@@ -9,7 +9,7 @@ feat(plugin-audit): `sys_comment` rows carry a writer-stamped parent pair, `obje
 
 Clause-②: yes
 
-`sys_comment` gains two `readonly` text columns and an index over them. They are derived from `thread_id` (`{object}:{record_id}`, split on the first colon) by one planner, `planCommentParentPair`, and `thread_id` stays the key authors write: nothing changes for a writer. A `sys_comment` before-insert hook stamps every inserted row, whoever writes it, over whatever value the writer sent; an update that names `thread_id` (a re-point) is re-stamped from it; a non-system caller's own value for either column is dropped by the engine on update. A thread that names no record stamps `null` / `null`, and such a comment stays hidden from every non-system reader, as before.
+`sys_comment` gains two `readonly` text columns and an index over them. They are derived from `thread_id` (`{object}:{record_id}`, split on the first colon) by one planner, `planCommentParentPair`, and `thread_id` stays the key authors write: nothing changes for a writer. A `sys_comment` before-insert hook stamps every inserted row, whoever writes it, over whatever value the writer sent; an update that names `thread_id` (a re-point) is re-stamped from it; and an update that names either column without a thread has the pair re-derived from the row's stored thread, for every caller — a historical import (`preserveAudit`) included, where the engine's update-side `readonly` strip keeps a value — so no writer's value for either column lands. A thread that names no record stamps `null` / `null`, and such a comment stays hidden from every non-system reader, as before.
 
 The comment-thread read gate (`installCommentReadVisibility`) is now the parent-record gate the activity stream and the compliance ledger use, over the comment's own pair: one branch `{ object_name: P, record_id: { $in: ReadableIds.of(P) } }` per registered object other than `sys_comment`, ORed and ANDed into the read's `where`, on `find`, `findOne`, `count` and `aggregate`. A broad comment read is served every comment the reader may read, on any table size, with a true `total`. What keeps the bounded 2,000-row fail-closed probe, chosen up front by name, never by catching a refusal:
 
@@ -22,4 +22,4 @@ The comment-thread read gate (`installCommentReadVisibility`) is now the parent-
 
 Comment reactions are unchanged: their only parent is `sys_comment`, which this gate narrows by an object-scoped middleware, so the reaction gate keeps the bounded probe (ADR-0139 D5.2).
 
-`installCommentReadVisibility` takes an optional third argument, the security source whose `canReadObject` admits a leaf; without it every comment read is the bounded probe, as before. `CommentAccessEngine` gains an optional `getSchema`. `@objectstack/plugin-audit` exports the backfill, `backfillCommentParentPair` (with `COMMENT_PARENT_PAIR_BACKFILL_PAGE_SIZE` and its report and engine types), the planner `planCommentParentPair` (with `COMMENT_PARENT_OBJECT_COLUMN`, `COMMENT_PARENT_RECORD_COLUMN` and the `CommentParentPair` type).
+`installCommentReadVisibility` takes an optional third argument, the security source whose `canReadObject` admits a leaf (`ParentObjectReadAdmissionSource`); without it every comment read is the bounded probe, as before. Its first parameter widens from `CommentAccessEngine` to `ParentRecordGateEngine` (`CommentAccessEngine` plus three optional members: a registry view, `hasObjectMiddleware` and `resolveEffectiveDatasource`); every existing caller's engine still satisfies it. Both types reach the published declaration through that signature. `CommentAccessEngine` gains an optional `getSchema`. `@objectstack/plugin-audit` exports the backfill, `backfillCommentParentPair` (with `COMMENT_PARENT_PAIR_BACKFILL_PAGE_SIZE` and its report and engine types), the planner `planCommentParentPair` (with `COMMENT_PARENT_OBJECT_COLUMN`, `COMMENT_PARENT_RECORD_COLUMN` and the `CommentParentPair` type).
@@ -55,7 +55,7 @@ async function confirm(question: string): Promise<boolean> {
  * unstamped rows are read, so a second run stamps nothing — re-running and
  * reading a clean report is the verification. No `sys_migration` flag is
  * recorded: nothing gates irreversible behaviour on it. The flags are
- * `os migrate comment-parent-pair`'s, one for one.
+ * `os migrate activity-changed-fields`'s, one for one.
  */
 export default class MigrateCommentParentPair extends Command {
   static override description =
 
@@ -333,14 +333,20 @@ function stampCommentParentPair(row: Record<string, unknown>): void {
  *    `readonly` strip leaves `sys_` objects to their own guards
  *    (`staticReadonlyInsertSubject`), so this assignment is the guard, as the
  *    create hook is for `is_edited`.
- *  - the re-point rule (`beforeUpdate`): an update that names `thread_id` —
- *    the write the update gate authorizes as an insert into the new thread —
- *    re-stamps the pair from it. The payload is shared by every row a
+ *  - update (`beforeUpdate`), for every caller: an update that names
+ *    `thread_id` — the re-point the update gate authorizes as an insert into
+ *    the new thread — is stamped from it. The payload is shared by every row a
  *    predicate update matches, so every row gets the same pair, as it gets the
- *    same `thread_id`. An update that names no `thread_id` stamps nothing: a
- *    non-system caller's own pair is stripped by the engine (both columns are
- *    `readonly`, and the update-side strip keeps only a value a hook
- *    assigned), and the system's own write is the backfill's.
+ *    same `thread_id`. An update that names either pair column WITHOUT a
+ *    thread is re-derived from the row's own stored thread (`previous`), so no
+ *    writer's value lands, the backfill's included. ⛔ The engine's update-side
+ *    `readonly` strip is not the guard here: under `preserveAudit` (a REST
+ *    historical import puts it on an ordinary caller's write) it keeps a
+ *    readonly value. A predicate update naming the pair re-derives a pair per
+ *    row, and one whose rows hold different threads is refused whole by the
+ *    engine (`MULTI_UPDATE_HOOK_KEY_DIVERGENCE`): one SET clause cannot carry
+ *    two pairs. With no stored row to derive from, the pair is dropped from the
+ *    write. An update naming none of the three columns stamps nothing.
  */
 function installCommentParentPairStamp(engine: CommentAccessEngine): void {
   engine.registerHook(
@@ -359,9 +365,25 @@ function installCommentParentPairStamp(engine: CommentAccessEngine): void {
     (ctx: any) => {
       const data: unknown = ctx?.input?.data;
       if (!data || typeof data !== 'object' || Array.isArray(data)) return;
-      if (!Object.prototype.hasOwnProperty.call(data, 'thread_id')) return;
+      const payload = data as Record<string, unknown>;
+      const names = (key: string) => Object.prototype.hasOwnProperty.call(payload, key);
+      if (!names('thread_id') && !COMMENT_PARENT_PAIR_COLUMNS.some(names)) return;
       if (!declaresCommentParentPair(engine)) return;
-      stampCommentParentPair(data as Record<string, unknown>);
+      if (names('thread_id')) {
+        stampCommentParentPair(payload);
+        return;
+      }
+      // The pair named without a thread: derive it from the row's own thread.
+      const previous: unknown = ctx?.previous;
+      const storedThread =
+        previous && typeof previous === 'object' ? (previous as Record<string, unknown>).thread_id : undefined;
+      if (typeof storedThread !== 'string') {
+        for (const column of COMMENT_PARENT_PAIR_COLUMNS) delete payload[column];
+        return;
+      }
+      const pair = planCommentParentPair(storedThread);
+      payload[COMMENT_PARENT_OBJECT_COLUMN] = pair.object_name;
+      payload[COMMENT_PARENT_RECORD_COLUMN] = pair.record_id;
     },
     { object: COMMENT_OBJECT, packageId: PACKAGE_ID },
   );
 
@@ -21,8 +21,12 @@
  * ## As the platform, through the migration door
  *
  * Rows are read and updated as the platform (a SYSTEM context), the shape of
- * `stored-metadata-body-migration.ts` and E6's activity backfill. The update
- * names the pair and the row's stored `updated_at` under `preserveAudit`, so
+ * `stored-metadata-body-migration.ts` and E6's activity backfill. The pair the
+ * update names is re-derived by the update stamp from the row's thread as it
+ * is stored at write time (`comment-access-hooks.ts`), so a re-point landing
+ * between this page's read and the row's write cannot leave the pair naming
+ * the thread the comment left. The update names the row's stored
+ * `updated_at` under `preserveAudit`, so
  * the backfill changes no comment's `updated_at` and names no `thread_id` or
  * `body` (no re-point, no edit stamp). A row whose thread names no record is
  * not stamped (its pair stays `null`, and it stays hidden from every
 
@@ -140,6 +140,7 @@ const commentOn = (object: string, id: string, body: string): Row => ({
 describe('[ADR-0139 E7] the comment-thread read gate over the stamped parent pair', () => {
   let kernel: ObjectKernel;
   let engine: ObjectQL;
+  let driver: SqliteWasmDriver;
   const seenWhere: unknown[] = [];
   const ids: Record<string, string> = {};
 
@@ -169,7 +170,7 @@ describe('[ADR-0139 E7] the comment-thread read gate over the stamped parent pai
   const atRest = async (id: string): Promise<Row> => (await engine.findOne(COMMENT, { where: { id }, context: SYS })) as Row;
 
   beforeAll(async () => {
-    ({ kernel, engine } = await bootKernel(new SqliteWasmDriver({ filename: ':memory:' })));
+    ({ kernel, engine } = await bootKernel((driver = new SqliteWasmDriver({ filename: ':memory:' }))));
     const warehouse = new WarehouseDriver({ filename: ':memory:' });
     await warehouse.connect();
     engine.registerDriver(warehouse);
@@ -317,7 +318,8 @@ describe('[ADR-0139 E7] the comment-thread read gate over the stamped parent pai
     // The state after the upgrade, for three rows: no pair at rest.
     const firstComment = ((await engine.find(COMMENT, { where: { thread_id: `${DOC}:${ids.firstDoc}` }, limit: 1, context: SYS })) as Row[])[0];
     const rowIds = [String(firstComment.id), ids.onVault, ids.onGatedA];
-    for (const id of rowIds) await engine.update(COMMENT, { id, object_name: null, record_id: null }, { context: SYS });
+    // Planted below the engine: every engine write of the pair is re-derived.
+    for (const id of rowIds) await driver.update(COMMENT, id, { object_name: null, record_id: null });
     for (const id of rowIds) expect((await atRest(id)).object_name ?? null).toBeNull();
 
     seenWhere.length = 0;
@@ -352,6 +354,14 @@ describe('[ADR-0139 E7] the comment-thread read gate over the stamped parent pai
     // Naming the pair without a thread: the engine strips a member's readonly value.
     await engine.update(COMMENT, { object_name: VAULT, record_id: ids.vault, body: 'still mine' }, { where: { id }, context: MEMBER_A });
     expect(await atRest(id)).toMatchObject({ body: 'still mine', object_name: DOC, record_id: other });
+
+    // ...and under `preserveAudit` (a REST historical import puts it on an
+    // ordinary caller's write), where the engine's strip keeps a readonly
+    // value, the stamp re-derives the pair from the row's own thread.
+    await engine.update(COMMENT, { object_name: VAULT, record_id: ids.vault }, { where: { id }, context: { ...MEMBER_A, preserveAudit: true } });
+    expect(await atRest(id)).toMatchObject({ thread_id: `${DOC}:${other}`, object_name: DOC, record_id: other });
+    await engine.update(COMMENT, { record_id: ids.vault }, { where: { id }, context: { ...MEMBER_A, preserveAudit: true } });
+    expect(await atRest(id)).toMatchObject({ object_name: DOC, record_id: other });
   });
 
   it('D5.2: the reaction gate keeps the bounded probe — a literal comment-id list, no leaf', async () => {
@@ -387,17 +397,20 @@ describe('[ADR-0139 E7] backfillCommentParentPair', () => {
   const logger = () => ({ info: vi.fn(), warn: vi.fn() });
 
   beforeAll(async () => {
-    ({ kernel, engine } = await bootKernel(new SqliteWasmDriver({ filename: ':memory:' })));
+    const driver = new SqliteWasmDriver({ filename: ':memory:' });
+    ({ kernel, engine } = await bootKernel(driver));
     engine.registry.registerObject(objectOf(DOC) as any, HARNESS_PACKAGE);
     await engine.syncSchemas();
     for (let i = 0; i < 5; i++) {
       const doc = String((await engine.insert(DOC, { name: `d${i}` }, { context: SYS })).id);
       rowIds.push(String((await engine.insert(COMMENT, commentOn(DOC, doc, `c${i}`), { context: SYS })).id));
     }
     rowIds.push(String((await engine.insert(COMMENT, { thread_id: 'free-form', body: 'x', author_id: 'u' }, { context: SYS })).id));
-    // The state after the upgrade: every row at rest, unstamped, with an updated_at of its own.
+    // The state after the upgrade: every row at rest, unstamped, with an
+    // updated_at of its own — planted below the engine, which re-derives any
+    // pair an engine write names.
     for (const id of rowIds) {
-      await engine.update(COMMENT, { id, object_name: null, record_id: null, updated_at: '2020-01-01T00:00:00.000Z' }, { context: { ...SYS, preserveAudit: true } });
+      await driver.update(COMMENT, id, { object_name: null, record_id: null, updated_at: '2020-01-01T00:00:00.000Z' });
       stampedAt.set(id, (await engine.findOne(COMMENT, { where: { id }, context: SYS }) as Row).updated_at);
     }
   }, 120_000);
 
@@ -219,9 +219,9 @@ describe('[ADR-0139 E7] the parent pair: one planner, stamped on create and on t
     };
     installCommentAccessHooks(engine, () => null, silentLogger());
     // The stamp is the one handler that exempts no caller: drive every handler as the system.
-    const run = async (event: string, data: unknown) => {
+    const run = async (event: string, data: unknown, previous: unknown = { body: 'b' }) => {
       for (const h of registered.filter((r) => r.event === event)) {
-        await h.handler({ object: 'sys_comment', event, input: { data, options: {} }, session: { isSystem: true }, previous: { body: 'b' } });
+        await h.handler({ object: 'sys_comment', event, input: { data, options: {} }, session: { isSystem: true }, previous });
       }
       return data;
     };
@@ -249,6 +249,27 @@ describe('[ADR-0139 E7] the parent pair: one planner, stamped on create and on t
     expect(await run('beforeUpdate', { body: 'b' })).toEqual({ body: 'b' });
   });
 
+  it('update: a pair named without a thread is re-derived from the stored thread, or dropped when there is none', async () => {
+    const run = hooks();
+    const stored = { body: 'b', thread_id: 'crm_case:c9' };
+    expect(await run('beforeUpdate', { object_name: 'vault', record_id: 'v1' }, stored)).toEqual({
+      object_name: 'crm_case',
+      record_id: 'c9',
+    });
+    expect(await run('beforeUpdate', { record_id: 'v1', body: 'x' }, stored)).toMatchObject({
+      body: 'x',
+      object_name: 'crm_case',
+      record_id: 'c9',
+    });
+    expect(await run('beforeUpdate', { object_name: null, record_id: null }, { thread_id: 'watercooler' })).toEqual({
+      object_name: null,
+      record_id: null,
+    });
+    const dropped = (await run('beforeUpdate', { object_name: 'vault', body: 'x' }, undefined)) as Record<string, unknown>;
+    expect(dropped).toMatchObject({ body: 'x' });
+    expect(dropped).not.toHaveProperty('object_name');
+  });
+
   it('a sys_comment that declares no pair is never stamped (no unknown column is written)', async () => {
     const run = hooks(false);
     expect(await run('beforeInsert', { thread_id: 'crm_case:c1' })).toEqual({ thread_id: 'crm_case:c1' });
 
@@ -109,9 +109,11 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  *   (the re-point the update gate authorizes as an insert into the new
  *   thread), the pair is re-stamped from it. A thread naming no record stamps
  *   `null` / `null`.
- * - **Read-only to authors.** Both declare `readonly: true`: a non-system
- *   update's own value is stripped by the engine; the create side is the
- *   stamp's assignment.
+ * - **Read-only to authors.** Both declare `readonly: true`, and no writer's
+ *   value lands: on create the stamp is assigned over it, and an update that
+ *   names either column without a thread has the pair re-derived from the
+ *   row's stored thread — for every caller, because under `preserveAudit` (a
+ *   historical import) the engine's update-side strip keeps a readonly value.
  * - **Stored rows.** Rows written before the pair existed carry `null` until
  *   `os migrate comment-parent-pair --apply` stamps them; until then the read
  *   gate answers them with the bounded thread probe (fail closed), never a
 
@@ -279,7 +279,10 @@ describe('[ADR-0139 E7] the comment-thread gate leafs over the parent pair: ever
 
   it('a row the backfill has not reached is probed by its thread, not leafed: still served when readable, still hidden when not', async () => {
     const cleared = [...bulk.mine.slice(0, UNSTAMPED), ...bulk.other.slice(0, UNSTAMPED)];
-    for (const rowId of cleared) await ql.update(COMMENT, { id: rowId, object_name: null, record_id: null }, { context: { ...SYS } });
+    // Planted below the engine, as a row from before the upgrade is: every
+    // engine write of the pair is re-derived from the row's thread.
+    const driver = ql.getDriver(COMMENT);
+    for (const rowId of cleared) await driver.update(COMMENT, rowId, { object_name: null, record_id: null });
     try {
       commentReads.length = 0;
       const { ids, totals } = await walk('member', bothThreads());
@@ -289,11 +292,10 @@ describe('[ADR-0139 E7] the comment-thread gate leafs over the parent pair: ever
       expect(probes.length).toBeGreaterThan(0);
       expect(probes.every((r) => r.where.includes('"object_name":{"$null":true}'))).toBe(true);
     } finally {
-      for (const rowId of cleared) {
-        const row = await ql.findOne(COMMENT, { where: { id: rowId }, context: { ...SYS } });
-        const [object, recordId] = String(row.thread_id).split(':');
-        await ql.update(COMMENT, { id: rowId, object_name: object, record_id: recordId }, { context: { ...SYS } });
-      }
+      // The engine write re-derives each row's pair from its thread: the backfill's own write path.
+      for (const rowId of cleared) await ql.update(COMMENT, { id: rowId, object_name: null, record_id: null }, { context: { ...SYS } });
+      const restored: Row[] = await ql.find(COMMENT, { where: { id: { $in: cleared } }, context: { ...SYS } });
+      expect(restored.every((r) => r.thread_id === `${r.object_name}:${r.record_id}`)).toBe(true);
     }
   });
 });