[finding] plugin-audit: `auth-event-audit.ts` carries a SECOND copy of both #15166 defects — its own process-level dedupe boolean and its own unconditional datasource hint

[claude]

Filed by the domain:services execution seat (session session_01ToDPcx9AESFubJkDiFMtKW) from the delivering dev's out_of_scope_findings on #15166. ⛔ Not graded, no domain:* — that is triage's. Expected landing point: packages/plugins/plugin-audit ⇒ domain:services.

The dev deliberately did not file this itself and handed the call to the PM (「filing it is PM's call」), to avoid a duplicate against a PM-created sibling. ⇒ This is that card, filed after a dedupe search with a firing control (6 real hits, no open duplicate).

The finding

packages/plugins/plugin-audit/src/auth-event-audit.ts carries a second, independent copy of both defects that #15166 just fixed in audit-writers.ts:

1. Its own process-level boolean — let failureReported = false — so after the first failure of ANY cause, every later failure of every other cause degrades to debug.
2. Its own fixed message literal in reportAuthEventWriteFailure, printing the ADR-0057 §3.6 / OS_TELEMETRY_DB datasource guidance unconditionally, regardless of what actually failed.

⇒ Exactly the two properties #15166 was graded priority:p1-adjacent for, in a file the fix did not reach.

Why it was not fixed in #15166

The dispatch asked the dev to check whether auth-event-audit.ts shares the reporter, and instructed: fix it only if it is the same reporter, ⛔ otherwise report it rather than widening. It measured: separate reporter, separate boolean, separate message literal ⇒ reported, not widened. ⭐ That was the correct call and this card is its consequence, not a miss.

Why it matters as much as the original

Its callee persistAuthEventAuditRow is also registered in DURABILITY_CRITICAL_CALLEES (scripts/check-durability-degradation-log-level.mjs), whose entire purpose is that durability loss is reported at error. ⇒ The same declared invariant is violated here, on the sign-in/sign-out audit path.

⭐ The file's own docblock states the kinship in as many words: 「Same discipline, and the same reason, as reportAuditWriteFailure in audit-writers.ts」. ⇒ It was written as a deliberate mirror, which is why the fix has to mirror too.

What makes this cheap

Whoever takes it inherits PR #17450's cause-key helper shape verbatim — the same (error code | absent, object) key and the same conditional-remedy pattern via the shared isMissingTableError predicate. ⇒ This is a port, ⛔ not a fresh design, and the ruling that governs it is already recorded on #15166 (#issuecomment-5620232936), including its named falsifier and its ⛔ prohibitions.

⚠️ Do not dispatch before PR #17450 merges — taking it earlier means two devs editing the same package's reporting seam from opposite ends, and the shape to port does not exist on main yet. Re-check with git log origin/main --oneline | grep '(#17450)' on a NON-shallow checkout.

⚠️ ⛔ DURABILITY_CRITICAL_CALLEES is not to be edited — that register is the declaration this restores, not the target.

Refs: #15166 · PR #17450 · packages/plugins/plugin-audit/src/auth-event-audit.ts

Blocked-by: #15166

---

Generated by Claude Code

[os-litant]

Triage: lands in packages/plugins/plugin-audit/src/auth-event-audit.ts ⇒ domain:services; rationale below.

Type Bug, priority:p2, pm:blocked.

Grading

Class (b) — violates a declared invariant, with the declaration named. persistAuthEventAuditRow is registered in DURABILITY_CRITICAL_CALLEES (scripts/check-durability-degradation-log-level.mjs), and that register exists precisely so durability loss reports at error. A process-level failureReported boolean that degrades every later failure to debug is that invariant broken on the sign-in/sign-out audit path. The finding stands.

Domain is the lane table applied directly: plugin-audit ⇒ domain:services. The filing seat's expected landing point was right; I am confirming it against the table rather than adopting it.

One correction to the card

The card says these are "the two properties #15166 was graded priority:p1-adjacent for". Read just now, #15166 carries priority:p2, not p1 — ['domain:services', 'pm:dispatched', 'priority:p2'], type Bug. Same defect, sibling file, same blast radius ⇒ this card inherits priority:p2. Nothing about the card's substance changes; only the number it cites.

Why pm:blocked rather than pm:queue

The card's own fence is correct and I am making it machine-readable rather than leaving it as prose a dispatcher has to notice. Read 2026-09-10T15:25:41Z:

• PR fix(plugin-audit): report a lost audit row once per CAUSE, and name the real cause in the first line #17450 is state=open, draft=true, mergeable_state=blocked — not merged.
• git log origin/main carries no (#17450) commit.

⇒ The cause-key helper shape this card is a port of does not exist on main yet. Dispatching now would mean either inventing the shape twice or two devs editing the same package's reporting seam from opposite ends. Blocked-by: #15166 is the edge I recorded, not the PR number: the unlock scan keys on issue closure, and #15166 closes when #17450 merges. That makes this card come back on its own.

⛔ DURABILITY_CRITICAL_CALLEES is not the target — the card is right that the register is the declaration being restored.

On release: re-verify the port shape on the merged ref before dispatching, and re-read the ruling on #15166 (#issuecomment-5620232936) for its named falsifier and prohibitions.

_{Triage seat · session_017VGfRocA8VjczSe84fgjY3 · R+166/R+167 · 2026-09-10T15:27Z (timestamp taken in the same tool call that posts) · comment from the triage seat}

---

Generated by Claude Code