feat(cli,plugin-audit): os migrate audit-mail-bodies masks the mail bodies that pre-#24688 audit and activity copies still hold in clear

[objectstack-fleet]

Closes #24693
Clause-②: yes

Residual R2 of the contract review of PR #24688. Before #24688 the audit writer copied sys_email / sys_identity_email rows into sys_audit_log and sys_activity with body_text / body_html in clear. Those bodies carry reset, verification, magic-link and invitation links. #24688 masks new copies only. This PR adds the one-time, idempotent cleanup for the copies written before it.

Measured first: its own os migrate command, not a ceremony step

• Order-independent. The cleanup masks every copy of BOTH mail logs, as the writer does, so it needs no identity selector. Before the ceremony it masks the sys_email copies. After it, the activity copies that feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681's step 5b re-points to sys_identity_email are masked the same way, and sys_audit_log keeps the object name it was written under either way (feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 does not rewrite the ledger).
• Reach. The residual exists on every database a pre-fix(platform-objects,plugin-audit,plugin-approvals)!: mail bodies are read only with manage_platform_settings, and the audit mirrors never copy them in clear #24688 writer wrote to. A ceremony step reaches only databases that take the ceremony, and once each. A command also backports to a release line that has no ceremony.
• Precedent. os migrate audit-metadata-bodies is the same family of fix as its own command: dry run by default, no sys_migration flag.
• So no ceremony file is touched. File overlap with PR feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 is zero.

Measured on the 18.0 upgrade-harness fixture (packages/qa/dogfood/test/upgrade-harness/fixture-18.0/, base d1173825b): 2 sys_audit_log rows and 2 sys_activity rows (create sides) hold a clear mail body. Counts only; no value was printed.

What changed

• @objectstack/plugin-audit
  • mail-log-body-mask.ts: maskMailLogBodyCopy, the one mask. A set body becomes SECRET_MASK, an unset one stays null, and no column is invented. ledgerView in audit-writers.ts now calls it instead of its inline loop, so the writer and the cleanup share one helper. The object names and body columns are still fix(platform-objects,plugin-audit,plugin-approvals)!: mail bodies are read only with manage_platform_settings, and the audit mirrors never copy them in clear #24688's MAIL_LOG_OBJECTS / MAIL_LOG_BODY_FIELDS / isMailLogObject, and the mask value is still SECRET_MASK; none is re-spelled.
  • mail-log-body-migration.ts:
    • two pure planners, planMailLogBodyAuditRowPatch (for new_value / old_value) and planMailLogBodyActivityRowPatch (for both halves of metadata, keeping the pair's other keys);
    • a runner, migrateMailLogBodyCopies, that keyset-pages both tables by id (500 rows a page) with object_name $in MAIL_LOG_OBJECTS and writes only the copy column;
    • the write runs as the platform under preserveAudit with the row's stored updated_at, the shape comment-parent-pair-backfill.ts takes, so no other column of the row moves;
    • the report is counts only (per table: scanned, rewritten; plus failures), and an unread table counts as a failure, never as clean.
• @objectstack/cli: os migrate audit-mail-bodies takes audit-metadata-bodies's flags one for one (--database-url, --apply, --yes, --force, --json), its read-only dry-run boot, and its absentTableReads view. It is enrolled in the one-shot family table, the --json stdout-purity family and the absent-database roster (with control rows).
• Docs: the cli.mdx data-migration table and a section. The platform checklist item cli.migrate-plan-apply-json goes to revision 6 (variant added, 18 → 19 subcommands). The tenant-audit census was regenerated (--write) for the runner's one new write call site, and the census page's hand-written figures were moved to match (230 → 231, 74 → 75, 129 → 130).
• Changeset 24693-audit-mail-bodies.md: minor for plugin-audit and cli, with Clause-②: yes as measured: a new operator command and new exports, and no accept set narrowed for an author.

Pins

• plugin-audit/src/mail-log-body-migration.test.ts (13): the mask, both planners and the paged runner, over 18.0-shaped rows on all four snapshot sides. It covers dry run, apply leaving 0 clear copies, non-body columns byte-identical, other objects untouched, a re-run that is a no-op, bounded pages, a failed read counted, the preserveAudit context, and no log line naming a body.
• qa/dogfood/test/audit-mail-bodies.dogfood.test.ts (4) runs the real os binary over a fresh copy of the 18.0 fixture:
  • 0: the fixture holds clear copies on both tables;
  • 1: the dry run counts them, and every audit/activity row is byte-identical afterwards;
  • 2: --apply leaves 0 clear copies. A rewritten row differs only in its copy column, and there only in the body keys, which now read the mask. Every other column (updated_at included) and every other row is byte-identical;
  • 3: a re-run masks nothing and changes no byte.
  • It declares test-budget: 20 (measured 12.84 s locally).
• Reverse verification (ablation through scripts/ablation-replace.mjs; the fix was committed first). The rewrite's mask call was made a no-op, plugin-audit rebuilt, and the dist preflight showed the marker live:
  • unit: 7 failed / 13;
  • dogfood: 2 failed / 4 (the dry-run count, and 0-clear after apply).
  • Restored to blob == HEAD, rebuilt, --absent preflight clean, tree clean; then 13/13 and 4/4 green again.

Proof (18.x line)

• R1: fresh boot (pnpm dev -- --fresh on a random port): health 200, seeded-admin sign-in 200, 0 error lines, server stopped.
• R2: upgrade-18x-harness.dogfood.test.ts passes, together with identity-mail-read-gate and the new pin: 3 files, 32 passed.
• R3: the harness's case 4 (the v17-trait copy is refused at boot), inside the R2 run.
• R4: cli serve-walled-posture-refusal.test.ts: 5 passed.

Tests and gates

• @objectstack/plugin-audit: 59 files, 953 passed. typecheck exit 0 (plugin-audit, cli, dogfood).
• @objectstack/cli unit tier: 314 files, 4,643 passed.
• Integration, on the touched files (data-commands.absent-database, schema-migrate.one-shot-family): 2 files, 151 passed.
• json-stdout-purity.e2e (nightly tier): 64 of 65 pass, including the family-equality case with the new member. The 1 red is os migrate organization-ownership --json's stderr-diagnostics case, a command this diff does not touch. NOT MEASURED on base.
• node scripts/pm/dispatch-gates.mjs --commands derived 104 commands (105 after the census files joined the diff). Exit codes were captured before any pipe:
  • 98 exited 0 on the first sweep.
  • Fixed and re-run at exit 0: check-tenant-audit-census and its --self-test (the new write call site), and check:objectql-double-limit (the test double now applies the caller's bound by presence).
  • NOT MEASURED (exit 3, prerequisite): check-plugin-teardown-shape --self-test (shallow clone), spec check:skill-examples and check:dual-build-cjs-loads (both need a full-workspace build). CI runs them.
  • check:merge-driver (new in the second derivation) exit 0. --ran reconciled 105 of 105.
• check-governed-merges --branch: 0 of 13 paths on the register, not governed. 1,130 changed lines.
• After merging main (head 6da0543a, clean merge; main brought one plugin-audit change, sys-audit-log.object.ts): rebuilt the dogfood closure. plugin-audit: 59 files, 959 passed. Dogfood (audit-mail-bodies, upgrade-18x-harness, identity-mail-read-gate): 3 files, 32 passed. check-tenant-audit-census: exit 0.

Acceptance notes

• The upgrade-harness fixture is a dump of TABLES only, so it carries no sys_activity view (the rotation's read view over its shards). Any read-only boot over it, which creates nothing, reads no activity rows. The new pin puts the view back as the server left it, and says so. A real 18.0 database carries the view, so this is fixture fidelity, not a command defect. It affects any read-only command test on that fixture.
• A platform administrator, the one reader the body field is served to, no longer reads a pre-upgrade mail body in the audit trail once the command has run. The mail log row keeps its body behind its gate. The changeset says so.
• The option-B precondition is recorded on security(plugin-audit): mask the mail bodies already copied into sys_audit_log / sys_activity before #24688 — a cleanup, and the precondition for giving organization admins their own mail bodies back #24693, in the os-dev report.
• Not touched: docs/adr/**, content/docs/releases/, every ceremony file of feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VHugC2zLtDQFNVzioMiUBo

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cli, @objectstack/plugin-audit, touching 26 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/plugins/plugin-audit/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

28 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json d20bf9b09b8084c64e021e9ba8d77c03fe6195e0.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-audit/src/index.ts) — pages documenting those are invisible to this run
• 7 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 35 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d20bf9b09b8084c64e021e9ba8d77c03fe6195e0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ca686f2f58cafb01ad906edd1d7b3a132880d2c2 — the merge of head ee7a0710319eb6dea05e3dddbee251f557526fad into base d20bf9b09b8084c64e021e9ba8d77c03fe6195e0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ca686f2f58cafb01ad906edd1d7b3a132880d2c2 && git checkout ca686f2f58cafb01ad906edd1d7b3a132880d2c2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d20bf9b09b8084c64e021e9ba8d77c03fe6195e0 ee7a0710319eb6dea05e3dddbee251f557526fad && git checkout -B drift-repro d20bf9b09b8084c64e021e9ba8d77c03fe6195e0 && git merge --no-ff ee7a0710319eb6dea05e3dddbee251f557526fad

node scripts/docs-audit/affected-docs.mjs --json d20bf9b09b8084c64e021e9ba8d77c03fe6195e0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d20bf9b09b8084c64e021e9ba8d77c03fe6195e0 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 6da0543a69de86d1aed144dd0ea7609beb75b592
Local-runs: none

① Derived judgments

Face: the paths decide none; the changeset .changeset/24693-audit-mail-bodies.md carries Clause-②: yes with no arm, so the record-recogniser prescribes the declaration face. Reviewed at contract-tier rigour regardless. Head verified: origin/claude/issue-24693-mirror-body-cleanup = 6da0543a69de86d1aed144dd0ea7609beb75b592, merge-base with origin/main = 54159fd742e5a79fc10ac41854dba3395e1a1ffe (main's tip), 7 commits, 15 files, +1147/−35.

1. Correctness and completeness — holds.

• Every stored clear copy is reached. sys_audit_log holds a row copy only in new_value / old_value (packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts:361-372); its metadata column (:406) carries the performer pair only (audit-writers.ts, the performed_by / on_behalf_of block above the row insert), and a read-audit row stores null on both sides (read-audit.ts:647-648). sys_activity holds the copy in metadata as the { old, new, _textSources } pair (objects/sys-activity.object.ts:273; audit-writers.ts:2211-2234); summary is rendered from the object's title field, which for both mail logs is subject (platform-objects/src/audit/sys-email.object.ts:29-30, sys-identity-email.object.ts:48-49), the tracked-change branch renders only fields declaring trackHistory: true (audit-writers.ts:790) and neither mail log declares one; record_label is the same title; changed_fields is a field-name list (type: 'tags', sys-activity.object.ts:288-292). So the two planners cover all four snapshot sides: planMailLogBodyAuditRowPatch (mail-log-body-migration.ts:96-107) over new_value and old_value, planMailLogBodyActivityRowPatch (:115-132) over both halves of the pair, keeping the pair's other keys. Both objects: the page predicate is object_name $in MAIL_LOG_OBJECTS (:189), the writer's own constant.
• Reuse, not re-spelling. mail-log-body-mask.ts:16-17 imports SECRET_MASK and MAIL_LOG_BODY_FIELDS / isMailLogObject; audit-writers.ts:22 and :1763-1764 now call maskMailLogBodyCopy in place of the inline loop (behaviour identical: set body to mask, unset stays null, no column invented). The mask helper and the planners are exported from plugin-audit/src/index.ts:70-81.
• Only body bytes move. rewriteSerialized re-serialises only a changed copy (:82-94); the patch names the copy column alone; the write is { ...patch, id, updated_at } under { isSystem: true, preserveAudit: true } (:224-228, the comment-parent-pair-backfill.ts:149-161 shape). The driver keeps a supplied updated_at under preserveAudit on both the plain and the rotation by-id update doors (driver-sql/src/sql-driver.ts:8520-8522, :8771, rotatedUpdateById :10183-10212, which probes every shard so the row's own shard is written). Pinned by the unit case "writes the copy column alone" and by dogfood case 2 (every other column, updated_at included, byte-identical).
• Two non-blocking notes. (i) A rewritten copy column is a parse/stringify round-trip, so a non-body key's bytes could normalise inside a rewritten copy (the precedent does the same; the dogfood compares parsed values). (ii) A row whose stored updated_at is null is not re-supplied (:227) and the driver then stamps it; the fixture's columns default to now, so none observed. Both are the family's existing shape.

2. Idempotence and safety — holds.

• Re-run no-op: maskMailLogBodyCopy returns false on a copy already masked (mail-log-body-mask.ts:34-37), so the planners return null and nothing is written; pinned in the unit test (planner idempotence, and the paged --apply re-run) and dogfood case 3.
• Partial failure resumable: single-id writes, a thrown read or write counted in failures (:191-196, :229-234), the CLI exits 1 on any failure (audit-mail-bodies.ts:174-176, :215); a re-run only revisits copies still holding a body.
• Batching and memory: keyset paging on id ascending, 500 rows a page (:58, :178-201), one page in memory at a time; the unit pin with pageSize: 2 asserts every page is bounded and each copy is read once.
• Dry run is the default; --apply writes; the report is counts only (MailLogBodyMigrationReport, :138-149). The CLI prints table names and counts (audit-mail-bodies.ts:184-188); the runner's log lines name a table and an id only (:206, :231); pinned "no log line names a body".
• Transaction boundaries: none, as the family (audit-metadata-bodies); acceptable for a row-local idempotent rewrite.
• Postures: the read runs as the platform so RLS (sys_audit_log_org, sys-audit-log.object.ts:176-178) is bypassed and every organization's copies are reached; the system-write organization rule is insert-only by design (objectql/src/tenancy/system-write-organization.ts:103-106), so the by-id update is not refused under a wall; sys_audit_log declares systemFields: { tenant: false } (:31). The boot is the family's bootSchemaStack, read-only for the dry run (deferSchemaDdl, readOnlyProbe, audit-mail-bodies.ts:131-136), with absentTableReads so a measured-absent table reads as no rows and the rotation view is always read (:159-165).
• Who runs it: an operator with database access (--database-url / OS_DATABASE_URL), no running server; the same door as every os migrate data command.

3. Interaction with PR #24681 (head edb2db1e82b8cf7a7c7351779311caba11b358b9) — order-independent; the overlap claim needs correcting.

• Semantics: both logs are masked on every row, no selector, so running before or after the ceremony gives the same end state; the ceremony re-points moved rows' activity copies to sys_identity_email (masked the same) and does not rewrite sys_audit_log. Agreed.
• Files: the PR body says the overlap is zero. It is not: 3 of this PR's 15 paths are also in feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681's 74 (content/docs/deployment/cli.mdx, docs/qa/platform-checklist/areas/cli.json, packages/cli/src/utils/schema-migrate.one-shot-family.integration.test.ts). A git merge-tree of the two heads shows cli.json and the one-shot family test merge clean, and cli.mdx conflicts only in the 17.x callout and the organization-ownership section, lines this PR does not touch (that is feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681's own drift against main's fix(cli): the organization-ownership drop refusal says what 18.0 supports for a v17 database #24635 / fix(runtime): the organization-ownership boot refusals say what 18.0 supports and name no step of the withdrawn ceremony command #24682 text). None of this PR's hunks conflict. The claim's rule, whichever lands second merges main, covers it.

4. Tests — adequate; small gaps, none blocking.

• Unit mail-log-body-migration.test.ts (13): mask, both planners on all four sides, dry run, apply to 0 clear, non-body columns byte-identical, a non-mail object as control, re-run no-op, bounded pages, a failed read counted, the preserveAudit context, no log line naming a body.
• Dogfood audit-mail-bodies.dogfood.test.ts (4) over a fresh copy of upgrade-harness/fixture-18.0 through the real binary: clear copies present on both tables (floor greater than 0, count measured by the test), dry run counts and writes nothing, --apply leaves 0 and moves no other byte, re-run no-op; test-budget: 20 declared. The fixture dump carries tables and indexes only (sqlite-text-dump.ts:35-38), so the test recreates the sys_activity view as the union of its shards (:143-152) before the read-only boot reads it; this is fixture fidelity, correctly stated.
• CLI: absent-database roster with control rows on both tables; one-shot family table (no-write and write arms); --json purity family member.
• Ablations as reported: unit 7/13 red, dogfood 2/4 red with the mask call made a no-op, restored to HEAD. Not re-run here.
• Gaps: no case above one page of 500 rows (bounded paging pinned at pageSize: 2); the 18.0 fixture holds no sys_identity_email rows (the unit test covers that object); the dogfood pins the fixture's count by measuring it rather than asserting the reported 2 + 2.

5. R1–R4. As reported by the dev before and after the main merge: fresh boot green, upgrade harness plus identity-mail read gate plus the new pin 3 files / 32 passed, the v17-trait refusal inside that run, serve-walled-posture-refusal 5 passed. Not re-run under this read-only record.

6. CLI surface — conforms. Flags are audit-metadata-bodies's one for one (--database-url, --apply, --yes, --force, --json; audit-mail-bodies.ts:67-85), same occupancy gate, confirmation and JSON refusal shapes; registered by oclif's pattern strategy (cli package.json oclif.commands.strategy: pattern). Docs: the cli.mdx data-migration table row, the empty-database paragraph and a new section; checklist item cli.migrate-plan-apply-json revision 6 with the 19th variant (19 non-test command files under commands/migrate/ on the head, verified). Changeset: minor for @objectstack/plugin-audit and @objectstack/cli, Clause-②: yes, no arm. Correct for a new operator command and new exports with nothing narrowed.

7. Dev note (b), json-stdout-purity.e2e red on migrate organization-ownership. Not this PR's path. main already fails that case: commit ae6bd1a69 (#24480) made the default export MigrateOrganizationOwnership refuse before any boot (packages/cli/src/commands/migrate/organization-ownership.ts:1123-1164, emitting the compact plan_refused document and nothing on stderr), while the file still contains bootSchemaStack( in the ceremony class (:510, :722) and a json: Flags.boolean(, so the discovery keeps the member and the test's "every boot diagnostic on stderr" case cannot see [StandaloneStack], Bootstrap complete or Graceful shutdown complete. The parse and no-kernel-record cases still pass, which matches the dev's 64 of 65. f89d29e38 (#24635) and 9e2722a92 (#24682) changed refusal text only. The FAMILY comment in the test (main :121-128) is stale since #24480. #24681 deletes the refusing subclass and restores the ceremony, which boots, so landing it cures the case. Nightly tier, so no PR run collects it.

8. CI check-runs on the head at review time. Lint & Repo Gates: FAILURE. Inside it, Lint · CI, release & engine gates is red on exactly one of 61 gates, WHERE-matcher conformance gate (pnpm check:where-matcher), whose output names this PR's new file: packages/plugins/plugin-audit/src/mail-log-body-migration.test.ts, line 148 matches, "NEW silently-wrong WHERE matcher (1 silent, 0 unjudged): no combinator branch (combinator read as a field name)"; 565 of 566 discovered matchers conform. Green: Build Core, Build Docs, TypeScript Type Check (source, consumer, debt ledger, workspace), Lint · ESLint, Lint · docs & code guards, Lint · repo & tooling gates, Lint · PM dispatch-gates, Check Changeset, Governed Surface Queue Guard, Check PR Size, both single-writer / same-issue claim guards, the card-claims-branch guard, Flag docs, Spec property liveness, Documentation Links, Dogfood Regression Gate, Test Core 5/6. In progress: Test Core 1, 2, 3, 4, 6 of 6. Skipped by filter: Console Pin Gate, Dogfood Verify CLI, Temporal Conformance, the dogfood shards, the packed-tarball smoke.

Blocking items

• B1 — CI red on the head, caused by the diff. The fake engine's matches in packages/plugins/plugin-audit/src/mail-log-body-migration.test.ts:148-154 handles $and, $in, $gt and equality, and reads any other $-key, $or included, as a field name, so a combinator query is answered silently wrong (the gate's shape b). The gate's baseline never grows. Fix: make the double refuse what it does not implement, the posture the gate header prescribes: inside the entries callback, before the equality fallback, if (key.startsWith('$') && key !== '$and') throw new Error(...) and, for an operator object whose keys are not $in / $gt, throw as well (or implement $or with .some over matches). Then run pnpm check:where-matcher (self-test first, as the script does) and push; the dev's local dispatch-gates --commands derivation (104 / 105) did not surface this gate, so it belongs in the dev's re-check list.

② Semver level

minor for @objectstack/plugin-audit (new exports: maskMailLogBodyCopy, migrateMailLogBodyCopies, the two planners, MAIL_LOG_BODY_COPY_OBJECTS, MAIL_LOG_BODY_MIGRATION_PAGE_SIZE, two types) and minor for @objectstack/cli (new command os migrate audit-mail-bodies). Clause-②: yes on the PR body and in the changeset, no arm; nothing an author can write is removed or narrowed. The level is correct; the changeset body carries the operator instruction (run once after upgrading, dry run first) and states who sees a difference.

③ Boundary flags

• Governed surfaces: none of the 15 paths is on the register (docs/adr/**, .claude/**, workflows, AGENTS.md untouched); no ceremony file of feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 is touched; content/docs/releases/ untouched.
• Correction owed on the PR body: "File overlap with PR feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 is zero" is false at the file level (3 shared paths, see ①.3); the hunks do not collide.
• Residual R-a (not this PR's path): json-stdout-purity.e2e's organization-ownership stderr case is red on main since feat(cli)!: 18.0 guards — os migrate organization-ownership refuses, and os serve refuses a walled posture at boot #24480 (ae6bd1a69); feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 cures it by restoring the booting ceremony; the FAMILY comment in packages/cli/test/json-stdout-purity.e2e.test.ts describing that member's refusal face as "emitted after the stack is shut down" is stale until then. Carry it on feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681's card or file a nightly-tier note.
• Residual R-b (outside the card's measured scope): sys_audit_log declares archive: { after: '90d', to: 'archive' } (sys-audit-log.object.ts:38-39); the Archiver copies cold rows to engine.datasource(archive.to) and hot-deletes them (objectql/src/lifecycle/lifecycle-service.ts:1072-1084, :1305-1316). On a deployment with that datasource registered, pre-fix(platform-objects,plugin-audit,plugin-approvals)!: mail bodies are read only with manage_platform_settings, and the audit mirrors never copy them in clear #24688 copies older than 90 days sit in the cold store, which this command, reading the hot engine, does not reach. Note it on security(plugin-audit): mask the mail bodies already copied into sys_audit_log / sys_activity before #24688 — a cleanup, and the precondition for giving organization admins their own mail bodies back #24693 as a measured follow-up (count first; most deployments register no archive datasource and retain).
• Option-B precondition recorded on security(plugin-audit): mask the mail bodies already copied into sys_audit_log / sys_activity before #24688 — a cleanup, and the precondition for giving organization admins their own mail bodies back #24693 (os-dev report 6281679244) is consistent with the code: the cleanup uses no identity selector and masks both logs, so condition 1 is independent of the selector conditions.
• Census: the one new write call site (mail-log-body-migration.ts update, object undecidable, elevated) is in the regenerated tenant-audit census and the hand-written page figures moved with it (230 → 231, 74 → 75, 129 → 130).
• No credential, token, link or body value appears in the diff's tests, logs or docs; the test bodies are sentinels and the mask literal in the changeset is the public mask glyph.

Implemented-by: claude/issue-24693-mirror-body-cleanup
Reviewed-by: session_01Y5583bs2RDd53MH6kM1ca3

VERDICT: FAIL

[objectstack-fleet]

Seat re-review · TIER_DEFAULT (in-seat, B1 only) · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-20T02:59Z

Head ee7a07103. This supersedes the FAIL of 6281834236 on its single blocking item; every other judgment in that record stands.

• B1 resolved. The only file changed since 6da0543a is mail-log-body-migration.test.ts (+22 / -10). The double's matcher is now a module-level matchesWhere that implements exactly equality, $in, $gt and $and, and throws on any other $-combinator or operator. A combinator key can no longer be read as a field name. Locally, check:where-matcher, check:objectql-double-limit and check:engine-double-contract exit 0; unit 13/13, dogfood 4/4 (addendum 6282002294).
• CI on ee7a07103: every required check succeeded, including "Lint · CI, release & engine gates" and all 6 Test Core shards.
• Residuals, recorded on security(plugin-audit): mask the mail bodies already copied into sys_audit_log / sys_activity before #24688 — a cleanup, and the precondition for giving organization admins their own mail bodies back #24693:
  • (a) json-stdout-purity's organization-ownership stderr case has been a main red since feat(cli)!: 18.0 guards — os migrate organization-ownership refuses, and os serve refuses a walled posture at boot #24480; feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 cures it.
  • (b) Correction to this PR body: file overlap with feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 is not zero. cli.mdx, cli.json and schema-migrate.one-shot-family.integration.test.ts are shared, and no hunk of this PR conflicts.
  • (c) Copies already moved to an archive datasource by sys_audit_log's 90-day lifecycle are not reached by this hot-engine rewrite. That is a stated limit, and it qualifies option-B precondition 1.

VERDICT: PASS. Not governed, 1,194 lines. The seat sets it ready with auto-merge on.