@@ -0,0 +1,14 @@
+---
+'@objectstack/plugin-audit': patch
+---
+
+fix(plugin-audit): the compliance ledger keeps no copy of secret-store key material
+
+Clause-②: no
+Metadata-protocol: none
+
+The audit writer copies each audited row into `sys_audit_log` (`new_value` / `old_value`) and into `sys_activity.metadata`. For the secret store and the two settings holders, that copy carried the encrypted key-material column. Every new copy now omits those columns, the way a field declared `internal` is omitted:
+
+- **What is still recorded.** Each create, update and delete of those rows keeps its ledger and activity row: which record, its producer-scoped label, key id, algorithm and version, who changed it and when. A write that changes only the key material still records its row, with the material on neither side.
+- **Which columns.** The list is closed, held by the writer (`KEY_MATERIAL_COPY_COLUMNS`), and keyed by the platform-object definitions' own names. A column of the same name on any other object is recorded as before.
+- **Copies already written.** `migrateKeyMaterialCopies(engine, logger, { apply })` and `migrateArchivedKeyMaterialCopies(driver, logger, { apply })` remove the columns from copies stored before this release, in the hot `sys_audit_log` / `sys_activity` tables and in an archive datasource. Both runs are dry by default, idempotent, change only the copy column, and keep each row's stored `updated_at`. Their reports hold counts only. The pure planners `planKeyMaterialAuditRowPatch` and `planKeyMaterialActivityRowPatch` are exported with them.
@@ -168,7 +168,12 @@ export const SysSecret = ObjectSchema.create({
   ],
 
   enable: {
-    trackHistory: false, // rotation events are recorded by sys_setting_audit
+    // Settings rotation events are recorded by sys_setting_audit. `trackHistory`
+    // governs field-change summaries only: the compliance ledger's CRUD mirror
+    // still records each create / update / delete of a row here — which row,
+    // its producer-scoped label, key id, algorithm and version — and keeps no
+    // copy of the key material (plugin-audit `key-material-copy.ts`).
+    trackHistory: false,
     // [ADR-0103] Engine-owned: secrets are minted/rotated only by the settings /
     // secret service (SYSTEM_CTX), never via the generic data API. Locked to
     // reads (ciphertext only; decryption is a separate privileged path). Since
 
@@ -40,8 +40,10 @@ import {
   SysVerification,
 } from '@objectstack/platform-objects/identity';
 import { SysEmail, SysIdentityEmail } from '@objectstack/platform-objects/audit';
+import { SysPlatformSetting, SysSecret, SysSetting } from '@objectstack/platform-objects/system';
 import { SECRET_MASK } from '@objectstack/objectql/core';
 import { installAuditWriters } from './audit-writers.js';
+import { KEY_MATERIAL_COPY_COLUMNS } from './key-material-copy.js';
 import { singlePostureDefaultOrganization } from './__tests__/single-posture-tenancy.js';
 
 type Row = Record<string, unknown>;
@@ -353,3 +355,97 @@ describe('[#24625] the ledger CRUD mirror masks a mail log\'s body columns', ()
     expect(created.body_text).toBe('control-body');
   });
 });
+
+/**
+ * The key-material columns `key-material-copy.ts` lists are omitted from every
+ * ledger copy, as an `internal` field is. Same in-memory boot as above, over
+ * the REAL definitions; a control column proves the mirror still records the
+ * row, and a write of only the material still records that a change happened.
+ */
+describe('the ledger CRUD mirror omits encrypted key-material columns', () => {
+  const MATERIAL_CENSUS: Array<{ def: ObjectDef; material: string[]; control: string }> = [
+    { def: SysSecret as unknown as ObjectDef, material: ['ciphertext'], control: 'kms_key_id' },
+    { def: SysSetting as unknown as ObjectDef, material: ['value_enc'], control: 'locked_reason' },
+    { def: SysPlatformSetting as unknown as ObjectDef, material: ['value_enc'], control: 'locked_reason' },
+  ];
+
+  it('the writer-owned list is exactly the census, and each listed column is declared by its object', () => {
+    expect([...KEY_MATERIAL_COPY_COLUMNS.entries()].map(([o, c]) => [o, [...c]])).toEqual(
+      MATERIAL_CENSUS.map(({ def, material }) => [def.name, material]),
+    );
+    for (const { def, material } of MATERIAL_CENSUS) {
+      for (const column of material) expect(def.fields, `${def.name}.${column} is declared`).toHaveProperty(column);
+    }
+  });
+
+  describe.each(MATERIAL_CENSUS.map((c) => [c.def.name, c] as const))('%s', (_name, { def, material, control }) => {
+    it('create, update and delete record the control column and none of the material', async () => {
+      const { engine, storeFor } = await boot(def);
+      const created = await engine.insert(def.name, seedRow(def, material, control, 'create'), SYS);
+      const id = String(created.id);
+      const changed = seedRow(def, material, control, 'update');
+      const patch: Row = { [control]: changed[control] };
+      for (const column of material) patch[column] = changed[column];
+      await engine.update(def.name, patch, { where: { id }, ...SYS } as any);
+      await engine.delete(def.name, { where: { id }, ...SYS } as any);
+
+      const rows = ledgerRows(storeFor, def.name);
+      const one = (a: string) => {
+        const hit = rows.filter((r) => r.action === a);
+        expect(hit, `one ${a} row`).toHaveLength(1);
+        return hit[0];
+      };
+      const sides = {
+        createNew: parse(one('create').new_value),
+        updateOld: parse(one('update').old_value),
+        updateNew: parse(one('update').new_value),
+        deleteOld: parse(one('delete').old_value),
+      };
+      expect(sides.createNew[control]).toBe('control-create');
+      expect(sides.updateOld[control]).toBe('control-create');
+      expect(sides.updateNew[control]).toBe('control-update');
+      expect(sides.deleteOld[control]).toBe('control-update');
+      for (const column of material) {
+        for (const [side, snapshot] of Object.entries(sides)) {
+          expect(snapshot, `${def.name}.${column} on ${side}`).not.toHaveProperty(column);
+        }
+      }
+
+      const atRest = JSON.stringify([...rows, ...activityRows(storeFor, def.name)]);
+      for (const column of material) {
+        for (const phase of ['create', 'update']) {
+          expect(atRest, `${def.name}.${column} (${phase}) at rest`).not.toContain(marker(def.name, column, phase));
+        }
+      }
+      expect(activityRows(storeFor, def.name).length, 'the activity mirror ran').toBeGreaterThan(0);
+    });
+
+    it('a write of ONLY the material still records its row, with neither value', async () => {
+      const { engine, storeFor } = await boot(def);
+      const created = await engine.insert(def.name, seedRow(def, material, control, 'create'), SYS);
+      const column = material[0];
+      await engine.update(def.name, { [column]: marker(def.name, column, 'rotate') }, { where: { id: String(created.id) }, ...SYS } as any);
+
+      const updates = ledgerRows(storeFor, def.name).filter((r) => r.action === 'update');
+      expect(updates, 'the change is recorded').toHaveLength(1);
+      expect(parse(updates[0].old_value)).not.toHaveProperty(column);
+      expect(parse(updates[0].new_value)).not.toHaveProperty(column);
+      const atRest = JSON.stringify([...ledgerRows(storeFor, def.name), ...activityRows(storeFor, def.name)]);
+      expect(atRest).not.toContain(marker(def.name, column, 'create'));
+      expect(atRest).not.toContain(marker(def.name, column, 'rotate'));
+    });
+  });
+
+  it('a column of the same name on an object the list does not name is still recorded (control)', async () => {
+    const { engine, storeFor } = await boot(SysSecret as unknown as ObjectDef);
+    const other = {
+      name: 'key_material_control', label: 'Control',
+      fields: { id: f('id', 'text', { primaryKey: true }), ciphertext: f('ciphertext', 'text'), value_enc: f('value_enc', 'text') },
+    };
+    engine.registry.registerObject(other as any, 'com.objectstack.test.key-material-control');
+    await engine.insert('key_material_control', { ciphertext: 'control-a', value_enc: 'control-b' }, SYS);
+    const created = parse(ledgerRows(storeFor, 'key_material_control').filter((r) => r.action === 'create')[0].new_value);
+    expect(created.ciphertext).toBe('control-a');
+    expect(created.value_enc).toBe('control-b');
+  });
+});
@@ -20,6 +20,8 @@ import type { IDataEngine } from '@objectstack/spec/contracts';
 import { SECRET_MASK, collectInternalReadFields, collectMaskedReadFields } from '@objectstack/objectql/core';
 // [#24625] The mask of a mail-log row's body columns in a copy of it.
 import { maskMailLogBodyCopy } from './mail-log-body-mask.js';
+// The key-material columns no copy of a row carries (`key-material-copy.ts`).
+import { keyMaterialColumnsOf, omitKeyMaterialFromCopy } from './key-material-copy.js';
 // [#7230] ADR-0079's record display-name contract, imported rather than
 // re-derived. `resolveDisplayField` IS the definition of "which field is this
 // object's human title" (`nameField` → deprecated `displayNameField` alias →
@@ -1558,6 +1560,8 @@ export function installAuditWriters(
     if (!titleField || titleField === 'id') return undefined;
     if (collectMaskedReadFields(def).includes(titleField)) return undefined;
     if (collectInternalReadFields(def).includes(titleField)) return undefined;
+    // …and a key-material column, which `ledgerView` omits by the same list.
+    if (keyMaterialColumnsOf(objectName).includes(titleField)) return undefined;
     return titleField;
   };
 
@@ -1854,6 +1858,12 @@ export function installAuditWriters(
     // keeps the body behind its field gate; the copy never holds it in clear.
     // [#24693] One helper, the one the at-rest rewrite of older copies applies.
     maskMailLogBodyCopy(objectName, out);
+    // A column that stores encrypted key material as plain text
+    // (`key-material-copy.ts` lists them and says why neither limb above
+    // reaches one) is OMITTED on every side, as an `internal` field is: the
+    // copy records which row changed and how, never the material. One helper,
+    // the one the at-rest rewrite of older copies applies.
+    omitKeyMaterialFromCopy(objectName, out);
     // [#21120] A stored metadata BODY (`sys_metadata` / `sys_metadata_history`)
     // is not a top-level secret field, so the mask above never touches it. The
     // audit copy is a credential read exit exactly like `/meta`, so the body is
 
@@ -88,6 +88,29 @@ export type {
   MailLogBodyMigrationOptions,
   MailLogBodyMigrationReport,
 } from './mail-log-body-migration.js';
+// The key-material columns no ledger copy carries, the one helper the writer
+// and the at-rest rewrite of older copies both apply, and that rewrite's pure
+// planners and runners (hot tables and the archive datasource).
+export {
+  KEY_MATERIAL_COPY_COLUMNS,
+  KEY_MATERIAL_COPY_OBJECTS,
+  keyMaterialColumnsOf,
+  omitKeyMaterialFromCopy,
+} from './key-material-copy.js';
+export {
+  migrateKeyMaterialCopies,
+  migrateArchivedKeyMaterialCopies,
+  planKeyMaterialAuditRowPatch,
+  planKeyMaterialActivityRowPatch,
+  KEY_MATERIAL_COPY_TABLES,
+} from './key-material-copy-migration.js';
+export type {
+  KeyMaterialArchiveDriver,
+  KeyMaterialCopyTable,
+  KeyMaterialMigrationEngine,
+  KeyMaterialMigrationOptions,
+  KeyMaterialMigrationReport,
+} from './key-material-copy-migration.js';
 // [ADR-0139 E6] The stored-row backfill of `sys_activity`'s two writer-stamped
 // read-rule columns, and the one planner it, the CRUD mirror and the
 // before-insert hook stamp by. The CLI command