fix(plugin-audit): leave the lifecycle sweeper's watermark out of the audit ledger

Every completed sweep wrote its sys_lifecycle_state row through the
generic audit writers, so each sweep fed sys_audit_log and sys_activity a
row the next sweep archives. The archive integration tests of
os migrate audit-key-material / audit-mail-bodies counted it as a second
archived row.

Claude-Session: https://claude.ai/code/session_016WV4cxAY2io7s5aVJa6YL4
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/29918-lifecycle-sweep-watermark.md

@@ -3,6 +3,7 @@
 '@objectstack/objectql': minor
 '@objectstack/platform-objects': minor
 '@objectstack/cli': minor
+'@objectstack/plugin-audit': minor
 ---
 
 Clause-②: yes (widening) — `PLATFORM_OBJECTS_BY_PACKAGE['platform-objects']` (and so `PLATFORM_PROVIDED_OBJECT_NAMES` / `isPlatformProvidedObjectName`) lists one more real platform object, `sys_lifecycle_state`. Its readers resolve references against the roster and none refuses an author declaration, so a stack that references the object now resolves it instead of drawing the unknown-platform-name advisory; nothing that was accepted is refused.
@@ -13,4 +14,4 @@ The lifecycle sweep remembers when it last completed, so a kernel that reboots o
 
 `LifecycleService` now keeps a watermark in a new engine-owned, tenant-less object, `sys_lifecycle_state` (declared and registered by `@objectstack/platform-objects`, one row per datastore, id `lifecycle`). At the initial delay the scheduler reads that one row: when the last completed sweep is younger than the sweep interval, the first sweep waits for the interval and the read is the only statement issued. An older or missing watermark, a kernel without the object, or a read that fails (logged at `warn`) sweeps at the initial delay as before. Every sweep that completes with no policy error and a finished reference audit advances the row; a failed or partial sweep leaves it alone. A datastore the process created from empty still defers its first sweep one interval, and now seeds the row. A direct `sweep()` call still always sweeps.
 
-The row is internal state, not a setting: no settings key, no environment variable, no audit row per sweep and no data API (`apiEnabled: false`). `OS_LIFECYCLE_DISABLED=1` still arms nothing. `os migrate organization-ownership` inventories the new table as deployment-level state with no organization column.
+The row is internal state, not a setting: no settings key, no environment variable, no audit row per sweep and no data API (`apiEnabled: false`). `@objectstack/plugin-audit` leaves `sys_lifecycle_state` out of `sys_audit_log` and `sys_activity`, so a sweep writes no ledger row for its own clock. `OS_LIFECYCLE_DISABLED=1` still arms nothing. `os migrate organization-ownership` inventories the new table as deployment-level state with no organization column.

packages/plugins/plugin-audit/src/audit-writers.test.ts

@@ -323,6 +323,29 @@ describe('audit writers — operational plumbing is excluded (#5193, ADR-0057 D5
     }
   });
 
+  it('writes NO audit/activity row for the lifecycle sweeper\'s watermark, first insert or hourly update (ADR-0057 §3.3)', async () => {
+    // `LifecycleService` inserts the `sys_lifecycle_state` row after its first
+    // completed sweep and updates it after every one since. Audited, each
+    // sweep fed the ledger a row the next sweep archives: cleanup re-feeding
+    // the table it drains.
+    const { engine, fire, created } = makeEngine({ ...SCHEMA, sys_lifecycle_state: ['id', 'last_swept_at'] });
+    installAuditWriters(engine as any, 'test.audit');
+    await fire('afterInsert', {
+      object: 'sys_lifecycle_state',
+      input: { id: 'lifecycle', last_swept_at: '2026-11-06T00:00:00.000Z' },
+      result: { id: 'lifecycle', last_swept_at: '2026-11-06T00:00:00.000Z' },
+      session: { isSystem: true },
+    });
+    await fire('afterUpdate', {
+      object: 'sys_lifecycle_state',
+      input: { id: 'lifecycle', last_swept_at: '2026-11-06T01:00:00.000Z' },
+      previous: { id: 'lifecycle', last_swept_at: '2026-11-06T00:00:00.000Z' },
+      result: { id: 'lifecycle', last_swept_at: '2026-11-06T01:00:00.000Z' },
+      session: { isSystem: true },
+    });
+    expect(created).toEqual([]);
+  });
+
   it('pays no before-phase snapshot read — for the skipped object OR the business one (#6656)', async () => {
     // [#6656] This case used to assert the saving for `sys_job_queue` only,
     // with `crm_lead` as the CONTROL that still paid — because #5860 could

packages/plugins/plugin-audit/src/audit-writers.ts

@@ -298,6 +298,14 @@ const SKIP_OBJECTS = new Set<string>([
   // and keep their compliance value, so they stay audited (see #5202).
   'sys_upload_session',          // chunked-upload progress (1 write per chunk)
   'ai_traces',                   // LLM trace telemetry
+  // [ADR-0057 §3.3] The lifecycle sweeper's own clock state (one row per
+  // datastore, `managedBy: 'engine-owned'`), written ONLY by objectql's
+  // `LifecycleService` under SYSTEM_CTX after every completed sweep. Audited,
+  // each sweep would feed `sys_audit_log` and `sys_activity` the very rows the
+  // next sweep archives or reaps: cleanup re-feeding the tables it drains.
+  // Not an act anyone performed; the ruling that created the object forbids
+  // an audit row per sweep.
+  'sys_lifecycle_state',         // sweep watermark (1 write per sweep)
 ]);
 
 /**