@@ -0,0 +1,14 @@
+---
+'@objectstack/service-settings': patch
+'@objectstack/plugin-audit': patch
+---
+
+fix(service-settings): a settings `config_change` audit row records the value before and after the change, with secrets kept as digests
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+A settings write's `config_change` row on `sys_audit_log` recorded who changed which key and when, plus a digest of the new value. It had no `old_value`, and its `new_value` held no readable value, so the row could not show what a policy setting (for example `auth.allowed_ip_ranges`) was changed from or to. ADR-0007 (Audit & history) asks for both, with an encrypted value recorded only as a placeholder and a checksum.
+
+- **`@objectstack/service-settings`.** `new_value` is `{ namespace, key, scope, value, digest }`. `old_value` has the same shape for the value the same stored settings row held before the write. It is `null` when that row held no value: a first write at that scope, or a row an earlier reset cleared. A reset now records its before value in `old_value`, and its `new_value` stays `null`. A secret-valued key, which is one the manifest declares `encrypted: true` (`type: 'password'` forces it), carries no `value` on either side. Each side carries only its masked digest, `<encrypted:hmac-sha256:…>`, or `<encrypted>` when no keyed digest is available. That is the same `new_value` such rows had before, so readers that parse it keep working. A row stored encrypted is never shown either, even if the key is no longer declared secret. `metadata` is unchanged and carries no value. `SettingsAuditSink.record` gets two optional entry fields, `value` and `previous`, and a host sink that ignores them works as before.
+- **`@objectstack/plugin-audit`.** The ledger's read-side field redaction now also applies to a `config_change` row about a settings store (`sys_setting`, or `sys_platform_setting` for a global value). If a reader's field-level security masks that store's `value` field, the reader gets neither the value nor its digest on either side. They still see which setting changed. The CRUD mirror's row about the same write is narrowed the same way. Readers who can see the field get the row exactly as stored.
@@ -3326,7 +3326,7 @@
       "title": "The settings audit trail keeps no fingerprint of a secret-valued setting that a reader can match offline: both ledgers record the platform's keyed digest or none, never the value or an unkeyed hash, so a caller who can only read the audit rows learns that the secret changed and nothing about its value",
       "since": "v17",
       "status": "active",
-      "revision": 5,
+      "revision": 6,
       "priority": "P1",
       "surface": "api",
       "personas": [
@@ -3408,7 +3408,7 @@
       },
       "source": [
         "packages/services/service-settings/src/settings-service.ts#secretAuditDigest (one helper supplies a secret write's fingerprint on both write branches, the sys_secret path and the legacy inline-adapter path: the provider's keyedDigest, or null with a once-per-key warn; never the adapter's unkeyed digest)",
-        "packages/services/service-settings/src/config-change-audit.ts#CONFIG_CHANGE_ACTION (the sys_audit_log config_change row: object_name sys_setting, new_value carries namespace/key/scope/digest, never the value; null on a reset)",
+        "packages/services/service-settings/src/config-change-audit.ts#CONFIG_CHANGE_ACTION (the sys_audit_log config_change row: object_name sys_setting, or sys_platform_setting for a global value; new_value carries namespace/key/scope/digest, null on a reset, and old_value the same shape for the value the stored row held before, null when it held none; a secret-valued key's sides carry the masked digest and never the value, while a non-secret key's also carry the value readable)",
         "packages/spec/src/contracts/crypto-provider.ts#keyedDigest (the contract text: a secret's audit fingerprint comes from keyedDigest and never from digest; with no keyed digest the trail records none)",
         "packages/services/service-settings/src/manifests/mail.manifest.ts (mail.api_key: type password, encrypted: true)",
         "#21792 (the maintainer ruling: secret-valued settings are fingerprinted with the keyed digest, never an unkeyed one; non-secret settings unchanged) · PR #21809 (the fix)",
@@ -3444,6 +3444,12 @@
           "date": "2026-10-27",
           "change": "steps[3] and [6], acceptance[1].clause, [4] (clause, verify), negative[0] and automated.ref re-pointed: a non-secret setting's audit digest is now the SHA-256 the sys_setting_audit / sys_platform_setting_audit columns declare, spelled 'sha256:' + 64 hex (crypto-adapter.ts settingAuditDigest), no longer the adapter's FNV-1a 32 ('fnv32:'). The step-7 control computes the algorithm the service now writes, so it can still prove the offline search would find an unkeyed digest. Not loosened: the secret search keeps the FNV-1a 32 as a second net, so a secret row carrying either unkeyed form still fails",
           "ref": "#26465"
+        },
+        {
+          "revision": 6,
+          "date": "2026-11-06",
+          "change": "source[1] re-pointed: the config_change row now records the before (old_value) and the after readable for a non-secret key, as ADR-0007 Audit & history decides, so 'never the value' holds for secret-valued keys only. No clause changed: every clause here scores the secret key mail.api_key, whose rows still carry the masked keyed digest and never the value, on both sides",
+          "ref": "#30923"
         }
       ]
     },
 
@@ -350,3 +350,83 @@ describe('[#21155] sys_audit_log before/after snapshots are served through the s
     for (const v of [V.masked2, V.unserved2, V.unservedDel]) expect(blob).toContain(v);
   });
 });
+
+// ---------------------------------------------------------------------------
+// [#30923] A settings write's `config_change` row
+// ---------------------------------------------------------------------------
+
+/**
+ * [#30923] service-settings' `config_change` row carries the setting's value
+ * before and after, readable for a key that is not secret-valued: one field of
+ * the settings store the row names (`sys_setting`, or `sys_platform_setting`
+ * for a global value), with its digest. A reader whose field-level security
+ * masks that field is served neither the value nor its fingerprint, as the
+ * CRUD mirror's row about the same write is narrowed; which setting changed
+ * stays.
+ *
+ * Pinned on the seam's own function over rows in the writer's shape: the writer
+ * is service-settings, which this package does not depend on. Its read-path
+ * mount is the one the scene above pins.
+ */
+describe('[#30923] a config_change row is narrowed by the settings store\'s `value` field', () => {
+  const S = { before: 'ALRSETTINGBEFORE41', after: 'ALRSETTINGAFTER42' };
+  const STORES = ['sys_setting', 'sys_platform_setting'];
+  const STORE_FIELDS = ['id', 'namespace', 'key', 'scope', 'value', 'value_enc', 'encrypted'];
+  /** The settings store's `value` is served to this reader MASKED. */
+  const MASKS_VALUE = { userId: 'u_settings_masked', tenantId: 'org_1' };
+  /** Served every field of the settings stores — the control. */
+  const SERVED_VALUE = { userId: 'u_settings_control', tenantId: 'org_1' };
+
+  const settingsSecurity = {
+    async getReadableFields(object: string): Promise<string[] | undefined> {
+      return STORES.includes(object) ? STORE_FIELDS : undefined;
+    },
+    async getQueryableFields(object: string, context?: any): Promise<string[] | undefined> {
+      const readable = (await settingsSecurity.getReadableFields(object)) ?? [];
+      return context?.userId === MASKS_VALUE.userId ? readable.filter((f) => f !== 'value') : readable;
+    },
+  };
+  const WHICH = { namespace: 'auth', key: 'allowed_ip_ranges', scope: 'global' };
+  const side = (value: string) => JSON.stringify({ ...WHICH, value, digest: 'sha256:' + 'ab'.repeat(32) });
+  const configRow = (object_name: string | null): Row => ({
+    id: 'cc1',
+    action: 'config_change',
+    object_name,
+    record_id: 'set1',
+    old_value: side(S.before),
+    new_value: side(S.after),
+  });
+
+  for (const store of STORES) {
+    it(`masked on ${store}: neither side keeps the value or its digest, and which setting changed stays`, async () => {
+      const row = configRow(store);
+      await redactAuditLogRows([row], settingsSecurity, MASKS_VALUE);
+      expect(snap(row, 'old_value')).toEqual(WHICH);
+      expect(snap(row, 'new_value')).toEqual(WHICH);
+      expect(JSON.stringify(row)).not.toContain(S.before);
+      expect(JSON.stringify(row)).not.toContain(S.after);
+    });
+  }
+
+  it('control: a reader served the store\'s value reads both sides byte-identical to the row at rest', async () => {
+    const row = configRow('sys_setting');
+    const atRest = { ...row };
+    await redactAuditLogRows([row], settingsSecurity, SERVED_VALUE);
+    expect(row).toEqual(atRest);
+    expect(snap(row, 'new_value').value).toBe(S.after);
+  });
+
+  it('a config_change row naming no settings store is served as written', async () => {
+    const row = configRow(null);
+    const atRest = { ...row };
+    await redactAuditLogRows([row], settingsSecurity, MASKS_VALUE);
+    expect(row).toEqual(atRest);
+  });
+
+  it('fail closed: a settings config_change snapshot that is not a JSON object is dropped', async () => {
+    const row = { ...configRow('sys_setting'), old_value: `not json ${S.before}` };
+    await redactAuditLogRows([row], settingsSecurity, SERVED_VALUE);
+    expect(row).not.toHaveProperty('old_value');
+    expect(snap(row, 'new_value').value).toBe(S.after);
+  });
+});
@@ -47,11 +47,21 @@
  *    the contract publishes WHICH fields are masked, not the masked value.
  *  - A record-write row's snapshot that is not a JSON object cannot be judged
  *    key by key, so it is dropped whole (fail closed).
+ *  - [#30923] A `config_change` row about a settings store
+ *    ({@link AUDIT_LOG_SETTINGS_STORE_OBJECTS}) carries, on each side, ONE
+ *    field of that store: the setting's `value` — readable for a key that is
+ *    not secret-valued — with its `digest` (`service-settings`'
+ *    `config-change-audit.ts`). A reader not served the store's `value` field
+ *    has both dropped, the fingerprint with the value it fingerprints (an
+ *    unkeyed digest of a short value answers "is it X?"), as the CRUD
+ *    mirror's row about the same write drops `value`; `namespace`, `key` and
+ *    `scope` stay. A snapshot that is not a JSON object is dropped whole.
  *  - A row of any other action is served as written. Measured per writer on
  *    the tree this landed on: `read`, `login`, `logout`, `login_failed`,
- *    `account_locked`, `import` and `action_invocation` rows write no snapshot; a `config_change` row's snapshot is a DIGEST of the
- *    setting, never its value (`service-settings`' `config-change-audit.ts`);
- *    a `platform_admin_standing_change` row's is the deployment's
+ *    `account_locked`, `import` and `action_invocation` rows write no
+ *    snapshot; a `config_change` row naming no settings store (the deployment
+ *    notice's hide) describes no field of one; a
+ *    `platform_admin_standing_change` row's is the deployment's
  *    administrator roster (`plugin-security`). None is a parent record's field
  *    map, and narrowing them by a parent's field set would only delete their
  *    own vocabulary.
@@ -87,8 +97,19 @@ import {
   type FieldVisibilitySource,
 } from './served-fields.js';
 import type { ActivityMiddlewareEngine } from './activity-read-visibility.js';
+import { AUDIT_LOG_SETTINGS_STORE_OBJECTS } from './objects/sys-audit-log.object.js';
 
 const LEDGER_OBJECT = 'sys_audit_log';
+
+/**
+ * [#30923] The settings service's ledger action, and the one field of a
+ * settings store its snapshot describes: the `value` both stores declare.
+ * `digest` is that value's fingerprint, so it is judged with it.
+ */
+const CONFIG_CHANGE_ACTION = 'config_change';
+const SETTINGS_STORES = new Set<string>(AUDIT_LOG_SETTINGS_STORE_OBJECTS);
+const SETTINGS_VALUE_FIELD = 'value';
+const CONFIG_CHANGE_VALUE_KEYS = [SETTINGS_VALUE_FIELD, 'digest'] as const;
 const SEAM = 'audit log field redaction';
 
 /**
@@ -111,6 +132,23 @@ const OBJECT_NAME_RE = /^[a-z_][a-z0-9_]*$/;
 
 const RECORD_WRITE = new Set<string>(LEDGER_RECORD_WRITE_ACTIONS);
 
+/**
+ * [#30923] A `config_change` snapshot for a reader not served the settings
+ * store's `value`: drop the value and its fingerprint, keep which setting
+ * changed. Mutates `snapshot`; answers whether it changed.
+ */
+function dropUnservedSettingValue(snapshot: Record<string, unknown>, served: ReadonlySet<string>): boolean {
+  if (served.has(SETTINGS_VALUE_FIELD)) return false;
+  let changed = false;
+  for (const key of CONFIG_CHANGE_VALUE_KEYS) {
+    if (key in snapshot) {
+      delete snapshot[key];
+      changed = true;
+    }
+  }
+  return changed;
+}
+
 /** Drop both snapshot columns — the fail-closed answer for one row. */
 function stripSnapshots(row: Record<string, unknown>): void {
   for (const col of SNAPSHOT_COLUMNS) delete row[col];
@@ -141,7 +179,10 @@ export async function redactAuditLogRows(
       stripSnapshots(row);
       continue;
     }
-    if (!RECORD_WRITE.has(action)) continue;
+    // [#30923] A settings write's row describes one field of its store.
+    const settingsChange =
+      action === CONFIG_CHANGE_ACTION && typeof row.object_name === 'string' && SETTINGS_STORES.has(row.object_name);
+    if (!RECORD_WRITE.has(action) && !settingsChange) continue;
 
     const object = row.object_name;
     if (typeof object !== 'string' || !OBJECT_NAME_RE.test(object)) {
@@ -166,7 +207,10 @@ export async function redactAuditLogRows(
         continue;
       }
       // Untouched bytes for a reader served every key.
-      if (dropUnservedKeys(snapshot, served)) row[col] = JSON.stringify(snapshot);
+      const changed = settingsChange
+        ? dropUnservedSettingValue(snapshot, served)
+        : dropUnservedKeys(snapshot, served);
+      if (changed) row[col] = JSON.stringify(snapshot);
     }
   }
 }
 
@@ -134,7 +134,9 @@ describe('#8145: a settings write reaches sys_audit_log as config_change', () =>
       key: 'workspace_name',
       encrypted: false,
     });
-    // A digest, never the value — the ledger describes the change, not the data.
+    // [#30923] The after, readable — `workspace_name` is not secret-valued —
+    // beside its digest (ADR-0007 § Audit & history).
+    expect(JSON.parse(String(row.new_value))).toMatchObject({ value: WORKSPACE_NAME });
     expect(JSON.parse(String(row.new_value)).digest).toBeTruthy();
     // Generous timeout so a REGRESSION reports `waitForRows`'s own message
     // ("expected at least one config_change row…") rather than vitest's 5s
@@ -157,15 +159,16 @@ describe('#8145: a settings write reaches sys_audit_log as config_change', () =>
     // The pointer pair: object_name names the store, record_id the row in it.
     expect(change.record_id).toBe(String(settingRows[0].id));
     // The record page's same-record list keys on record_id: beside the
-    // config_change row it finds the CRUD mirror's row about the same write,
-    // which holds the non-secret value the digest row does not.
+    // config_change row it finds the CRUD mirror's row about the same write.
+    // [#30923] Both now carry the non-secret value: the config_change row
+    // records it readable, as ADR-0007 § Audit & history decides.
     const mirror = (await findRows(ql, 'sys_audit_log', { record_id: change.record_id })).filter((r) =>
       ['create', 'update'].includes(String(r.action)),
     );
     expect(mirror.length).toBeGreaterThanOrEqual(1);
     expect(mirror.every((r) => r.object_name === change.object_name)).toBe(true);
     expect(mirror.some((r) => String(r.new_value ?? '').includes(WORKSPACE_NAME))).toBe(true);
-    expect(String(change.new_value)).not.toContain(WORKSPACE_NAME);
+    expect(JSON.parse(String(change.new_value)).value).toBe(WORKSPACE_NAME);
   }, 30_000);
 
   it('the shipped `config_changes` list view — its OWN declared filter — now matches', async () => {