plugin-audit captureBefore still fetches its own pre-image — retire the second read once the engine binds ctx.previous before every before* dispatch

[os-zhuang]

Part of #5846 (the retirement its (a) half makes possible). Filed by the engine-core seat per multi-repo rule 3 (linkage chores are issues, not memory) at dispatch time of the #5574+#5846 engine half.

Blocked-by: #5574
Blocked-by: #5846

Fact (origin/main at filing)

packages/plugins/plugin-audit/src/audit-writers.ts — captureBefore (registered on beforeUpdate / beforeDelete) performs its own ql.findOne for the target id and stores the row on ctx.__previous. Its own comment states the reason: "HookContext.previous 官方有类型但引擎不总是填" (the engine does not always fill it).

That justification is expiring:

• delete side: since 单记录 delete 从不绑定 hookContext.previous —— 契约声明「for update/delete」,引擎只在 update 分支赋值;#5038 之后批量 delete 反而比单记录 delete 更完整 #5272 the engine reads the prior row BEFORE dispatching beforeDelete and binds previous;
• update side: the in-flight engine half of beforeUpdate hook 在 multi:true 批量更新上拿不到 ctx.previous —— sys_fetch_previous_update 依赖 input.id;引擎已为校验取 priorRows 却不喂 hook(17.0.0-rc.2) #5574 + 单 id update 把同一行前置状态读了 3 次(engine 前置行门 + sys_fetch_previous_update + plugin-audit captureBefore),且后两次不受任何按对象需求门约束 #5846 (branch claude/issue-5574-bulk-before-per-row) moves the update-side prior read ahead of beforeUpdate and binds previous on both the single-id and predicate paths, retiring sys_fetch_previous_update.

Once that lands, captureBefore's fetch is a per-write redundant engine read (full read pipeline: middleware, RLS, field masking) that no consumer needs.

Scope

Make captureBefore consume ctx.previous when bound (or retire the fetch entirely if the engine guarantee covers every registered case — claimant judges by code, not by this card). Audit output must stay byte-identical. Pin with a test that a single-id update() on an audited kernel performs no additional engine read beyond the engine's own bound one — and measure the delete side too (bound since #5272).

Non-scope

• The registration-face exclusion work is DONE (plugin-audit 的 5 个 hook 全部无 object 注册 ⇒ 引擎「按对象」需求门(#5284 单 id / #5038 批量)在 audit 启用时恒真 #5860 closed 2026-08-08 via the hook 注册契约只能表达「命中这些对象」,无法表达「全局但排除这些对象」—— #5860 因此在 plugin-audit 内无法落地 #5928 excludeObjects contract) — do not reopen it.
• The objectql builtin family (sys_fetch_previous_delete) is delete() 的按对象前置行门在任何 kernel 托管引擎上恒真 —— ObjectQLPlugin 自带的 sys_fetch_previous_delete 以 object: '*' 注册在 beforeDelete #5929 (engine-core lane).

Routing

Lands in packages/plugins/plugin-audit ⇒ expected domain:identity; routing label left to the triage seat (single-producer rule).

Refs: #5846 (source), #5272, #5574, #5860 (closed), #5929.

[os-zhuang]

Triage: domain:identity + pm:queue → pm:blocked (grade swap, not a demotion).

• Routing: fix lands in packages/plugins/plugin-audit (audit-writers.ts — captureBefore verified at :540 on origin/main @ 04476e7, still doing its own findOne + __previous stash) ⇒ domain:identity, matching the card's own routing note.
• State: body carries Blocked-by: #5574 and Blocked-by: #5846, both open and in flight (pm:dispatched) — a card whose premise ("the engine binds ctx.previous before every before* dispatch") is not yet true on main is pm:blocked, not dispatchable. The unlock sweep returns it when the engine half merges; re-verify the update-side binding on the merged ref then (the delete side is already bound since 单记录 delete 从不绑定 hookContext.previous —— 契约声明「for update/delete」,引擎只在 update 分支赋值;#5038 之后批量 delete 反而比单记录 delete 更完整 #5272).
• Dedup: distinct from delete() 的按对象前置行门在任何 kernel 托管引擎上恒真 —— ObjectQLPlugin 自带的 sys_fetch_previous_delete 以 object: '*' 注册在 beforeDelete #5929 (objectql builtin family, engine-core lane) and plugin-audit 的 5 个 hook 全部无 object 注册 ⇒ 引擎「按对象」需求门(#5284 单 id / #5038 批量)在 audit 启用时恒真 #5860 (closed) as the card itself records.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code