@@ -14,7 +14,7 @@ A read of `sys_approval_request` through the generic data door (`find`, `findOne
 
 Before this, a deployment that granted read on the object served every request of the organization on that door, including the payload snapshots of records the caller cannot open.
 
-- **One rule for both doors.** The gate asks `ApprovalService.visibleRequestIdsFor`, which is the approvals door's own visibility. It is not the activity stream's parent-record gate, which admits every reader of the record: the record-reader tier stays off unless the deployment names the object.
+- **One rule for both doors.** The gate asks the approvals service for its own visibility (the same rule `listRequests` and `getRequest` apply), through an in-package handle: the published `ApprovalService` type is unchanged. It is not the activity stream's parent-record gate, which admits every reader of the record: the record-reader tier stays off unless the deployment names the object.
 - **Absence, not refusal.** A request the caller may not see answers a by-id read exactly as a missing one does, `404 RECORD_NOT_FOUND`. A list's `total` and a grouped count are narrowed like its rows. A failed visibility answer denies the read and logs a warning.
 - **Unchanged.** The approvals door, an administrator's view (Setup → Approvals → Requests), and the approval engine's own reads. A deployment that grants no read on the object still answers `403`.
 - The record-reader tier no longer anchors on `sys_approval_request` itself, even when `recordReaderVisibleObjects` names it.
@@ -85,6 +85,7 @@ import {
   resolveReadableSnapshotFields,
   type FieldVisibilitySource,
 } from './payload-redaction.js';
+import type { RequestVisibilitySource } from './request-read-gate.js';
 
 /**
  * Node-era approval runtime (ADR-0019).
@@ -1250,6 +1251,52 @@ export interface ApprovalServiceOptions {
   messageTranslator?: () => ValidationMessageTranslator | undefined;
 }
 
+/**
+ * The stored row request `requestId` names inside `tenantOrg` (every
+ * organization when `null`), read as the system — the one read a by-id serve
+ * (`ApprovalService.loadRequest`) and a by-id visibility question (the read
+ * gate's source below) both take, so the two cannot disagree about which record
+ * an id is anchored on.
+ */
+async function findRequestRow(
+  engine: ApprovalEngine,
+  requestId: string,
+  tenantOrg: string | null,
+): Promise<any | null> {
+  const where: any = { id: requestId };
+  if (tenantOrg) where.organization_id = tenantOrg;
+  const rows = await engine.find('sys_approval_request', {
+    where, limit: 1, context: SYSTEM_CTX,
+  });
+  return Array.isArray(rows) && rows[0] ? rows[0] : null;
+}
+
+/**
+ * [#22559] Each service's own request visibility, as the generic data door's
+ * read gate on `sys_approval_request` asks it (`request-read-gate.ts`).
+ *
+ * In-package only, and deliberately not a member of {@link ApprovalService}:
+ * the published class type stays exactly what it was, and the one consumer —
+ * `ApprovalsServicePlugin`, binding the gate — reaches it through
+ * {@link requestVisibilitySourceOf}, which the package entry does not
+ * re-export. The answer is written by the class itself, in its constructor,
+ * so it calls the class's private rule rather than restating it.
+ */
+const REQUEST_VISIBILITY = new WeakMap<ApprovalService, RequestVisibilitySource>();
+
+/**
+ * [#22559] The visibility source the read gate consumes for `service`: the
+ * approvals door's own `visibleRequestIds`, asked for a read that arrives
+ * through another door. Every constructed service registers one.
+ */
+export function requestVisibilitySourceOf(service: ApprovalService): RequestVisibilitySource {
+  const source = REQUEST_VISIBILITY.get(service);
+  if (!source) {
+    throw new Error('[approvals] no request visibility source is registered for this ApprovalService instance');
+  }
+  return source;
+}
+
 export class ApprovalService implements IApprovalService {
   private readonly engine: ApprovalEngine;
   private readonly clock: ApprovalClock;
@@ -1292,6 +1339,39 @@ export class ApprovalService implements IApprovalService {
         .map((n) => String(n ?? '').trim())
         .filter(Boolean),
     );
+    // [#22559] This door's request visibility, asked by a read that arrives
+    // through ANOTHER door: the generic data door's read gate on
+    // `sys_approval_request`. It is `visibleRequestIds` itself — the
+    // participant set, the override actor's unrestricted view and the
+    // default-OFF record-reader tier (#8652) — so the two doors serve one rule
+    // and cannot drift apart. ⛔ No second visibility rule lives in the gate.
+    //
+    // `null` is "every request in scope": the override actor, a system context
+    // included (its own reads are this service's, so the gate never narrows
+    // them, and answering costs no read). Otherwise the ids this door would
+    // serve the caller for a read naming `target`; empty means none. `target`
+    // names the record the tier anchors on, exactly as on this door: `object` +
+    // `recordId` is a list filtered to one record (`listRequests`); `requestId`
+    // is a request loaded by id, which carries its own anchor (`loadRequest`).
+    // Absent, the read is untargeted — the participant set alone, as for the
+    // inbox.
+    REQUEST_VISIBILITY.set(this, {
+      visibleRequestIdsFor: async (context, target) => {
+        // `organizationId` is not on the envelope — see isOverrideActor().
+        const tenantOrg = (context as any)?.organizationId ?? context?.tenantId ?? null;
+        // The same first question `visibleRequestIds` asks, asked before the
+        // by-id anchor is fetched so the unrestricted answer costs no read.
+        if (this.isOverrideActor(context, tenantOrg)) return null;
+        let anchor: { object?: string | null; recordId?: string | null } = {
+          object: target?.object, recordId: target?.recordId,
+        };
+        if (!(anchor.object && anchor.recordId) && target?.requestId) {
+          const raw = await findRequestRow(this.engine, target.requestId, tenantOrg);
+          anchor = raw ? { object: raw.object_name, recordId: raw.record_id } : {};
+        }
+        return this.visibleRequestIds(context, tenantOrg, anchor);
+      },
+    });
   }
 
   /** Attach (or replace) the ADR-0105 D9 posture provider. */
@@ -6528,63 +6608,6 @@ export class ApprovalService implements IApprovalService {
     return [...new Set<string>(list.map(r => String(r.request_id)))];
   }
 
-  /**
-   * [#22559] This door's request visibility, asked by a read that arrives
-   * through ANOTHER door: the generic data door's read gate on
-   * `sys_approval_request` (`request-read-gate.ts`). It is
-   * {@link ApprovalService.visibleRequestIds} itself — the participant set,
-   * the override actor's unrestricted view and the default-OFF record-reader
-   * tier (#8652) — so the two doors serve one rule and cannot drift apart.
-   * ⛔ No second visibility rule lives in the gate.
-   *
-   * `null` means "every request in scope": the override actor, a system
-   * context included (its own reads are this service's, so the gate never
-   * narrows them, and answering costs no read). Otherwise the set of request
-   * ids this door would serve the caller for a read naming `target`; empty
-   * means none.
-   *
-   * `target` names the record the record-reader tier anchors on, exactly as on
-   * this door: `object` + `recordId` is a list filtered to one record
-   * ({@link ApprovalService.listRequests}); `requestId` is a request loaded by
-   * id, which carries its own anchor ({@link ApprovalService.loadRequest}).
-   * Absent, the read is untargeted — the participant set alone, as for the
-   * inbox.
-   */
-  async visibleRequestIdsFor(
-    context: ExecutionContext,
-    target?: { object?: string | null; recordId?: string | null; requestId?: string | null },
-  ): Promise<Set<string> | null> {
-    // `organizationId` is not on the envelope — see isOverrideActor().
-    const tenantOrg = (context as any)?.organizationId ?? context?.tenantId ?? null;
-    // The same first question `visibleRequestIds` asks, asked before the
-    // by-id anchor is fetched so the unrestricted answer costs no read.
-    if (this.isOverrideActor(context, tenantOrg)) return null;
-    let anchor: { object?: string | null; recordId?: string | null } = {
-      object: target?.object, recordId: target?.recordId,
-    };
-    if (!(anchor.object && anchor.recordId) && target?.requestId) {
-      const raw = await this.findRequestRow(target.requestId, tenantOrg);
-      anchor = raw ? { object: raw.object_name, recordId: raw.record_id } : {};
-    }
-    return this.visibleRequestIds(context, tenantOrg, anchor);
-  }
-
-  /**
-   * The stored row request `requestId` names inside `tenantOrg` (every
-   * organization when `null`), read as the system — the one read a by-id serve
-   * ({@link ApprovalService.loadRequest}) and a by-id visibility question
-   * ({@link ApprovalService.visibleRequestIdsFor}) both take, so the two cannot
-   * disagree about which record an id is anchored on.
-   */
-  private async findRequestRow(requestId: string, tenantOrg: string | null): Promise<any | null> {
-    const where: any = { id: requestId };
-    if (tenantOrg) where.organization_id = tenantOrg;
-    const rows = await this.engine.find('sys_approval_request', {
-      where, limit: 1, context: SYSTEM_CTX,
-    });
-    return Array.isArray(rows) && rows[0] ? rows[0] : null;
-  }
-
   /**
    * The request ids this caller is a PARTICIPANT of, or `null` for a caller
    * who may see everything in scope (#3590).
@@ -6969,7 +6992,7 @@ export class ApprovalService implements IApprovalService {
     if (!requestId) return null;
     // `organizationId` is not on the envelope — see isOverrideActor().
     const tenantOrg = (context as any)?.organizationId ?? context?.tenantId;
-    const raw = await this.findRequestRow(requestId, tenantOrg ?? null);
+    const raw = await findRequestRow(this.engine, requestId, tenantOrg ?? null);
     if (!raw) return null;
     const caller = await this.actingCaller(context);
     // #3590: tenant scoping alone let any authenticated user read any request
 
@@ -15,6 +15,7 @@ import { SysApprovalDelegation } from './sys-approval-delegation.object.js';
 import { renderConfirmPage, renderResultPage } from './action-link-pages.js';
 import {
   ApprovalService,
+  requestVisibilitySourceOf,
   ESCALATION_JOB_NAME,
   ESCALATION_SCAN_INTERVAL_MS,
   type ApprovalEngine,
@@ -310,7 +311,7 @@ export class ApprovalsServicePlugin implements Plugin {
     // the manual API), and a read through the generic door needs the gate
     // whichever API wrote the row.
     if (typeof (engine as any).registerMiddleware === 'function') {
-      bindRequestReadGate(engine as any, this.service, ctx.logger);
+      bindRequestReadGate(engine as any, requestVisibilitySourceOf(this.service), ctx.logger);
     } else {
       ctx.logger.warn(
         'ApprovalsServicePlugin: the ObjectQL engine has no middleware seam — reads of sys_approval_request '
 
@@ -51,7 +51,7 @@ import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { ObjectStackProtocolImplementation } from '@objectstack/metadata-protocol';
 import type { EngineAggregateOptions, EngineCountOptions, EngineQueryOptions } from '@objectstack/spec/data';
-import { ApprovalService } from './approval-service.js';
+import { ApprovalService, requestVisibilitySourceOf } from './approval-service.js';
 import { ApprovalsServicePlugin, type ApprovalsPluginOptions } from './approvals-plugin.js';
 import { SysApprovalRequest } from './sys-approval-request.object.js';
 import { SysApprovalAction } from './sys-approval-action.object.js';
@@ -322,7 +322,8 @@ describe('the record-reader tier ON for the object', () => {
 describe('fails closed', () => {
   it('a visibility answer that fails denies the read, and says so', async () => {
     const rig = await boot();
-    vi.spyOn(rig.svc, 'visibleRequestIdsFor').mockRejectedValueOnce(new Error('probe went away'));
+    // The very source the plugin handed the gate: the service registers one object per instance.
+    vi.spyOn(requestVisibilitySourceOf(rig.svc), 'visibleRequestIdsFor').mockRejectedValueOnce(new Error('probe went away'));
     expect((await listIds(rig, ADMIN)).ids).toEqual([]);
     expect(rig.warnings.some((w) => w.includes('request read gate') && w.includes('fail closed'))).toBe(true);
   });
 
@@ -18,12 +18,14 @@
  *
  * ## One rule, two doors
  *
- * ⛔ Nothing here decides who may see a request. The answer is
- * `ApprovalService.visibleRequestIdsFor`, which IS the approvals door's
- * `visibleRequestIds`: the participant set (submitter, current approver, past
- * actor), the override actor's unrestricted view, and the record-reader tier,
- * which stays default OFF. This module only reads which record a query names,
- * hands that to the service, and ANDs the answer into the read.
+ * ⛔ Nothing here decides who may see a request. The answer is the approvals
+ * service's own: {@link RequestVisibilitySource}, which the plugin reaches
+ * with `requestVisibilitySourceOf(service)` (`approval-service.ts`, in-package
+ * only) and which IS the approvals door's private `visibleRequestIds`: the
+ * participant set (submitter, current approver, past actor), the override
+ * actor's unrestricted view, and the record-reader tier, which stays default
+ * OFF. This module only reads which record a query names, hands that to the
+ * service, and ANDs the answer into the read.
  *
  * ⛔ This is deliberately NOT `plugin-audit`'s parent-record read gate (the
  * activity stream's shape), which keeps a row whenever its parent record is
@@ -76,6 +78,7 @@
  * by the tier is served the row read-only on both doors.
  */
 
+import type { ExecutionContext } from '@objectstack/spec/kernel';
 import { pinnedEquality } from './payload-predicate-guard.js';
 import { APPROVAL_REQUEST_OBJECT, type MiddlewareEngine } from './payload-redaction-middleware.js';
 
@@ -94,10 +97,15 @@ export interface RequestReadTarget {
   requestId?: string;
 }
 
-/** The one visibility definition the gate reads: the approvals service's. */
+/**
+ * The one visibility definition the gate reads: the approvals service's,
+ * written by `ApprovalService`'s constructor and reached through
+ * `requestVisibilitySourceOf`. `null` is "every request in scope"; a set is the
+ * ids the approvals door would serve the caller for a read naming `target`.
+ */
 export interface RequestVisibilitySource {
   visibleRequestIdsFor(
-    context: any,
+    context: ExecutionContext,
     target?: { object?: string | null; recordId?: string | null; requestId?: string | null },
   ): Promise<Set<string> | null>;
 }