diff --git a/pipeline_service/audit_service.py b/pipeline_service/audit_service.py
index a12fc03..53ac3d5 100644
--- a/pipeline_service/audit_service.py
+++ b/pipeline_service/audit_service.py
@@ -140,13 +140,16 @@ async def delete_audit_logs(sor, user_id: str, username: str, before: str = "",
                             client_ip: str = "") -> dict:
     """删除审计日志（仅 owner.audit）。before 为时间戳，删除早于该时间的日志。
 
-    删除操作本身也会审计（防自删留痕）。
+    删除操作本身也会审计（audit_delete 留痕），且 audit_delete 记录**永不删除**，
+    保证删除操作的证据永久保留（防自删）。
     """
     ns = {}
-    wsql = ""
+    # 排除 audit_delete 记录，保证删除留痕不被删
     if before:
-        wsql = " WHERE created_at<${b}$"
+        wsql = " WHERE created_at<${b}$ AND action != 'audit_delete'"
         ns["b"] = before
+    else:
+        wsql = " WHERE action != 'audit_delete'"
     # 先记录删除操作（在删除前写，确保删除动作本身留痕）
     await audit_log(sor, user_id, username, "audit_delete",
                     target="sd_audit_logs", detail="删除 before=" + (before or "全部"),