fix(plugin-audit): a user's own sys_user_preference write no longer reaches their bell as a sys_activity row

[objectstack-fleet]

Fixes #22961

Clause-②: no

A user's own write to their own sys_user_preference row (the console's ui.recent, ui.favorites and palette recents) no longer adds a sys_activity row, so it no longer reaches the user's bell as Updated User Preference "ui.recent". The sys_audit_log row for the same write is unchanged.

What the bell entries are, measured

The card marked its mechanism "to confirm". Measured on origin/main a2240c4dc:

• They are sys_activity rows, not inbox messages. A throwaway probe (not committed) used the real ObjectKernel, ObjectQLPlugin, AuditPlugin, SQLite and the shipped SysUserPreference object. It created and then updated a user's own ui.recent row, acting as that user. Each write produced one sys_audit_log row and one sys_activity row. The update's summary was Updated User Preference "ui.recent" (the card's text), with actor_id set to the user. The objectui bell's Activity tab lists the newest sys_activity rows the caller may read. Its second line is timeAgo · object_name, which matches the card's · sys_user_preference subtitle; notification rows show no object name.
• Nothing turns a record write into a sys_inbox_message. service-messaging registers no data hook. The only callers of emit() are approvals, comment @mentions, the automation notify node and the HTTP nodes. Subscription expansion (sys_notification_subscription) is not wired, and its object docblock says so. So the inbox half of the card's acceptance item 3 already holds on main, and the activity mirror is the channel to change.
• Other writers of a preference row. Members are limited to their own rows by RLS (sys_user_preference_self, user_id == current_user.id). An organization admin's wildcard modifyAllRecords passes that RLS, and Setup lists the object (nav_user_preferences), so an admin can edit another user's row. No server-side code writes the object. These writers keep today's rows.
• Which objects are in the class. The console keeps all of its per-user UI state on sys_user_preference: objectui's ConsoleShell binds its ui.favorites, ui.recent and ui.flow.palette.recents adapters to it. No other per-user UI-state object exists. No spec key means "per-user UI state". The existing enable.activities: false mutes every writer, which is wider than this rule.

The change

In packages/plugins/plugin-audit/src/audit-writers.ts:

• Beside SKIP_OBJECTS, a closed, module-private map, PER_USER_UI_STATE_OWNER_FIELD (sys_user_preference maps to user_id). Its comment writes the rule down: what reaches a user's bell is another actor's act or something the user needs, never the user's own UI state.

• In writeAudit, the writer keeps the ledger row and skips the activity row when both of these hold:

  • the object is in the map;
  • the user the activity row would name (userId, the actor_id value) is the owner on every side of the row the write carries.

  It also skips the actor-name read, which only feeds the activity row. This is the same seam as the existing enable.activities opt-out.

• Not touched: SKIP_OBJECTS; AUDIT_EXCLUDED_OBJECTS, which the hook registration and read-audit.ts read; the package entry. dist/index.d.ts names neither new symbol (0 hits; the control installAuditWriters has 3). The sys_audit_log row a preference write produces is unchanged.

Pins (audit-writers.test.ts)

• The owner's own create, update and delete of a sys_user_preference row each produce exactly one sys_audit_log row (action, user_id and record_id asserted) and zero sys_activity rows.
• CONTROL: the same user's update of an ordinary audited object keeps its activity row.
• CONTROL: on a user's preference row, each of these keeps its activity row, with the expected actor_id:
  • a write by another user (an admin);
  • a system write with no user;
  • the owner moving the row to another user.

Ablations ran through scripts/ablation-replace.mjs in wrap mode. For each one the tool showed the anchor count going 1 to 0 on disk and the blob changing. It then proved the restore: blob equal to HEAD and an empty git diff HEAD. They ran on 2632f1ee5, whose plugin-audit sources are byte-identical to the head:

1. Skip removed (mirrorsActivity = activitiesEnabled): Tests 3 failed | 4 passed. The three own-write pins fail with AssertionError: expected [ { object: 'sys_activity', …(1) } ] to have a length of +0 but got 1.
2. Blanket mute (owner check removed): Tests 3 failed | 4 passed. The three other-writer controls fail with AssertionError: expected [] to have a length of 1 but got +0.
3. Ledger row dropped (sys_user_preference added to SKIP_OBJECTS): Tests 6 failed | 1 passed. The own-write pins fail at audit-writers.test.ts:727, the sys_audit_log length assertion.

The first attempts at ablations 2 and 3 were no-ops. Their replacement text contained the anchor, so ablation-replace saw the anchor count stay at 1, refused before running the tests, and restored the file. Both were re-run with anchors the replacement does not contain. The readings above are from the re-runs.

The card's acceptance item 1 (a browser walk) was not done. The pins carry it at the writer seam that produces the rows.

Verification

• @objectstack/plugin-audit unit suite, at 2632f1ee5 (later commits change only the changeset): Test Files 47 passed (47), Tests 750 passed (750).
• pnpm --filter @objectstack/plugin-audit typecheck (tsc, the scripts project and check:test-typecheck over tsconfig.test.json): exit 0.
• Dependency closure (turbo run build --filter=@objectstack/plugin-audit^..., 15 tasks) and the package's own build (check-dts-emitted: 1/1 declaration file present): exit 0.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands over this branch (3 paths, 67 families), every command run and reconciled with --ran.
  • At 03373429f: Run reconciliation — 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN, with every recorded exit code 0.
  • A first pass at 2632f1ee5 recorded check:dual-build-cjs-loads and check:i18n at exit 3 (PREREQUISITE NOT MET), because other packages had no dist/. Later in that pass, check:type-check-debt built the whole workspace through turbo run typecheck.
  • On the head pass both measured green: 107 CommonJS entries across 66 packages load, and 9 packages' translation bundles are in sync.
• Lint, scoped to the touched files, with three pieces of evidence:
  • eslint's own config claims both files (--print-config: 6 and 5 rules); it claims nothing for the changeset .md.
  • eslint --no-inline-config --format json over the two files: 2 files, 0 errors, 0 warnings, at 03373429f.
  • eslint.config.mjs never enables type-aware linting (no parserOptions.project, no typed rules, stated at its line 327), so this diff cannot change the result for any file it does not touch.
• origin/main was merged before opening the PR. It was still a2240c4dc (remote tip read with ls-remote), so the merge was a no-op.

Acceptance notes

• Activity rows written before this change are not deleted. They leave the feed when the 14-day sys_activity retention (lifecycle.retention.maxAge: '14d') removes them. The changeset says so.
• For a skipped activity row, the writer still composes the summary and resolves the locale, exactly as it does today for enable.activities: false. That work is wasted but has no observable effect. Not filed.
• The bell's Activity tab shows sys_activity.object_name verbatim (objectui InboxPopover.tsx, filled by activityItemType.ts). Every other activity row therefore still shows a machine name such as crm_lead rather than the object's label. This is reported to the seat as a candidate in objectui. It is not in this PR.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-audit, touching 6 documentable anchor(s).

12 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/error-catalog.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/data-modeling/drivers.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/data-modeling/objects.mdx (via sys_user_preference (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/deployment/cli.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/kernel/runtime-services/audit-service.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/permissions/authentication.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/permissions/delegated-administration.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/permissions/permission-sets.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/permissions/positions.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/permissions/record-view-auditing.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/permissions/system-context.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/protocol/kernel/config-resolution.mdx (via user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via sys_user_preference (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/releases/v16.mdx (via sys_user_preference (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))
• content/docs/releases/v17/17-5.mdx (via sys_user_preference (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD), user_id (literal, a string literal in PER_USER_UI_STATE_OWNER_FIELD))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 6a40a09ed952f83b1f765d47cd76aee4a41f6672 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c24b031694e12fde9175bc15608431b7ab810baa — the merge of head 5adbe6e7555699708080bd70726bfdd6bc54df12 into base 6a40a09ed952f83b1f765d47cd76aee4a41f6672, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c24b031694e12fde9175bc15608431b7ab810baa && git checkout c24b031694e12fde9175bc15608431b7ab810baa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6a40a09ed952f83b1f765d47cd76aee4a41f6672 5adbe6e7555699708080bd70726bfdd6bc54df12 && git checkout -B drift-repro 6a40a09ed952f83b1f765d47cd76aee4a41f6672 && git merge --no-ff 5adbe6e7555699708080bd70726bfdd6bc54df12

node scripts/docs-audit/affected-docs.mjs --json 6a40a09ed952f83b1f765d47cd76aee4a41f6672

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6a40a09ed952f83b1f765d47cd76aee4a41f6672 → pass the list as
args.docs, on the commit named under Which tree this was computed on.