@@ -0,0 +1,12 @@
+---
+'@objectstack/plugin-approvals': patch
+---
+
+fix(plugin-approvals): a reminder's notification no longer carries one-tap approve / reject links, so no stored notification row holds a raw action token
+
+Clause-②: no
+
+- **What changed.** `remind()` still sends each concrete pending approver their own `approval.reminder` notification, with the same title, body and deep link to the request in the Approvals Inbox. It no longer mints ADR-0043 action tokens for that notification, and the payload it hands to `messaging` has no `actions` list. Messaging stores that payload, on the `sys_notification` event row and on each `sys_notification_delivery` row, so the links were kept in the database as usable links. ADR-0043's storage rule (`sys_approval_token` keeps SHA-256 digests only) exists so that the database holds none.
+- **What a recipient sees.** Nothing changes. A reminder names no channel, so it is delivered to the in-app inbox, and the inbox row never carried the links.
+- **Unchanged.** The action page (`GET` and `POST /api/v1/approvals/act`), `issueActionTokens`, `peekActionToken` and `redeemActionToken` behave exactly as before, and a redeemed token still decides as the approver it binds. The approval notification payload type no longer accepts links, and `issueActionTokens` now states that a raw token may travel only in a message that is sent and not kept.
+- **Rows written before this fix.** A reminder sent by an earlier build stored its links. Each of those tokens stops working at its 72-hour expiry, or earlier: once it is used, once its request is decided or recalled, or once its slot is reassigned. The rows themselves age out under the notification tables' retention, 90 days at most.
@@ -111,8 +111,11 @@ const ORG_A = 'org_battery_a';
 const ORG_B = 'org_battery_b';
 const orgOfDeal = (key: string): string => (key.startsWith('sla_') ? ORG_B : ORG_A);
 
-/** The fields `notify()` declares for a notification's payload. */
-const PAYLOAD_FIELDS = new Set(['title', 'body', 'actionUrl', 'actions']);
+/**
+ * The fields `notify()` declares for a notification's payload. [#24564] No
+ * `actions`: an ADR-0043 action link never rides a payload messaging stores.
+ */
+const PAYLOAD_FIELDS = new Set(['title', 'body', 'actionUrl']);
 
 const sysUser = {
   name: 'sys_user',
@@ -230,7 +233,7 @@ describe('every approval notification carries its text in body', () => {
     expect(thread.pending_approvers).toEqual(['position:legal', 'u_alice']);
     await svc.comment(ids.thread, { actorId: 'u_sub', comment: COMMENT }, asUser('u_sub'));
     await svc.requestInfo(ids.thread, { actorId: 'u_alice', comment: QUESTION }, asUser('u_alice'));
-    // A remind reaches the person with their own action links.
+    // A remind reaches the person — with no action link (#24564).
     await svc.remind(ids.thread, { actorId: 'u_sub' }, asUser('u_sub'));
     await svc.reassign(ids.thread, { actorId: 'u_alice', to: 'u_bob' }, asUser('u_alice'));
 
@@ -298,8 +301,8 @@ describe('every approval notification carries its text in body', () => {
       'approval.returned@revise',
       'approval.returned@rework',
       'approval.reassigned@thread',
-      'approval.reminder@thread+links',
-      'approval.reminder@bare+links',
+      'approval.reminder@thread',
+      'approval.reminder@bare',
       'approval.request_info@thread',
       'approval.comment@thread',
       'approval.escalated@sla_reassign',
@@ -328,7 +331,7 @@ describe('every approval notification carries its text in body', () => {
     // name in each body, not the rest of the sentence around it.
     const NAMED: Record<string, string> = {
       'approval.requested@thread': 'Deal D_thread',
-      'approval.reminder@thread+links': 'Deal D_thread',
+      'approval.reminder@thread': 'Deal D_thread',
       'approval.sla_breached@sla_notify': 'Deal D_sla_notify',
       'approval.sla_breached@sla_notify>submitter': 'Deal D_sla_notify',
       'approval.escalated@sla_reassign': 'Deal D_sla_reassign',
@@ -339,7 +342,7 @@ describe('every approval notification carries its text in body', () => {
       'approval.ooo_skipped@ooo': 'Deal D_ooo',
       // The control: the object's schema has no label, so the record is named
       // by the object's API name and the id.
-      'approval.reminder@bare+links': 'crm_memo D_bare',
+      'approval.reminder@bare': 'crm_memo D_bare',
     };
     const offenders = Object.entries(NAMED).flatMap(([site, name]) => {
       const bodies = emits.filter((e) => siteOf(e) === site).map((e) => String(e.payload?.body));
 
@@ -1686,20 +1686,22 @@ describe('ApprovalService (node era)', () => {
     expect(await svc.redeemActionToken(forU7.reject)).toMatchObject({ ok: false, reason: 'not_pending' });
   });
 
-  it('remind: each concrete approver gets their own action links', async () => {
+  it('remind: each concrete approver gets their own reminder, and none carries an action link (#24564)', async () => {
     const emitted: any[] = [];
     svc.attachMessaging({ async emit(input) { emitted.push(input); } });
-    const req = await svc.openNodeRequest(openInput(['u9', 'ada@example.com']), CTX);
-    await svc.remind(req.id, { actorId: 'u1' }, CTX);
+    const reqId = (await svc.openNodeRequest(openInput(['u9', 'ada@example.com']), CTX)).id;
+    const minted = (engine._tables['sys_approval_token'] ?? []).length;
+    await svc.remind(reqId, { actorId: 'u1' }, CTX);
     const reminders = emitted.filter(e => e.topic === 'approval.reminder');
-    expect(reminders).toHaveLength(2);
+    expect(reminders.map(r => r.audience)).toEqual([['u9'], ['ada@example.com']]);
     for (const r of reminders) {
-      expect(r.audience).toHaveLength(1);
-      expect(r.payload.actions).toHaveLength(2);
-      expect(r.payload.actions[0].url).toContain('/api/v1/approvals/act?token=');
+      // Messaging stores the payload it is handed: no link, no token, in any field.
+      expect(Object.keys(r.payload).sort()).toEqual(['actionUrl', 'body', 'title']);
+      expect(JSON.stringify(r)).not.toMatch(/token=|\/approvals\/act/);
+      expect(r.payload.actionUrl).toBe(`/system/approvals?request=${reqId}`);
     }
-    const urls = reminders.flatMap(r => r.payload.actions.map((a: any) => a.url));
-    expect(new Set(urls).size).toBe(4); // every link is personal + per-action
+    // A reminder mints nothing: a token minted here could only travel in the stored payload.
+    expect((engine._tables['sys_approval_token'] ?? []).length).toBe(minted);
   });
 
   // ── pagination + search pushdown (#1745) ────────────────────────
 
@@ -331,14 +331,23 @@ export interface ApprovalMessagingSurface {
 
 /**
  * What an approval notification hands to the messaging service: the
- * `EmitInput` payload fields the delivered notification is built from, plus a
- * reminder's one-tap decision links.
+ * `EmitInput` payload fields the delivered notification is built from.
  *
  * `body` is the text the recipient reads under the title. Messaging builds the
  * inbox row's `body_md`, and each channel's fallback rendering, from
  * `payload.body` and no other field, so the text is declared here rather than
  * left to a free-form bag: a call site that spells it any other way does not
  * compile. Spelled `message`, it once reached every recipient as an empty body.
+ *
+ * ⛔ [#24564] No field carries a bearer credential: no ADR-0043 action link and
+ * no raw action token, in any spelling. Messaging KEEPS this payload — verbatim
+ * on the `sys_notification` event row, and snapshotted onto every
+ * `sys_notification_delivery` row it enqueues — so anything in it is in the
+ * database for as long as those rows live. ADR-0043's storage axis is that the
+ * database holds no usable link (`sys_approval_token` stores digests only),
+ * and a raw link here is a usable link at rest. The shape is closed so that a
+ * call site handing one over does not compile; {@link ApprovalService.issueActionTokens}
+ * says where a raw token may travel instead.
  */
 type ApprovalNotificationPayload = {
   /** The headline. */
@@ -347,8 +356,6 @@ type ApprovalNotificationPayload = {
   readonly body: string;
   /** Where opening it lands; `notify()` narrows the approvals inbox to the request. */
   readonly actionUrl: string;
-  /** Approve / Reject links on a reminder to a concrete approver (ADR-0043). */
-  readonly actions?: ReadonlyArray<{ readonly label: string; readonly url: string }>;
 };
 
 /** Minimum time between submitter reminders on one request. */
@@ -3719,8 +3726,8 @@ export class ApprovalService implements IApprovalService {
     //    `onEmptyApprovers` decides that case, not this fan-out;
     //  - not an out-of-office DELEGATE, who was already told above by
     //    `approval.ooo_substituted` — one message per approver, not two.
-    // No one-tap decision links: ADR-0043 mints those on `remind()` only, and
-    // minting bearer tokens on every opening is a decision this does not make.
+    // No one-tap decision links: a notification payload is stored, and a raw
+    // ADR-0043 token in it is a usable link at rest (`ApprovalNotificationPayload`).
     //
     // [#23556] The body names the record by its object's label and its id —
     // `Deal D_123`, never `crm_deal/D_123` — so a grouped bell entry tells its
@@ -5204,39 +5211,37 @@ export class ApprovalService implements IApprovalService {
       actor_id: recordedActor(context), comment: input.comment ?? null, created_at: nowIso,
     }), { context: SYSTEM_CTX });
 
-    // Per-approver fan-out: concrete identities (user ids / emails) each get
-    // their OWN one-tap approve/reject links (ADR-0043); `position:*`-style
-    // literals can't carry a personal token and fall back to a plain nudge.
+    // Per-approver fan-out, the opening's shape (`approval.requested`): each
+    // concrete identity (a user id / an email) gets its own reminder;
+    // `position:*`-style literals go to the shared nudge below, which
+    // `notify()` drops — a slot address names no one.
     // [#23978] One name for every recipient, the form `approval.requested` uses.
+    //
+    // ⛔ [#24564] No one-tap decision link (ADR-0043) rides a reminder.
+    // Messaging stores the payload it is handed (`ApprovalNotificationPayload`),
+    // so a raw token there is a usable link in the database — the one thing
+    // ADR-0043's storage axis rules out. Nor would a link here reach the
+    // approver: a reminder names no channel, messaging's default materializes
+    // it in the in-app inbox, and the inbox row carries the title, the body and
+    // the deep link below, never links. The deep link is the approver's way in.
     const subject = this.nameSubjectRecord(raw.object_name, raw.record_id);
     let notified = 0;
     const concrete = pending.filter(a => a && !a.includes(':'));
     const literals = pending.filter(a => a && a.includes(':'));
     for (const approver of concrete) {
-      try {
-        const tokens = await this.issueActionTokens(requestId, approver);
-        notified += await this.notify({
-          topic: 'approval.reminder',
-          organizationId: raw.organization_id,
-          audience: [approver],
-          actorContext: context,
-          source: { object: 'sys_approval_request', id: requestId },
-          dedupKey: `approval-remind-${requestId}-${nowIso}-${approver}`,
-          payload: {
-            title: 'Approval reminder',
-            body: `A decision on ${subject} is still waiting on you.`,
-            actionUrl: '/system/approvals',
-            actions: [
-              { label: 'Approve', url: this.actionLinkUrl(tokens.approve) },
-              { label: 'Reject', url: this.actionLinkUrl(tokens.reject) },
-            ],
-          },
-        });
-      } catch (err: any) {
-        this.logger?.warn?.('[approvals] reminder with action links failed', {
-          request: requestId, approver, error: err?.message ?? String(err),
-        });
-      }
+      notified += await this.notify({
+        topic: 'approval.reminder',
+        organizationId: raw.organization_id,
+        audience: [approver],
+        actorContext: context,
+        source: { object: 'sys_approval_request', id: requestId },
+        dedupKey: `approval-remind-${requestId}-${nowIso}-${approver}`,
+        payload: {
+          title: 'Approval reminder',
+          body: `A decision on ${subject} is still waiting on you.`,
+          actionUrl: '/system/approvals',
+        },
+      });
     }
     if (literals.length) {
       notified += await this.notify({
@@ -5269,6 +5274,13 @@ export class ApprovalService implements IApprovalService {
    * Issue one-tap approve/reject tokens for one approver on one pending
    * request. Raw tokens are returned ONCE; only SHA-256 hashes are stored
    * (`sys_approval_token`), so a DB leak yields no usable links.
+   *
+   * ⛔ [#24564] That guarantee holds only as far as the CALLER keeps it: a raw
+   * token — or an {@link actionLinkUrl} built from one — is never written to a
+   * persisted row. Not a notification payload (messaging stores those, see
+   * `ApprovalNotificationPayload`), not an audit row, not a log line. It may
+   * travel only in a message that is sent and not kept. No notification this
+   * service sends carries one, so no first-party path calls this today.
    */
   async issueActionTokens(
     requestId: string,
@@ -5423,15 +5435,15 @@ export class ApprovalService implements IApprovalService {
    * vouch for on the decision's context — or `null` when no person can be
    * named without guessing.
    *
-   * Tokens are minted for concrete slots only (`remind`'s fan-out), so the
-   * slot is a user id or an email:
+   * A token binds the slot `issueActionTokens` minted it for, normally a
+   * concrete one — a user id or an email:
    *
    *   - a user id IS the person;
    *   - an email names the ONE account carrying exactly that email — the same
    *     proof `resolveActor` takes for a named email, and the recipient
    *     resolver's own rule for delivering to it. No account, or more than one,
    *     names nobody;
-   *   - a `type:value` literal names no person (no first-party path mints one).
+   *   - a `type:value` literal names no person.
    *
    * Before this the slot itself went on the context, so an email-bound link
    * recorded the email as the acting user — on the action row and in the