@@ -9,7 +9,7 @@ feat(plugin-audit): `sys_comment` rows carry a writer-stamped parent pair, `obje
 
 Clause-②: yes
 
-`sys_comment` gains two `readonly` text columns and an index over them. They are derived from `thread_id` (`{object}:{record_id}`, split on the first colon) by one planner, `planCommentParentPair`, and `thread_id` stays the key authors write: nothing changes for a writer. A `sys_comment` before-insert hook stamps every inserted row, whoever writes it, over whatever value the writer sent; an update that names `thread_id` (a re-point) is re-stamped from it; and an update that names either column without a thread has the pair re-derived from the row's stored thread, for every caller — a historical import (`preserveAudit`) included, where the engine's update-side `readonly` strip keeps a value — so no writer's value for either column lands. A thread that names no record stamps `null` / `null`, and such a comment stays hidden from every non-system reader, as before.
+`sys_comment` gains two `readonly` text columns and an index over them. They are derived from `thread_id` (`{object}:{record_id}`, split on the first colon) by one planner, `planCommentParentPair`, and `thread_id` stays the key authors write: nothing changes for a writer. A `sys_comment` before-insert hook stamps every inserted row, whoever writes it, over whatever value the writer sent; an update that names `thread_id` (a re-point) is re-stamped from it; and an update that names either column without a thread has the pair re-derived from the row's stored thread, for every caller — a historical import (`preserveAudit`) included, where the engine's update-side `readonly` strip keeps a value — so no writer's value for either column lands. A multi-row update that names either column without a thread is refused whole (`VALIDATION_ERROR` / 400, nothing written) when its rows' threads name different records, since one write cannot store each row's own pair; over rows sharing one thread it stores that thread's pair. A thread that names no record stamps `null` / `null`, and such a comment stays hidden from every non-system reader, as before.
 
 The comment-thread read gate (`installCommentReadVisibility`) is now the parent-record gate the activity stream and the compliance ledger use, over the comment's own pair: one branch `{ object_name: P, record_id: { $in: ReadableIds.of(P) } }` per registered object other than `sys_comment`, ORed and ANDed into the read's `where`, on `find`, `findOne`, `count` and `aggregate`. A broad comment read is served every comment the reader may read, on any table size, with a true `total`. What keeps the bounded 2,000-row fail-closed probe, chosen up front by name, never by catching a refusal:
 
 
@@ -342,12 +342,51 @@ function stampCommentParentPair(row: Record<string, unknown>): void {
  *    writer's value lands, the backfill's included. ⛔ The engine's update-side
  *    `readonly` strip is not the guard here: under `preserveAudit` (a REST
  *    historical import puts it on an ordinary caller's write) it keeps a
- *    readonly value. A predicate update naming the pair re-derives a pair per
- *    row, and one whose rows hold different threads is refused whole by the
- *    engine (`MULTI_UPDATE_HOOK_KEY_DIVERGENCE`): one SET clause cannot carry
- *    two pairs. With no stored row to derive from, the pair is dropped from the
- *    write. An update naming none of the three columns stamps nothing.
+ *    readonly value. A predicate update naming the pair without a thread
+ *    re-derives a pair per matched row over one shared payload, and one SET
+ *    clause carries a single pair to every row, so when the matched rows'
+ *    threads name different records the write is refused whole, before
+ *    anything is written ({@link refusePairDivergence}, `VALIDATION_ERROR` /
+ *    400): the engine's own key-set divergence check cannot see it, since
+ *    every row assigns the same two keys. With no stored row to derive from,
+ *    the pair is dropped from the write. An update naming none of the three
+ *    columns stamps nothing.
  */
+/** The catalog member for a request whose shape is refused (ADR-0112). */
+const PAIR_DIVERGENCE_CODE: StandardErrorCode = 'VALIDATION_ERROR';
+
+/** The pair the first row of a predicate update derived, per write (the engine's shared `dispatch.scope`). */
+const pairByWrite = new WeakMap<object, CommentParentPair>();
+
+/**
+ * Refuse a predicate (`per-row`) update whose matched rows derive different
+ * parent pairs: one `SET` clause cannot carry two pairs, and carrying one row's
+ * pair to another row would authorize that comment by a record its thread does
+ * not name. Refused before anything is written (every before-hook runs ahead
+ * of the one write). A by-id update, and a predicate update whose rows share
+ * one thread, pass. `VALIDATION_ERROR` / 400: the request's shape is what is
+ * refused, and the remedy is in the caller's hands.
+ */
+function refusePairDivergence(dispatch: unknown, pair: CommentParentPair): void {
+  const d = dispatch as { mode?: unknown; scope?: unknown } | undefined;
+  if (d?.mode !== 'per-row' || !d.scope || typeof d.scope !== 'object') return;
+  const first = pairByWrite.get(d.scope);
+  if (!first) {
+    pairByWrite.set(d.scope, pair);
+    return;
+  }
+  if (first.object_name === pair.object_name && first.record_id === pair.record_id) return;
+  const err: any = new Error(
+    'Refusing a multi-row update of sys_comment that names object_name / record_id without thread_id: the matched ' +
+      "comments' threads name different records, and one write cannot store each comment's own pair. The pair is " +
+      "derived from thread_id — update the comments one by one, or name thread_id.",
+  );
+  err.code = PAIR_DIVERGENCE_CODE;
+  err.status = 400;
+  err.statusCode = 400;
+  throw err;
+}
+
 function installCommentParentPairStamp(engine: CommentAccessEngine): void {
   engine.registerHook(
     'beforeInsert',
@@ -382,6 +421,12 @@ function installCommentParentPairStamp(engine: CommentAccessEngine): void {
         return;
       }
       const pair = planCommentParentPair(storedThread);
+      // A predicate update dispatches this handler once per matched row over
+      // ONE shared payload, and one SET clause carries the last row's values to
+      // every row. The engine's key-set divergence check cannot see this (every
+      // row assigns the same two keys), so the pair is compared here, across
+      // the call's rows, on the scope object the engine shares between them.
+      refusePairDivergence(ctx?.dispatch, pair);
       payload[COMMENT_PARENT_OBJECT_COLUMN] = pair.object_name;
       payload[COMMENT_PARENT_RECORD_COLUMN] = pair.record_id;
     },
 
@@ -364,6 +364,25 @@ describe('[ADR-0139 E7] the comment-thread read gate over the stamped parent pai
     expect(await atRest(id)).toMatchObject({ object_name: DOC, record_id: other });
   });
 
+  it('a SYSTEM multi-row update naming the pair over comments on different records is refused whole; over one thread it stores that thread\'s pair', async () => {
+    const [d1, d2] = ((await engine.find(DOC, { limit: 2, context: SYS })) as Row[]).map((r) => String(r.id));
+    const a = String((await engine.insert(COMMENT, commentOn(DOC, d1, 'multi a'), { context: SYS })).id);
+    const b = String((await engine.insert(COMMENT, commentOn(DOC, d2, 'multi b'), { context: SYS })).id);
+    const c = String((await engine.insert(COMMENT, commentOn(DOC, d1, 'multi c'), { context: SYS })).id);
+    const outcome = await engine
+      .update(COMMENT, { object_name: VAULT, record_id: ids.vault }, { multi: true, where: { id: { $in: [a, b] } }, context: SYS } as any)
+      .then((value) => ({ value }), (error) => ({ error }));
+    expect(outcome).toHaveProperty('error');
+    const error = (outcome as { error: any }).error;
+    expect({ code: error.code, status: error.status }).toEqual({ code: 'VALIDATION_ERROR', status: 400 });
+    expect(await atRest(a)).toMatchObject({ object_name: DOC, record_id: d1 });
+    expect(await atRest(b)).toMatchObject({ object_name: DOC, record_id: d2 });
+    // Rows sharing one thread derive one pair: the write lands, and stores that pair.
+    await engine.update(COMMENT, { object_name: VAULT, record_id: ids.vault }, { multi: true, where: { id: { $in: [a, c] } }, context: SYS } as any);
+    expect(await atRest(a)).toMatchObject({ object_name: DOC, record_id: d1 });
+    expect(await atRest(c)).toMatchObject({ object_name: DOC, record_id: d1 });
+  });
+
   it('D5.2: the reaction gate keeps the bounded probe — a literal comment-id list, no leaf', async () => {
     const reactionWhere: unknown[] = [];
     engine.registerMiddleware(async (op: any, next: () => Promise<void>) => {
 
@@ -270,6 +270,32 @@ describe('[ADR-0139 E7] the parent pair: one planner, stamped on create and on t
     expect(dropped).not.toHaveProperty('object_name');
   });
 
+  it('a multi-row update naming the pair: refused when the rows derive different pairs, passed when they share one', async () => {
+    const registered: Array<{ event: string; handler: (ctx: any) => any }> = [];
+    const engine: any = {
+      registerHook: (event: string, handler: (ctx: any) => any, options: any) => {
+        if (options?.object === 'sys_comment' && event === 'beforeUpdate') registered.push({ event, handler });
+      },
+      getSchema: () => ({ fields: PAIR_FIELDS }),
+    };
+    installCommentAccessHooks(engine, () => null, silentLogger());
+    const dispatchRows = async (threads: string[]) => {
+      const scope = {};
+      const payload: Record<string, unknown> = { object_name: 'vault' };
+      for (const [index, thread] of threads.entries()) {
+        for (const h of registered) {
+          await h.handler({
+            object: 'sys_comment', input: { data: payload, options: {} }, session: { isSystem: true },
+            previous: { thread_id: thread }, dispatch: { mode: 'per-row', index, scope },
+          });
+        }
+      }
+      return payload;
+    };
+    await expect(dispatchRows(['crm_case:c1', 'crm_case:c2'])).rejects.toMatchObject({ code: 'VALIDATION_ERROR', status: 400 });
+    expect(await dispatchRows(['crm_case:c1', 'crm_case:c1'])).toEqual({ object_name: 'crm_case', record_id: 'c1' });
+  });
+
   it('a sys_comment that declares no pair is never stamped (no unknown column is written)', async () => {
     const run = hooks(false);
     expect(await run('beforeInsert', { thread_id: 'crm_case:c1' })).toEqual({ thread_id: 'crm_case:c1' });
 
@@ -114,6 +114,9 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  *   names either column without a thread has the pair re-derived from the
  *   row's stored thread — for every caller, because under `preserveAudit` (a
  *   historical import) the engine's update-side strip keeps a readonly value.
+ *   A multi-row update naming the pair without a thread is refused whole
+ *   (`VALIDATION_ERROR` / 400) when its rows' threads name different records:
+ *   one write cannot store each row's own pair.
  * - **Stored rows.** Rows written before the pair existed carry `null` until
  *   `os migrate comment-parent-pair --apply` stamps them; until then the read
  *   gate answers them with the bounded thread probe (fail closed), never a