@@ -11,7 +11,9 @@ fix(objectql, plugin-auth)!: deleting an organization that still owns records is
 
 - An organization that still owns records is refused with `409` and the standard `DELETE_RESTRICTED` code. The body names each table and its row count, `dependents: [{ object, count }]`, and never a row's values. The refusal runs before better-auth's handler, so nothing is written, the caller's active organization included. A caller the organization does not let delete it still gets better-auth's own `403`, with no count.
 - Append-only ledgers (objects declared `managedBy: 'append-only'`, such as `sys_activity`, `sys_audit_log` and `sys_email`) are history, not records. They never refuse the delete, and their rows are kept: every reference they hold to the organization (`organization_id` on `sys_activity` and `sys_email`, the attribution `tenant_id` on `sys_audit_log`) goes on naming the deleted organization, never NULL and never deleted. The delete writes activity rows of its own, so counting them would refuse every delete.
-- An attribution column `organization_id` on an object whose tenancy is disabled (such as `sys_approval_request`, an engine-owned row an administrator cannot delete) is kept the same way: not counted, not cleared. A pointer to the organization, such as a session's or an API key's `active_organization_id`, is cleared as before.
+- Engine-owned rows (objects declared `managedBy: 'engine-owned'`) are treated the same way. The platform writes them as a consequence of records or activity, and an administrator cannot delete them over the data API: approval requests, approvers and tokens; automation runs; notifications, their receipts and deliveries; outgoing HTTP deliveries; mailboxes and mirrored mail; record shares and share links; import jobs; audience-binding suggestions; and organization-level settings values and their audit. They never refuse the delete, and they are kept, still naming the deleted organization.
+- So engine-owned and append-only rows outlive the organization, and go on naming it. Under tenant scoping no organization reads them.
+- An attribution column `organization_id` on an object whose tenancy is disabled is kept the same way: not counted, not cleared. A pointer to the organization, such as a session's or an API key's `active_organization_id`, is cleared as before.
 - An organization that owns nothing but its own auth structure is deleted whole: its members and invitations (better-auth), and its teams, their members and the organization-admin grants its owners and admins hold (plugin-auth, from `beforeDeleteOrganization`). Any other grant scoped to the organization counts as a record.
 - The request runs as one engine transaction and rolls back on any error answer, so a delete either removes all of that or none of it. On a datasource whose driver has no transactions, the refusals are the guarantee, because both run before the first write: the record count above, and, for the Default Organization, the last-administrator guard, whose `403` is now asked before better-auth deletes any member (it used to arrive after the members and invitations were gone).
 - Under all of this, the engine itself refuses to delete a `sys_organization` row while any row still names it in its tenant column, whatever path reaches the delete: `409 DELETE_RESTRICTED` with the same `dependents` list, which better-auth's door now carries to the wire too. It counts each table rather than reading its rows. An organization is deleted by id only: a delete matching organizations by a filter (`multi: true`) is refused with `409 DELETE_RESTRICTED` naming the by-id route, because only the by-id delete runs this referential pass. A tenant column is never set to NULL.
@@ -25,6 +27,6 @@ Clause-②: yes (narrowing)
 
 - **FROM:** deleting an organization that still owned records answered `500` after deleting its members and invitations (tenant column NOT NULL), or `200` with its teams and records orphaned to `organization_id = NULL` (tenant column nullable, an 18.0.0-born database). A direct engine delete of such a `sys_organization` row did the same.
 - **TO:** both answer `409 DELETE_RESTRICTED`, with `dependents: [{ object, count }]` naming every table that still holds rows. Nothing is deleted or changed.
-- **Fix:** delete the organization's records, or move them to another organization, then delete the organization. The refusal names the tables to look at. Business units, positions, sharing rules and organization-level settings count as records; activity, audit and mail-log rows do not.
+- **Fix:** delete the organization's records, or move them to another organization, then delete the organization. The refusal names the tables to look at. Business units, positions and sharing rules count as records. Activity, audit and mail-log rows do not, nor do engine-owned rows (approval state, runs, deliveries, shares, settings values).
 - **Seed datasets:** on a composition with the organizations runtime (`@objectstack/organizations`) and an app that ships seed datasets, a new organization receives that seed replay at creation, so it owns records from its first moment and its delete is refused until they are removed. The refusal lists them. Delete them (or move them) like any other records, then delete the organization. Measured on the showcase: a fresh organization owns 132 seeded rows in 19 tables.
 - **Already orphaned on 18.0.0?** Rows an earlier organization delete set to `organization_id = NULL` are not touched by this release. Organization-less rows are what the v18 organization-ownership ceremony (`os migrate organization-ownership`) attributes or reports.
@@ -170,7 +170,7 @@ const AUDIT_LIKE = {
   },
 };
 
-/** Tenancy disabled, with an `organization_id` attribution column (`sys_approval_request`). */
+/** Tenancy disabled, with an `organization_id` attribution column (the closed rule of seat decision 6305996369, B5). */
 const REQUEST_LIKE = {
   name: 'request_like',
   label: 'Request',
@@ -181,6 +181,28 @@ const REQUEST_LIKE = {
   },
 };
 
+/**
+ * An engine-owned object with a tenant column (`sys_approval_request`): the
+ * platform writes its rows, an administrator cannot delete them, and they
+ * outlive the organization (seat decision 6307135388).
+ */
+const APPROVAL_LIKE = {
+  name: 'approval_like',
+  label: 'Approval request',
+  managedBy: 'engine-owned' as const,
+  fields: { status: { name: 'status', label: 'Status', type: 'text' as const } },
+};
+/** Its actions: an append-only ledger (`sys_approval_action`). */
+const APPROVAL_ACTION_LIKE = {
+  name: 'approval_action_like',
+  label: 'Approval action',
+  managedBy: 'append-only' as const,
+  fields: {
+    request_id: { name: 'request_id', label: 'Request', type: 'lookup' as const, reference: 'approval_like' },
+    action: { name: 'action', label: 'Action', type: 'text' as const },
+  },
+};
+
 async function makeEngine(objects: any[]) {
   const engine = new ObjectQL({ logger: { debug() {}, info() {}, warn() {}, error() {} } } as any);
   const store = makeDriver();
@@ -304,6 +326,43 @@ describe('[#24948] an append-only ledger neither refuses the delete nor is clear
   });
 });
 
+describe('[#24948] an engine-owned object neither refuses the delete nor is cleared by it (seat decision 6307135388)', () => {
+  const seedApproval = (store: ReturnType<typeof makeDriver>) => {
+    store.seed('approval_like', { id: 'ar1', status: 'approved', organization_id: ORG_ID });
+    store.seed('approval_action_like', { id: 'aa1', request_id: 'ar1', action: 'submit', organization_id: ORG_ID });
+    store.seed('approval_action_like', { id: 'aa2', request_id: 'ar1', action: 'approve', organization_id: ORG_ID });
+  };
+
+  it('deletes an organization whose only rows are an approval request and its actions, and keeps them naming it', async () => {
+    const { engine, store } = await makeEngine([ORGANIZATION, ACCOUNT, APPROVAL_LIKE, APPROVAL_ACTION_LIKE]);
+    seedApproval(store);
+    expect(await engine.organizationOwnedRowCounts(ORG_ID)).toEqual([]);
+
+    expect(await deleteOrg(engine)).toBeNull();
+
+    expect(store.rows('sys_organization').map((r) => r.id)).toEqual([OTHER_ORG]);
+    // Kept, and still naming the deleted organization: never NULL, never deleted.
+    expect(store.rows('approval_like').map((r) => [r.id, r.organization_id])).toEqual([['ar1', ORG_ID]]);
+    expect(store.rows('approval_action_like').map((r) => [r.id, r.request_id, r.organization_id])).toEqual([
+      ['aa1', 'ar1', ORG_ID],
+      ['aa2', 'ar1', ORG_ID],
+    ]);
+    expect(store.writes.filter((w) => w.includes('approval_'))).toEqual([]);
+  });
+
+  it('CONTROL: beside them, a record still refuses, and only the record is named', async () => {
+    const { engine, store } = await makeEngine([ORGANIZATION, ACCOUNT, APPROVAL_LIKE, APPROVAL_ACTION_LIKE]);
+    seedApproval(store);
+    store.seed('acct', { id: 'a1', organization_id: ORG_ID });
+
+    const err = await deleteOrg(engine);
+
+    expect(err?.code).toBe('DELETE_RESTRICTED');
+    expect(err?.dependents).toEqual([{ object: 'acct', count: 1 }]);
+    expect(store.writes).toEqual([]);
+  });
+});
+
 describe('[#24948] references the delete keeps as they are (seat decision 6305996369)', () => {
   it("an append-only ledger's non-tenant lookup keeps naming the deleted organization", async () => {
     const { engine, store } = await makeEngine([ORGANIZATION, AUDIT_LIKE]);
 
@@ -20018,45 +20018,52 @@ export class ObjectQL implements IObjectQLEngine {
   }
 
   /**
-   * [#24948] Is `child` an append-only ledger, whose rows outlive the
-   * organization they name? Read from the declaration the object already
-   * carries, `managedBy: 'append-only'` (the audit bucket: `sys_activity`,
-   * `sys_audit_log`, `sys_email` and their siblings), never from a list of
-   * names.
+   * [#24948] Do `child`'s rows outlive the organization they name? Read from
+   * the declaration the object already carries, never from a list of names:
    *
-   * Such a row is history, not a record an administrator manages: it ages out
-   * on its own retention, or is the delivery log of something that already
-   * happened. The organization delete itself writes `sys_activity` rows, so a
-   * ledger that counted would refuse every organization delete, the empty ones
-   * included. Neither refusal counts a ledger. Its rows are kept, and so is
-   * their tenant column: it goes on naming the deleted organization, never
-   * NULL (ADR-0131 D1) and never deleted (ADR-0131 §8), and under tenant
-   * scoping the rows read as no organization's (seat decision 6305179819).
+   *   - `managedBy: 'append-only'`, a ledger (the audit bucket: `sys_activity`,
+   *     `sys_audit_log`, `sys_email` and their siblings). Such a row is history:
+   *     it ages out on its own retention, or is the delivery log of something
+   *     that already happened. The organization delete itself writes
+   *     `sys_activity` rows, so a ledger that counted would refuse every
+   *     organization delete, the empty ones included (seat decision 6305179819).
+   *   - `managedBy: 'engine-owned'`, a row the platform writes as a consequence
+   *     of records or activity (approval state, automation runs, notification
+   *     and HTTP deliveries, mirrored mail, record shares, import jobs,
+   *     settings values), which an administrator cannot delete over the data
+   *     API. Counting it would make any organization that has been used
+   *     undeletable through every door (seat decision 6307135388).
+   *
+   * Neither refusal counts such a row. It is kept, and so is every reference it
+   * holds to the organization: it goes on naming the deleted organization,
+   * never NULL (ADR-0131 D1) and never deleted (ADR-0131 §8), and under tenant
+   * scoping the row reads as no organization's.
    */
-  private static isAppendOnlyLedger(child: ServiceObject): boolean {
-    return (child as { managedBy?: unknown })?.managedBy === 'append-only';
+  private static outlivesOrganization(child: ServiceObject): boolean {
+    const managedBy = (child as { managedBy?: unknown })?.managedBy;
+    return managedBy === 'append-only' || managedBy === 'engine-owned';
   }
 
   /**
    * [#24948] Does an organization delete keep `child.fieldName`, a `set_null`
    * lookup into `sys_organization` that is not `child`'s tenant column, as it
-   * is? Two kinds of reference, and only these (seat decisions 6305179819 and
-   * 6305996369):
+   * is? Two kinds of reference, and only these (seat decisions 6305179819,
+   * 6305996369 and 6307135388):
    *
-   *   - every such lookup on an append-only ledger ({@link isAppendOnlyLedger}):
-   *     `sys_audit_log.tenant_id` is the audit log's attribution, not its tenant
-   *     column, and history outlives what it audits;
+   *   - every such lookup on an object whose rows outlive the organization
+   *     ({@link outlivesOrganization}): `sys_audit_log.tenant_id` is the audit
+   *     log's attribution, not its tenant column, and history outlives what it
+   *     audits;
    *   - an attribution column named `organization_id` on an object whose
-   *     tenancy is disabled (`resolveTenantFieldName` answers null), such as
-   *     `sys_approval_request`: an engine-owned row an administrator cannot
-   *     delete, so it is neither counted nor cleared.
+   *     tenancy is disabled (`resolveTenantFieldName` answers null): neither
+   *     counted nor cleared. No object in this tree declares one today.
    *
    * Everything else keeps its `set_null`: a pointer such as a session's or an
    * API key's `active_organization_id`, or a parent-organization lookup, is
    * cleared exactly as before.
    */
   private static keepsOrganizationReference(child: ServiceObject, fieldName: string): boolean {
-    if (ObjectQL.isAppendOnlyLedger(child)) return true;
+    if (ObjectQL.outlivesOrganization(child)) return true;
     return fieldName === SystemFieldName.ORGANIZATION_ID && resolveTenantFieldName(child) === null;
   }
 
@@ -20115,7 +20122,7 @@ export class ObjectQL implements IObjectQLEngine {
   /**
    * [#24948] The engine half of organization delete: refuse while any row
    * outside the cascade set still names the organization in its tenant column,
-   * an append-only ledger's excepted ({@link isAppendOnlyLedger}).
+   * a row that outlives the organization excepted ({@link outlivesOrganization}).
    *
    * Runs before the walk touches the first relation, and reads every tenant
    * relation before it throws, so the one refusal names every table that holds
@@ -20143,8 +20150,8 @@ export class ObjectQL implements IObjectQLEngine {
     for (const child of objects) {
       const childName = (child as any)?.name as string | undefined;
       const fields = (child as any)?.fields as Record<string, any> | undefined;
-      // An append-only ledger's rows outlive the organization: not counted, kept as they are.
-      if (!childName || !fields || ObjectQL.isAppendOnlyLedger(child)) continue;
+      // An append-only or engine-owned object's rows outlive the organization: not counted, kept as they are.
+      if (!childName || !fields || ObjectQL.outlivesOrganization(child)) continue;
       for (const [fieldName, fdef] of Object.entries(fields)) {
         const behavior = this.cascadeRelationBehavior(ORGANIZATION_OBJECT, child, fieldName, fdef);
         if (!this.isTenantColumnSetNull(ORGANIZATION_OBJECT, child, fieldName, behavior)) continue;
@@ -20194,8 +20201,8 @@ export class ObjectQL implements IObjectQLEngine {
    * row.
    *
    * `exclude` names the objects the caller removes as part of the delete
-   * itself. An append-only ledger is never counted ({@link isAppendOnlyLedger}),
-   * the same set the engine's own refusal leaves out.
+   * itself. An append-only or engine-owned object is never counted ({@link
+   * outlivesOrganization}), the same set the engine's own refusal leaves out.
    */
   async organizationOwnedRowCounts(
     organizationId: string,
@@ -20206,7 +20213,7 @@ export class ObjectQL implements IObjectQLEngine {
     for (const child of this._registry.getAllObjects()) {
       const childName = (child as any)?.name as string | undefined;
       const fields = (child as any)?.fields as Record<string, any> | undefined;
-      if (!childName || !fields || exclude.has(childName) || ObjectQL.isAppendOnlyLedger(child)) continue;
+      if (!childName || !fields || exclude.has(childName) || ObjectQL.outlivesOrganization(child)) continue;
       const tenantField = resolveTenantFieldName(child);
       if (!tenantField || !fields[tenantField]) continue;
       const fdef = fields[tenantField];
 
@@ -25,10 +25,12 @@
  * 1. **Refused while the organization owns records.** {@link
  *    organizationDeleteRefusal} counts, per table, the rows that name the
  *    organization in their tenant column, leaving out the organization's own
- *    auth structure and every append-only ledger (`managedBy: 'append-only'`:
- *    `sys_activity`, `sys_email` and their siblings), whose rows are history,
- *    are kept, and go on naming the deleted organization (seat decision
- *    6305179819; the engine reads the same set). Any count above zero refuses with 409
+ *    auth structure and every object declared `managedBy: 'append-only'`
+ *    (ledgers: `sys_activity`, `sys_email` and their siblings) or
+ *    `managedBy: 'engine-owned'` (rows the platform writes: approval state,
+ *    runs, deliveries, shares), whose rows are kept and go on naming the
+ *    deleted organization (seat decisions 6305179819 and 6307135388; the
+ *    engine reads the same set). Any count above zero refuses with 409
  *    `DELETE_RESTRICTED` and `dependents: [{ object, count }]`: counts, never a
  *    row value. It runs in `hooks.before`, ahead of the vendor's handler, and
  *    only for a caller the vendor itself would admit (a member holding the