@@ -0,0 +1,19 @@
+---
+'@objectstack/plugin-audit': patch
+---
+
+fix(plugin-audit)!: a comment's display name is stamped from the caller's session, like its author id
+
+Clause-②: no (narrowing) — on a `sys_comment` write by a non-system caller, an `author_name` / `author_avatar_url` the request carries is not stored: on create both are the session user's own, and on update both are read-only and dropped (reported in `droppedFields`). Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, export or stored shape is removed, renamed or re-shaped, and no stored row is read, rewritten, converted or dropped, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is a runtime accept set on two platform-written columns of one platform object, `sys_comment.author_name` and `author_avatar_url`, whose values now come from the user's own profile; the remedy for a user who wants another name or picture shown is editing that profile, which no ledger entry can derive. The other categories are closed on facts: the bumped package publishes (not unpublished); no ADR-0087 id covers these columns and this diff adds none (not registered, not already-registered); `installAuditWriters` gains a return value and `installCommentAccessHooks` an optional parameter, so no export is retired and no interface or type narrows (not runtime-export-retired, runtime-interface-only or type-surface-only). -->
+
+**BREAKING** accept-set narrowing on `sys_comment` writes (`@objectstack/plugin-audit`), served by every data door (REST, MCP, the console).
+
+- **Now.** A comment's display identity is the server's, the same as its `author_id`. On create, `author_name` and `author_avatar_url` are the session user's own display name and avatar, read from their `sys_user` profile (the title column and `image`) through the same resolution the record history's actor columns are written with, and assigned whether or not the request carries them. A user whose profile cannot be read is stored with neither. On update both fields are `readonly`: a non-system caller's value is dropped and reported in `droppedFields` and the `X-ObjectStack-Dropped-Fields` header, the rest of the write lands, and the write is never refused, so an edit, the author's or a parent editor's, never changes whose name a comment shows.
+- **Unchanged.** `author_id` keeps its rules. System-context writes (seeds, imports, migrations) keep the values they supply, on create and on update. Comments already stored keep what they were written with. The console needs no change: the create payload it sends is accepted and its display fields are assigned over.
+- **Also.** A comment posted without a display name (a REST, MCP or agent client that sends none) now shows its author's name, where it used to show none.
+- **Hosts that compose the hooks themselves.** `installAuditWriters` now returns a handle whose `resolveActorSnapshot(api, userId)` is that resolution, and `installCommentAccessHooks` takes it as an optional sixth argument, `resolveAuthorIdentity(ctx, userId)`. `AuditPlugin` wires the two together. A host that installs the comment hooks without it stores no display identity on new comments (readers show them as unknown) and is told so once, at install, at `warn`.
+
+**The remedy.** None for the console or for a client that sends no display identity. A user changes the name and picture their comments show by editing their own profile (`sys_user.name` / `image`); a comment keeps the values it was created with.
@@ -437,7 +437,7 @@ export class AuditPlugin implements Plugin {
           return undefined;
         }
       };
-      installAuditWriters(engine as any, this.name, {
+      const auditWriters = installAuditWriters(engine as any, this.name, {
         getMessaging,
         getI18n,
         getLocale,
@@ -515,6 +515,12 @@ export class AuditPlugin implements Plugin {
               return null;
             }
           },
+          // A comment's display identity (author name and avatar) is the
+          // session user's own, read by the same resolution the record
+          // history's actor columns are written with.
+          auditWriters
+            ? (hookCtx, userId) => auditWriters.resolveActorSnapshot(hookCtx?.api, userId)
+            : undefined,
         );
         if (typeof (engine as any).registerMiddleware === 'function') {
           // [ADR-0139 E7] The thread gate writes one ReadableIds leaf per parent
 
@@ -8,6 +8,7 @@ import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
 import { ObjectKernel } from '@objectstack/core';
 import { ObjectQL, ObjectQLPlugin } from '@objectstack/objectql';
 import { SqliteWasmDriver } from '@objectstack/driver-sqlite-wasm';
+import { SysUser } from '@objectstack/platform-objects/identity';
 import { AuditPlugin } from './audit-plugin.js';
 import { singlePostureTenancy } from './__tests__/single-posture-tenancy.js';
 import { installDefaultOrganization } from './default-organization.testkit.js';
@@ -106,7 +107,6 @@ describe('audit writers — a localization change reaches the very next @mention
       {
         thread_id: `biz_task:${taskId}`,
         author_id: 'u_admin',
-        author_name: 'Ada',
         body: `note ${comments}`,
         mentions: '["u_bob"]',
       },
@@ -129,10 +129,14 @@ describe('audit writers — a localization change reaches the very next @mention
     engine.registerDriver(driver, true);
     engine.registry.registerObject(sysSetting as any, HARNESS_PACKAGE);
     engine.registry.registerObject(task as any, HARNESS_PACKAGE);
+    // The mention's actor is named from the author's own profile: a comment's
+    // display name is stamped from the session, like its author id.
+    engine.registry.registerObject(SysUser as any, HARNESS_PACKAGE);
     await engine.syncSchemas();
     // A real `single` install's Default Organization: the system writes below
     // derive it (ADR-0131 D9), as a fresh NOT NULL tenant column requires (D1).
     await installDefaultOrganization(engine);
+    await engine.insert('sys_user', { id: 'u_admin', name: 'Ada', email: 'ada@seam.test' }, SYSTEM as any);
 
     sql = async (statement, bindings) => {
       const result = await (driver as unknown as { execute(s: string, b: unknown[]): Promise<unknown> }).execute(
 
@@ -140,6 +140,29 @@ export interface AuditI18nSurface {
   t(key: string, locale: string, params?: Record<string, unknown>): string;
 }
 
+/**
+ * A user's display identity as the platform holds it: the `sys_user` title
+ * column (the display name) and `sys_user.image` (the avatar URL), each `null`
+ * where it cannot be read. The rule is `resolveActorSnapshot`'s, inside
+ * {@link installAuditWriters}.
+ */
+export interface AuditActorSnapshot {
+  name: string | null;
+  avatarUrl: string | null;
+}
+
+/** What {@link installAuditWriters} hands back to the plugin that composes it. */
+export interface AuditWritersHandle {
+  /**
+   * The display identity of `userId`, read from `sys_user` with the system's
+   * own read through `api` (a hook context's `api`) — the one resolution the
+   * `sys_activity` actor columns are written with, so every other platform
+   * writer of a user's display identity asks it rather than keeping a second
+   * one. It never rejects: an unreadable identity answers `null` for both.
+   */
+  resolveActorSnapshot(api: unknown, userId: string): Promise<AuditActorSnapshot>;
+}
+
 /** Options for {@link installAuditWriters}. */
 export interface AuditWriterOptions {
   /**
@@ -1239,8 +1262,8 @@ export function installAuditWriters(
   engine: any,
   packageId = 'com.objectstack.audit',
   opts: AuditWriterOptions = {},
-): void {
-  if (!engine || typeof engine.registerHook !== 'function') return;
+): AuditWritersHandle | undefined {
+  if (!engine || typeof engine.registerHook !== 'function') return undefined;
 
   const getMessaging = opts.getMessaging ?? (() => undefined);
   const getI18n = opts.getI18n ?? (() => undefined);
@@ -1733,7 +1756,7 @@ export function installAuditWriters(
    * rows written after the window; rows already written keep what they were
    * written with, which is what a snapshot is.
    */
-  type ActorSnapshot = { name: string | null; avatarUrl: string | null };
+  type ActorSnapshot = AuditActorSnapshot;
   const NO_ACTOR_SNAPSHOT: ActorSnapshot = { name: null, avatarUrl: null };
   /** `sys_user`'s profile-image column (ADR-0092 Tier 1: "`image` — avatar URL"). */
   const USER_AVATAR_FIELD = 'image';
@@ -2668,6 +2691,10 @@ export function installAuditWriters(
   // judged and notified like one written with it. The registration is what
   // has the engine bind `previous` on this object's update.
   engine.registerHook('afterUpdate', writeCommentMentions, { object: 'sys_comment', packageId });
+
+  // The comment author's display identity is stamped from this same
+  // resolution (`installCommentAccessHooks`, wired by `AuditPlugin`).
+  return { resolveActorSnapshot };
 }
 
 /**
 
@@ -23,6 +23,10 @@
  *      verified with a caller-scoped `findOne`, so the parent's own
  *      OWD/sharing, RLS and object-level CRUD all apply. `author_id` is
  *      server-stamped from the session; a client-supplied value never wins.
+ *      So is the display identity beside it: `author_name` and
+ *      `author_avatar_url` are the session user's own name and avatar
+ *      ({@link CommentAuthorIdentityResolver}), never the client's, and both
+ *      are read-only on update (`objects/sys-comment.object.ts`).
  *    * `beforeUpdate` / `beforeDelete`: the caller must be the comment's
  *      AUTHOR, or hold EDIT on the parent record (see "Parent EDIT" below) —
  *      the attachment kit's uploader-or-parent-editor rule. A multi-row write
@@ -221,6 +225,24 @@ export interface CommentAccessLogger {
   debug?(msg: string, meta?: unknown): void;
 }
 
+/** A comment author's display identity: the name and avatar URL the platform
+ * holds for that user, each `null` where it cannot be read. */
+export interface CommentAuthorIdentity {
+  name: string | null;
+  avatarUrl: string | null;
+}
+
+/**
+ * Resolves the display identity of the user a comment is stamped with, given
+ * the write's hook context. `AuditPlugin` wires the audit writers' actor
+ * snapshot (`AuditWritersHandle.resolveActorSnapshot`), the resolution the
+ * `sys_activity` actor columns are written with, so a user reads as the same
+ * name in a comment and in the record's history.
+ */
+export type CommentAuthorIdentityResolver = (ctx: any, userId: string) => Promise<CommentAuthorIdentity>;
+
+const NO_AUTHOR_IDENTITY: CommentAuthorIdentity = { name: null, avatarUrl: null };
+
 /** Must match `AuditPlugin.name` — hooks are removable by owning package. */
 const PACKAGE_ID = 'com.objectstack.audit';
 const SYSTEM_CTX = { isSystem: true } as const;
@@ -709,14 +731,45 @@ async function callerCanRead(ctx: any, target: CommentThreadTarget): Promise<boo
  * asked on a record-sharing abstention instead; absent too, a
  * `controlled_by_parent` parent meets no master check here, exactly as its own
  * update meets none.
+ *
+ * `resolveAuthorIdentity` answers the display identity (name, avatar) a new
+ * comment is stamped with, for the session's user. Absent, a comment is stored
+ * with neither, never with the client's: the display identity is the server's
+ * or none. That composition is said once, here, at install.
  */
 export function installCommentAccessHooks(
   engine: CommentAccessEngine,
   getSharing: () => CommentSharingLike | null | undefined,
   logger: CommentAccessLogger,
   messageTranslator?: () => ValidationMessageTranslator | undefined,
   getSecurity?: () => CommentSecurityLike | null | undefined,
+  resolveAuthorIdentity?: CommentAuthorIdentityResolver,
 ): void {
+  if (!resolveAuthorIdentity) {
+    logger.warn(
+      '[audit] comment access: no author identity resolver is composed — new comments store no author_name / ' +
+        'author_avatar_url (readers show them as unknown). AuditPlugin wires one; a host calling ' +
+        'installCommentAccessHooks directly passes `resolveAuthorIdentity`.',
+    );
+  }
+
+  /** The display identity of the session's user, the server's own answer: a
+   * session with no user, a resolver that is absent or fails, and a value that
+   * is not a non-blank string all answer `null`, never the client's value. */
+  const authorIdentityOf = async (ctx: any): Promise<CommentAuthorIdentity> => {
+    const userId: unknown = ctx.session.userId;
+    if ((typeof userId !== 'string' && typeof userId !== 'number') || String(userId) === '') return NO_AUTHOR_IDENTITY;
+    if (!resolveAuthorIdentity) return NO_AUTHOR_IDENTITY;
+    let identity: CommentAuthorIdentity | null | undefined;
+    try {
+      identity = await resolveAuthorIdentity(ctx, String(userId));
+    } catch {
+      return NO_AUTHOR_IDENTITY;
+    }
+    const text = (value: unknown): string | null => (typeof value === 'string' && value.trim() ? value : null);
+    return { name: text(identity?.name), avatarUrl: text(identity?.avatarUrl) };
+  };
+
   /** May the caller EDIT the parent record behind `target`? The composition
    * "Parent EDIT" in the module header sets out. [#24646] Where the security
    * service serves `explain`, the parent's own by-id update judgement decides
@@ -891,6 +944,16 @@ export function installCommentAccessHooks(
         target.object,
       );
     }
+
+    // The display identity is the server's too, exactly as `author_id`
+    // above: the name and avatar a reader is shown are the session user's
+    // own, assigned over whatever the client sent, and assigned when it sent
+    // nothing. Asked only once the comment is admitted, so a refused write
+    // reads no identity. On update both are read-only
+    // (`objects/sys-comment.object.ts`), so they stay the creator's.
+    const identity = await authorIdentityOf(ctx);
+    data.author_name = identity.name;
+    data.author_avatar_url = identity.avatarUrl;
   };
   engine.registerHook('beforeInsert', onInsert, { object: COMMENT_OBJECT, packageId: PACKAGE_ID });
   engine.registerHook('beforeInsert', onInsert, { object: COMMENT_REACTION_OBJECT, packageId: PACKAGE_ID });