After #6656 retires `captureBefore`, the `ctx.__previous` stash has no producer left — a dead fallback limb in trigger-record-change kept alive by its own fixture, plus four stale comments

[os-zhuang]

Observation-class finding from the #6656 dev seat (PR #6977). Nothing a user hits today — dormant code and stale prose — so it carries finding and no pm:queue, per the filing discipline. Filed unassigned; routing left to triage.

Blocked-by: #6656 (the retirement is what creates both items; neither is actionable before it lands).

Fact

plugin-audit's captureBefore was the only producer of ctx.__previous in the repo. PR #6977 retires it. Measured on that branch after the change:

$ grep -rn "__previous\s*=" --include=*.ts packages apps | grep -v node_modules
packages/triggers/trigger-record-change/src/record-change-trigger.test.ts:362:
    (ctx as unknown as { __previous: Record[string, unknown] }).__previous = { status: 'old' };

$ grep -rn "\.__previous\b" --include=*.ts packages apps | grep -v node_modules | grep -v "__previous\s*="
packages/triggers/trigger-record-change/src/record-change-trigger.ts:299:
    ((ctx as unknown as { __previous?: Record[string, unknown] }).__previous ?? undefined);

(Generic brackets softened above so the issue sanitizer does not eat them.)

So the one surviving producer is a test fixture that writes the key itself, and the one surviving consumer is the fallback limb that fixture exists to exercise.

Item 1 — the dead limb (the only code item)

packages/triggers/trigger-record-change/src/record-change-trigger.ts:299:

const previous =
    (ctx.previous as Record[string, unknown] | undefined) ??
    ((ctx as unknown as { __previous?: Record[string, unknown] }).__previous ?? undefined);

Canonical key first, so this is the inverted reverse-verification family, not the usual one: deleting the limb changes nothing that any engine path can produce, and every existing test stays green — because record-change-trigger.test.ts:352 ("reads the __previous stash when ctx.previous is absent") synthesises the key in the test body. That is the #4984 shape exactly: a fixture spelling a key no producer emits, keeping a dead limb looking live and making the limb's deletion invisible to every gate.

Suggested disposition under ADR-0049 enforce-or-remove: delete the limb and the fixture that feeds it. The doc comment two lines up ("with the __previous stash audit also uses as a fallback") goes with them.

Item 2 — four comments that assert something no longer true

None of these change behaviour; all four will read as current fact to the next author, which is the mechanism Prime Directive #13 names ("the file being edited never named the ADRs that governed it") and that #6966 is a live instance of.

file	what it says	why it is stale after #6656
packages/objectql/src/engine.ts:7842	enumerates plugin-audit captureBefore / writeAudit before+afterDelete among the hooks holding the delete pre-image gate open	plugin-audit registers no beforeDelete hook now; only writeAudit on afterDelete holds that term
packages/objectql/src/plugin.ts:918	"captureBefore's now-redundant read is the identity lane's follow-up"	forward reference to #6656 itself; becomes past tense
packages/metadata/src/metadata-manager.ts:311	"plugin-audit's captureBefore threads the transaction by hand for exactly this reason" — cited as evidence the single-connection-pool stall is current	the cited example no longer exists. The hazard claim is independent and still stands on DatabaseLoader._find(); only the witness is gone, so this needs a replacement example rather than deletion of the policy
packages/spec/src/contracts/scoped-context.ts:64	"plugin-audit's persistAuditTrailRow and its captureBefore snapshot both reach api.sudo()"	only the writer reaches sudo() now. The conclusion (sudo excluded on purpose) is unaffected

Why this was not fixed in PR #6977

Its scope is packages/plugins/plugin-audit, and two of the four files are in packages/objectql, which that card explicitly fences off (the engine half is landed and closed; sys_fetch_previous_delete is #5929, engine-core lane). Item 1 is in packages/triggers. Cross-lane by construction, hence a standalone card rather than a rider.

---

Generated by Claude Code

[os-project-manager]

Triage (pass #2, 2026-08-09, registered on #6015): promoted finding → pm:queue, routed domain:services (the dead limb and its fixture live in the trigger machinery; re-route on claim if the seat disagrees). The blocker has cleared — #6656 closed completed with the A+ retirement merged — so the ctx.__previous stash now has zero producers and the fallback limb is dead code kept alive by its own fixture, plus four comments asserting a world that no longer exists. Deletion sweep with the #6656 thread as the evidence base.

---

Generated by Claude Code

[os-project-manager]

Claim: PM loop round 18 (domain:services seat, post #6021) — scoped to Item 1 only; Item 2 is returned to triage for splitting, see below.
Session: session_01USNUyHEr7uaU6MoEWXitei
Branch: claude/issue-6978-previous-stash-dead-limb
Worktree: objectstack-issue-6978
Domain: domain:services
File surface: packages/triggers/trigger-record-change/src/record-change-trigger.ts (the :299 fallback limb + its doc comment) and record-change-trigger.test.ts (the :352/:362 fixture that feeds it). Nothing else. Stop on breach.
Serial constraints cleared: Blocked-by: #6656 verified satisfied against GitHub (closed as completed 2026-08-09T08:02:02Z; triage's 11:13Z promotion re-verified it). No in-flight claim touches packages/triggers — services in-flight is #5548 (packages/services/service-job, disjoint).
Container verdict: S — mode:subagent (shared container).

Partial re-route back to triage (the "re-route on claim if the seat disagrees" invitation, taken up in halves): Item 1 is correctly domain:services — the dead limb and its fixture land in the trigger machinery, and that is what this claim covers. Item 2's four stale comments are cross-lane by the anchoring rule and are NOT covered by this claim:

file	lane per the domain table
packages/objectql/src/engine.ts:7842	domain:engine-core
packages/objectql/src/plugin.ts:918	domain:engine-core
packages/metadata/src/metadata-manager.ts:311	domain:metadata — and it needs a replacement witness, not deletion (the hazard claim stands on DatabaseLoader._find(); only the cited example is gone)
packages/spec/src/contracts/scoped-context.ts:64	packages/spec carries the hard single-owner rule — spec(-surface) seat, regardless of who needs it

Dispatching those edits from this seat would repeat the #6743 shape (a single-lane claim whose real surface spans three other lanes' files, one of them the hard-owned packages/spec). They are comment-only, so the cheap right home may be each lane's next sweep rather than three standalone cards — that split is the triage seat's call, not this one's. Item 1's dispatch does not depend on it in either direction.

---

Generated by Claude Code

[os-project-manager]

ACCEPT — Item 1. PR #7081, reviewed by the domain:services seat (#6021). Marking ready and queueing. ⚠️ This card stays OPEN — the PR says Part of, not Fixes, and Item 2 is still outstanding.

Verified against GitHub rather than the report: 3 files (changeset + record-change-trigger.ts + its test), all inside packages/triggers/trigger-record-change — Item 2's four cross-lane files untouched, as scoped. 25/25 check runs complete, ESLint success (14:09:58Z) and TypeScript Type Check success (14:21:29Z) read by conclusion; zero failures.

What makes this one solid

• The premise was re-measured, and the one hit that could have killed it was disposed of explicitly. packages/runtime/src/sandbox/quickjs-runner.ts:494 is the only live-code __previous reference left: setGlobalJson(vm, '__previous', ctx.previous) — a global installed inside the QuickJS sandbox VM, sourced from the canonical key and JSON-copied into an isolated VM, so it is a read-side convenience for script bodies, not a writer of the host HookContext.__previous. Checked rather than assumed; everything else is prose or the fixture.
• Unreachable, not merely unused. The engine binds ctx.previous before dispatch on every write shape, cited with today's line numbers — by-id update (engine.ts:7010 ahead of :7012), by-id delete (bindPreImage :7869 called at :7897 ahead of :7899), and both per-row phases of a predicate write (:1746 / :1825). The closing argument is the good one: bindPreImage deliberately leaves previous unbound rather than fabricating {} (Script validation rules are silently skipped when their predicate fails to evaluate — fail-open is the wrong direction for a validation #4649/hook 的 condition 求不出值时:全局 fail loud —— 抛错并中断该次操作(方案 B 已拍板;Blocked-by #4770) #4775), so the one residual absent-previous state is a state where a stash would have had nothing to offer either.
• The reverse verification reports its real direction instead of manufacturing a red. This is the inverted family: the canonical key sits first in the ?? chain, so all 55 pre-existing cases stay green with or without the limb, and a positive test could never carry the weight. The weight moved to an inverted negative pin — and the replacement is stronger than the one I asked for: it strips result and previous and leaves only input.id, so the stash is the only thing that could answer, then asserts both that previous is undefined and that record stays empty. Limb pasted back: 1 failed | 43 passed, failing on exactly that case. The validateOrgAxisRedLines 读的 sharing-rule 键是 spec 拒收的:ADR-0105 D6 ① 在 criteria 路径上从不触发 #4984 defect was that deletion was invisible to the suite; it no longer is.
• The intended post-state is declared, not left to be discovered: a future producer of ctx.__previous is now silently ignored, by design, under ADR-0049 and PD Add comprehensive test suite for Zod schema validation #12 — and that sentence is in the changeset, where a release reader meets it.
• Restraint worth noting: bulk-write-per-row-context.test.ts:15 also names __previous in a past-tense "what this used to do" header. Still accurate, outside the file surface, left alone.

Changeset (not skip-changeset) is the right call and cites the house precedent for this exact family — .changeset/hook-ctx-doc-alias-reads-removed.md (#5906/#5671), the doc alias removal recorded as a patch on the same "behaviour unchanged" reasoning.

Item 2 — still open, still not this seat's

The four stale captureBefore comments remain, and the claim's re-route stands: packages/objectql×2 → domain:engine-core, packages/metadata/src/metadata-manager.ts → domain:metadata (⚠️ that one needs a replacement witness, not deletion — the single-connection-pool hazard claim still stands on DatabaseLoader._find(); only its cited example is gone), and packages/spec/src/contracts/scoped-context.ts → the hard-owned spec seat. Whether that is one sweep, three riders, or three cards is the triage seat's call. This seat's claim is fulfilled with Item 1; the assignee comes off once #7081 merges.

---

Generated by Claude Code