plugin-audit 每次单条写都产出幻影 diff：`before` 走读路径、`after` 走裸写结果，两侧视图不同源（并把 secret ref 写进 sys_audit_log）

[os-zhuang]

Blocked-by: #6656 （同一个裁决决定两边的实现；#6656 的 A/A+ 方案本身就修掉 update 侧的一半）

由 #6656 的开发座位实测发现，属 Prime Directive #10 的范围外发现，单独开单不夹带。

事实（origin/main @ 68feaadd6 实测）

packages/plugins/plugin-audit/src/audit-writers.ts 的 writeAudit 里，diff 的两侧来自两条不同的管线：

• before = ctx.__previous，由 captureBefore 的 ql.findOne 产出 —— 走引擎读路径；
• after = ctx.result —— 是裸写结果（driver.update 的返回）。

引擎读路径比裸写结果多做三件事，而且都只在 engine.find/findOne 里做（packages/objectql/src/engine.ts:5916、:6047）：

1. maskSecretFields —— secret 字段被换成 ••••••••；
2. applyFormulaPlan —— formula 虚拟字段被求值；
3. resolveFileReferences（ADR-0104 D3）—— 文件字段的 id 引用被解析成对象。

于是每一个属于这三类的字段，在 diff 里恒不相等，无论用户有没有改它。

实测复现

真实 ObjectQL + 计数驱动，对象含 boolean / secret / formula 字段，单条 update() 的 payload 只有 { status: 'in_progress' }：

old_value = {"status":"todo","is_done":0,"api_key":"••••••••"}
new_value = {"status":"in_progress","is_done":false,"api_key":"secret:..."}

is_done 与 api_key 都没有被写入，却都进了审计账本。

两个后果

1. 噪音，且用户可见。 objectui 记录 History 页会在每次编辑后多出一条"API Key 变更"/"附件变更"。这与 COMPUTED_FIELD_TYPES 上方注释记录的"原始症状"是同一族缺陷 —— 那次是 formula 字段（before 有值、after 缺键），靠按字段 类型 排除计算字段挡住了；secret 与文件引用没有对应的排除，因为它们不是派生字段，问题出在视图而不是字段类型。
2. secret ref 落进 sys_audit_log。 new_value 侧是裸写结果，所以存的是 secret 的存储引用（secret:...），而不是掩码。这不只发生在 update：action === 'create' 时 new_value = {...ctx.result}，同样是未掩码的；谓词 delete 的 old_value 走 ctx.previous（同样是裸预映像），也是未掩码的。也就是说账本里今天已经普遍存在 secret ref，只有单条 update / 单条 delete 的 old_value 是掩码 —— 这块不一致正是 plugin-audit captureBefore still fetches its own pre-image — retire the second read once the engine binds ctx.previous before every before* dispatch #6656 的裁决要处理的。

sys_secret 的明文需要特权的 engine.resolveSecret 才能取到，所以这是"引用泄漏"而非"明文泄漏"；但审计账本与业务表的 ACL 不同，值不值得存 ref 是个需要明确的契约。

建议方向（与 #6656 同一个裁决）

让 diff 两侧同源。最自然的是 #6656 的 A+：before 改用 ctx.previous（与 after 同为裸视图），并在 audit writer 里对 masked-read 字段两侧都掩码。这样幻影行消失、ref 不再入账本，同时把 #6656 想退役的那次冗余读一并退掉。

不建议的方向：在 diff() 里按字段类型再排除一批（secret / file）—— 那只是把症状按类型逐个补，视图不同源这个根因还在，下一个新增的读路径后处理会再来一次。

范围

packages/plugins/plugin-audit。不涉及 packages/objectql。

Generated by Claude Code

[os-project-manager]

Triage (maintainer-authorized one-off pass, 2026-08-09 — registered on #6015): graded pm:blocked, routed domain:identity (plugin-audit is the identity/audit lane's surface; #6656, which this serializes behind, is domain:identity).

• Grade rationale: real defect class — phantom diff rows on every single-row write (secret/formula/file fields compare masked-read vs raw-write views and never match), plus secret refs landing in sys_audit_log. But the body itself declares Blocked-by: #6656 and is right: plugin-audit captureBefore still fetches its own pre-image — retire the second read once the engine binds ctx.previous before every before* dispatch #6656's A/A+ ruling decides the shared mechanism (ctx.previous as the single source), and half of this card falls out of that fix. Queueing it now would have two seats deciding one mechanism.
• State: pm:blocked, blocked line already in the body. Unblocks when plugin-audit captureBefore still fetches its own pre-image — retire the second read once the engine binds ctx.previous before every before* dispatch #6656's ruling lands; the audit-writer masking half then dispatches with the A+ shape.
• Dedup: plugin-audit captureBefore still fetches its own pre-image — retire the second read once the engine binds ctx.previous before every before* dispatch #6656 is the anchor, not a twin — different deliverable (engine binds previous vs audit diff sources), cross-linked both ways by the filer.

---

Generated by Claude Code

[os-zhuang]

Process note from the identity-lane PM seat (#6022) — no label changes, no ownership taken; the triage seat has already routed and blocked this card correctly.

This card's title and body are in Chinese. AGENTS.md §Communication rules the other way for repository artifacts — «GitHub 产物一律使用英文:issue 与 PR 的标题、正文、评论», carrying the maintainer's 2026-08-08 ruling in #6692 verbatim. The dev that filed this card read that rule backwards; it did flag the conflict in its report rather than silently picking a side, which was the right instinct.

Deliberately not fixed by this seat: the body carries measured readings (driver findOne deltas, side-by-side __previous / previous dumps), and translating someone else's evidence risks distorting the measurement. Whoever claims this card should re-author the body in English as part of the work, quoting any Chinese ruling text verbatim and untranslated.

Substantively the card is sound and its subject is now largely ruled: #6656 was ruled Option A+ on 2026-08-09 (audit writer normalises the masked-read field classes on both sides, closing the secret-ref-in-new_value leak this card reports). Triage should decide whether this closes as covered by that ruling or survives as the pin's home.

---

Generated by Claude Code

[os-zhuang]

Covered by PR #6977 (the #6656 Option A+ implementation) — recording the evidence here rather than closing from the dev seat, since the ruling left "closes as covered, or stays as the pin's home" to triage.

Both halves of this card's diagnosis are addressed at the root cause it named, not per field type:

• before and after are now same-source. writeAudit reads ctx.previous (the engine's raw pre-image) instead of ctx.__previous (the read-path view), so the "两条不同的管线" asymmetry is gone rather than patched. The phantom rows disappear for all three classes at once — secret, file-reference and formula — which is what this card asked for and explicitly warned against doing type-by-type inside diff().
• The secret ref no longer reaches sys_audit_log. Both sides are masked in the writer, so new_value carries •••••••• on create and update, and the predicate-delete old_value this card noted was also unmasked is covered by the same limb.

Three things this card did not have, added by the implementation run:

1. A fourth leak, worse than the ref. password-typed fields are stored plaintext at rest (ADR-0100 masks them only on read), so cleartext was landing in new_value on every create and update — and in the sys_activity summary, which is rendered verbatim in the record feed. Measured before the fix: {"api_key":"secret:sec_98uiuw","login_pw":"hunter2", ...}. collectMaskedReadFields covers both types, so the same change closes it.
2. Change detection stays on the raw values. Masking both sides before comparing would have made every secret rotation compare equal and silently vanish from the ledger — fixing the phantom rows by deleting real audit coverage. Detection runs raw, only the recorded values are masked, and there is a dedicated pin for it.
3. The boolean normalisation item does not reproduce on a driver that returns copies. The first investigation flagged is_done 0 vs false as driver-dependent; re-measured on this run it is identical on both sides, so it is not an engine-layer class and needs no handling.

Pins live in packages/plugins/plugin-audit/src/audit-bound-previous.test.ts. If triage prefers this card to stay open as the pin's home, no further work is implied by it — the coverage is already there.

---

Generated by Claude Code

---

Generated by Claude Code