 1 || p.threshold > p.eligibleApprovers.length || !p.delegations || typeof p.delegations !== "object" || Array.isArray(p.delegations) || !Object.entries(p.delegations).every(([from, to]) => actor(from) && Array.isArray(to) && to.every(actor)) || (p.batch !== undefined && (!Number.isSafeInteger(p.batch.maxItems) || p.batch.maxItems < 2 || p.batch.maxItems > 32 || !Array.isArray(p.batch.actionKinds) || p.batch.actionKinds.length !== 1 || p.batch.actionKinds[0] !== "tool")) || (p.escalation !== undefined && (!time(p.escalation.at) || !Array.isArray(p.escalation.eligibleApprovers) || !p.escalation.eligibleApprovers.every(actor) || !Number.isSafeInteger(p.escalation.threshold) || p.escalation.threshold < 1 || p.escalation.threshold > p.escalation.eligibleApprovers.length)) || !Array.isArray(a.decisions) || a.decisions.length > 64 || !a.decisions.every(d => /^[a-f0-9-]{36}$/.test(d.requestId) && Number.isSafeInteger(d.expectedVersion) && d.expectedVersion >= 1 && ["granted", "denied"].includes(d.decision) && (d.scope === "once" || d.scope === "run") && actor(d.actor) && time(d.decidedAt) && (d.delegatedFrom === undefined || actor(d.delegatedFrom)) && (d.reason === undefined || text(d.reason)) && (d.batchId === undefined || /^[a-f0-9-]{36}$/.test(d.batchId))) || !a.progress || !Number.isSafeInteger(a.progress.required) || !Number.isSafeInteger(a.progress.granted) || !Number.isSafeInteger(a.progress.pending) || typeof a.progress.escalated !== "boolean") return false;
     const { digest: _digest, ...policyPayload } = p;
     if (p.digest !== approvalPolicyDigest(policyPayload)) return false;
   }
@@ -202,7 +202,7 @@ export class ApprovalStore {
       const existing = await this.audit(workspace);
       const repeated = event.requestId === undefined ? undefined : existing.find(item => item.approvalId === event.approvalId && item.requestId === event.requestId);
       if (repeated) {
-        const same = repeated.type === event.type && repeated.actor === event.actor && repeated.delegatedFrom === event.delegatedFrom && repeated.decision === event.decision && repeated.scope === event.scope && repeated.policyVersion === event.policyVersion && repeated.policyDigest === event.policyDigest;
+        const same = repeated.type === event.type && repeated.actor === event.actor && repeated.delegatedFrom === event.delegatedFrom && repeated.decision === event.decision && repeated.scope === event.scope && repeated.batchId === event.batchId && repeated.policyVersion === event.policyVersion && repeated.policyDigest === event.policyDigest;
         if (!same) throw new OrgApiError(errorCodes.approval_conflict, 409, "Request id was already used for another audit decision");
         return repeated;
       }
@@ -228,7 +228,7 @@ export class ApprovalStore {
         const value = JSON.parse(line) as ApprovalAuditEvent;
         const { hash, ...unsigned } = value;
         const expected = `sha256:${crypto.createHash("sha256").update(JSON.stringify(unsigned)).digest("hex")}`;
-        if (!/^sha256:[a-f0-9]{64}$/.test(hash) || hash !== expected || value.seq !== events.length + 1 || value.previousHash !== events.at(-1)?.hash || !ID.test(value.approvalId) || (value.requestId !== undefined && !/^[a-f0-9-]{36}$/.test(value.requestId))) throw auditFailure();
+        if (!/^sha256:[a-f0-9]{64}$/.test(hash) || hash !== expected || value.seq !== events.length + 1 || value.previousHash !== events.at(-1)?.hash || !ID.test(value.approvalId) || (value.requestId !== undefined && !/^[a-f0-9-]{36}$/.test(value.requestId)) || (value.batchId !== undefined && !/^[a-f0-9-]{36}$/.test(value.batchId))) throw auditFailure();
         events.push(value);
       }
       return id ? events.filter(e => e.approvalId === id) : events;
diff --git a/apps/server/src/routes/approvals.ts b/apps/server/src/routes/approvals.ts
index 02e18692..f13fef43 100644
--- a/apps/server/src/routes/approvals.ts
+++ b/apps/server/src/routes/approvals.ts
@@ -3,9 +3,19 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { OrgApiError, errorCodes } from "@roleweave/shared";
 import type { ControlPlaneContext } from "../context.js";
 import { readJsonBody, sendJson } from "../http.js";
-import { approvals, parseDecision } from "../approvals/service.js";
+import { approvals, parseBatchDecision, parseDecision } from "../approvals/service.js";
 
 export async function handleApprovals(ctx: ControlPlaneContext, req: IncomingMessage, res: ServerResponse, url: URL, actor?: string): Promise<boolean> {
+  if (url.pathname === "/approvals/batch/decision") {
+    if (req.method !== "POST") throw new OrgApiError(errorCodes.method_not_allowed, 405, "Unsupported approval operation");
+    const body = await readJsonBody<Record<string, unknown>>(req);
+    if (!body || typeof body !== "object" || Array.isArray(body)) throw new OrgApiError(errorCodes.approval_request_invalid, 400, "Invalid batch decision");
+    const { workspaceToken, ...decision } = body;
+    if (!actor) throw new OrgApiError(errorCodes.unauthorized, 401, "An authenticated approval actor is required");
+    const result = await approvals(ctx).decideBatch(ctx.workspace.requireOpen(), workspaceToken, parseBatchDecision(decision), actor);
+    sendJson(res, result.status, result.response);
+    return true;
+  }
   const match = url.pathname.match(/^\/approvals(?:\/([a-f0-9]{64})(?:\/(decision|audit))?)?$/);
   if (!match) return false;
   const ws = ctx.workspace.requireOpen();
diff --git a/apps/server/src/routes/turns.ts b/apps/server/src/routes/turns.ts
index 11edf65e..dfa2fffa 100644
--- a/apps/server/src/routes/turns.ts
+++ b/apps/server/src/routes/turns.ts
@@ -69,6 +69,8 @@ export interface TurnPostBody {
   engine: TurnEngine;
   /** Operator verdict for a resume turn (#193); optional, additive. */
   pendingApproval?: TurnPendingApproval;
+  /** Internal-only atomic recovery input assembled by ApprovalService. */
+  pendingApprovals?: TurnPendingApproval[];
   /** Additive #52: set only by the group spawn path, never by a route body. */
   groupRef?: string;
   /** Additive #222: optional goal binding. */
@@ -384,6 +386,9 @@ export async function executeTurn(
       ...(body.pendingApproval !== undefined
         ? { pendingApproval: body.pendingApproval }
         : {}),
+      ...(body.pendingApprovals !== undefined
+        ? { pendingApprovals: body.pendingApprovals }
+        : {}),
       ...(conversationRef !== undefined ? { conversationRef } : {}),
     });
     const beginInput = {
diff --git a/apps/server/src/turns/envelope.ts b/apps/server/src/turns/envelope.ts
index fcb05789..142eaed2 100644
--- a/apps/server/src/turns/envelope.ts
+++ b/apps/server/src/turns/envelope.ts
@@ -37,6 +37,7 @@ export function createTurnEnvelope(input: {
   message: string;
   /** Operator verdict for a resume turn (#193); included in the digest. */
   pendingApproval?: TurnPendingApproval;
+  pendingApprovals?: TurnPendingApproval[];
   /** Contract-level back-link (de#205); included in the digest when present. */
   conversationRef?: string;
 }): TurnEnvelope {
@@ -58,6 +59,9 @@ export function createTurnEnvelope(input: {
     ...(input.pendingApproval !== undefined
       ? { pendingApproval: input.pendingApproval }
       : {}),
+    ...(input.pendingApprovals !== undefined
+      ? { pendingApprovals: input.pendingApprovals }
+      : {}),
     ...(hasRef ? { conversationRef: input.conversationRef } : {}),
   };
   return { ...body, envelopeDigest: computeEnvelopeDigest(body) };
diff --git a/apps/server/test/approvals-center.test.ts b/apps/server/test/approvals-center.test.ts
index ac701d67..3b541f35 100644
--- a/apps/server/test/approvals-center.test.ts
+++ b/apps/server/test/approvals-center.test.ts
@@ -13,6 +13,8 @@ class ApprovalDriver implements TurnRunDriver {
   expiresAt = new Date(Date.now() + 60000).toISOString();
   target = "report.md";
   reason = "The write needs operator approval";
+  actionKind: "write" | "exec" | "network" | "tool" = "write";
+  approvalCount = 1;
   runScope = false;
   invalidRunBinding = false;
   preview?: ApprovalChangePreview;
@@ -22,19 +24,25 @@ class ApprovalDriver implements TurnRunDriver {
     const runId = crypto.randomUUID(), timestamp = new Date().toISOString();
     const base = { runId, timestamp };
     const d = request.envelope.pendingApproval;
+    const batch = request.envelope.pendingApprovals;
     const events: EngineEvent[] = [{ ...base, type: "run.started" }];
-    if (d) {
+    if (d || batch) {
       await this.hold;
-      if (d.decision === "granted") events.push({ ...base, type: "approval.granted", approvalId: d.approvalId, grantedBy: "operator", scope: d.scope ?? "once" }, { ...base, type: "run.completed", output: "done", terminalReason: "goal_met" });
-      else events.push({ ...base, type: "approval.denied", approvalId: d.approvalId, deniedBy: "operator" }, { ...base, type: "run.failed", error: { code: "engine.approval_denied", message: "denied", retryable: false, terminalReason: "cancelled" } });
+      const decisions = batch ?? [d!];
+      if (decisions[0]!.decision === "granted") events.push(...decisions.map(decision => ({ ...base, type: "approval.granted" as const, approvalId: decision.approvalId, grantedBy: "operator" as const, scope: decision.scope ?? "once" })), { ...base, type: "run.completed", output: "done", terminalReason: "goal_met" });
+      else events.push(...decisions.map(decision => ({ ...base, type: "approval.denied" as const, approvalId: decision.approvalId, deniedBy: "operator" as const })), { ...base, type: "run.failed", error: { code: "engine.approval_denied", message: "denied", retryable: false, terminalReason: "cancelled" } });
     } else {
-      const action = { kind: "write" as const, description: "write report", target: this.target };
-      const binding = `sha256:${crypto.createHash("sha256").update(approvalRunScopeBindingInput("same-engine-id", runId, action, this.expiresAt)).digest("hex")}`;
-      events.push({ ...base, type: "approval.requested", approvalId: "same-engine-id", action: {
-        ...action,
-        ...(this.preview ? { preview: this.preview } : {}),
-        ...(this.runScope ? { scope: { version: "approval-scope-offer.v1" as const, allowed: ["once", "run"] as Array<"once" | "run">, runBinding: this.invalidRunBinding ? `sha256:${"0".repeat(64)}` : binding } } : {}),
-      }, reason: this.reason, expiresAt: this.expiresAt },
+      for (let index = 0; index < this.approvalCount; index++) {
+        const approvalId = this.approvalCount === 1 ? "same-engine-id" : `same-engine-id-${index + 1}`;
+        const action = { kind: this.actionKind, description: "write report", target: this.target };
+        const binding = `sha256:${crypto.createHash("sha256").update(approvalRunScopeBindingInput(approvalId, runId, action, this.expiresAt)).digest("hex")}`;
+        events.push({ ...base, type: "approval.requested", approvalId, action: {
+          ...action,
+          ...(this.preview ? { preview: this.preview } : {}),
+          ...(this.runScope ? { scope: { version: "approval-scope-offer.v1" as const, allowed: ["once", "run"] as Array<"once" | "run">, runBinding: this.invalidRunBinding ? `sha256:${"0".repeat(64)}` : binding } } : {}),
+        }, reason: this.reason, expiresAt: this.expiresAt });
+      }
+      events.push(
       { ...base, type: "run.failed", error: { code: "engine.approval_required", message: "waiting", retryable: true, terminalReason: "engine_internal_error" } });
     }
     for (const event of events) request.onEvent?.(event);
@@ -73,6 +81,29 @@ async function settle(s: TestServer, id: string) {
   throw new Error("Approval did not settle");
 }
 
+const batchPolicy = (overrides: Record<string, unknown> = {}) => ({
+  schemaVersion: "roleweave-approval-policy.v1",
+  version: "batch-tools-1",
+  default: { eligibleApprovers: ["operator"], threshold: 1, batch: { maxItems: 4, actionKinds: ["tool"] }, ...overrides },
+});
+
+async function rejectBatch(driver: ApprovalDriver, policy: Record<string, unknown>, versions?: (version: number) => number) {
+  const workspace = await copyExampleWorkspace(), s = await startTestServer(undefined, driver);
+  try {
+    await fs.mkdir(path.join(workspace, ".digital-employee", "workbench"), { recursive: true });
+    await fs.writeFile(path.join(workspace, ".digital-employee", "workbench", "approval-policy.json"), JSON.stringify(policy));
+    await open(s, workspace); await request(s);
+    const snapshot = await list(s);
+    const response = await api(s.baseUrl, "/approvals/batch/decision", {
+      token: s.token, method: "POST",
+      body: { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: snapshot.items.map(item => ({ id: item.id, expectedVersion: versions?.(item.version) ?? item.version })) },
+    });
+    assert.equal(response.status, 200, JSON.stringify(response.body));
+    assert.deepEqual((response.body as { items: Array<{ status: string }> }).items.map(item => item.status), snapshot.items.map(() => "rejected"));
+    assert.equal(driver.calls.filter(call => call.envelope.pendingApprovals).length, 0);
+  } finally { await s.close(); }
+}
+
 test("approval center restores the source session, preserves expiry, is idempotent and survives restart", async () => {
   const driver = new ApprovalDriver(), workspace = await copyExampleWorkspace();
   let s = await startTestServer(undefined, driver);
@@ -345,6 +376,91 @@ test("approval views redact secrets while preserving safe decision context", asy
   } finally { await s.close(); }
 });
 
+test("#403 batches one homogeneous low-risk tool source through one recovery turn", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
+  const workspace = await copyExampleWorkspace(), s = await startTestServer(undefined, driver);
+  try {
+    await fs.mkdir(path.join(workspace, ".digital-employee", "workbench"), { recursive: true });
+    await fs.writeFile(path.join(workspace, ".digital-employee", "workbench", "approval-policy.json"), JSON.stringify(batchPolicy()));
+    await open(s, workspace); await request(s);
+    const snapshot = await list(s);
+    const response = await api(s.baseUrl, "/approvals/batch/decision", {
+      token: s.token, method: "POST",
+      body: { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })) },
+    });
+    assert.equal(response.status, 202, JSON.stringify(response.body));
+    for (const item of snapshot.items) assert.equal((await settle(s, item.id)).execution.phase, "completed");
+    assert.equal(driver.calls.filter(call => call.envelope.pendingApprovals).length, 1);
+    assert.equal(driver.calls.find(call => call.envelope.pendingApprovals)?.envelope.pendingApprovals?.length, 2);
+  } finally { await s.close(); }
+});
+
+test("#403 rolls back every member when one batch persistence write fails", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
+  const workspace = await copyExampleWorkspace(), s = await startTestServer(undefined, driver);
+  try {
+    await fs.mkdir(path.join(workspace, ".digital-employee", "workbench"), { recursive: true });
+    await fs.writeFile(path.join(workspace, ".digital-employee", "workbench", "approval-policy.json"), JSON.stringify(batchPolicy()));
+    await open(s, workspace); await request(s);
+    const snapshot = await list(s), service = approvals(s.ctx);
+    const originalPut = service.store.put.bind(service.store);
+    let grantedWrites = 0;
+    service.store.put = async (directory, record) => {
+      if (record.status === "granted" && record.execution.phase === "starting" && ++grantedWrites === 2) {
+        throw new Error("synthetic second-member write failure");
+      }
+      await originalPut(directory, record);
+    };
+    try {
+      const response = await api(s.baseUrl, "/approvals/batch/decision", {
+        token: s.token, method: "POST",
+        body: { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })) },
+      });
+      assert.equal(response.status, 500, JSON.stringify(response.body));
+    } finally {
+      service.store.put = originalPut;
+    }
+    const restored = await list(s);
+    assert.ok(restored.items.every(item => item.status === "pending" && item.execution.phase === "not_started" && item.decision === undefined));
+    assert.equal(driver.calls.filter(call => call.envelope.pendingApprovals).length, 0);
+  } finally { await s.close(); }
+});
+
+test("#403 rejects write approvals at the batch boundary", async () => {
+  const driver = new ApprovalDriver(); driver.approvalCount = 2;
+  await rejectBatch(driver, batchPolicy());
+});
+
+test("#403 rejects exec approvals at the batch boundary", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "exec"; driver.approvalCount = 2;
+  await rejectBatch(driver, batchPolicy());
+});
+
+test("#403 rejects network approvals at the batch boundary", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "network"; driver.approvalCount = 2;
+  await rejectBatch(driver, batchPolicy());
+});
+
+test("#403 rejects expired approvals at the batch boundary", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2; driver.expiresAt = new Date(Date.now() - 1000).toISOString();
+  await rejectBatch(driver, batchPolicy());
+});
+
+test("#403 rejects version-conflicted approvals at the batch boundary", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
+  await rejectBatch(driver, batchPolicy(), version => version + 1);
+});
+
+test("#403 rejects batches that need more than one approval principal", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
+  await rejectBatch(driver, batchPolicy({ eligibleApprovers: ["operator", "reviewer"], threshold: 2 }));
+});
+
+test("#403 rejects run-scope offers at the batch boundary", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2; driver.runScope = true;
+  await rejectBatch(driver, batchPolicy());
+});
+
 test("expired, rotated and stale-workspace approvals cannot execute", async () => {
   const driver = new ApprovalDriver(), s = await startTestServer(undefined, driver);
   try {
diff --git a/docs/approvals-p0.md b/docs/approvals-p0.md
index 14318c0e..1b57cf7f 100644
--- a/docs/approvals-p0.md
+++ b/docs/approvals-p0.md
@@ -64,7 +64,7 @@ npm run build:renderer
 - Windows 目录 fsync 的耐久性限制沿用现有原子写实现。
 - 已接受的恢复若因工作区切换或崩溃未能完成，不自动执行第二次；页面保留结果待核实。
 - 历史扫描不是常驻全量索引；分页读取会核对完整有界快照。
-- 群聊恢复、多审批人权限、批量批准和外部通知不属于本期。
+- 群聊恢复和外部通知不属于本期。
 
 ## 多人审批策略（#402）
 
@@ -110,3 +110,32 @@ npm run build:renderer
 `GET /approvals/:id/audit` 为已认证客户端导出该请求的 `requested`、`decision`
 和 `escalated` 事件。事件记录实际 actor、可选委派来源、策略版本/摘要，并以
 跨记录的 SHA-256 前序哈希链连接；格式或链不完整时导出会失败关闭。
+
+## 同源低风险批量裁决（#403）
+
+批量批准不是客户端对单项接口的循环调用。策略必须在请求创建时显式冻结
+`batch` 分类；没有该配置的请求永远只能逐项裁决。唯一可配置的类别是 `tool`，
+服务端还要求请求上下文风险为 `medium`。`write`、`exec`、`network`、群聊来源、
+过期项、已裁决项、升级中的多人门槛和 `run` scope 都不允许加入批量。
+
+```json
+{
+  "default": {
+    "eligibleApprovers": ["operator"],
+    "threshold": 1,
+    "batch": { "maxItems": 16, "actionKinds": ["tool"] }
+  }
+}
+```
+
+`POST /approvals/batch/decision` 接收工作区 token、一个 batch `requestId`、
+固定的 `decision: "granted"` 和每项 `{id, expectedVersion}`。服务端在改写任何
+记录前重验全部成员：每项版本、来源回合、策略快照、actor、到期时间和精确来源
+元组（kind、岗位、会话、turn、run、engine）必须一致。若有成员不合格，响应逐项
+给出 `rejected` 原因，且不裁决任何成员。
+
+有效集合以每项确定性派生的幂等键写入独立审计事件（关联同一 batch ID），并由
+一个恢复回合携带 `pendingApprovals` 结算。引擎在发出任一批准事件或消费模型前
+校验完整集合；任何过期或无效成员使整组失败关闭。所有成员共享同一 recovery
+turn；进程在持久化 intent 后中断时，照单项语义显示 `indeterminate`，绝不猜测或
+重放外部动作。队列只投影可批量分类和最大数量，不泄露审批人名单。
diff --git a/packages/shared/src/approvals.ts b/packages/shared/src/approvals.ts
index b04336a1..2efc288d 100644
--- a/packages/shared/src/approvals.ts
+++ b/packages/shared/src/approvals.ts
@@ -41,6 +41,9 @@ export interface ApprovalPolicySnapshot {
   eligibleApprovers: string[];
   threshold: number;
   delegations: Record<string, string[]>;
+  /** Explicit opt-in for #403. The server accepts only `tool` here; writes,
+   * commands and network requests are never batchable by configuration. */
+  batch?: { maxItems: number; actionKinds: Array<"tool"> };
   escalation?: { at: string; eligibleApprovers: string[]; threshold: number };
 }
 export interface ApprovalDecisionEvent {
@@ -52,6 +55,9 @@ export interface ApprovalDecisionEvent {
   delegatedFrom?: string;
   reason?: string;
   decidedAt: string;
+  /** Batch operation identity; individual requestId remains the idempotency
+   * key and audit handle for this particular member. */
+  batchId?: string;
 }
 export interface ApprovalPolicyProgress {
   required: number;
@@ -73,6 +79,7 @@ export interface ApprovalAuditEvent {
   policyDigest: string;
   previousHash?: string;
   hash: string;
+  batchId?: string;
 }
 export interface ApprovalRecord {
   schemaVersion: "workbench-approval.v1" | "workbench-approval.v2";
@@ -105,6 +112,9 @@ export interface ApprovalView extends Omit<ApprovalRecord, "policy" | "decisions
   schemaVersion: "workbench-approval.v1";
   canDecide: boolean;
   unavailableReason?: string;
+  /** Server-projected, non-sensitive #403 classification. Absence means this
+   * item must stay a single approval; it never exposes policy rosters. */
+  batch?: { maxItems: number };
 }
 export interface ApprovalList {
   items: ApprovalView[];
@@ -115,3 +125,26 @@ export interface ApprovalList {
   /** Opaque instance token, invalidated even by reopening the same directory. */
   workspaceToken: string;
 }
+
+/** Server-only batch input. Every member retains its own optimistic version;
+ * the outer requestId makes retries stable without reusing a single-item
+ * decision id. */
+export interface ApprovalBatchDecisionRequest {
+  requestId: string;
+  decision: "granted";
+  reason?: string;
+  items: Array<{ id: string; expectedVersion: number }>;
+}
+
+export interface ApprovalBatchDecisionResult {
+  id: string;
+  status: "accepted" | "rejected";
+  record?: ApprovalView;
+  code?: string;
+  message?: string;
+}
+
+export interface ApprovalBatchDecisionResponse {
+  requestId: string;
+  items: ApprovalBatchDecisionResult[];
+}
diff --git a/packages/shared/src/turns.ts b/packages/shared/src/turns.ts
index 59ab6862..11dded75 100644
--- a/packages/shared/src/turns.ts
+++ b/packages/shared/src/turns.ts
@@ -144,6 +144,9 @@ export interface TurnEnvelope {
   turnId: string;
   input: string;
   pendingApproval?: TurnPendingApproval;
+  /** #403 atomic recovery set. Only the approval service can construct this
+   * field; public turn endpoints still reject direct verdicts. */
+  pendingApprovals?: TurnPendingApproval[];
   /** Upstream de#205 (DE-CONVREF-001): only present under v1alpha2; the
    * builder pairs field⇔schemaVersion strictly (v1 + field is fail-closed
    * upstream, so that combination is never produced locally). Non-empty,
diff --git a/packages/ui/src/locales/en.ts b/packages/ui/src/locales/en.ts
index d812c3fd..14fe53b3 100644
--- a/packages/ui/src/locales/en.ts
+++ b/packages/ui/src/locales/en.ts
@@ -892,6 +892,11 @@ export const enCatalog: Record<string, string> = {
   "apr.loadFailed": "Could not load approvals. Refresh to retry.",
   "apr.submitFailed": "Decision receipt is unconfirmed. Refresh before retrying.",
   "apr.retrySameDecision": "The last submission is unconfirmed. Retry with the same decision and reason.",
+  "apr.batchSelect": "Select for policy-controlled batch approval",
+  "apr.batchSummary": "{count} low-risk approvals selected from {source}",
+  "apr.batchNeedMore": "Select one more approval from this exact source run to create a batch.",
+  "apr.batchBoundary": "The server will re-check every version, policy classification, source, and expiry before one recovery run starts.",
+  "apr.batchApprove": "Approve selected",
   "apr.reasonTooLong": "Reason exceeds 1024 UTF-8 bytes. Shorten it before submitting.",
   "apr.status.pending": "Pending",
   "apr.status.granted": "Approved",
diff --git a/packages/ui/src/locales/zh.ts b/packages/ui/src/locales/zh.ts
index a79c3775..80b76d51 100644
--- a/packages/ui/src/locales/zh.ts
+++ b/packages/ui/src/locales/zh.ts
@@ -895,6 +895,11 @@ export const zhCatalog: Record<string, string> = {
   "apr.loadFailed": "读取审批失败，请稍后刷新",
   "apr.submitFailed": "提交结果尚未确认，请刷新后重试",
   "apr.retrySameDecision": "上次提交结果尚未确认，请使用相同裁决和理由重试",
+  "apr.batchSelect": "选择加入策略受控批量批准",
+  "apr.batchSummary": "已从 {source} 选择 {count} 项低风险审批",
+  "apr.batchNeedMore": "请从同一来源回合再选择一项审批以形成批量。",
+  "apr.batchBoundary": "提交前服务端会重新校验每项版本、策略分类、来源和到期时间，并且只启动一个恢复回合。",
+  "apr.batchApprove": "批准所选项",
   "apr.reasonTooLong": "理由超过 1024 字节，请缩短后提交",
   "apr.status.pending": "待审批",
   "apr.status.granted": "已批准",

From 559f2fcbd064cfc1ac0446ddabe8b2757d00cac9 Mon Sep 17 00:00:00 2001
From: Bindy-lbb <70745012+Bindy-lbb@users.noreply.github.com>
Date: Mon, 21 Sep 2026 16:59:58 +0800
Subject: [PATCH 2/2] fix(approvals): compensate failed batch audit decisions

---
 apps/desktop/renderer/src/approvals/types.ts  |   2 +-
 .../renderer/test/approval-queue.test.tsx     |   4 +-
 apps/server/src/approvals/service.ts          |  73 +++++++--
 apps/server/src/approvals/store.ts            |   7 +-
 apps/server/test/approvals-center.test.ts     | 150 +++++++++++++++++-
 docs/approvals-p0.md                          |  11 +-
 packages/shared/src/approvals.ts              |   4 +-
 packages/ui/src/locales/en.ts                 |   2 +-
 packages/ui/src/locales/zh.ts                 |   2 +-
 9 files changed, 225 insertions(+), 30 deletions(-)

diff --git a/apps/desktop/renderer/src/approvals/types.ts b/apps/desktop/renderer/src/approvals/types.ts
index b905916c..5a5c3824 100644
--- a/apps/desktop/renderer/src/approvals/types.ts
+++ b/apps/desktop/renderer/src/approvals/types.ts
@@ -53,7 +53,7 @@ export interface ApprovalQueueItem {
   /** The server's projection of the engine-declared eligible grant scopes. */
   scopeAllowed?: Array<"once" | "run">;
   /** Non-sensitive server projection: this member is policy-classified for a
-   * low-risk batch, subject to final source/version checks at submit time. */
+   * restricted-tool batch, subject to final source/version checks at submit time. */
   batchMaxItems?: number;
   requestedAt?: string;
   expiresAt?: string;
diff --git a/apps/desktop/renderer/test/approval-queue.test.tsx b/apps/desktop/renderer/test/approval-queue.test.tsx
index 8dd86009..905cfcb5 100644
--- a/apps/desktop/renderer/test/approval-queue.test.tsx
+++ b/apps/desktop/renderer/test/approval-queue.test.tsx
@@ -145,7 +145,7 @@ describe("P0 \u5ba1\u6279\u961f\u5217 (\u2461)", () => {
     expect(onApprove).toHaveBeenCalledWith("appr-abc", undefined, "run");
   });
 
-  it("#403 shows the exact same-source low-risk selection before one batch callback", () => {
+  it("#403 shows the exact same-source restricted-tool selection before one batch callback", () => {
     const onApproveBatch = vi.fn();
     const source = { kind: "session" as const, positionId: "writer-1", conversationId: "session-1", turnId: "turn-1", runId: "run-1", engine: "qoder" as const };
     render(<ApprovalQueue items={[
@@ -155,7 +155,7 @@ describe("P0 \u5ba1\u6279\u961f\u5217 (\u2461)", () => {
     ]} onApprove={noop} onDeny={noop} onApproveBatch={onApproveBatch} />);
     const selectors = screen.getAllByRole("checkbox", { name: "选择加入策略受控批量批准" });
     fireEvent.click(selectors[0]!); fireEvent.click(selectors[1]!);
-    expect(screen.getByText(/已从 writer-1 · session-1 选择 2 项低风险审批/)).toBeInTheDocument();
+    expect(screen.getByText(/已从 writer-1 · session-1 选择 2 项受限工具审批/)).toBeInTheDocument();
     expect(selectors[2]).toBeDisabled();
     fireEvent.click(screen.getByRole("button", { name: "批准所选项" }));
     expect(onApproveBatch).toHaveBeenCalledWith(["batch-a", "batch-b"]);
diff --git a/apps/server/src/approvals/service.ts b/apps/server/src/approvals/service.ts
index 4fec9ffd..82650381 100644
--- a/apps/server/src/approvals/service.ts
+++ b/apps/server/src/approvals/service.ts
@@ -53,6 +53,13 @@ function batchMemberRequestId(batchId: string, approvalId: string): string {
   return `${digest.slice(0, 8)}-${digest.slice(8, 12)}-5${digest.slice(13, 16)}-${variant}${digest.slice(17, 20)}-${digest.slice(20, 32)}`;
 }
 
+/** An append-only audit ledger cannot delete an intent that failed to commit.
+ * Give its compensating event a distinct deterministic id so retrying the
+ * same failed batch records the same reversal rather than another verdict. */
+function batchMemberRollbackRequestId(batchId: string, approvalId: string): string {
+  return batchMemberRequestId(`rollback:${batchId}`, approvalId);
+}
+
 function sourceSignature(record: ApprovalRecord): string {
   const source = record.source;
   return JSON.stringify([source.kind, source.positionId, source.conversationId, source.turnId, source.runId, source.engine]);
@@ -395,7 +402,7 @@ export class ApprovalService {
         // policy permits batching, and only medium-risk restricted tools may
         // opt in; write/exec/network are structurally excluded.
         if (a.action.kind !== "tool" || a.context?.risk !== "medium" || a.action.scope?.allowed.includes("run") || !a.policy?.batch || !a.policy.batch.actionKinds.includes("tool") || a.policy.batch.maxItems < request.items.length) {
-          errors.set(a.id, "Approval is not eligible for a low-risk batch"); continue;
+          errors.set(a.id, "Approval is not eligible for a restricted-tool batch"); continue;
         }
         if (!a.decisions || !a.progress || a.progress.pending !== 1 || !canActForPolicy(a.policy, actor, undefined)) {
           errors.set(a.id, "Approval policy does not permit this batch decision"); continue;
@@ -423,6 +430,22 @@ export class ApprovalService {
       // storage. The preflight above is intentionally all-or-nothing; a
       // storage failure must not turn it into a partially granted batch.
       const originals = new Map(members.map(member => [member.record.id, structuredClone(member.record)]));
+      const appendAuditReversals = async (audited: typeof members): Promise<void> => {
+        for (const member of audited) {
+          const original = originals.get(member.record.id)!;
+          await this.store.appendAudit(ws.dir, {
+            approvalId: original.id,
+            requestId: batchMemberRollbackRequestId(request.requestId, original.id),
+            revertedRequestId: member.requestId,
+            batchId: request.requestId,
+            timestamp: new Date().toISOString(),
+            type: "decision_reverted",
+            actor,
+            policyVersion: original.policy!.version,
+            policyDigest: original.policy!.digest,
+          });
+        }
+      };
       const sourceRecord = members[0]!.record;
       const source = turns.find(turn => turn.turnId === sourceRecord.source.turnId && turn.positionId === sourceRecord.source.positionId && (turn.conversationRef ?? turn.conversationId) === sourceRecord.source.conversationId)!;
       const turnId = crypto.randomUUID();
@@ -447,11 +470,24 @@ export class ApprovalService {
           a.version++; a.updatedAt = decidedAt;
         }
         // Audit is append-only, so make every durable audit append succeed
-        // before publishing any approval record. A retry recognizes the same
-        // member request ids and reuses these entries.
-        for (const member of members) {
-          const a = member.record;
-          await this.store.appendAudit(ws.dir, { approvalId: a.id, requestId: member.requestId, batchId: request.requestId, timestamp: decidedAt, type: "decision", actor, decision: "granted", scope: "once", policyVersion: a.policy!.version, policyDigest: a.policy!.digest });
+        // before publishing any approval record. If an append partway through
+        // fails, reverse every decision that did reach the ledger; otherwise
+        // an audit export would claim an approval that stayed pending.
+        const audited: typeof members = [];
+        try {
+          for (const member of members) {
+            const a = member.record;
+            await this.store.appendAudit(ws.dir, { approvalId: a.id, requestId: member.requestId, batchId: request.requestId, timestamp: decidedAt, type: "decision", actor, decision: "granted", scope: "once", policyVersion: a.policy!.version, policyDigest: a.policy!.digest });
+            audited.push(member);
+          }
+        } catch (error) {
+          for (const member of members) member.record = structuredClone(originals.get(member.record.id)!);
+          try { await appendAuditReversals(audited); }
+          catch (compensationError) {
+            for (const member of members) this.ctx.bus.publish("approvals.changed", { workspacePath: ws.dir, id: member.record.id, version: member.record.version });
+            throw new OrgApiError(errorCodes.approval_storage_failed, 500, "Approval batch audit failed and compensation could not be confirmed", true, { cause: compensationError });
+          }
+          throw new OrgApiError(errorCodes.approval_storage_failed, 500, "Approval batch audit failed; every written decision was reverted", true, { cause: error });
         }
         try {
           for (const member of members) {
@@ -461,12 +497,23 @@ export class ApprovalService {
           // `atomicWriteJson` prevents a torn individual record. Restore all
           // members nevertheless, including the write that reported failure,
           // so neither a failed loop nor a subsequent retry exposes a subset.
-          await Promise.all(members.map(async member => {
-            const original = originals.get(member.record.id)!;
-            await this.save(ws, original);
-            Object.assign(member.record, structuredClone(original));
-          })).catch(() => undefined);
-          throw error;
+          // The ledger is append-only: a completed restore therefore receives
+          // a per-member reversal, which makes the earlier granted intent
+          // non-final to every audit consumer.
+          for (const member of members) member.record = structuredClone(originals.get(member.record.id)!);
+          const restoreFailures: unknown[] = [];
+          for (const member of members) {
+            try { await this.save(ws, member.record); }
+            catch (restoreError) { restoreFailures.push(restoreError); }
+          }
+          if (restoreFailures.length) {
+            // A failed rollback must be visible to clients: they must refresh
+            // from disk rather than trusting the failed operation's response.
+            for (const member of members) this.ctx.bus.publish("approvals.changed", { workspacePath: ws.dir, id: member.record.id, version: member.record.version });
+            throw new OrgApiError(errorCodes.approval_storage_failed, 500, "Approval batch persistence failed and rollback could not be confirmed", true, { cause: restoreFailures[0] });
+          }
+          await appendAuditReversals(members);
+          throw new OrgApiError(errorCodes.approval_storage_failed, 500, "Approval batch persistence failed; every member was restored", true, { cause: error });
         }
       } catch (error) {
         reservation.release();
@@ -480,7 +527,7 @@ export class ApprovalService {
         try {
           const result = await executeTurn(this.ctx, undefined, {
             positionId: sourceRecord.source.positionId, engine: sourceRecord.source.engine,
-            input: `[审批批量裁决] 请继续执行原任务中这一组已批准的低风险动作\n${source.input}`,
+            input: `[审批批量裁决] 请继续执行原任务中这一组已批准的受限工具动作\n${source.input}`,
             pendingApprovals: members.map(member => ({ approvalId: member.record.approvalId, decision: "granted" as const, decidedBy: "operator" as const, scope: "once" as const, ...(request.reason ? { reason: request.reason } : {}), ...(member.record.expiresAt ? { expiresAt: member.record.expiresAt } : {}) })),
           }, session, undefined, undefined, ws, {
             turnId, reservation,
diff --git a/apps/server/src/approvals/store.ts b/apps/server/src/approvals/store.ts
index 6d2da6df..a05d1d76 100644
--- a/apps/server/src/approvals/store.ts
+++ b/apps/server/src/approvals/store.ts
@@ -12,6 +12,8 @@ import { approvalPolicyDigest } from "./policy.js";
 
 const MAX_BYTES = 128 * 1024;
 const ID = /^[a-f0-9]{64}$/;
+const REQUEST_ID = /^[a-f0-9-]{36}$/;
+const auditTypes = new Set<ApprovalAuditEvent["type"]>(["requested", "decision", "escalated", "decision_reverted"]);
 const failure = () => new OrgApiError(errorCodes.approval_storage_failed, 500, "Approval storage is unavailable or invalid");
 const locked = () => new OrgApiError(errorCodes.approval_writer_busy, 409, "Another local control plane owns approvals for this workspace");
 const auditFailure = () => new OrgApiError(errorCodes.approval_storage_failed, 500, "Approval audit is unavailable or invalid");
@@ -202,7 +204,7 @@ export class ApprovalStore {
       const existing = await this.audit(workspace);
       const repeated = event.requestId === undefined ? undefined : existing.find(item => item.approvalId === event.approvalId && item.requestId === event.requestId);
       if (repeated) {
-        const same = repeated.type === event.type && repeated.actor === event.actor && repeated.delegatedFrom === event.delegatedFrom && repeated.decision === event.decision && repeated.scope === event.scope && repeated.batchId === event.batchId && repeated.policyVersion === event.policyVersion && repeated.policyDigest === event.policyDigest;
+        const same = repeated.type === event.type && repeated.actor === event.actor && repeated.delegatedFrom === event.delegatedFrom && repeated.decision === event.decision && repeated.scope === event.scope && repeated.batchId === event.batchId && repeated.revertedRequestId === event.revertedRequestId && repeated.policyVersion === event.policyVersion && repeated.policyDigest === event.policyDigest;
         if (!same) throw new OrgApiError(errorCodes.approval_conflict, 409, "Request id was already used for another audit decision");
         return repeated;
       }
@@ -228,7 +230,8 @@ export class ApprovalStore {
         const value = JSON.parse(line) as ApprovalAuditEvent;
         const { hash, ...unsigned } = value;
         const expected = `sha256:${crypto.createHash("sha256").update(JSON.stringify(unsigned)).digest("hex")}`;
-        if (!/^sha256:[a-f0-9]{64}$/.test(hash) || hash !== expected || value.seq !== events.length + 1 || value.previousHash !== events.at(-1)?.hash || !ID.test(value.approvalId) || (value.requestId !== undefined && !/^[a-f0-9-]{36}$/.test(value.requestId)) || (value.batchId !== undefined && !/^[a-f0-9-]{36}$/.test(value.batchId))) throw auditFailure();
+        const reversal = value.type === "decision_reverted";
+        if (!/^sha256:[a-f0-9]{64}$/.test(hash) || hash !== expected || value.seq !== events.length + 1 || value.previousHash !== events.at(-1)?.hash || !auditTypes.has(value.type) || !ID.test(value.approvalId) || (value.requestId !== undefined && !REQUEST_ID.test(value.requestId)) || (value.batchId !== undefined && !REQUEST_ID.test(value.batchId)) || (value.revertedRequestId !== undefined && !REQUEST_ID.test(value.revertedRequestId)) || (reversal && (value.requestId === undefined || value.batchId === undefined || value.revertedRequestId === undefined)) || (!reversal && value.revertedRequestId !== undefined)) throw auditFailure();
         events.push(value);
       }
       return id ? events.filter(e => e.approvalId === id) : events;
diff --git a/apps/server/test/approvals-center.test.ts b/apps/server/test/approvals-center.test.ts
index 3b541f35..4d59d68e 100644
--- a/apps/server/test/approvals-center.test.ts
+++ b/apps/server/test/approvals-center.test.ts
@@ -376,7 +376,7 @@ test("approval views redact secrets while preserving safe decision context", asy
   } finally { await s.close(); }
 });
 
-test("#403 batches one homogeneous low-risk tool source through one recovery turn", async () => {
+test("#403 batches one homogeneous restricted-tool source through one recovery turn", async () => {
   const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
   const workspace = await copyExampleWorkspace(), s = await startTestServer(undefined, driver);
   try {
@@ -384,18 +384,57 @@ test("#403 batches one homogeneous low-risk tool source through one recovery tur
     await fs.writeFile(path.join(workspace, ".digital-employee", "workbench", "approval-policy.json"), JSON.stringify(batchPolicy()));
     await open(s, workspace); await request(s);
     const snapshot = await list(s);
+    const payload = {
+      workspaceToken: snapshot.workspaceToken,
+      requestId: crypto.randomUUID(),
+      decision: "granted",
+      items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })),
+    };
     const response = await api(s.baseUrl, "/approvals/batch/decision", {
       token: s.token, method: "POST",
-      body: { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })) },
+      body: payload,
     });
     assert.equal(response.status, 202, JSON.stringify(response.body));
+    const replay = await api(s.baseUrl, "/approvals/batch/decision", { token: s.token, method: "POST", body: payload });
+    assert.equal(replay.status, 200, "the same batch request must reuse its member decisions");
     for (const item of snapshot.items) assert.equal((await settle(s, item.id)).execution.phase, "completed");
     assert.equal(driver.calls.filter(call => call.envelope.pendingApprovals).length, 1);
     assert.equal(driver.calls.find(call => call.envelope.pendingApprovals)?.envelope.pendingApprovals?.length, 2);
   } finally { await s.close(); }
 });
 
-test("#403 rolls back every member when one batch persistence write fails", async () => {
+test("#403 rejects unclassified tool batches before dispatch", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
+  await rejectBatch(driver, {
+    schemaVersion: "roleweave-approval-policy.v1",
+    version: "single-tool-only-1",
+    default: { eligibleApprovers: ["operator"], threshold: 1 },
+  });
+});
+
+test("#403 rejects classified tool members from different source runs before dispatch", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool";
+  const workspace = await copyExampleWorkspace(), s = await startTestServer(undefined, driver);
+  try {
+    await fs.mkdir(path.join(workspace, ".digital-employee", "workbench"), { recursive: true });
+    await fs.writeFile(path.join(workspace, ".digital-employee", "workbench", "approval-policy.json"), JSON.stringify(batchPolicy()));
+    await open(s, workspace);
+    await request(s, "repo-owner");
+    await request(s, "community-operator");
+    const snapshot = await list(s);
+    assert.equal(snapshot.items.length, 2);
+    const response = await api(s.baseUrl, "/approvals/batch/decision", {
+      token: s.token,
+      method: "POST",
+      body: { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })) },
+    });
+    assert.equal(response.status, 200, JSON.stringify(response.body));
+    assert.deepEqual((response.body as { items: Array<{ status: string }> }).items.map(item => item.status), ["rejected", "rejected"]);
+    assert.equal(driver.calls.filter(call => call.envelope.pendingApprovals).length, 0);
+  } finally { await s.close(); }
+});
+
+test("#403 rolls back every member and compensates the audit ledger when one batch persistence write fails", async () => {
   const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
   const workspace = await copyExampleWorkspace(), s = await startTestServer(undefined, driver);
   try {
@@ -411,18 +450,119 @@ test("#403 rolls back every member when one batch persistence write fails", asyn
       }
       await originalPut(directory, record);
     };
+    const failedPayload = { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted" as const, items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })) };
     try {
       const response = await api(s.baseUrl, "/approvals/batch/decision", {
         token: s.token, method: "POST",
-        body: { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })) },
+        body: failedPayload,
       });
       assert.equal(response.status, 500, JSON.stringify(response.body));
+      assert.equal((response.body as { code: string }).code, "approval_storage_failed");
+      assert.equal((response.body as { message: string }).message, "Approval batch persistence failed; every member was restored", JSON.stringify(response.body));
     } finally {
       service.store.put = originalPut;
     }
     const restored = await list(s);
     assert.ok(restored.items.every(item => item.status === "pending" && item.execution.phase === "not_started" && item.decision === undefined));
     assert.equal(driver.calls.filter(call => call.envelope.pendingApprovals).length, 0);
+    for (const item of restored.items) {
+      const audit = await api(s.baseUrl, `/approvals/${item.id}/audit`, { token: s.token });
+      assert.equal(audit.status, 200, JSON.stringify(audit.body));
+      const events = (audit.body as { events: Array<{ type: string; requestId?: string; revertedRequestId?: string; batchId?: string }> }).events;
+      assert.deepEqual(events.map(event => event.type), ["requested", "decision", "decision_reverted"]);
+      assert.equal(events[1]!.batchId, failedPayload.requestId);
+      assert.equal(events[2]!.batchId, failedPayload.requestId);
+      assert.equal(events[2]!.revertedRequestId, events[1]!.requestId);
+    }
+    const retry = await api(s.baseUrl, "/approvals/batch/decision", {
+      token: s.token,
+      method: "POST",
+      body: { workspaceToken: restored.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: restored.items.map(item => ({ id: item.id, expectedVersion: item.version })) },
+    });
+    assert.equal(retry.status, 202, JSON.stringify(retry.body));
+    for (const item of restored.items) await settle(s, item.id);
+    for (const item of restored.items) {
+      const audit = await api(s.baseUrl, `/approvals/${item.id}/audit`, { token: s.token });
+      const events = (audit.body as { events: Array<{ type: string; requestId?: string; revertedRequestId?: string }> }).events;
+      const reverted = new Set(events.filter(event => event.type === "decision_reverted").map(event => event.revertedRequestId));
+      assert.equal(events.filter(event => event.type === "decision" && !reverted.has(event.requestId)).length, 1, "only the retry is an unreverted grant");
+    }
+  } finally { await s.close(); }
+});
+
+test("#403 compensates already-appended decisions when the second audit append fails", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
+  const workspace = await copyExampleWorkspace(), s = await startTestServer(undefined, driver);
+  try {
+    await fs.mkdir(path.join(workspace, ".digital-employee", "workbench"), { recursive: true });
+    await fs.writeFile(path.join(workspace, ".digital-employee", "workbench", "approval-policy.json"), JSON.stringify(batchPolicy()));
+    await open(s, workspace); await request(s);
+    const snapshot = await list(s), service = approvals(s.ctx);
+    const originalAppend = service.store.appendAudit.bind(service.store);
+    let decisionAppends = 0;
+    service.store.appendAudit = async (directory, event) => {
+      if (event.type === "decision" && ++decisionAppends === 2) throw new Error("synthetic second-member audit failure");
+      return originalAppend(directory, event);
+    };
+    const payload = { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })) };
+    try {
+      const response = await api(s.baseUrl, "/approvals/batch/decision", { token: s.token, method: "POST", body: payload });
+      assert.equal(response.status, 500, JSON.stringify(response.body));
+      assert.equal((response.body as { code: string }).code, "approval_storage_failed");
+    } finally {
+      service.store.appendAudit = originalAppend;
+    }
+    const restored = await list(s);
+    assert.ok(restored.items.every(item => item.status === "pending" && item.execution.phase === "not_started" && item.decision === undefined));
+    const audits = await Promise.all(restored.items.map(async item => {
+      const response = await api(s.baseUrl, `/approvals/${item.id}/audit`, { token: s.token });
+      assert.equal(response.status, 200, JSON.stringify(response.body));
+      return (response.body as { events: Array<{ type: string; requestId?: string; revertedRequestId?: string; batchId?: string }> }).events;
+    }));
+    const events = audits.flat();
+    const decisions = events.filter(event => event.type === "decision");
+    const reversals = events.filter(event => event.type === "decision_reverted");
+    assert.equal(decisions.length, 1);
+    assert.equal(reversals.length, 1);
+    assert.equal(reversals[0]!.batchId, payload.requestId);
+    assert.equal(reversals[0]!.revertedRequestId, decisions[0]!.requestId);
+    assert.equal(driver.calls.filter(call => call.envelope.pendingApprovals).length, 0);
+  } finally { await s.close(); }
+});
+
+test("#403 makes a failed record rollback observable", async () => {
+  const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
+  const workspace = await copyExampleWorkspace(), s = await startTestServer(undefined, driver);
+  try {
+    await fs.mkdir(path.join(workspace, ".digital-employee", "workbench"), { recursive: true });
+    await fs.writeFile(path.join(workspace, ".digital-employee", "workbench", "approval-policy.json"), JSON.stringify(batchPolicy()));
+    await open(s, workspace); await request(s);
+    const snapshot = await list(s), service = approvals(s.ctx);
+    const published: Array<{ id?: string }> = [];
+    const unsubscribe = s.ctx.bus.subscribe(event => {
+      if (event.type === "approvals.changed") published.push(event.payload as { id?: string });
+    });
+    const originalPut = service.store.put.bind(service.store);
+    let grantedWrites = 0, rollbackWrites = 0;
+    service.store.put = async (directory, record) => {
+      if (record.status === "granted" && record.execution.phase === "starting" && ++grantedWrites === 2) throw new Error("synthetic second-member write failure");
+      if (record.status === "pending" && ++rollbackWrites === 1) throw new Error("synthetic rollback write failure");
+      await originalPut(directory, record);
+    };
+    try {
+      const response = await api(s.baseUrl, "/approvals/batch/decision", {
+        token: s.token,
+        method: "POST",
+        body: { workspaceToken: snapshot.workspaceToken, requestId: crypto.randomUUID(), decision: "granted", items: snapshot.items.map(item => ({ id: item.id, expectedVersion: item.version })) },
+      });
+      assert.equal(response.status, 500, JSON.stringify(response.body));
+      assert.deepEqual(response.body, { code: "approval_storage_failed", message: "Approval batch persistence failed and rollback could not be confirmed", retryable: true });
+    } finally {
+      service.store.put = originalPut;
+      unsubscribe();
+    }
+    assert.deepEqual(new Set(published.map(event => event.id)), new Set(snapshot.items.map(item => item.id)));
+    assert.equal(driver.calls.filter(call => call.envelope.pendingApprovals).length, 0);
   } finally { await s.close(); }
 });
 
@@ -451,7 +591,7 @@ test("#403 rejects version-conflicted approvals at the batch boundary", async ()
   await rejectBatch(driver, batchPolicy(), version => version + 1);
 });
 
-test("#403 rejects batches that need more than one approval principal", async () => {
+test("#403 rejects batches that still need more than one approval principal", async () => {
   const driver = new ApprovalDriver(); driver.actionKind = "tool"; driver.approvalCount = 2;
   await rejectBatch(driver, batchPolicy({ eligibleApprovers: ["operator", "reviewer"], threshold: 2 }));
 });
diff --git a/docs/approvals-p0.md b/docs/approvals-p0.md
index 1b57cf7f..4c710b16 100644
--- a/docs/approvals-p0.md
+++ b/docs/approvals-p0.md
@@ -107,16 +107,19 @@ npm run build:renderer
 立即终止请求，批准只有在达到当前门槛后才会启动恢复回合。
 
 队列只显示聚合的 `granted/required` 和是否升级，不暴露候选审批人或委派图。
-`GET /approvals/:id/audit` 为已认证客户端导出该请求的 `requested`、`decision`
-和 `escalated` 事件。事件记录实际 actor、可选委派来源、策略版本/摘要，并以
+`GET /approvals/:id/audit` 为已认证客户端导出该请求的 `requested`、`decision`、
+`decision_reverted` 和 `escalated` 事件。批量记录在某成员落盘失败后会为每个已写入
+的 decision 追加同 batch ID、关联原 request ID 的 `decision_reverted`，因此哈希链
+会明确表达该裁决未提交。事件记录实际 actor、可选委派来源、策略版本/摘要，并以
 跨记录的 SHA-256 前序哈希链连接；格式或链不完整时导出会失败关闭。
 
-## 同源低风险批量裁决（#403）
+## 同源受限工具批量裁决（#403）
 
 批量批准不是客户端对单项接口的循环调用。策略必须在请求创建时显式冻结
 `batch` 分类；没有该配置的请求永远只能逐项裁决。唯一可配置的类别是 `tool`，
 服务端还要求请求上下文风险为 `medium`。`write`、`exec`、`network`、群聊来源、
-过期项、已裁决项、升级中的多人门槛和 `run` scope 都不允许加入批量。
+过期项、已裁决项、仍需多于一票的多人门槛和 `run` scope 都不允许加入批量。已有
+足够的先前同意、且本次裁决恰好完成每个成员门槛的最后一票可以批量收尾。
 
 ```json
 {
diff --git a/packages/shared/src/approvals.ts b/packages/shared/src/approvals.ts
index 2efc288d..b84bf87f 100644
--- a/packages/shared/src/approvals.ts
+++ b/packages/shared/src/approvals.ts
@@ -69,7 +69,7 @@ export interface ApprovalAuditEvent {
   approvalId: string;
   seq: number;
   timestamp: string;
-  type: "requested" | "decision" | "escalated";
+  type: "requested" | "decision" | "escalated" | "decision_reverted";
   requestId?: string;
   actor?: string;
   delegatedFrom?: string;
@@ -80,6 +80,8 @@ export interface ApprovalAuditEvent {
   previousHash?: string;
   hash: string;
   batchId?: string;
+  /** The decision request invalidated by an append-only batch rollback. */
+  revertedRequestId?: string;
 }
 export interface ApprovalRecord {
   schemaVersion: "workbench-approval.v1" | "workbench-approval.v2";
diff --git a/packages/ui/src/locales/en.ts b/packages/ui/src/locales/en.ts
index 14fe53b3..7d336586 100644
--- a/packages/ui/src/locales/en.ts
+++ b/packages/ui/src/locales/en.ts
@@ -893,7 +893,7 @@ export const enCatalog: Record<string, string> = {
   "apr.submitFailed": "Decision receipt is unconfirmed. Refresh before retrying.",
   "apr.retrySameDecision": "The last submission is unconfirmed. Retry with the same decision and reason.",
   "apr.batchSelect": "Select for policy-controlled batch approval",
-  "apr.batchSummary": "{count} low-risk approvals selected from {source}",
+  "apr.batchSummary": "{count} restricted-tool approvals selected from {source}",
   "apr.batchNeedMore": "Select one more approval from this exact source run to create a batch.",
   "apr.batchBoundary": "The server will re-check every version, policy classification, source, and expiry before one recovery run starts.",
   "apr.batchApprove": "Approve selected",
diff --git a/packages/ui/src/locales/zh.ts b/packages/ui/src/locales/zh.ts
index 80b76d51..832e43f5 100644
--- a/packages/ui/src/locales/zh.ts
+++ b/packages/ui/src/locales/zh.ts
@@ -896,7 +896,7 @@ export const zhCatalog: Record<string, string> = {
   "apr.submitFailed": "提交结果尚未确认，请刷新后重试",
   "apr.retrySameDecision": "上次提交结果尚未确认，请使用相同裁决和理由重试",
   "apr.batchSelect": "选择加入策略受控批量批准",
-  "apr.batchSummary": "已从 {source} 选择 {count} 项低风险审批",
+  "apr.batchSummary": "已从 {source} 选择 {count} 项受限工具审批",
   "apr.batchNeedMore": "请从同一来源回合再选择一项审批以形成批量。",
   "apr.batchBoundary": "提交前服务端会重新校验每项版本、策略分类、来源和到期时间，并且只启动一个恢复回合。",
   "apr.batchApprove": "批准所选项",