@@ -0,0 +1,25 @@
+---
+'@objectstack/plugin-audit': patch
+---
+
+A `sys_activity` row that an `activityMilestones` entry fired is withheld from a reader who is not served every field a declared milestone watches
+
+Clause-②: no
+
+A fired milestone's row speaks about its watched fields: its `type` and its summary come from the
+milestone declaration, beside `metadata.kind`. Narrowing the row column by column left those two
+columns speaking to a reader not served a watched field.
+
+The row is now withheld from that reader as a row, on every read (`find`, `findOne`, `count` and
+`aggregate`), by the same pre-scan and the same served-field answer that withhold an update whose
+every recorded change the reader is not served. A list's total, its pages and a by-id read all
+agree with the rows served.
+
+- **A reader served every watched field** is served the row unchanged, with `metadata.kind`.
+- **A reader withheld only fields no milestone watches** is served it too.
+- **A row no milestone fired**, and a row an app writes itself, are unchanged.
+- **If the pre-scan fails**, the read is denied rather than served unjudged.
+
+Rows written before the CRUD mirror declared the watched fields carry no `metadata.kind`, so nothing
+on them says a milestone fired; they are judged as before. Nothing you author changes: no key,
+option, export or type is added or removed.
@@ -56,7 +56,9 @@
  *    one of them is served the row without the kind. A reader served them keeps
  *    it: it is a classification, and every key of it is one the reader may
  *    read anyway. A kind on a row someone else wrote is the author's, served as
- *    written, like its text.
+ *    written, like its text. [#22786] On a read through the middleware such a
+ *    milestone row does not reach that reader at all (see below); dropping the
+ *    kind is the column half of the same answer.
  *  - The declaration itself is bookkeeping and is never served to a reader: it
  *    names fields, and which field names a reader may see is the metadata
  *    plane's question, not this one's.
@@ -106,6 +108,28 @@
  * judged, so the read is answered from the judged rows alone
  * (`{ id: { $in: KEPT } }`), and a warn says so.
  *
+ * ## A fired milestone is withheld as a row from a reader not served its watched fields (#22786)
+ *
+ * A fired milestone's row speaks about its watched fields in columns the
+ * key-by-key narrowing does not reach: its `type` is the declaration's, and
+ * its summary is the declaration's sentence. Both say that a watched field
+ * entered its declared value. So the same pre-scan, by the same answer,
+ * withholds that row as a ROW from a reader not served every field a declared
+ * milestone watches — the list the mirror declares the row's `metadata.kind`
+ * from ({@link ActivityTextSources.kind}). One judgement per row
+ * (`isWithheldRow`), one pre-scan, one WHERE:
+ *
+ *  - The row is withheld exactly when the redaction would drop its kind. A
+ *    reader served every watched field is served the row with its kind; a
+ *    reader withheld only fields no milestone watches is served it too.
+ *  - A declaration with no readable list is of unknown provenance and is judged
+ *    as the text precedent judges one: served only to a reader not restricted
+ *    on the parent.
+ *  - A `kind` on a row the mirror did not write is the author's: not judged.
+ *  - Rows written before the mirror declared the list carry no kind, so nothing
+ *    on them says a milestone fired; they are judged by the rules above them,
+ *    and age out with the object's retention, like the earlier shape's text.
+ *
  * ## Fail closed
  *
  * An unexpected failure strips every value-bearing column from the rows of the
@@ -251,11 +275,55 @@ const REDACTION_SEAM = 'activity field redaction';
 /** One read's served-unmasked answer, per parent object. */
 type ServedFor = (object: string) => Promise<string[] | undefined>;
 
+/**
+ * One read's answer to "is this reader served fewer fields of `object` than the
+ * system is?", per parent object: how a value of UNKNOWN provenance is judged.
+ * No full answer to compare against reads as restricted (closed).
+ */
+type RestrictedFor = (object: string, served: ReadonlySet<string>) => Promise<boolean>;
+
+/** {@link RestrictedFor} for ONE read: one system read per parent object, never one per row. */
+function restrictedPerRead(security: ActivityFieldVisibilitySource | undefined): RestrictedFor {
+  const restricted = new Map<string, Promise<boolean>>();
+  return (object, served) => {
+    let p = restricted.get(object);
+    if (!p) {
+      p = (async () => {
+        let all: string[] | undefined;
+        try {
+          all = await security!.getReadableFields(object, SYSTEM_CTX as never);
+        } catch {
+          all = undefined;
+        }
+        // No full answer to compare against: unknown provenance stays closed.
+        if (!Array.isArray(all)) return true;
+        return all.some((f) => !served.has(String(f)));
+      })();
+      restricted.set(object, p);
+    }
+    return p;
+  };
+}
+
+/**
+ * Whether a value composed from `sources` is served to a reader served
+ * `served`: every source served, or, for `'unknown'` provenance, a reader not
+ * restricted on the parent. The ONE answer both the row rule and the column
+ * redaction judge a declared value by.
+ */
+async function sourcesServed(
+  sources: string[] | 'unknown',
+  served: ReadonlySet<string>,
+  restricted: () => Promise<boolean>,
+): Promise<boolean> {
+  return sources === 'unknown' ? !(await restricted()) : sources.every((f) => served.has(f));
+}
+
 /** The engine slice the withheld-update rule's pre-scan needs. */
 export type ActivityRedactionEngine = ActivityMiddlewareEngine & Pick<CommentAccessEngine, 'find'>;
 
 /** The columns the withheld-update pre-scan reads: the row, its parent object
- * and its stored change. */
+ * and its stored change (with, [#22786], a milestone's kind and its declaration). */
 const WITHHELD_SCAN_COLUMNS = ['id', 'object_name', 'metadata'] as const;
 
 /** No real row matches it: the withheld-update rule's fail-closed answer. */
@@ -280,18 +348,62 @@ export function isWithheldOnlyUpdate(metadata: Record<string, unknown> | null, s
 }
 
 /**
- * [#21388] The WHERE that withholds, from one read, every update row whose
- * stored change is withheld whole from the reader `servedFor` answers for:
+ * [#22786] Whether an activity row is a fired milestone, as the CRUD mirror
+ * declared it, whose watched fields are not all served to this reader. The
+ * watched fields are the list the mirror declares the row's
+ * `metadata.kind` from ({@link kindProvenance}), judged by the same answer
+ * the redaction serves that kind by, so the row is withheld exactly when the
+ * redaction would drop its kind. False for a row with no milestone kind and
+ * for a kind on a row the mirror did not write (the author's, served as
+ * written). `restricted` answers for a declaration with no readable list.
+ * Exported for direct testing.
+ */
+export async function isWithheldMilestone(
+  metadata: Record<string, unknown> | null,
+  served: ReadonlySet<string>,
+  restricted: () => Promise<boolean>,
+): Promise<boolean> {
+  if (!metadata || metadata[ACTIVITY_KIND_KEY] !== ACTIVITY_MILESTONE_KIND) return false;
+  const watched = kindProvenance(metadata);
+  if (watched === null) return false;
+  return !(await sourcesServed(watched, served, restricted));
+}
+
+/**
+ * [#21388, #22786] The ONE withheld-row judgement the pre-scan makes: a row
+ * whose very presence speaks about a field this reader is not served, which
+ * narrowing its columns cannot take back. Either an update whose every
+ * recorded change is withheld ({@link isWithheldOnlyUpdate}), or a fired
+ * milestone whose watched fields are not all served
+ * ({@link isWithheldMilestone}). Exported for direct testing.
+ */
+export async function isWithheldRow(
+  metadata: Record<string, unknown> | null,
+  served: ReadonlySet<string>,
+  restricted: () => Promise<boolean>,
+): Promise<boolean> {
+  return isWithheldOnlyUpdate(metadata, served) || (await isWithheldMilestone(metadata, served, restricted));
+}
+
+/** No full answer is the closed answer: see {@link RestrictedFor}. */
+const RESTRICTED_CLOSED: RestrictedFor = async () => true;
+
+/**
+ * [#21388] The WHERE that withholds, from one read, every row
+ * {@link isWithheldRow} withholds from the reader `servedFor` answers for:
  * `null` when the read withholds nothing, `{ id: { $nin: WITHHELD } }` when the
  * pre-scan saw every row the read can touch, and `{ id: { $in: KEPT } }` when
  * it reached its bound (fail closed: an unjudged row is never served).
+ * [#22786] `restrictedFor` is the read's answer for a declaration of unknown
+ * provenance; without one, such a row is judged restricted (closed).
  * Exported for direct testing.
  */
 export async function computeWithheldUpdateFilter(
   engine: Pick<CommentAccessEngine, 'find'>,
   ast: Record<string, unknown>,
   servedFor: ServedFor,
   logger: ActivityRedactionLogger,
+  restrictedFor: RestrictedFor = RESTRICTED_CLOSED,
 ): Promise<unknown | null> {
   // The rows the read would touch, under SYSTEM context (the reader may not be
   // served their change; that is what is being decided). The caller's own
@@ -318,7 +430,9 @@ export async function computeWithheldUpdateFilter(
         servedSets.set(object, answer === undefined ? undefined : new Set(answer.map(String)));
       }
       const served = servedSets.get(object);
-      isWithheld = served !== undefined && isWithheldOnlyUpdate(parseMetadata(row.metadata), served);
+      isWithheld =
+        served !== undefined &&
+        (await isWithheldRow(parseMetadata(row.metadata), served, () => restrictedFor(object, served)));
     }
     const id = row.id;
     const usable = (typeof id === 'string' || typeof id === 'number') && String(id) !== '';
@@ -355,31 +469,15 @@ export async function redactActivityRows(
   /** The read's own answer, when the caller already holds one: the middleware
    * shares it with the withheld-update rule, so both judge by ONE answer. */
   served?: ServedFor,
+  /** [#22786] Likewise the read's answer for unknown provenance. */
+  restricted?: RestrictedFor,
 ): Promise<void> {
   const list = (Array.isArray(rows) ? rows : rows ? [rows] : []) as unknown[];
   if (list.length === 0) return;
   // One answer per parent object per read, never one per row.
   const servedFor = served ?? servedFieldsPerRead(security, context, logger, REDACTION_SEAM);
-  const restricted = new Map<string, Promise<boolean>>();
   /** Is this reader served fewer fields of `object` than the system is? */
-  const restrictedOn = (object: string, servedSet: Set<string>) => {
-    let p = restricted.get(object);
-    if (!p) {
-      p = (async () => {
-        let all: string[] | undefined;
-        try {
-          all = await security!.getReadableFields(object, SYSTEM_CTX as never);
-        } catch {
-          all = undefined;
-        }
-        // No full answer to compare against: unknown provenance stays closed.
-        if (!Array.isArray(all)) return true;
-        return all.some((f) => !servedSet.has(String(f)));
-      })();
-      restricted.set(object, p);
-    }
-    return p;
-  };
+  const restrictedOn = restricted ?? restrictedPerRead(security);
 
   for (const item of list) {
     if (!isRecord(item)) continue;
@@ -400,8 +498,8 @@ export async function redactActivityRows(
     const provenance = textProvenance(metadata);
     const kindSources = kindProvenance(metadata);
     /** Whether a value composed from `sources` is served to this reader. */
-    const servedWhole = async (sources: string[] | 'unknown') =>
-      sources === 'unknown' ? !(await restrictedOn(object, servedSet)) : sources.every((f) => servedSet.has(f));
+    const servedWhole = (sources: string[] | 'unknown') =>
+      sourcesServed(sources, servedSet, () => restrictedOn(object, servedSet));
 
     if (metadata) {
       let changed = false;
@@ -441,8 +539,9 @@ const JUDGED_BY = ['object_name', 'metadata'] as const;
  * Inert on an engine without the middleware seam; `AuditPlugin` says so.
  *
  * [#21388] Before the read runs, the same middleware withholds every update row
- * whose stored change is withheld whole from this reader, as a WHERE on all
- * four reads (`computeWithheldUpdateFilter`). `AuditPlugin` registers it after
+ * whose stored change is withheld whole from this reader, and [#22786] every
+ * fired milestone row whose watched fields it is not all served, as a WHERE on
+ * all four reads (`computeWithheldUpdateFilter`). `AuditPlugin` registers it after
  * the read gate, so the gate's parent filter is already in the WHERE its
  * pre-scan reads.
  */
@@ -458,9 +557,10 @@ export function installActivityFieldRedaction(
       const security = getSecurity();
       // One answer per read, shared by the row rule and the redaction below.
       const servedFor = servedFieldsPerRead(security, ctx.context, logger, REDACTION_SEAM);
+      const restrictedFor = restrictedPerRead(security);
       if (security && ctx.ast && PARENT_GATE_READ_OPS.has(ctx.operation)) {
         try {
-          const filter = await computeWithheldUpdateFilter(engine, ctx.ast, servedFor, logger);
+          const filter = await computeWithheldUpdateFilter(engine, ctx.ast, servedFor, logger, restrictedFor);
           if (filter) andIntoWhere(ctx, filter);
         } catch (err) {
           // A pre-scan failure must never fall open into the timing leak.
@@ -476,7 +576,7 @@ export function installActivityFieldRedaction(
       await next();
       const list = (Array.isArray(ctx.result) ? ctx.result : ctx.result ? [ctx.result] : []) as unknown[];
       try {
-        await redactActivityRows(list, security, ctx.context, logger, servedFor);
+        await redactActivityRows(list, security, ctx.context, logger, servedFor, restrictedFor);
       } catch (err) {
         // A redaction failure must never fall open into a leak.
         logger.warn(