@nvisy/sdk 0.33.0 → 0.34.0

package/dist/{index-0_K3HaXB.d.ts → index-BsijAKTe.d.ts}

@@ -1227,23 +1227,30 @@ interface paths {
     };
     /**
      * List workspace activities
-     * @description Returns the workspace's activity log, most recent first, cursor-paginated. Optional filters: `type` (repeatable, e.g. `file.created`), `actor` (an account id), and a `from`/`to` day range (each bound narrows only when given; the feed is otherwise all-time).
+     * @description Returns the workspace's activity log, most recent first, cursor-paginated. Optional filters: `type` (repeatable, e.g. `file.created`), `actor` (a username), and a `from`/`to` day range (each bound narrows only when given; the feed is otherwise all-time).
      */
     get: {
       parameters: {
         query?: {
-          /** @description Keep only activities performed by this account. Omit for any actor. */
-          actor?: string;
+          /** @description Username of the account whose activities to keep. Omit for any actor. */
+          actor?: components["schemas"]["Handle"];
           /**
-           * @description Cursor pointing to the last item of the previous page.
-           *     Obtain this from the `nextCursor` field in the response.
+           * @description Keep only these activity types (e.g. `file.created`). Repeat the `type`
+           *     parameter for several; omit for no type constraint.
            */
-          after?: string;
+          type?: components["schemas"]["ActivityType"][];
           /**
            * @description First day of the range (inclusive), `YYYY-MM-DD`. Defaults so the range
            *     spans the last `DEFAULT_WINDOW_DAYS` days through `to`.
            */
           from?: string;
+          /** @description Last day of the range (inclusive), `YYYY-MM-DD`. Defaults to today (UTC). */
+          to?: string;
+          /**
+           * @description Cursor pointing to the last item of the previous page.
+           *     Obtain this from the `nextCursor` field in the response.
+           */
+          after?: string;
           /**
            * @description Whether to include the total item count in the response's `total` field.
            *     Defaults to `false`, since counting is an extra query; set it to `true`
@@ -1252,14 +1259,6 @@ interface paths {
           includeCount?: boolean;
           /** @description The maximum number of records to return (1-100, default: 20). */
           limit?: number;
-          /** @description Last day of the range (inclusive), `YYYY-MM-DD`. Defaults to today (UTC). */
-          to?: string;
-          /**
-           * @description Keep only these activity types (e.g. `file.created`). Repeat the `type`
-           *     parameter for several; omit for no type constraint. The field is `types`
-           *     since `type` is a reserved word.
-           */
-          type?: components["schemas"]["ActivityType"][];
         };
         header?: never;
         path: {
@@ -1339,10 +1338,13 @@ interface paths {
     get: {
       parameters: {
         query?: {
-          /** @description Keep only activities performed by this account. Omit for any actor. */
-          actor?: string;
-          /** @description Output format; defaults to `csv`. */
-          format?: components["schemas"]["ExportFormat"];
+          /** @description Username of the account whose activities to keep. Omit for any actor. */
+          actor?: components["schemas"]["Handle"];
+          /**
+           * @description Keep only these activity types (e.g. `file.created`). Repeat the `type`
+           *     parameter for several; omit for no type constraint.
+           */
+          type?: components["schemas"]["ActivityType"][];
           /**
            * @description First day of the range (inclusive), `YYYY-MM-DD`. Defaults so the range
            *     spans the last `DEFAULT_WINDOW_DAYS` days through `to`.
@@ -1350,12 +1352,8 @@ interface paths {
           from?: string;
           /** @description Last day of the range (inclusive), `YYYY-MM-DD`. Defaults to today (UTC). */
           to?: string;
-          /**
-           * @description Keep only these activity types (e.g. `file.created`). Repeat the `type`
-           *     parameter for several; omit for no type constraint. The field is `types`
-           *     since `type` is a reserved word.
-           */
-          type?: components["schemas"]["ActivityType"][];
+          /** @description Output format; defaults to `csv`. */
+          format?: components["schemas"]["ExportFormat"];
         };
         header?: never;
         path: {
@@ -5441,22 +5439,34 @@ interface paths {
       requestBody?: never;
       responses: {
         /**
-         * @description What detection found in one document.
+         * @description What detection found in one document, plus what a reviewer
+         *     decided about it.
+         *
+         *     Wraps elide's [`Report`] with the three things elide does not
+         *     model: the recognition [`DocumentContext`] the entities were
+         *     scored against, how the document decoded, and the reviewer
+         *     decisions in [`edits`](Self::edits).
+         *
+         *     # Serialization
          *
-         *     The body group plus per-container-part groups (each tagged by
-         *     modality) plus the recognition [`AuditContext`] the entities
-         *     were scored against.
+         *     [`Serialize`] but deliberately **not** `Deserialize`: a
+         *     serialized report tags entity groups by modality *name*, so
+         *     rebuilding one needs the registry [`Engine`] holds. Read an
+         *     audit back with [`Engine::deserialize_audit`].
          *
-         *     The context travels with the entities so anonymize can rebuild
-         *     an orchestrator against exactly the vocabulary analyze used.
-         *     Anything a policy predicate compares against beyond the label
-         *     catalog (asserted languages, jurisdictions, document tags) is
-         *     here; labels are re-derived from the policy set on each
-         *     anonymize call.
+         *     # Schema
          *
-         *     No [`Default`]: a well-formed audit must carry a real
-         *     [`AuditContext`] with a real correlation id. Callers building
-         *     an audit outside the analyze path construct it explicitly.
+         *     Generate under the **serialize** contract
+         *     ([`SchemaSettings::for_serialize`]). `edits` and `usage` are
+         *     `skip_serializing_if`, and only that contract marks them
+         *     optional — `schema_for!` defaults to deserialize and declares
+         *     both required, so a generated client would reject responses this
+         *     crate really emits.
+         *
+         *     [`Engine`]: super::Engine
+         *     [`Engine::deserialize_audit`]: super::Engine::deserialize_audit
+         *     [`Report`]: elide::Report
+         *     [`SchemaSettings::for_serialize`]: schemars::generate::SchemaSettings::for_serialize
          */
         200: {
           headers: {
@@ -8712,79 +8722,31 @@ interface components {
       workspaceSlug: components["schemas"]["Handle"];
     };
     /**
-     * @description Query parameters for the activity export: the type/actor filter, a bounded date
-     *     window (defaulted and capped, since the export materializes rows), and the
-     *     output `format`. See [`DateWindow`] for the range defaults and bounds.
+     * @description The export-only query parameter: the output format. Kept separate from the
+     *     shared filter and window so each is extracted on its own (see
+     *     [`ActivityFilterQuery`] for why flattening is avoided).
      */
-    ActivityExportQuery: {
-      /**
-       * Format: uuid
-       * @description Keep only activities performed by this account. Omit for any actor.
-       */
-      actor?: string;
+    ActivityExportOptions: {
       /** @description Output format; defaults to `csv`. */
       format?: components["schemas"]["ExportFormat"];
-      /**
-       * Format: date
-       * @description First day of the range (inclusive), `YYYY-MM-DD`. Defaults so the range
-       *     spans the last `DEFAULT_WINDOW_DAYS` days through `to`.
-       */
-      from?: string;
-      /**
-       * Format: date
-       * @description Last day of the range (inclusive), `YYYY-MM-DD`. Defaults to today (UTC).
-       */
-      to?: string;
-      /**
-       * @description Keep only these activity types (e.g. `file.created`). Repeat the `type`
-       *     parameter for several; omit for no type constraint. The field is `types`
-       *     since `type` is a reserved word.
-       */
-      type?: components["schemas"]["ActivityType"][];
     };
     /**
-     * @description Query parameters for the activity feed: the type/actor filter, an optional date
-     *     window (narrows only when given — the feed is otherwise all-time), and cursor
-     *     pagination.
+     * @description The activity-specific filter parameters: which activity types to keep and
+     *     whose activities to keep.
+     *
+     *     This is its own query struct so an endpoint composes it alongside the shared
+     *     [`CursorPagination`](crate::handler::request::CursorPagination) and
+     *     [`DateWindow`] as separate query extractors, rather than `#[serde(flatten)]`ing
+     *     them into one struct: the query extractor (`serde_html_form`) mis-handles
+     *     flattened sub-structs — a flattened pagination struct fails to deserialize even
+     *     a bare `?limit=` — so each concern is extracted on its own.
      */
-    ActivityListQuery: {
-      /**
-       * Format: uuid
-       * @description Keep only activities performed by this account. Omit for any actor.
-       */
-      actor?: string;
-      /**
-       * @description Cursor pointing to the last item of the previous page.
-       *     Obtain this from the `nextCursor` field in the response.
-       */
-      after?: string;
-      /**
-       * Format: date
-       * @description First day of the range (inclusive), `YYYY-MM-DD`. Defaults so the range
-       *     spans the last `DEFAULT_WINDOW_DAYS` days through `to`.
-       */
-      from?: string;
-      /**
-       * @description Whether to include the total item count in the response's `total` field.
-       *     Defaults to `false`, since counting is an extra query; set it to `true`
-       *     only when the count is actually needed.
-       * @default false
-       */
-      includeCount?: boolean;
-      /**
-       * Format: uint32
-       * @description The maximum number of records to return (1-100, default: 20).
-       */
-      limit?: number;
-      /**
-       * Format: date
-       * @description Last day of the range (inclusive), `YYYY-MM-DD`. Defaults to today (UTC).
-       */
-      to?: string;
+    ActivityFilterQuery: {
+      /** @description Username of the account whose activities to keep. Omit for any actor. */
+      actor?: components["schemas"]["Handle"];
       /**
        * @description Keep only these activity types (e.g. `file.created`). Repeat the `type`
-       *     parameter for several; omit for no type constraint. The field is `types`
-       *     since `type` is a reserved word.
+       *     parameter for several; omit for no type constraint.
        */
       type?: components["schemas"]["ActivityType"][];
     };
@@ -9050,42 +9012,50 @@ interface components {
      *     it on the entity's [`Redaction`] event so an audit can trace a change back to
      *     the policy that demanded it.
      *
-     *     The rationale takes one of two [`kind`](Attribution::kind)s, by how much
-     *     structure the author has ([`AttributionKind::Freeform`] /
-     *     [`AttributionKind::Cited`]). Orthogonal to that, an attribution may carry a
-     *     [`source_id`](Attribution::source_id): an opaque, caller-owned [`Uuid`] the
-     *     policy layer uses to link back to a source record (a rule, a request, a
-     *     document). elide-core stores and hashes it verbatim; it never resolves or
-     *     validates it.
+     *     The rationale takes one of two shapes, by how much structure the author has:
+     *     a [`Freeform`](Attribution::Freeform) label or a formal
+     *     [`Cited`](Attribution::Cited) authority. Start one with
+     *     [`Attribution::freeform`] / [`Attribution::cited`], refine it with the
+     *     shape's `with_*` builder, and let it convert into an `Attribution`:
+     *
+     *     ```
+     *     # use elide_core::entity::audit::Attribution;
+     *     let attribution: Attribution =
+     *         Attribution::freeform("gdpr-art-17")
+     *             .with_description("right to erasure")
+     *             .into();
+     *     ```
      *
      *     [`Redaction`]: crate::entity::audit::AuditKind::Redaction
      */
-    Attribution: {
-      /** @description The shape of the rationale: a freeform label or a formal citation. */
-      kind: components["schemas"]["AttributionKind"];
-      /**
-       * Format: uuid
-       * @description Opaque, caller-owned link to a source record, when given.
-       */
-      source_id?: string;
-    };
-    /** @description The shape of an [`Attribution`]'s rationale. */
-    AttributionKind: {
-      /** @description Human-readable description (e.g. `"right to erasure"`), when given. */
-      description?: string;
+    Attribution: ({
       /** @constant */
       kind: "freeform";
-      /** @description The policy's name (e.g. `"gdpr-art-17"`, `"hipaa-safe-harbor"`). */
-      name: string;
-    } | {
-      /** @description The authority cited (e.g. `"GDPR"`, `"HIPAA"`, `"internal-policy"`). */
-      authority: string;
-      /** @description The citation within that authority (e.g. `"Art. 17(1)"`, `"§164.514"`). */
-      citation: string;
+    } & components["schemas"]["FreeformAttribution"]) | ({
       /** @constant */
       kind: "cited";
-      /** @description Why the citation applies here (e.g. `"data subject requested erasure"`). */
-      rationale: string;
+    } & components["schemas"]["CitedAttribution"]);
+    /**
+     * @description A detection recognition missed.
+     *
+     *     Recorded on the report with human provenance, so it is never
+     *     mistaken for an automatic hit, then redacted under the policy set
+     *     like any other entity: an added label the policy does not cover
+     *     is left alone.
+     *
+     *     Carries no entity id — the entity does not exist yet, and the
+     *     engine mints one when the edit is applied, so a client cannot
+     *     collide with a real detection or shadow an existing entity.
+     */
+    AudioAdd: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /** @description What the reviewer says this is. */
+      label: components["schemas"]["LabelRef"];
+      /** @description Where it sits in the document. */
+      location: components["schemas"]["AudioLocation"];
+      /** @description The rationale, when one was given. */
+      reason?: string;
     };
     /**
      * @description One node in an entity's audit DAG: a thing that happened, with its
@@ -9162,115 +9132,70 @@ interface components {
      * @description Kind of an [`AuditEvent`], carrying its event-specific detail and the
      *     rationale for why it happened.
      *
-     *     `#[non_exhaustive]`: new event kinds (verification, annotation, …)
-     *     can be added compatibly. The recognition kinds ([`Pattern`],
-     *     [`Model`]) carry the matched [`Location`]; the rest carry their own
-     *     data.
-     *
+     *     A thin tagged union: each variant wraps one payload struct (e.g.
+     *     [`Redaction`], [`Selection`], [`Manual`]) that owns that kind's fields, its
+     *     docs, and how it folds into the audit hash. Match on a variant to reach its
+     *     payload:
+     *
+     *     ```
+     *     # use elide_core::entity::audit::AuditKind;
+     *     # use elide_core::modality::text::Text;
+     *     # fn show(kind: &AuditKind<Text>) {
+     *     if let AuditKind::Redaction(redaction) = kind {
+     *         let _ = &redaction.operator;
+     *     }
+     *     # }
+     *     ```
+     *
+     *     `#[non_exhaustive]`: new event kinds (verification, annotation, …) can be
+     *     added compatibly. The recognition kinds ([`Pattern`], [`Model`]) carry the
+     *     matched [`Location`]; the rest carry their own data.
+     *
+     *     [`AuditEvent`]: super::AuditEvent
      *     [`Pattern`]: AuditKind::Pattern
      *     [`Model`]: AuditKind::Model
      *     [`Location`]: Modality::Location
      */
     AudioAuditKind: {
+      detail: components["schemas"]["AudioPattern"];
       /** @constant */
       kind: "pattern";
-      /** @description Where the recognizer matched. */
-      location: components["schemas"]["AudioLocation"];
-      /** @description Pattern detail. */
-      pattern: components["schemas"]["PatternEvent"];
     } | {
+      detail: components["schemas"]["AudioModel"];
       /** @constant */
       kind: "model";
-      /** @description Where the recognizer matched. */
-      location: components["schemas"]["AudioLocation"];
-      /** @description Model detail. */
-      model: components["schemas"]["ModelEvent"];
     } | {
+      detail: components["schemas"]["Deduplication"];
       /** @constant */
       kind: "deduplication";
-      /** @description Name of the fusion strategy that combined them. */
-      strategy: string;
     } | {
-      /** @description The loser's confidence at resolution time. */
-      competing_confidence: components["schemas"]["Confidence"];
-      /** @description The label of the detection that lost arbitration. */
-      competing_label: components["schemas"]["LabelRef"];
+      detail: components["schemas"]["Conflict"];
       /** @constant */
       kind: "conflict";
-      /** @description Name of the conflict policy that chose the winner. */
-      resolved_by: string;
     } | {
-      /** @description The competing detection's confidence. */
-      competing_confidence: components["schemas"]["Confidence"];
-      /** @description The label of the competing detection. */
-      competing_label: components["schemas"]["LabelRef"];
-      /** @description Name of the policy that flagged the contest. */
-      flagged_by: string;
+      detail: components["schemas"]["Contested"];
       /** @constant */
       kind: "contested";
     } | {
-      /**
-       * Format: double
-       * @description Multiplier applied.
-       */
-      factor: number;
+      detail: components["schemas"]["Calibration"];
       /** @constant */
       kind: "calibration";
     } | {
-      /**
-       * @description The located [`Hint`] the keyword fired from, when the match came
-       *     from an out-of-band hint (a column header, a key) rather than
-       *     the in-text word window. `None` for an in-text-window match.
-       *
-       *     [`Hint`]: crate::modality::Hint
-       */
-      hint?: components["schemas"]["AudioHint"];
-      /** @description Keyword that fired the boost. */
-      keyword: string;
+      detail: components["schemas"]["AudioRefinement"];
       /** @constant */
       kind: "refinement";
-      /**
-       * @description Where the boosting keyword sits in the medium. For a hint match
-       *     this mirrors the hint's own location; for an in-text-window match
-       *     it is the keyword resolved through the modality's [`locate`] (a
-       *     pixel box for image, a time span for audio, the byte range for
-       *     text/tabular). `None` when the keyword's stream range could not be
-       *     placed, symmetric with a match the recognizer itself drops.
-       *
-       *     [`locate`]: crate::modality::TextRecognizable::locate
-       */
-      location?: components["schemas"]["AudioLocation"];
     } | {
-      /**
-       * @description The author-supplied policy rationale, when the operator carried an
-       *     [`Attribution`]; `None` otherwise.
-       */
-      attribution?: components["schemas"]["Attribution"];
-      /** @description Identifier of the key needed to reverse it, if reversible. */
-      key_id?: string;
+      detail: components["schemas"]["Redaction"];
       /** @constant */
       kind: "redaction";
-      /** @description How much the output leaks about the original. */
-      leak_profile: components["schemas"]["LeakProfile"];
-      /**
-       * @description Which selection rule chose this operator: the automatic "why"
-       *     (matched a label, a tag, a predicate, or the fallback).
-       */
-      matched_by: components["schemas"]["RuleMatch"];
-      /** @description Which operator (name + version) ran. */
-      operator: components["schemas"]["OperatorId"];
-      /**
-       * @description BLAKE3 digest of the original text the operator hid, when the
-       *     redaction layer recorded it. Proves *what* was redacted without
-       *     storing the plaintext; `None` when the operator did not capture it.
-       */
-      span_hash?: components["schemas"]["AuditHash"];
-      /**
-       * Format: uint32
-       * @description Byte length of the original text the operator hid, paired with
-       *     [`span_hash`](Self::Redaction::span_hash). `None` when not captured.
-       */
-      span_length?: number;
+    } | {
+      detail: components["schemas"]["Selection"];
+      /** @constant */
+      kind: "selection";
+    } | {
+      detail: components["schemas"]["AudioManual"];
+      /** @constant */
+      kind: "manual";
     };
     /**
      * @description Full audit trail of an [`Entity`]: every [`AuditEvent`] in its life, as a
@@ -9327,6 +9252,26 @@ interface components {
       /** @description Original filename, when known. */
       filename?: string;
     };
+    /**
+     * @description One change to an analyzed document.
+     *
+     *     `Add` carries no id because the entity does not exist yet; the
+     *     engine mints one when the edit is applied, so a client cannot
+     *     collide with a real detection or shadow an existing entity.
+     */
+    AudioEdit: ({
+      /** @constant */
+      op: "add";
+    } & components["schemas"]["AudioAdd"]) | ({
+      /** @constant */
+      op: "retag";
+    } & components["schemas"]["AudioRetag"]) | ({
+      /** @constant */
+      op: "suppress";
+    } & components["schemas"]["Suppress"]) | ({
+      /** @constant */
+      op: "redact";
+    } & components["schemas"]["AudioRedact"]);
     /**
      * @description Detected piece of sensitive information within some medium.
      *
@@ -9355,7 +9300,12 @@ interface components {
     AudioEntity: {
       /**
        * @description Tamper-evident audit trail: every contributing detection, the fusion
-       *     event if any, and the redaction that hid it, as a hash-linked DAG.
+       *     event if any, and the redaction that hid it, as a hash-linked DAG. It is
+       *     also the single source of truth for whether a reviewer
+       *     [suppressed](Self::is_suppressed) the entity — a suppression is a
+       *     [`Manual`] event on this trail, not a separate flag.
+       *
+       *     [`Manual`]: crate::entity::audit::AuditKind::Manual
        */
       audit: components["schemas"]["AudioAuditLog"];
       /** @description Effective confidence in `0.0..=1.0` (fused, if applicable). */
@@ -9400,30 +9350,6 @@ interface components {
        */
       recognized_range?: components["schemas"]["Range_of_uint"];
     };
-    /**
-     * @description One recognized entity plus the optional reviewer override.
-     *
-     *     The bound mirrors elide's [`Entity<M>`]: serialization needs
-     *     `M::Location` and `M::Data` (de)serializable, and JsonSchema
-     *     derivation needs them schema-able. All four modalities elide
-     *     ships satisfy these under the `serde` + `schema` features.
-     */
-    AudioEntityRecord: {
-      /** @description The elide entity, as recognition produced it. */
-      entity: components["schemas"]["AudioEntity"];
-      /**
-       * @description Reviewer-supplied redaction override.
-       *
-       *     `None` means "use the matching policy rule's decision";
-       *     `Some(...)` overrides that rule for this specific entity
-       *     at apply time. Reviewer overrides take precedence over
-       *     every policy rule and inherit the authority of the
-       *     [`Review::policy_id`] they name: the audit event's
-       *     attribution stamps that policy so the trail names the
-       *     authority under which the override fired.
-       */
-      review?: components["schemas"]["Review"];
-    };
     /**
      * @description Located, typed piece of context a recognizer may treat as in-context
      *     for a nearby value.
@@ -9464,6 +9390,85 @@ interface components {
       /** @description Diarization label of the speaker, when a diarizer assigned one. */
       speaker_id?: string;
     };
+    /**
+     * @description A human override, outside automatic detection: an entity a reviewer added by
+     *     hand, or a detected one they marked to ignore. Its provenance is a person's
+     *     decision, not a recognizer's — so the trail records *why* (an
+     *     [`Attribution`], when supplied). *Who* made the override is the event's
+     *     [`source`], not a payload field.
+     *
+     *     [`source`]: super::AuditEvent::source
+     */
+    AudioManual: {
+      /**
+       * @description The reviewer's rationale, when supplied (e.g. a freeform
+       *     `"false positive"`, or a cited authority). `None` for an unexplained
+       *     override.
+       */
+      attribution?: components["schemas"]["Attribution"];
+      /**
+       * @description Which human decision this records: including a missed entity, or
+       *     suppressing a detected one. This is the authority on whether the entity
+       *     is redacted — [`AuditLog::is_suppressed`] reads it, so there is no
+       *     separate flag to keep in sync.
+       *
+       *     [`AuditLog::is_suppressed`]: crate::entity::audit::AuditLog::is_suppressed
+       */
+      intent: components["schemas"]["ManualIntent"];
+      /** @description Where the override applies, in modality-native coordinates. */
+      location: components["schemas"]["AudioLocation"];
+    };
+    /**
+     * @description Detail of a model/NER recognition: a model matched at `location`, with its
+     *     metadata in `model`.
+     */
+    AudioModel: {
+      /** @description Where the recognizer matched. */
+      location: components["schemas"]["AudioLocation"];
+      /** @description Model metadata (name, version, contextual flag). */
+      model: components["schemas"]["ModelEvent"];
+    };
+    /**
+     * @description Detail of a pattern/dictionary recognition: a recognizer matched at
+     *     `location`, with the pattern metadata in `pattern`.
+     */
+    AudioPattern: {
+      /** @description Where the recognizer matched. */
+      location: components["schemas"]["AudioLocation"];
+      /** @description Pattern metadata (name, regex, validator, contextual flag). */
+      pattern: components["schemas"]["PatternEvent"];
+    };
+    /**
+     * @description Redact this entity with `action` instead of the operator the
+     *     policy picked.
+     */
+    AudioRedact: {
+      /**
+       * @description The operator to run, typed to the entity's own modality so a
+       *     text entity cannot be given an image operator.
+       */
+      action: components["schemas"]["AudioRedaction"];
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity to redact.
+       */
+      id: string;
+      /**
+       * Format: uuid
+       * @description The policy whose authority the reviewer exercises. Must match
+       *     a submitted policy's `id`.
+       *
+       *     Not only for audit: it picks which per-policy pseudonym vault
+       *     and `KeyProvider` the operator resolves against, so an
+       *     override using `Pseudonymize` or `HmacHash` stays consistent
+       *     with that policy's other rules.
+       */
+      policyId: string;
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /** @description Operator spec a `redact` audio rule carries. */
     AudioRedaction: {
       /** @constant */
@@ -9497,140 +9502,145 @@ interface components {
        */
       waveform?: components["schemas"]["Waveform"];
     };
+    /** @description A context keyword near the entity lifted its confidence. */
+    AudioRefinement: {
+      /**
+       * @description The located [`Hint`] the keyword fired from, when the match came from an
+       *     out-of-band hint (a column header, a key) rather than the in-text word
+       *     window. `None` for an in-text-window match.
+       *
+       *     [`Hint`]: crate::modality::Hint
+       */
+      hint?: components["schemas"]["AudioHint"];
+      /** @description Keyword that fired the boost. */
+      keyword: string;
+      /**
+       * @description Where the boosting keyword sits in the medium. For a hint match this
+       *     mirrors the hint's own location; for an in-text-window match it is the
+       *     keyword resolved through the modality's [`locate`]. `None` when the
+       *     keyword's stream range could not be placed.
+       *
+       *     [`locate`]: crate::modality::TextRecognizable::locate
+       */
+      location?: components["schemas"]["AudioLocation"];
+    };
+    /**
+     * @description Correct what an existing detection *is* or *covers*, then redact
+     *     it under the policy set as corrected.
+     *
+     *     A reviewer fixing recognition's mistake rather than overriding
+     *     its consequence. Retagging into a label the policy does not cover
+     *     leaves the entity alone, exactly as if it had been detected that
+     *     way — which is why it is auditable rather than a mutable field.
+     */
+    AudioRetag: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity being corrected.
+       */
+      id: string;
+      /** @description The corrected label, when recognition got it wrong. */
+      label?: components["schemas"]["LabelRef"];
+      /**
+       * @description The corrected location, when the span clipped the value or
+       *     ran past it.
+       */
+      location?: components["schemas"]["AudioLocation"];
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /**
-     * @description What detection found in one document.
+     * @description What detection found in one document, plus what a reviewer
+     *     decided about it.
+     *
+     *     Wraps elide's [`Report`] with the three things elide does not
+     *     model: the recognition [`DocumentContext`] the entities were
+     *     scored against, how the document decoded, and the reviewer
+     *     decisions in [`edits`](Self::edits).
+     *
+     *     # Serialization
      *
-     *     The body group plus per-container-part groups (each tagged by
-     *     modality) plus the recognition [`AuditContext`] the entities
-     *     were scored against.
+     *     [`Serialize`] but deliberately **not** `Deserialize`: a
+     *     serialized report tags entity groups by modality *name*, so
+     *     rebuilding one needs the registry [`Engine`] holds. Read an
+     *     audit back with [`Engine::deserialize_audit`].
      *
-     *     The context travels with the entities so anonymize can rebuild
-     *     an orchestrator against exactly the vocabulary analyze used.
-     *     Anything a policy predicate compares against beyond the label
-     *     catalog (asserted languages, jurisdictions, document tags) is
-     *     here; labels are re-derived from the policy set on each
-     *     anonymize call.
+     *     # Schema
      *
-     *     No [`Default`]: a well-formed audit must carry a real
-     *     [`AuditContext`] with a real correlation id. Callers building
-     *     an audit outside the analyze path construct it explicitly.
+     *     Generate under the **serialize** contract
+     *     ([`SchemaSettings::for_serialize`]). `edits` and `usage` are
+     *     `skip_serializing_if`, and only that contract marks them
+     *     optional — `schema_for!` defaults to deserialize and declares
+     *     both required, so a generated client would reject responses this
+     *     crate really emits.
+     *
+     *     [`Engine`]: super::Engine
+     *     [`Engine::deserialize_audit`]: super::Engine::deserialize_audit
+     *     [`Report`]: elide::Report
+     *     [`SchemaSettings::for_serialize`]: schemars::generate::SchemaSettings::for_serialize
      */
     Audit: {
       /**
-       * @description The body group.
+       * @description How this document was decoded when it was analyzed.
        *
-       *     `None` when no body pipeline produced entities (pre-analyze,
-       *     or the codec resolved the doc to a modality with no
-       *     pipeline).
+       *     Carried back so anonymize decodes identically: the entity
+       *     offsets below are stored against the first decode, and a
+       *     differently-rendered second one would not line up.
        */
-      body?: components["schemas"]["EntityGroup"];
+      codec: components["schemas"]["CodecParams"];
       /**
-       * @description Recognition context.
-       *
-       *     The asserted languages, countries, document tags, and the
-       *     analyze-side correlation id. Held so
-       *     [`Engine::anonymize`] can compile against the same
-       *     vocabulary analyze used without the caller re-passing an
-       *     `AnalyzerParams`.
+       * @description What the caller asserted when this document was analyzed:
+       *     languages, jurisdictions, document tags.
        *
-       *     Required on the wire: a missing context on an incoming
-       *     [`Audit`] rejects at deserialize time so the shape
-       *     mismatch surfaces at load, not at apply.
+       *     Carried back so [`Engine::anonymize`] compiles against the
+       *     same vocabulary analyze used, and re-decodes under the same
+       *     codec configuration, without the caller re-passing it.
        *
        *     [`Engine::anonymize`]: super::Engine::anonymize
        */
-      context: components["schemas"]["AuditContext"];
+      context: components["schemas"]["DocumentContext"];
       /**
-       * @description One entry per container part the orchestrator surfaced.
+       * @description What a reviewer changed: detections they added, corrected,
+       *     suppressed, or chose an operator for.
+       *
+       *     A list rather than one decision per entity, because the
+       *     operations feed independent channels — a retag and an
+       *     operator override on the same entity are both legitimate.
+       *
+       *     Separate from the report because elide has no concept of a
+       *     per-entity operator override: [`anonymize_with`] re-resolves
+       *     operators from live policy at apply time.
        *
-       *     Keyed by the container-private part id (e.g. a DOCX zip
-       *     entry name like `"word/media/image1.png"`); each value
-       *     carries that part's modality + entities.
+       *     [`anonymize_with`]: elide::Orchestrator::anonymize_with
        */
-      parts?: {
-        [key: string]: components["schemas"]["EntityGroup"];
-      };
+      edits: components["schemas"]["EditSet"];
       /**
-       * @description What the analyze pass cost: one entry per recognizer and
-       *     enricher that ran, each self-identifying by the name the
-       *     deployment configured it under.
+       * @description The detections: elide's own report, body and container
+       *     parts, each entity carrying its provenance chain.
        *
-       *     Empty when nothing model-backed ran, which is the common
-       *     case for a pattern-only pass. Recorded on analyze and not
-       *     re-derived at anonymize time, so a host that bills or rate
-       *     limits on model spend reads it straight off the returned
-       *     [`Audit`].
-       */
-      usage?: components["schemas"]["UsageReport"];
-    };
-    /**
-     * @description Recognition-side facts that travel from analyze to anonymize.
-     *
-     *     Mirrors elide's [`Scope`] shape one-for-one: direct fields
-     *     for `languages` and `countries` (typed, elide-native), a
-     *     [`metadata`] sub-struct for free-form classification strings
-     *     (`tags`, `purpose`, `audience`), and the analyze-time
-     *     [`correlation_id`]. The label catalog is not on here -
-     *     labels are policy-owned, and anonymize re-derives them from
-     *     the policy set it was handed.
-     *
-     *     No [`Default`]: `correlation_id` has no meaningful default
-     *     (a nil UUID would silently collapse unrelated audits under
-     *     one bucket in downstream trace aggregators), so callers
-     *     supply one explicitly. Everything else defaults to empty.
-     *
-     *     [`Scope`]: elide::recognition::Scope
-     *     [`metadata`]: Self::metadata
-     *     [`correlation_id`]: Self::correlation_id
-     */
-    AuditContext: {
-      /**
-       * Format: uuid
-       * @description Analyze-time correlation id.
+       *     Edit it through [`Report`]'s own API — [`include`],
+       *     [`suppress`], [`entities`] — for the decisions elide models.
+       *     Operator overrides live in [`edits`](Self::edits).
        *
-       *     Threaded into every tracing span on the recognition path;
-       *     carried over so the anonymize path can link its own spans
-       *     to the same request. The anonymize call supplies a fresh
-       *     id from the passed [`Document`] as the anonymize-side
-       *     correlation id: this one stays as the analyze-side
-       *     pointer.
-       *
-       *     Required on the wire.
-       *
-       *     [`Document`]: elide_wire::file::Document
+       *     [`Report`]: elide::Report
+       *     [`include`]: elide::Report::include
+       *     [`suppress`]: elide::Report::suppress
+       *     [`entities`]: elide::Report::entities
        */
-      correlationId: string;
+      report: components["schemas"]["Report"];
       /**
-       * @description Caller-asserted jurisdictions.
-       *
-       *     Recorded from `AnalyzerParams.scope.countries`.
-       */
-      countries?: components["schemas"]["CountryCode"][];
-      /**
-       * @description Caller-asserted languages for the analysis.
+       * @description What the analyze pass cost: one entry per recognizer and
+       *     enricher that ran, each self-identifying by the name the
+       *     deployment configured it under.
        *
-       *     Recorded from `AnalyzerParams.scope.languages` at analyze
-       *     time; anonymize re-uses them verbatim.
-       * @default []
-       */
-      languages?: components["schemas"]["Languages"];
-      /**
-       * @description Free-form request context: document tags, request purpose,
-       *     output audience. See elide's [`ScopeMetadata`].
+       *     Carried here rather than read off the report: elide derives
+       *     usage during analysis and drops it when a report is rebuilt
+       *     from the wire, so a host that bills on model spend would
+       *     lose it on the round trip.
        */
-      metadata?: components["schemas"]["ScopeMetadata"];
-      /**
-       * @description OCR mode the analyze call decoded with. Recorded so the
-       *     anonymize call re-decodes the same document under the same
-       *     codec configuration: otherwise entity offsets stored in
-       *     the audit wouldn't line up against a differently-rendered
-       *     second decode. Defaults to [`RasterMode::Auto`] (the codec's
-       *     built-in behaviour) when omitted.
-       * @default {
-       *       "kind": "auto"
-       *     }
-       */
-      rasterMode?: components["schemas"]["RasterMode"];
+      usage: components["schemas"]["UsageReport"];
     };
     /**
      * @description A 32-byte BLAKE3 digest.
@@ -9717,6 +9727,14 @@ interface components {
       /** @description Minimum corner (top-left, conventionally). */
       min: components["schemas"]["Point"];
     };
+    /** @description The entity's confidence was rescaled by a per-recognizer factor. */
+    Calibration: {
+      /**
+       * Format: double
+       * @description Multiplier applied.
+       */
+      factor: number;
+    };
     /**
      * @description The coarse group a [`Label`] belongs to, for organizing detected entities
      *     by kind (`financial`, `health`, `identity`, …).
@@ -9819,6 +9837,21 @@ interface components {
       /** @description The text delta. */
       delta: string;
     };
+    /**
+     * @description A [`Cited`](Attribution::Cited) rationale: a citable authority, the citation
+     *     within it, and an optional rationale for why it applies.
+     */
+    CitedAttribution: {
+      /** @description The authority cited (e.g. `"GDPR"`, `"HIPAA"`, `"internal-policy"`). */
+      authority: string;
+      /** @description The citation within that authority (e.g. `"Art. 17(1)"`, `"§164.514"`). */
+      citation: string;
+      /**
+       * @description Why the citation applies here (e.g. `"data subject requested erasure"`),
+       *     when given.
+       */
+      rationale?: string;
+    };
     /**
      * @description Text a [`TextRedaction::Clamp`] emits for out-of-range values.
      *
@@ -9845,6 +9878,24 @@ interface components {
     } | {
       [key: string]: string;
     };
+    /**
+     * @description How the codec decodes this document.
+     *
+     *     Defaults to the codec's own behaviour, so a caller with no
+     *     opinion passes [`CodecParams::default`].
+     */
+    CodecParams: {
+      /**
+       * @description How container formats carrying both a text layer and page
+       *     images treat OCR.
+       *
+       *     Defaults to [`RasterMode::Auto`], the codec's own behaviour.
+       * @default {
+       *       "kind": "auto"
+       *     }
+       */
+      rasterMode?: components["schemas"]["RasterMode"];
+    };
     /**
      * @description Color as 8-bit RGB.
      *
@@ -9904,6 +9955,18 @@ interface components {
      *     [`Confidence`]: crate::primitive::Confidence
      */
     ConfidenceThreshold: number;
+    /**
+     * @description A competing detection of a *different* label over the same span was resolved
+     *     against this (winning) entity — the loser is recorded, not dropped.
+     */
+    Conflict: {
+      /** @description The loser's confidence at resolution time. */
+      competing_confidence: components["schemas"]["Confidence"];
+      /** @description The label of the detection that lost arbitration. */
+      competing_label: components["schemas"]["LabelRef"];
+      /** @description Name of the conflict policy that chose the winner. */
+      resolved_by: string;
+    };
     /**
      * @description Response type for a workspace connection.
      *
@@ -10087,6 +10150,19 @@ interface components {
        */
       provider?: string[];
     };
+    /**
+     * @description A competing detection of a different label over the same span was left
+     *     *unresolved*: both entities survive, flagged for a human. Recorded on each
+     *     entity of the contested pair, naming the other.
+     */
+    Contested: {
+      /** @description The competing detection's confidence. */
+      competing_confidence: components["schemas"]["Confidence"];
+      /** @description The label of the competing detection. */
+      competing_label: components["schemas"]["LabelRef"];
+      /** @description Name of the policy that flagged the contest. */
+      flagged_by: string;
+    };
     /**
      * @description [ISO 3166-1] country, identified by its code.
      *
@@ -10195,7 +10271,7 @@ interface components {
        *     Overrides the pipeline's `defaultScope` when present; absent falls back to
        *     the pipeline default.
        */
-      scope?: components["schemas"]["ScopeParams"];
+      scope?: components["schemas"]["DocumentContext"];
     };
     /**
      * @description Request payload for creating a new workspace policy.
@@ -10329,6 +10405,11 @@ interface components {
        */
       to?: string;
     };
+    /** @description Several detections were fused into one entity. */
+    Deduplication: {
+      /** @description Name of the fusion strategy that combined them. */
+      strategy: string;
+    };
     /**
      * @description Pixel dimensions of an image or any 2-D canvas.
      *
@@ -10352,6 +10433,36 @@ interface components {
        */
       width: number;
     };
+    /**
+     * @description What a caller asserts about the document being processed.
+     *
+     *     Everything defaults to empty, so a caller asserting nothing
+     *     passes [`DocumentContext::default`] and lets the recognizers use
+     *     their own defaults.
+     */
+    DocumentContext: {
+      /**
+       * @description Jurisdictions the caller asserts apply.
+       *
+       *     Read by policy predicates that vary by jurisdiction, so a
+       *     rule can act on a document from one country and not another.
+       */
+      countries?: components["schemas"]["CountryCode"][];
+      /**
+       * @description Languages the caller asserts the document is in.
+       *
+       *     Recognizers that take a language hint use it; the
+       *     language-detection enricher fills the gap when this is
+       *     empty.
+       * @default []
+       */
+      languages?: components["schemas"]["Languages"];
+      /**
+       * @description Free-form request context: document tags, request purpose,
+       *     output audience. See elide's [`ScopeMetadata`].
+       */
+      metadata?: components["schemas"]["ScopeMetadata"];
+    };
     /**
      * Format: uint16
      * @description Dots-per-inch resolution for rasterizing vector content.
@@ -10365,6 +10476,21 @@ interface components {
      *     [`scale_factor`]: Self::scale_factor
      */
     Dpi: number;
+    /**
+     * @description Reviewer edits for one document, one list per modality.
+     *
+     *     Empty by default: an audit nobody has reviewed carries none.
+     */
+    EditSet: {
+      /** @description Edits to audio entities. */
+      audio?: components["schemas"]["AudioEdit"][];
+      /** @description Edits to image entities. */
+      image?: components["schemas"]["ImageEdit"][];
+      /** @description Edits to tabular entities. */
+      tabular?: components["schemas"]["TabularEdit"][];
+      /** @description Edits to text entities. */
+      text?: components["schemas"]["TextEdit"][];
+    };
     /**
      * @description Coreference identifier shared by entities that denote the same
      *     real-world thing.
@@ -10380,36 +10506,6 @@ interface components {
      *     mentions, not a global key.
      */
     EntityCoRef: string;
-    /**
-     * @description A modality-tagged group of recognised entities.
-     *
-     *     The unit [`Audit`] stores in `body` and in every `parts`
-     *     entry.
-     *
-     *     Tagged by `modality` (snake_case) so deserialization picks the
-     *     right variant and the entity vec inside is statically typed
-     *     per modality: apply-time we hand each variant back to elide
-     *     as a `Vec<Entity<M>>` for the appropriate `M`.
-     *
-     *     [`Audit`]: crate::Audit
-     */
-    EntityGroup: {
-      entities: components["schemas"]["TextEntityRecord"][];
-      /** @constant */
-      modality: "text";
-    } | {
-      entities: components["schemas"]["TabularEntityRecord"][];
-      /** @constant */
-      modality: "tabular";
-    } | {
-      entities: components["schemas"]["ImageEntityRecord"][];
-      /** @constant */
-      modality: "image";
-    } | {
-      entities: components["schemas"]["AudioEntityRecord"][];
-      /** @constant */
-      modality: "audio";
-    };
     /**
      * @description HTTP error response representation with security-conscious design.
      *
@@ -10527,6 +10623,16 @@ interface components {
      * @enum {string}
      */
     FormatToken: "csv" | "docx" | "htm" | "html" | "jpeg" | "jpg" | "json" | "log" | "pdf" | "png" | "rtf" | "tif" | "tiff" | "txt" | "wav" | "xlsx" | "xml";
+    /**
+     * @description A [`Freeform`](Attribution::Freeform) rationale: a policy label and an
+     *     optional human description, with no formal citation.
+     */
+    FreeformAttribution: {
+      /** @description Human-readable description (e.g. `"right to erasure"`), when given. */
+      description?: string;
+      /** @description The policy's name (e.g. `"gdpr-art-17"`, `"hipaa-safe-harbor"`). */
+      name: string;
+    };
     /**
      * @description Typed credentials for Google Cloud Storage.
      *
@@ -10657,6 +10763,28 @@ interface components {
      *       as de-identified.
      */
     HipaaDeidMethod: "safe_harbor" | "limited_data_set" | "expert_determination";
+    /**
+     * @description A detection recognition missed.
+     *
+     *     Recorded on the report with human provenance, so it is never
+     *     mistaken for an automatic hit, then redacted under the policy set
+     *     like any other entity: an added label the policy does not cover
+     *     is left alone.
+     *
+     *     Carries no entity id — the entity does not exist yet, and the
+     *     engine mints one when the edit is applied, so a client cannot
+     *     collide with a real detection or shadow an existing entity.
+     */
+    ImageAdd: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /** @description What the reviewer says this is. */
+      label: components["schemas"]["LabelRef"];
+      /** @description Where it sits in the document. */
+      location: components["schemas"]["ImageLocation"];
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /**
      * @description One node in an entity's audit DAG: a thing that happened, with its
      *     effect on confidence and its tamper-evident links.
@@ -10732,115 +10860,70 @@ interface components {
      * @description Kind of an [`AuditEvent`], carrying its event-specific detail and the
      *     rationale for why it happened.
      *
-     *     `#[non_exhaustive]`: new event kinds (verification, annotation, …)
-     *     can be added compatibly. The recognition kinds ([`Pattern`],
-     *     [`Model`]) carry the matched [`Location`]; the rest carry their own
-     *     data.
-     *
+     *     A thin tagged union: each variant wraps one payload struct (e.g.
+     *     [`Redaction`], [`Selection`], [`Manual`]) that owns that kind's fields, its
+     *     docs, and how it folds into the audit hash. Match on a variant to reach its
+     *     payload:
+     *
+     *     ```
+     *     # use elide_core::entity::audit::AuditKind;
+     *     # use elide_core::modality::text::Text;
+     *     # fn show(kind: &AuditKind<Text>) {
+     *     if let AuditKind::Redaction(redaction) = kind {
+     *         let _ = &redaction.operator;
+     *     }
+     *     # }
+     *     ```
+     *
+     *     `#[non_exhaustive]`: new event kinds (verification, annotation, …) can be
+     *     added compatibly. The recognition kinds ([`Pattern`], [`Model`]) carry the
+     *     matched [`Location`]; the rest carry their own data.
+     *
+     *     [`AuditEvent`]: super::AuditEvent
      *     [`Pattern`]: AuditKind::Pattern
      *     [`Model`]: AuditKind::Model
      *     [`Location`]: Modality::Location
      */
     ImageAuditKind: {
+      detail: components["schemas"]["ImagePattern"];
       /** @constant */
       kind: "pattern";
-      /** @description Where the recognizer matched. */
-      location: components["schemas"]["ImageLocation"];
-      /** @description Pattern detail. */
-      pattern: components["schemas"]["PatternEvent"];
     } | {
+      detail: components["schemas"]["ImageModel"];
       /** @constant */
       kind: "model";
-      /** @description Where the recognizer matched. */
-      location: components["schemas"]["ImageLocation"];
-      /** @description Model detail. */
-      model: components["schemas"]["ModelEvent"];
     } | {
+      detail: components["schemas"]["Deduplication"];
       /** @constant */
       kind: "deduplication";
-      /** @description Name of the fusion strategy that combined them. */
-      strategy: string;
     } | {
-      /** @description The loser's confidence at resolution time. */
-      competing_confidence: components["schemas"]["Confidence"];
-      /** @description The label of the detection that lost arbitration. */
-      competing_label: components["schemas"]["LabelRef"];
+      detail: components["schemas"]["Conflict"];
       /** @constant */
       kind: "conflict";
-      /** @description Name of the conflict policy that chose the winner. */
-      resolved_by: string;
     } | {
-      /** @description The competing detection's confidence. */
-      competing_confidence: components["schemas"]["Confidence"];
-      /** @description The label of the competing detection. */
-      competing_label: components["schemas"]["LabelRef"];
-      /** @description Name of the policy that flagged the contest. */
-      flagged_by: string;
+      detail: components["schemas"]["Contested"];
       /** @constant */
       kind: "contested";
     } | {
-      /**
-       * Format: double
-       * @description Multiplier applied.
-       */
-      factor: number;
+      detail: components["schemas"]["Calibration"];
       /** @constant */
       kind: "calibration";
     } | {
-      /**
-       * @description The located [`Hint`] the keyword fired from, when the match came
-       *     from an out-of-band hint (a column header, a key) rather than
-       *     the in-text word window. `None` for an in-text-window match.
-       *
-       *     [`Hint`]: crate::modality::Hint
-       */
-      hint?: components["schemas"]["ImageHint"];
-      /** @description Keyword that fired the boost. */
-      keyword: string;
+      detail: components["schemas"]["ImageRefinement"];
       /** @constant */
       kind: "refinement";
-      /**
-       * @description Where the boosting keyword sits in the medium. For a hint match
-       *     this mirrors the hint's own location; for an in-text-window match
-       *     it is the keyword resolved through the modality's [`locate`] (a
-       *     pixel box for image, a time span for audio, the byte range for
-       *     text/tabular). `None` when the keyword's stream range could not be
-       *     placed, symmetric with a match the recognizer itself drops.
-       *
-       *     [`locate`]: crate::modality::TextRecognizable::locate
-       */
-      location?: components["schemas"]["ImageLocation"];
     } | {
-      /**
-       * @description The author-supplied policy rationale, when the operator carried an
-       *     [`Attribution`]; `None` otherwise.
-       */
-      attribution?: components["schemas"]["Attribution"];
-      /** @description Identifier of the key needed to reverse it, if reversible. */
-      key_id?: string;
+      detail: components["schemas"]["Redaction"];
       /** @constant */
       kind: "redaction";
-      /** @description How much the output leaks about the original. */
-      leak_profile: components["schemas"]["LeakProfile"];
-      /**
-       * @description Which selection rule chose this operator: the automatic "why"
-       *     (matched a label, a tag, a predicate, or the fallback).
-       */
-      matched_by: components["schemas"]["RuleMatch"];
-      /** @description Which operator (name + version) ran. */
-      operator: components["schemas"]["OperatorId"];
-      /**
-       * @description BLAKE3 digest of the original text the operator hid, when the
-       *     redaction layer recorded it. Proves *what* was redacted without
-       *     storing the plaintext; `None` when the operator did not capture it.
-       */
-      span_hash?: components["schemas"]["AuditHash"];
-      /**
-       * Format: uint32
-       * @description Byte length of the original text the operator hid, paired with
-       *     [`span_hash`](Self::Redaction::span_hash). `None` when not captured.
-       */
-      span_length?: number;
+    } | {
+      detail: components["schemas"]["Selection"];
+      /** @constant */
+      kind: "selection";
+    } | {
+      detail: components["schemas"]["ImageManual"];
+      /** @constant */
+      kind: "manual";
     };
     /**
      * @description Full audit trail of an [`Entity`]: every [`AuditEvent`] in its life, as a
@@ -10895,6 +10978,26 @@ interface components {
       /** @description Original filename, when known. */
       filename?: string;
     };
+    /**
+     * @description One change to an analyzed document.
+     *
+     *     `Add` carries no id because the entity does not exist yet; the
+     *     engine mints one when the edit is applied, so a client cannot
+     *     collide with a real detection or shadow an existing entity.
+     */
+    ImageEdit: ({
+      /** @constant */
+      op: "add";
+    } & components["schemas"]["ImageAdd"]) | ({
+      /** @constant */
+      op: "retag";
+    } & components["schemas"]["ImageRetag"]) | ({
+      /** @constant */
+      op: "suppress";
+    } & components["schemas"]["Suppress"]) | ({
+      /** @constant */
+      op: "redact";
+    } & components["schemas"]["ImageRedact"]);
     /**
      * @description Detected piece of sensitive information within some medium.
      *
@@ -10923,7 +11026,12 @@ interface components {
     ImageEntity: {
       /**
        * @description Tamper-evident audit trail: every contributing detection, the fusion
-       *     event if any, and the redaction that hid it, as a hash-linked DAG.
+       *     event if any, and the redaction that hid it, as a hash-linked DAG. It is
+       *     also the single source of truth for whether a reviewer
+       *     [suppressed](Self::is_suppressed) the entity — a suppression is a
+       *     [`Manual`] event on this trail, not a separate flag.
+       *
+       *     [`Manual`]: crate::entity::audit::AuditKind::Manual
        */
       audit: components["schemas"]["ImageAuditLog"];
       /** @description Effective confidence in `0.0..=1.0` (fused, if applicable). */
@@ -10968,30 +11076,6 @@ interface components {
        */
       recognized_range?: components["schemas"]["Range_of_uint"];
     };
-    /**
-     * @description One recognized entity plus the optional reviewer override.
-     *
-     *     The bound mirrors elide's [`Entity<M>`]: serialization needs
-     *     `M::Location` and `M::Data` (de)serializable, and JsonSchema
-     *     derivation needs them schema-able. All four modalities elide
-     *     ships satisfy these under the `serde` + `schema` features.
-     */
-    ImageEntityRecord: {
-      /** @description The elide entity, as recognition produced it. */
-      entity: components["schemas"]["ImageEntity"];
-      /**
-       * @description Reviewer-supplied redaction override.
-       *
-       *     `None` means "use the matching policy rule's decision";
-       *     `Some(...)` overrides that rule for this specific entity
-       *     at apply time. Reviewer overrides take precedence over
-       *     every policy rule and inherit the authority of the
-       *     [`Review::policy_id`] they name: the audit event's
-       *     attribution stamps that policy so the trail names the
-       *     authority under which the override fired.
-       */
-      review?: components["schemas"]["Review"];
-    };
     /**
      * @description Located, typed piece of context a recognizer may treat as in-context
      *     for a nearby value.
@@ -11037,6 +11121,85 @@ interface components {
        */
       polygon?: components["schemas"]["Polygon"];
     };
+    /**
+     * @description A human override, outside automatic detection: an entity a reviewer added by
+     *     hand, or a detected one they marked to ignore. Its provenance is a person's
+     *     decision, not a recognizer's — so the trail records *why* (an
+     *     [`Attribution`], when supplied). *Who* made the override is the event's
+     *     [`source`], not a payload field.
+     *
+     *     [`source`]: super::AuditEvent::source
+     */
+    ImageManual: {
+      /**
+       * @description The reviewer's rationale, when supplied (e.g. a freeform
+       *     `"false positive"`, or a cited authority). `None` for an unexplained
+       *     override.
+       */
+      attribution?: components["schemas"]["Attribution"];
+      /**
+       * @description Which human decision this records: including a missed entity, or
+       *     suppressing a detected one. This is the authority on whether the entity
+       *     is redacted — [`AuditLog::is_suppressed`] reads it, so there is no
+       *     separate flag to keep in sync.
+       *
+       *     [`AuditLog::is_suppressed`]: crate::entity::audit::AuditLog::is_suppressed
+       */
+      intent: components["schemas"]["ManualIntent"];
+      /** @description Where the override applies, in modality-native coordinates. */
+      location: components["schemas"]["ImageLocation"];
+    };
+    /**
+     * @description Detail of a model/NER recognition: a model matched at `location`, with its
+     *     metadata in `model`.
+     */
+    ImageModel: {
+      /** @description Where the recognizer matched. */
+      location: components["schemas"]["ImageLocation"];
+      /** @description Model metadata (name, version, contextual flag). */
+      model: components["schemas"]["ModelEvent"];
+    };
+    /**
+     * @description Detail of a pattern/dictionary recognition: a recognizer matched at
+     *     `location`, with the pattern metadata in `pattern`.
+     */
+    ImagePattern: {
+      /** @description Where the recognizer matched. */
+      location: components["schemas"]["ImageLocation"];
+      /** @description Pattern metadata (name, regex, validator, contextual flag). */
+      pattern: components["schemas"]["PatternEvent"];
+    };
+    /**
+     * @description Redact this entity with `action` instead of the operator the
+     *     policy picked.
+     */
+    ImageRedact: {
+      /**
+       * @description The operator to run, typed to the entity's own modality so a
+       *     text entity cannot be given an image operator.
+       */
+      action: components["schemas"]["ImageRedaction"];
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity to redact.
+       */
+      id: string;
+      /**
+       * Format: uuid
+       * @description The policy whose authority the reviewer exercises. Must match
+       *     a submitted policy's `id`.
+       *
+       *     Not only for audit: it picks which per-policy pseudonym vault
+       *     and `KeyProvider` the operator resolves against, so an
+       *     override using `Pseudonymize` or `HmacHash` stays consistent
+       *     with that policy's other rules.
+       */
+      policyId: string;
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /** @description Operator spec a `redact` image rule carries. */
     ImageRedaction: {
       /** @constant */
@@ -11077,6 +11240,55 @@ interface components {
       /** @constant */
       kind: "blackbox";
     };
+    /** @description A context keyword near the entity lifted its confidence. */
+    ImageRefinement: {
+      /**
+       * @description The located [`Hint`] the keyword fired from, when the match came from an
+       *     out-of-band hint (a column header, a key) rather than the in-text word
+       *     window. `None` for an in-text-window match.
+       *
+       *     [`Hint`]: crate::modality::Hint
+       */
+      hint?: components["schemas"]["ImageHint"];
+      /** @description Keyword that fired the boost. */
+      keyword: string;
+      /**
+       * @description Where the boosting keyword sits in the medium. For a hint match this
+       *     mirrors the hint's own location; for an in-text-window match it is the
+       *     keyword resolved through the modality's [`locate`]. `None` when the
+       *     keyword's stream range could not be placed.
+       *
+       *     [`locate`]: crate::modality::TextRecognizable::locate
+       */
+      location?: components["schemas"]["ImageLocation"];
+    };
+    /**
+     * @description Correct what an existing detection *is* or *covers*, then redact
+     *     it under the policy set as corrected.
+     *
+     *     A reviewer fixing recognition's mistake rather than overriding
+     *     its consequence. Retagging into a label the policy does not cover
+     *     leaves the entity alone, exactly as if it had been detected that
+     *     way — which is why it is auditable rather than a mutable field.
+     */
+    ImageRetag: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity being corrected.
+       */
+      id: string;
+      /** @description The corrected label, when recognition got it wrong. */
+      label?: components["schemas"]["LabelRef"];
+      /**
+       * @description The corrected location, when the span clipped the value or
+       *     ran past it.
+       */
+      location?: components["schemas"]["ImageLocation"];
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /**
      * @description Workspace invite with complete information.
      *
@@ -11354,7 +11566,7 @@ interface components {
        *     categories), so this is where that mapping is recorded as
        *     data rather than prose.
        */
-      attribution?: components["schemas"]["AttributionKind"];
+      attribution?: components["schemas"]["Attribution"];
       /** @description Optional description for reviewers. */
       description?: string;
       /**
@@ -11563,6 +11775,12 @@ interface components {
        */
       rememberMe?: boolean;
     };
+    /**
+     * @description Which human decision a [`Manual`] event records — the reviewer actions on a
+     *     finding: [`Flag`](ManualIntent::Flag) a miss, [`Suppress`](ManualIntent::Suppress)
+     *     a false positive, or [`Amend`](ManualIntent::Amend) an existing finding.
+     */
+    ManualIntent: "flag" | "suppress" | "amend";
     /** @description Response type for a mark-all-read action. */
     MarkedReadStatus: {
       /**
@@ -11661,7 +11879,7 @@ interface components {
      * @enum {string}
      */
     ModalityToken: "audio" | "image" | "tabular" | "text";
-    /** @description Detail of a model/NER recognition. */
+    /** @description Metadata of a model/NER recognition, carried by [`Model`]. */
     ModelEvent: {
       /** @description Whether contextual analysis adjusted the score for this match. */
       contextual: boolean;
@@ -11866,11 +12084,11 @@ interface components {
       /** @description The new password (will be hashed before storage). */
       newPassword: string;
     };
-    /** @description Detail of a pattern/dictionary recognition. */
+    /** @description Metadata of a pattern/dictionary recognition, carried by [`Pattern`]. */
     PatternEvent: {
       /**
-       * @description Whether contextual analysis (keyword co-occurrence) adjusted the
-       *     score for this match.
+       * @description Whether contextual analysis (keyword co-occurrence) adjusted the score
+       *     for this match.
        */
       contextual: boolean;
       /** @description Name of the pattern that matched (e.g. `"ssn"`, `"email"`). */
@@ -11987,7 +12205,7 @@ interface components {
        *     A document's own scope overrides this at detect time; absent here means
        *     the document must assert its own.
        */
-      defaultScope?: components["schemas"]["ScopeParams"];
+      defaultScope?: components["schemas"]["DocumentContext"];
       /**
        * @description Slugs of workspace policies applied at redaction.
        *
@@ -12305,11 +12523,11 @@ interface components {
        * @description Human-readable name. Display-only. Does not key anything.
        *
        *     Names the policy in a redaction event's [`Attribution`]
-       *     when a rule that fired carried no [`AttributionKind::Cited`]
+       *     when a rule that fired carried no [`Attribution::Cited`]
        *     attribution to render.
        *
        *     [`Attribution`]: elide_core::entity::audit::Attribution
-       *     [`AttributionKind::Cited`]: elide_core::entity::audit::AttributionKind::Cited
+       *     [`Attribution::Cited`]: elide_core::entity::audit::Attribution::Cited
        */
       name: string;
       /** @description Ordered rules. First match wins within this policy. */
@@ -12391,26 +12609,29 @@ interface components {
        * @description Why this rule exists: the authority it answers to.
        *
        *     The engine renders it into the redaction event's
-       *     [`Attribution`], so a reviewer sees the provision rather
-       *     than a bare UUID. `None` falls back to recording the
-       *     policy and rule ids alone.
+       *     [`Attribution`] verbatim, so a reviewer sees the provision
+       *     the rule answers to. `None` falls back to a freeform
+       *     attribution under the enclosing policy's name and
+       *     description — the rule itself is not named in the trail.
        *
        *     Optional so ad-hoc and hand-authored rules stay cheap to
        *     write; the shipped templates set it on every rule.
        *
        *     [`Attribution`]: elide_core::entity::audit::Attribution
        */
-      attribution?: components["schemas"]["AttributionKind"];
+      attribution?: components["schemas"]["Attribution"];
       /** @description Optional description for reviewers. */
       description?: string;
       /**
        * Format: uuid
-       * @description Stable identifier. UUIDv7 recommended. Engine stamps it
-       *     into the redaction event's [`Attribution::source_id`] so
-       *     reviewers can trace which rule fired. Every attachment a
-       *     [`RuleDispatch::Table`] expands into shares this UUID.
+       * @description Stable identifier. UUIDv7 recommended. Every attachment a
+       *     [`RuleDispatch::Table`] expands into shares this UUID, so
+       *     one authored rule stays one rule however many labels it
+       *     dispatches over.
        *
-       *     [`Attribution::source_id`]: elide_core::entity::audit::Attribution::source_id
+       *     Not carried onto the audit trail: a redaction event names
+       *     the [`attribution`](Self::attribution) the rule declared, or
+       *     its policy's, rather than the rule's own id.
        */
       id: string;
       /** @description Human-readable name. Display-only. */
@@ -12496,7 +12717,7 @@ interface components {
      *
      *     Serialises as an internally-tagged object under `kind`,
      *     matching the house pattern for option-bearing enums
-     *     (`Predicate`, `TextRedaction`, `AnyRedaction`). A caller
+     *     (`Predicate`, `TextRedaction`). A caller
      *     wire-picks a template as
      *     `{"kind": "hipaa_safe_harbor"}` or, for variants with
      *     operator options,
@@ -12696,6 +12917,40 @@ interface components {
       /** @description Recognizer's version at the time it ran. */
       version: string;
     };
+    /** @description An operator hid the entity. */
+    Redaction: {
+      /**
+       * @description The author-supplied policy rationale, when the operator carried an
+       *     [`Attribution`]; `None` otherwise.
+       */
+      attribution?: components["schemas"]["Attribution"];
+      /** @description Identifier of the key needed to reverse it, if reversible. */
+      key_id?: string;
+      /**
+       * @description How much the output leaks about the original, when the operator claimed a
+       *     profile; `None` when it made no claim.
+       */
+      leak_profile?: components["schemas"]["LeakProfile"];
+      /**
+       * @description Which selection rule chose this operator: the automatic "why" (matched a
+       *     label, a tag, a predicate, or the fallback).
+       */
+      matched_by: components["schemas"]["RuleMatch"];
+      /** @description Which operator (name + version) ran. */
+      operator: components["schemas"]["OperatorId"];
+      /**
+       * @description BLAKE3 digest of the original text the operator hid, when the redaction
+       *     layer recorded it. Proves *what* was redacted without storing the
+       *     plaintext; `None` when the operator did not capture it.
+       */
+      span_hash?: components["schemas"]["AuditHash"];
+      /**
+       * Format: uint32
+       * @description Byte length of the original text the operator hid, paired with
+       *     [`span_hash`](Self::span_hash). `None` when not captured.
+       */
+      span_length?: number;
+    };
     /**
      * @description Public view of one recognizer in the engine's NER or LLM
      *     lineup.
@@ -12737,6 +12992,45 @@ interface components {
       /** @description Whether to accept or decline the invitation. */
       acceptInvite: boolean;
     };
+    Report: {
+      body: ({
+        entities: components["schemas"]["TextEntity"][];
+        /** @constant */
+        modality: "text";
+      } | {
+        entities: components["schemas"]["ImageEntity"][];
+        /** @constant */
+        modality: "image";
+      } | {
+        entities: components["schemas"]["AudioEntity"][];
+        /** @constant */
+        modality: "audio";
+      } | {
+        entities: components["schemas"]["TabularEntity"][];
+        /** @constant */
+        modality: "tabular";
+      }) | null;
+      parts: {
+        [key: string]: {
+          entities: components["schemas"]["TextEntity"][];
+          /** @constant */
+          modality: "text";
+        } | {
+          entities: components["schemas"]["ImageEntity"][];
+          /** @constant */
+          modality: "image";
+        } | {
+          entities: components["schemas"]["AudioEntity"][];
+          /** @constant */
+          modality: "audio";
+        } | {
+          entities: components["schemas"]["TabularEntity"][];
+          /** @constant */
+          modality: "tabular";
+        };
+      };
+      usage?: components["schemas"]["UsageReport"];
+    };
     /**
      * @description How long a class of data is retained.
      *
@@ -12799,38 +13093,6 @@ interface components {
        */
       redactedDocuments?: components["schemas"]["Retention"];
     };
-    /**
-     * @description A reviewer-supplied redaction override with the policy
-     *     authority it draws from.
-     *
-     *     The `policy_id` isn't just for audit: it also picks which
-     *     per-policy pseudonym vault and per-policy [`KeyProvider`] the
-     *     override's operator resolves against, so an override using
-     *     [`Pseudonymize`] or [`HmacHash`] stays consistent with the
-     *     authoring policy's other rules.
-     *
-     *     [`KeyProvider`]: elide::redaction::operators::KeyProvider
-     *     [`Pseudonymize`]: elide::redaction::operators::Pseudonymize
-     *     [`HmacHash`]: elide::redaction::operators::HmacHash
-     */
-    Review: {
-      /**
-       * @description The per-modality redaction operators to run for this
-       *     entity. Overrides whatever the policy set would have
-       *     picked for the same entity.
-       */
-      action: components["schemas"]["ModalityRedactions"];
-      /**
-       * Format: uuid
-       * @description The policy whose authority the reviewer exercises. Must
-       *     match the `id` of a [`PolicyDefinition`] submitted with
-       *     the anonymize request. The audit event stamps this UUID
-       *     as the attribution `name`.
-       *
-       *     [`PolicyDefinition`]: elide_governance::PolicyDefinition
-       */
-      policyId: string;
-    };
     /**
      * @description A serializable summary of *which selection rule* bound an operator to an
      *     entity — the automatic "why" behind a redaction.
@@ -13071,39 +13333,28 @@ interface components {
       tags?: string[];
     };
     /**
-     * @description Caller-asserted scope for one request.
-     *
-     *     A narrower wire projection of `elide::recognition::Scope`:
-     *     `languages` and `countries` (typed, elide-native), plus
-     *     elide's [`ScopeMetadata`] block for free-form classification
-     *     strings (`tags`, `purpose`, `audience`). The engine assembles
-     *     this plus a server-minted `correlation_id` and a policy-derived
-     *     label catalog into the orchestrator's `Scope` at compile time.
+     * @description An operator was *picked* to hide the entity — the redaction decision,
+     *     recorded before it is applied so it can be reviewed (and the entity edited)
+     *     first. The [`Redaction`] event that follows records the operator actually
+     *     run.
      */
-    ScopeParams: {
+    Selection: {
       /**
-       * @description Caller-asserted jurisdictions.
-       *
-       *     When non-empty, recognizers that carry per-rule country
-       *     scopes skip rules that match none of them. An empty list
-       *     means "any": rules that declare countries still run as a
-       *     permissive fallback so callers who don't assert a
-       *     jurisdiction don't lose detections.
+       * @description The author-supplied policy rationale, when the matched rule carried an
+       *     [`Attribution`]; `None` otherwise.
        */
-      countries?: components["schemas"]["CountryCode"][];
+      attribution?: components["schemas"]["Attribution"];
       /**
-       * @description Caller-asserted languages for the analysis.
-       *
-       *     Empty means the caller asserted none, leaving detection
-       *     (if a language enricher runs) to fill in.
-       * @default []
+       * @description Which selection rule chose this operator: the automatic "why" (matched a
+       *     label, a tag, a predicate, or the fallback).
        */
-      languages?: components["schemas"]["Languages"];
+      matched_by: components["schemas"]["RuleMatch"];
       /**
-       * @description Free-form request context: document tags, request purpose,
-       *     output audience. See elide's [`ScopeMetadata`].
+       * @description Identity (name + version) of the operator picked. Its *config* is not
+       *     recorded — it lives in the policy that will run it, so apply re-resolves
+       *     the configured operator rather than reading it here.
        */
-      metadata?: components["schemas"]["ScopeMetadata"];
+      operator: components["schemas"]["OperatorId"];
     };
     /** @description Request to send a message and stream the assistant's reply. */
     SendChatMessage: {
@@ -13247,6 +13498,24 @@ interface components {
        */
       totalBytes: number;
     };
+    /**
+     * @description Leave this entity alone: a reviewer calling it a false positive.
+     *
+     *     It keeps its place and its provenance; the redaction pass skips
+     *     it. Recorded as a `Manual` event, so *who* decided and *why* is
+     *     auditable rather than the detection silently disappearing.
+     */
+    Suppress: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity to leave alone.
+       */
+      id: string;
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /**
      * @description Request payload to trigger a connection sync.
      *
@@ -13328,6 +13597,28 @@ interface components {
      *     to track whether a run was manually triggered, scheduled, or triggered by a webhook.
      */
     SyncTriggerType: "manual" | "scheduled" | "webhook";
+    /**
+     * @description A detection recognition missed.
+     *
+     *     Recorded on the report with human provenance, so it is never
+     *     mistaken for an automatic hit, then redacted under the policy set
+     *     like any other entity: an added label the policy does not cover
+     *     is left alone.
+     *
+     *     Carries no entity id — the entity does not exist yet, and the
+     *     engine mints one when the edit is applied, so a client cannot
+     *     collide with a real detection or shadow an existing entity.
+     */
+    TabularAdd: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /** @description What the reviewer says this is. */
+      label: components["schemas"]["LabelRef"];
+      /** @description Where it sits in the document. */
+      location: components["schemas"]["TabularLocation"];
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /**
      * @description One node in an entity's audit DAG: a thing that happened, with its
      *     effect on confidence and its tamper-evident links.
@@ -13403,115 +13694,70 @@ interface components {
      * @description Kind of an [`AuditEvent`], carrying its event-specific detail and the
      *     rationale for why it happened.
      *
-     *     `#[non_exhaustive]`: new event kinds (verification, annotation, …)
-     *     can be added compatibly. The recognition kinds ([`Pattern`],
-     *     [`Model`]) carry the matched [`Location`]; the rest carry their own
-     *     data.
-     *
+     *     A thin tagged union: each variant wraps one payload struct (e.g.
+     *     [`Redaction`], [`Selection`], [`Manual`]) that owns that kind's fields, its
+     *     docs, and how it folds into the audit hash. Match on a variant to reach its
+     *     payload:
+     *
+     *     ```
+     *     # use elide_core::entity::audit::AuditKind;
+     *     # use elide_core::modality::text::Text;
+     *     # fn show(kind: &AuditKind<Text>) {
+     *     if let AuditKind::Redaction(redaction) = kind {
+     *         let _ = &redaction.operator;
+     *     }
+     *     # }
+     *     ```
+     *
+     *     `#[non_exhaustive]`: new event kinds (verification, annotation, …) can be
+     *     added compatibly. The recognition kinds ([`Pattern`], [`Model`]) carry the
+     *     matched [`Location`]; the rest carry their own data.
+     *
+     *     [`AuditEvent`]: super::AuditEvent
      *     [`Pattern`]: AuditKind::Pattern
      *     [`Model`]: AuditKind::Model
      *     [`Location`]: Modality::Location
      */
     TabularAuditKind: {
+      detail: components["schemas"]["TabularPattern"];
       /** @constant */
       kind: "pattern";
-      /** @description Where the recognizer matched. */
-      location: components["schemas"]["TabularLocation"];
-      /** @description Pattern detail. */
-      pattern: components["schemas"]["PatternEvent"];
     } | {
+      detail: components["schemas"]["TabularModel"];
       /** @constant */
       kind: "model";
-      /** @description Where the recognizer matched. */
-      location: components["schemas"]["TabularLocation"];
-      /** @description Model detail. */
-      model: components["schemas"]["ModelEvent"];
     } | {
+      detail: components["schemas"]["Deduplication"];
       /** @constant */
       kind: "deduplication";
-      /** @description Name of the fusion strategy that combined them. */
-      strategy: string;
     } | {
-      /** @description The loser's confidence at resolution time. */
-      competing_confidence: components["schemas"]["Confidence"];
-      /** @description The label of the detection that lost arbitration. */
-      competing_label: components["schemas"]["LabelRef"];
+      detail: components["schemas"]["Conflict"];
       /** @constant */
       kind: "conflict";
-      /** @description Name of the conflict policy that chose the winner. */
-      resolved_by: string;
     } | {
-      /** @description The competing detection's confidence. */
-      competing_confidence: components["schemas"]["Confidence"];
-      /** @description The label of the competing detection. */
-      competing_label: components["schemas"]["LabelRef"];
-      /** @description Name of the policy that flagged the contest. */
-      flagged_by: string;
+      detail: components["schemas"]["Contested"];
       /** @constant */
       kind: "contested";
     } | {
-      /**
-       * Format: double
-       * @description Multiplier applied.
-       */
-      factor: number;
+      detail: components["schemas"]["Calibration"];
       /** @constant */
       kind: "calibration";
     } | {
-      /**
-       * @description The located [`Hint`] the keyword fired from, when the match came
-       *     from an out-of-band hint (a column header, a key) rather than
-       *     the in-text word window. `None` for an in-text-window match.
-       *
-       *     [`Hint`]: crate::modality::Hint
-       */
-      hint?: components["schemas"]["TabularHint"];
-      /** @description Keyword that fired the boost. */
-      keyword: string;
-      /** @constant */
-      kind: "refinement";
-      /**
-       * @description Where the boosting keyword sits in the medium. For a hint match
-       *     this mirrors the hint's own location; for an in-text-window match
-       *     it is the keyword resolved through the modality's [`locate`] (a
-       *     pixel box for image, a time span for audio, the byte range for
-       *     text/tabular). `None` when the keyword's stream range could not be
-       *     placed, symmetric with a match the recognizer itself drops.
-       *
-       *     [`locate`]: crate::modality::TextRecognizable::locate
-       */
-      location?: components["schemas"]["TabularLocation"];
-    } | {
-      /**
-       * @description The author-supplied policy rationale, when the operator carried an
-       *     [`Attribution`]; `None` otherwise.
-       */
-      attribution?: components["schemas"]["Attribution"];
-      /** @description Identifier of the key needed to reverse it, if reversible. */
-      key_id?: string;
+      detail: components["schemas"]["TabularRefinement"];
+      /** @constant */
+      kind: "refinement";
+    } | {
+      detail: components["schemas"]["Redaction"];
       /** @constant */
       kind: "redaction";
-      /** @description How much the output leaks about the original. */
-      leak_profile: components["schemas"]["LeakProfile"];
-      /**
-       * @description Which selection rule chose this operator: the automatic "why"
-       *     (matched a label, a tag, a predicate, or the fallback).
-       */
-      matched_by: components["schemas"]["RuleMatch"];
-      /** @description Which operator (name + version) ran. */
-      operator: components["schemas"]["OperatorId"];
-      /**
-       * @description BLAKE3 digest of the original text the operator hid, when the
-       *     redaction layer recorded it. Proves *what* was redacted without
-       *     storing the plaintext; `None` when the operator did not capture it.
-       */
-      span_hash?: components["schemas"]["AuditHash"];
-      /**
-       * Format: uint32
-       * @description Byte length of the original text the operator hid, paired with
-       *     [`span_hash`](Self::Redaction::span_hash). `None` when not captured.
-       */
-      span_length?: number;
+    } | {
+      detail: components["schemas"]["Selection"];
+      /** @constant */
+      kind: "selection";
+    } | {
+      detail: components["schemas"]["TabularManual"];
+      /** @constant */
+      kind: "manual";
     };
     /**
      * @description Full audit trail of an [`Entity`]: every [`AuditEvent`] in its life, as a
@@ -13550,6 +13796,26 @@ interface components {
      *     [`verify`]: Self::verify
      */
     TabularAuditLog: components["schemas"]["TabularAuditEvent"][];
+    /**
+     * @description One change to an analyzed document.
+     *
+     *     `Add` carries no id because the entity does not exist yet; the
+     *     engine mints one when the edit is applied, so a client cannot
+     *     collide with a real detection or shadow an existing entity.
+     */
+    TabularEdit: ({
+      /** @constant */
+      op: "add";
+    } & components["schemas"]["TabularAdd"]) | ({
+      /** @constant */
+      op: "retag";
+    } & components["schemas"]["TabularRetag"]) | ({
+      /** @constant */
+      op: "suppress";
+    } & components["schemas"]["Suppress"]) | ({
+      /** @constant */
+      op: "redact";
+    } & components["schemas"]["TabularRedact"]);
     /**
      * @description Detected piece of sensitive information within some medium.
      *
@@ -13578,7 +13844,12 @@ interface components {
     TabularEntity: {
       /**
        * @description Tamper-evident audit trail: every contributing detection, the fusion
-       *     event if any, and the redaction that hid it, as a hash-linked DAG.
+       *     event if any, and the redaction that hid it, as a hash-linked DAG. It is
+       *     also the single source of truth for whether a reviewer
+       *     [suppressed](Self::is_suppressed) the entity — a suppression is a
+       *     [`Manual`] event on this trail, not a separate flag.
+       *
+       *     [`Manual`]: crate::entity::audit::AuditKind::Manual
        */
       audit: components["schemas"]["TabularAuditLog"];
       /** @description Effective confidence in `0.0..=1.0` (fused, if applicable). */
@@ -13623,30 +13894,6 @@ interface components {
        */
       recognized_range?: components["schemas"]["Range_of_uint"];
     };
-    /**
-     * @description One recognized entity plus the optional reviewer override.
-     *
-     *     The bound mirrors elide's [`Entity<M>`]: serialization needs
-     *     `M::Location` and `M::Data` (de)serializable, and JsonSchema
-     *     derivation needs them schema-able. All four modalities elide
-     *     ships satisfy these under the `serde` + `schema` features.
-     */
-    TabularEntityRecord: {
-      /** @description The elide entity, as recognition produced it. */
-      entity: components["schemas"]["TabularEntity"];
-      /**
-       * @description Reviewer-supplied redaction override.
-       *
-       *     `None` means "use the matching policy rule's decision";
-       *     `Some(...)` overrides that rule for this specific entity
-       *     at apply time. Reviewer overrides take precedence over
-       *     every policy rule and inherit the authority of the
-       *     [`Review::policy_id`] they name: the audit event's
-       *     attribution stamps that policy so the trail names the
-       *     authority under which the override fired.
-       */
-      review?: components["schemas"]["Review"];
-    };
     /**
      * @description Located, typed piece of context a recognizer may treat as in-context
      *     for a nearby value.
@@ -13717,6 +13964,85 @@ interface components {
        */
       start_offset?: number;
     };
+    /**
+     * @description A human override, outside automatic detection: an entity a reviewer added by
+     *     hand, or a detected one they marked to ignore. Its provenance is a person's
+     *     decision, not a recognizer's — so the trail records *why* (an
+     *     [`Attribution`], when supplied). *Who* made the override is the event's
+     *     [`source`], not a payload field.
+     *
+     *     [`source`]: super::AuditEvent::source
+     */
+    TabularManual: {
+      /**
+       * @description The reviewer's rationale, when supplied (e.g. a freeform
+       *     `"false positive"`, or a cited authority). `None` for an unexplained
+       *     override.
+       */
+      attribution?: components["schemas"]["Attribution"];
+      /**
+       * @description Which human decision this records: including a missed entity, or
+       *     suppressing a detected one. This is the authority on whether the entity
+       *     is redacted — [`AuditLog::is_suppressed`] reads it, so there is no
+       *     separate flag to keep in sync.
+       *
+       *     [`AuditLog::is_suppressed`]: crate::entity::audit::AuditLog::is_suppressed
+       */
+      intent: components["schemas"]["ManualIntent"];
+      /** @description Where the override applies, in modality-native coordinates. */
+      location: components["schemas"]["TabularLocation"];
+    };
+    /**
+     * @description Detail of a model/NER recognition: a model matched at `location`, with its
+     *     metadata in `model`.
+     */
+    TabularModel: {
+      /** @description Where the recognizer matched. */
+      location: components["schemas"]["TabularLocation"];
+      /** @description Model metadata (name, version, contextual flag). */
+      model: components["schemas"]["ModelEvent"];
+    };
+    /**
+     * @description Detail of a pattern/dictionary recognition: a recognizer matched at
+     *     `location`, with the pattern metadata in `pattern`.
+     */
+    TabularPattern: {
+      /** @description Where the recognizer matched. */
+      location: components["schemas"]["TabularLocation"];
+      /** @description Pattern metadata (name, regex, validator, contextual flag). */
+      pattern: components["schemas"]["PatternEvent"];
+    };
+    /**
+     * @description Redact this entity with `action` instead of the operator the
+     *     policy picked.
+     */
+    TabularRedact: {
+      /**
+       * @description The operator to run, typed to the entity's own modality so a
+       *     text entity cannot be given an image operator.
+       */
+      action: components["schemas"]["TabularRedaction"];
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity to redact.
+       */
+      id: string;
+      /**
+       * Format: uuid
+       * @description The policy whose authority the reviewer exercises. Must match
+       *     a submitted policy's `id`.
+       *
+       *     Not only for audit: it picks which per-policy pseudonym vault
+       *     and `KeyProvider` the operator resolves against, so an
+       *     override using `Pseudonymize` or `HmacHash` stays consistent
+       *     with that policy's other rules.
+       */
+      policyId: string;
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /** @description Operator spec a `redact` tabular rule carries. */
     TabularRedaction: {
       /** @constant */
@@ -13734,6 +14060,55 @@ interface components {
       /** @constant */
       kind: "drop_column";
     };
+    /** @description A context keyword near the entity lifted its confidence. */
+    TabularRefinement: {
+      /**
+       * @description The located [`Hint`] the keyword fired from, when the match came from an
+       *     out-of-band hint (a column header, a key) rather than the in-text word
+       *     window. `None` for an in-text-window match.
+       *
+       *     [`Hint`]: crate::modality::Hint
+       */
+      hint?: components["schemas"]["TabularHint"];
+      /** @description Keyword that fired the boost. */
+      keyword: string;
+      /**
+       * @description Where the boosting keyword sits in the medium. For a hint match this
+       *     mirrors the hint's own location; for an in-text-window match it is the
+       *     keyword resolved through the modality's [`locate`]. `None` when the
+       *     keyword's stream range could not be placed.
+       *
+       *     [`locate`]: crate::modality::TextRecognizable::locate
+       */
+      location?: components["schemas"]["TabularLocation"];
+    };
+    /**
+     * @description Correct what an existing detection *is* or *covers*, then redact
+     *     it under the policy set as corrected.
+     *
+     *     A reviewer fixing recognition's mistake rather than overriding
+     *     its consequence. Retagging into a label the policy does not cover
+     *     leaves the entity alone, exactly as if it had been detected that
+     *     way — which is why it is auditable rather than a mutable field.
+     */
+    TabularRetag: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity being corrected.
+       */
+      id: string;
+      /** @description The corrected label, when recognition got it wrong. */
+      label?: components["schemas"]["LabelRef"];
+      /**
+       * @description The corrected location, when the span clipped the value or
+       *     ran past it.
+       */
+      location?: components["schemas"]["TabularLocation"];
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /**
      * @description The template a [`PolicyDefinition`] was built from.
      *
@@ -13826,6 +14201,28 @@ interface components {
        */
       payload?: unknown;
     };
+    /**
+     * @description A detection recognition missed.
+     *
+     *     Recorded on the report with human provenance, so it is never
+     *     mistaken for an automatic hit, then redacted under the policy set
+     *     like any other entity: an added label the policy does not cover
+     *     is left alone.
+     *
+     *     Carries no entity id — the entity does not exist yet, and the
+     *     engine mints one when the edit is applied, so a client cannot
+     *     collide with a real detection or shadow an existing entity.
+     */
+    TextAdd: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /** @description What the reviewer says this is. */
+      label: components["schemas"]["LabelRef"];
+      /** @description Where it sits in the document. */
+      location: components["schemas"]["TextLocation"];
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /**
      * @description One node in an entity's audit DAG: a thing that happened, with its
      *     effect on confidence and its tamper-evident links.
@@ -13901,115 +14298,70 @@ interface components {
      * @description Kind of an [`AuditEvent`], carrying its event-specific detail and the
      *     rationale for why it happened.
      *
-     *     `#[non_exhaustive]`: new event kinds (verification, annotation, …)
-     *     can be added compatibly. The recognition kinds ([`Pattern`],
-     *     [`Model`]) carry the matched [`Location`]; the rest carry their own
-     *     data.
-     *
+     *     A thin tagged union: each variant wraps one payload struct (e.g.
+     *     [`Redaction`], [`Selection`], [`Manual`]) that owns that kind's fields, its
+     *     docs, and how it folds into the audit hash. Match on a variant to reach its
+     *     payload:
+     *
+     *     ```
+     *     # use elide_core::entity::audit::AuditKind;
+     *     # use elide_core::modality::text::Text;
+     *     # fn show(kind: &AuditKind<Text>) {
+     *     if let AuditKind::Redaction(redaction) = kind {
+     *         let _ = &redaction.operator;
+     *     }
+     *     # }
+     *     ```
+     *
+     *     `#[non_exhaustive]`: new event kinds (verification, annotation, …) can be
+     *     added compatibly. The recognition kinds ([`Pattern`], [`Model`]) carry the
+     *     matched [`Location`]; the rest carry their own data.
+     *
+     *     [`AuditEvent`]: super::AuditEvent
      *     [`Pattern`]: AuditKind::Pattern
      *     [`Model`]: AuditKind::Model
      *     [`Location`]: Modality::Location
      */
     TextAuditKind: {
+      detail: components["schemas"]["TextPattern"];
       /** @constant */
       kind: "pattern";
-      /** @description Where the recognizer matched. */
-      location: components["schemas"]["TextLocation"];
-      /** @description Pattern detail. */
-      pattern: components["schemas"]["PatternEvent"];
     } | {
+      detail: components["schemas"]["TextModel"];
       /** @constant */
       kind: "model";
-      /** @description Where the recognizer matched. */
-      location: components["schemas"]["TextLocation"];
-      /** @description Model detail. */
-      model: components["schemas"]["ModelEvent"];
     } | {
+      detail: components["schemas"]["Deduplication"];
       /** @constant */
       kind: "deduplication";
-      /** @description Name of the fusion strategy that combined them. */
-      strategy: string;
     } | {
-      /** @description The loser's confidence at resolution time. */
-      competing_confidence: components["schemas"]["Confidence"];
-      /** @description The label of the detection that lost arbitration. */
-      competing_label: components["schemas"]["LabelRef"];
+      detail: components["schemas"]["Conflict"];
       /** @constant */
       kind: "conflict";
-      /** @description Name of the conflict policy that chose the winner. */
-      resolved_by: string;
     } | {
-      /** @description The competing detection's confidence. */
-      competing_confidence: components["schemas"]["Confidence"];
-      /** @description The label of the competing detection. */
-      competing_label: components["schemas"]["LabelRef"];
-      /** @description Name of the policy that flagged the contest. */
-      flagged_by: string;
+      detail: components["schemas"]["Contested"];
       /** @constant */
       kind: "contested";
     } | {
-      /**
-       * Format: double
-       * @description Multiplier applied.
-       */
-      factor: number;
+      detail: components["schemas"]["Calibration"];
       /** @constant */
       kind: "calibration";
     } | {
-      /**
-       * @description The located [`Hint`] the keyword fired from, when the match came
-       *     from an out-of-band hint (a column header, a key) rather than
-       *     the in-text word window. `None` for an in-text-window match.
-       *
-       *     [`Hint`]: crate::modality::Hint
-       */
-      hint?: components["schemas"]["TextHint"];
-      /** @description Keyword that fired the boost. */
-      keyword: string;
+      detail: components["schemas"]["TextRefinement"];
       /** @constant */
       kind: "refinement";
-      /**
-       * @description Where the boosting keyword sits in the medium. For a hint match
-       *     this mirrors the hint's own location; for an in-text-window match
-       *     it is the keyword resolved through the modality's [`locate`] (a
-       *     pixel box for image, a time span for audio, the byte range for
-       *     text/tabular). `None` when the keyword's stream range could not be
-       *     placed, symmetric with a match the recognizer itself drops.
-       *
-       *     [`locate`]: crate::modality::TextRecognizable::locate
-       */
-      location?: components["schemas"]["TextLocation"];
     } | {
-      /**
-       * @description The author-supplied policy rationale, when the operator carried an
-       *     [`Attribution`]; `None` otherwise.
-       */
-      attribution?: components["schemas"]["Attribution"];
-      /** @description Identifier of the key needed to reverse it, if reversible. */
-      key_id?: string;
+      detail: components["schemas"]["Redaction"];
       /** @constant */
       kind: "redaction";
-      /** @description How much the output leaks about the original. */
-      leak_profile: components["schemas"]["LeakProfile"];
-      /**
-       * @description Which selection rule chose this operator: the automatic "why"
-       *     (matched a label, a tag, a predicate, or the fallback).
-       */
-      matched_by: components["schemas"]["RuleMatch"];
-      /** @description Which operator (name + version) ran. */
-      operator: components["schemas"]["OperatorId"];
-      /**
-       * @description BLAKE3 digest of the original text the operator hid, when the
-       *     redaction layer recorded it. Proves *what* was redacted without
-       *     storing the plaintext; `None` when the operator did not capture it.
-       */
-      span_hash?: components["schemas"]["AuditHash"];
-      /**
-       * Format: uint32
-       * @description Byte length of the original text the operator hid, paired with
-       *     [`span_hash`](Self::Redaction::span_hash). `None` when not captured.
-       */
-      span_length?: number;
+    } | {
+      detail: components["schemas"]["Selection"];
+      /** @constant */
+      kind: "selection";
+    } | {
+      detail: components["schemas"]["TextManual"];
+      /** @constant */
+      kind: "manual";
     };
     /**
      * @description Full audit trail of an [`Entity`]: every [`AuditEvent`] in its life, as a
@@ -14059,6 +14411,26 @@ interface components {
      *     several recognizers.
      */
     TextData: string;
+    /**
+     * @description One change to an analyzed document.
+     *
+     *     `Add` carries no id because the entity does not exist yet; the
+     *     engine mints one when the edit is applied, so a client cannot
+     *     collide with a real detection or shadow an existing entity.
+     */
+    TextEdit: ({
+      /** @constant */
+      op: "add";
+    } & components["schemas"]["TextAdd"]) | ({
+      /** @constant */
+      op: "retag";
+    } & components["schemas"]["TextRetag"]) | ({
+      /** @constant */
+      op: "suppress";
+    } & components["schemas"]["Suppress"]) | ({
+      /** @constant */
+      op: "redact";
+    } & components["schemas"]["TextRedact"]);
     /**
      * @description Detected piece of sensitive information within some medium.
      *
@@ -14087,7 +14459,12 @@ interface components {
     TextEntity: {
       /**
        * @description Tamper-evident audit trail: every contributing detection, the fusion
-       *     event if any, and the redaction that hid it, as a hash-linked DAG.
+       *     event if any, and the redaction that hid it, as a hash-linked DAG. It is
+       *     also the single source of truth for whether a reviewer
+       *     [suppressed](Self::is_suppressed) the entity — a suppression is a
+       *     [`Manual`] event on this trail, not a separate flag.
+       *
+       *     [`Manual`]: crate::entity::audit::AuditKind::Manual
        */
       audit: components["schemas"]["TextAuditLog"];
       /** @description Effective confidence in `0.0..=1.0` (fused, if applicable). */
@@ -14132,30 +14509,6 @@ interface components {
        */
       recognized_range?: components["schemas"]["Range_of_uint"];
     };
-    /**
-     * @description One recognized entity plus the optional reviewer override.
-     *
-     *     The bound mirrors elide's [`Entity<M>`]: serialization needs
-     *     `M::Location` and `M::Data` (de)serializable, and JsonSchema
-     *     derivation needs them schema-able. All four modalities elide
-     *     ships satisfy these under the `serde` + `schema` features.
-     */
-    TextEntityRecord: {
-      /** @description The elide entity, as recognition produced it. */
-      entity: components["schemas"]["TextEntity"];
-      /**
-       * @description Reviewer-supplied redaction override.
-       *
-       *     `None` means "use the matching policy rule's decision";
-       *     `Some(...)` overrides that rule for this specific entity
-       *     at apply time. Reviewer overrides take precedence over
-       *     every policy rule and inherit the authority of the
-       *     [`Review::policy_id`] they name: the audit event's
-       *     attribution stamps that policy so the trail names the
-       *     authority under which the override fired.
-       */
-      review?: components["schemas"]["Review"];
-    };
     /**
      * @description Located, typed piece of context a recognizer may treat as in-context
      *     for a nearby value.
@@ -14205,6 +14558,85 @@ interface components {
        */
       source?: components["schemas"]["SourceRef"][];
     };
+    /**
+     * @description A human override, outside automatic detection: an entity a reviewer added by
+     *     hand, or a detected one they marked to ignore. Its provenance is a person's
+     *     decision, not a recognizer's — so the trail records *why* (an
+     *     [`Attribution`], when supplied). *Who* made the override is the event's
+     *     [`source`], not a payload field.
+     *
+     *     [`source`]: super::AuditEvent::source
+     */
+    TextManual: {
+      /**
+       * @description The reviewer's rationale, when supplied (e.g. a freeform
+       *     `"false positive"`, or a cited authority). `None` for an unexplained
+       *     override.
+       */
+      attribution?: components["schemas"]["Attribution"];
+      /**
+       * @description Which human decision this records: including a missed entity, or
+       *     suppressing a detected one. This is the authority on whether the entity
+       *     is redacted — [`AuditLog::is_suppressed`] reads it, so there is no
+       *     separate flag to keep in sync.
+       *
+       *     [`AuditLog::is_suppressed`]: crate::entity::audit::AuditLog::is_suppressed
+       */
+      intent: components["schemas"]["ManualIntent"];
+      /** @description Where the override applies, in modality-native coordinates. */
+      location: components["schemas"]["TextLocation"];
+    };
+    /**
+     * @description Detail of a model/NER recognition: a model matched at `location`, with its
+     *     metadata in `model`.
+     */
+    TextModel: {
+      /** @description Where the recognizer matched. */
+      location: components["schemas"]["TextLocation"];
+      /** @description Model metadata (name, version, contextual flag). */
+      model: components["schemas"]["ModelEvent"];
+    };
+    /**
+     * @description Detail of a pattern/dictionary recognition: a recognizer matched at
+     *     `location`, with the pattern metadata in `pattern`.
+     */
+    TextPattern: {
+      /** @description Where the recognizer matched. */
+      location: components["schemas"]["TextLocation"];
+      /** @description Pattern metadata (name, regex, validator, contextual flag). */
+      pattern: components["schemas"]["PatternEvent"];
+    };
+    /**
+     * @description Redact this entity with `action` instead of the operator the
+     *     policy picked.
+     */
+    TextRedact: {
+      /**
+       * @description The operator to run, typed to the entity's own modality so a
+       *     text entity cannot be given an image operator.
+       */
+      action: components["schemas"]["TextRedaction"];
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity to redact.
+       */
+      id: string;
+      /**
+       * Format: uuid
+       * @description The policy whose authority the reviewer exercises. Must match
+       *     a submitted policy's `id`.
+       *
+       *     Not only for audit: it picks which per-policy pseudonym vault
+       *     and `KeyProvider` the operator resolves against, so an
+       *     override using `Pseudonymize` or `HmacHash` stays consistent
+       *     with that policy's other rules.
+       */
+      policyId: string;
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /** @description Operator spec a `redact` text rule carries. */
     TextRedaction: {
       /** @constant */
@@ -14351,6 +14783,55 @@ interface components {
        */
       style?: components["schemas"]["DateStyle"];
     };
+    /** @description A context keyword near the entity lifted its confidence. */
+    TextRefinement: {
+      /**
+       * @description The located [`Hint`] the keyword fired from, when the match came from an
+       *     out-of-band hint (a column header, a key) rather than the in-text word
+       *     window. `None` for an in-text-window match.
+       *
+       *     [`Hint`]: crate::modality::Hint
+       */
+      hint?: components["schemas"]["TextHint"];
+      /** @description Keyword that fired the boost. */
+      keyword: string;
+      /**
+       * @description Where the boosting keyword sits in the medium. For a hint match this
+       *     mirrors the hint's own location; for an in-text-window match it is the
+       *     keyword resolved through the modality's [`locate`]. `None` when the
+       *     keyword's stream range could not be placed.
+       *
+       *     [`locate`]: crate::modality::TextRecognizable::locate
+       */
+      location?: components["schemas"]["TextLocation"];
+    };
+    /**
+     * @description Correct what an existing detection *is* or *covers*, then redact
+     *     it under the policy set as corrected.
+     *
+     *     A reviewer fixing recognition's mistake rather than overriding
+     *     its consequence. Retagging into a label the policy does not cover
+     *     leaves the entity alone, exactly as if it had been detected that
+     *     way — which is why it is auditable rather than a mutable field.
+     */
+    TextRetag: {
+      /** @description Who made it, when the caller said. */
+      actor?: string;
+      /**
+       * Format: uuid
+       * @description The entity being corrected.
+       */
+      id: string;
+      /** @description The corrected label, when recognition got it wrong. */
+      label?: components["schemas"]["LabelRef"];
+      /**
+       * @description The corrected location, when the span clipped the value or
+       *     ran past it.
+       */
+      location?: components["schemas"]["TextLocation"];
+      /** @description The rationale, when one was given. */
+      reason?: string;
+    };
     /**
      * @description Half-open `[start, end)` stream interval, measured in microseconds.
      *
@@ -14985,8 +15466,8 @@ type Schemas$21 = components["schemas"];
 type Activity = Schemas$21["Activity"];
 type ActivityPage = Schemas$21["ActivityPage"];
 type ActivityType = Schemas$21["ActivityType"];
-type ActivityListQuery = Schemas$21["ActivityListQuery"];
-type ActivityExportQuery = Schemas$21["ActivityExportQuery"];
+type ActivityFilterQuery = Schemas$21["ActivityFilterQuery"];
+type ActivityExportOptions = Schemas$21["ActivityExportOptions"];
 type ActivityPayload = Schemas$21["ActivityPayload"];
 type WorkspaceActivityParams = Schemas$21["WorkspaceActivityParams"];
 type MemberActivityParams = Schemas$21["MemberActivityParams"];
@@ -15028,18 +15509,29 @@ type ApiTokenPage = Schemas$19["ApiTokenPage"];
 //#endregion
 //#region src/datatypes/audit.d.ts
 type Schemas$18 = components["schemas"];
-type EntityGroup = Schemas$18["EntityGroup"];
-type AuditContext = Schemas$18["AuditContext"];
+type Audit = Schemas$18["Audit"];
+type DocumentContext = Schemas$18["DocumentContext"];
+type CodecParams = Schemas$18["CodecParams"];
 type EntityCoRef = Schemas$18["EntityCoRef"];
+type Report = Schemas$18["Report"];
+type EditSet = Schemas$18["EditSet"];
 type RasterMode = Schemas$18["RasterMode"];
 type Dpi = Schemas$18["Dpi"];
-type Review = Schemas$18["Review"];
-type Attribution = Schemas$18["Attribution"];
-type AttributionKind = Schemas$18["AttributionKind"];
+type Redaction = Schemas$18["Redaction"];
+type Selection = Schemas$18["Selection"];
+type Suppress = Schemas$18["Suppress"];
+type ManualIntent = Schemas$18["ManualIntent"];
 type LeakProfile = Schemas$18["LeakProfile"];
 type RuleMatch = Schemas$18["RuleMatch"];
+type Attribution = Schemas$18["Attribution"];
+type CitedAttribution = Schemas$18["CitedAttribution"];
+type FreeformAttribution = Schemas$18["FreeformAttribution"];
 type ModelEvent = Schemas$18["ModelEvent"];
 type PatternEvent = Schemas$18["PatternEvent"];
+type Conflict = Schemas$18["Conflict"];
+type Contested = Schemas$18["Contested"];
+type Deduplication = Schemas$18["Deduplication"];
+type Calibration = Schemas$18["Calibration"];
 type OperatorId = Schemas$18["OperatorId"];
 type AuditHash = Schemas$18["AuditHash"];
 type Category = Schemas$18["Category"];
@@ -15052,36 +15544,64 @@ type Polygon = Schemas$18["Polygon"];
 type Dimensions = Schemas$18["Dimensions"];
 type TimeSpan = Schemas$18["TimeSpan"];
 type TextEntity = Schemas$18["TextEntity"];
-type TextEntityRecord = Schemas$18["TextEntityRecord"];
 type TextAuditEvent = Schemas$18["TextAuditEvent"];
 type TextAuditKind = Schemas$18["TextAuditKind"];
+type TextAuditLog = Schemas$18["TextAuditLog"];
 type TextHint = Schemas$18["TextHint"];
 type TextLocation = Schemas$18["TextLocation"];
-type TextAuditLog = Schemas$18["TextAuditLog"];
 type TextData = Schemas$18["TextData"];
+type TextModel = Schemas$18["TextModel"];
+type TextPattern = Schemas$18["TextPattern"];
+type TextManual = Schemas$18["TextManual"];
+type TextEdit = Schemas$18["TextEdit"];
+type TextAdd = Schemas$18["TextAdd"];
+type TextRedact = Schemas$18["TextRedact"];
+type TextRefinement = Schemas$18["TextRefinement"];
+type TextRetag = Schemas$18["TextRetag"];
 type ImageEntity = Schemas$18["ImageEntity"];
-type ImageEntityRecord = Schemas$18["ImageEntityRecord"];
 type ImageAuditEvent = Schemas$18["ImageAuditEvent"];
 type ImageAuditKind = Schemas$18["ImageAuditKind"];
+type ImageAuditLog = Schemas$18["ImageAuditLog"];
 type ImageHint = Schemas$18["ImageHint"];
 type ImageLocation = Schemas$18["ImageLocation"];
-type ImageAuditLog = Schemas$18["ImageAuditLog"];
 type ImageData = Schemas$18["ImageData"];
+type ImageModel = Schemas$18["ImageModel"];
+type ImagePattern = Schemas$18["ImagePattern"];
+type ImageManual = Schemas$18["ImageManual"];
+type ImageEdit = Schemas$18["ImageEdit"];
+type ImageAdd = Schemas$18["ImageAdd"];
+type ImageRedact = Schemas$18["ImageRedact"];
+type ImageRefinement = Schemas$18["ImageRefinement"];
+type ImageRetag = Schemas$18["ImageRetag"];
 type AudioEntity = Schemas$18["AudioEntity"];
-type AudioEntityRecord = Schemas$18["AudioEntityRecord"];
 type AudioAuditEvent = Schemas$18["AudioAuditEvent"];
 type AudioAuditKind = Schemas$18["AudioAuditKind"];
+type AudioAuditLog = Schemas$18["AudioAuditLog"];
 type AudioHint = Schemas$18["AudioHint"];
 type AudioLocation = Schemas$18["AudioLocation"];
-type AudioAuditLog = Schemas$18["AudioAuditLog"];
 type AudioData = Schemas$18["AudioData"];
+type AudioModel = Schemas$18["AudioModel"];
+type AudioPattern = Schemas$18["AudioPattern"];
+type AudioManual = Schemas$18["AudioManual"];
+type AudioEdit = Schemas$18["AudioEdit"];
+type AudioAdd = Schemas$18["AudioAdd"];
+type AudioRedact = Schemas$18["AudioRedact"];
+type AudioRefinement = Schemas$18["AudioRefinement"];
+type AudioRetag = Schemas$18["AudioRetag"];
 type TabularEntity = Schemas$18["TabularEntity"];
-type TabularEntityRecord = Schemas$18["TabularEntityRecord"];
 type TabularAuditEvent = Schemas$18["TabularAuditEvent"];
 type TabularAuditKind = Schemas$18["TabularAuditKind"];
+type TabularAuditLog = Schemas$18["TabularAuditLog"];
 type TabularHint = Schemas$18["TabularHint"];
 type TabularLocation = Schemas$18["TabularLocation"];
-type TabularAuditLog = Schemas$18["TabularAuditLog"];
+type TabularModel = Schemas$18["TabularModel"];
+type TabularPattern = Schemas$18["TabularPattern"];
+type TabularManual = Schemas$18["TabularManual"];
+type TabularEdit = Schemas$18["TabularEdit"];
+type TabularAdd = Schemas$18["TabularAdd"];
+type TabularRedact = Schemas$18["TabularRedact"];
+type TabularRefinement = Schemas$18["TabularRefinement"];
+type TabularRetag = Schemas$18["TabularRetag"];
 //#endregion
 //#region src/datatypes/auth.d.ts
 type Schemas$17 = components["schemas"];
@@ -15270,11 +15790,9 @@ type PipelineRunStatus = Schemas$3["PipelineRunStatus"];
 type PipelineRunPage = Schemas$3["PipelineRunPage"];
 type PipelineRunsQuery = Schemas$3["PipelineRunsQuery"];
 type RunStatusEvent = Schemas$3["RunStatusEvent"];
-type Audit = Schemas$3["Audit"];
 //#endregion
 //#region src/datatypes/scope.d.ts
 type Schemas$2 = components["schemas"];
-type ScopeParams = Schemas$2["ScopeParams"];
 type ScopeMetadata = Schemas$2["ScopeMetadata"];
 type CountryCode = Schemas$2["CountryCode"];
 type Language = Schemas$2["Language"];
@@ -15309,5 +15827,5 @@ type Retention = Schemas["Retention"];
 type RetentionSettings = Schemas["RetentionSettings"];
 type RetentionOverride = Schemas["RetentionOverride"];
 //#endregion
-export { LabelRef as $, ChatSessionPage as $n, TextAuditEvent as $r, GenerateInviteCode as $t, CreatePipelineRun as A, Activity as Ai, ConnectionId as An, ImageData as Ar, CursorPagination as At, Color as B, PipelineActivityParams as Bi, S3Credentials as Bn, Polygon as Br, NotificationSettings as Bt, Language as C, StorageAnalytics as Ci, ExportQuery as Cn, Dimensions as Cr, PipelineDefinition as Ct, ScopeMetadata as D, UsageAnalytics as Di, AzureCredentials as Dn, ImageAuditEvent as Dr, PipelineSummaryPage as Dt, Languages as E, Usage as Ei, AnthropicCredentials as En, EntityGroup as Er, PipelineSummary as Et, RunId as F, ActivityType as Fi, ConnectionsQuery as Fn, LeakProfile as Fr, MemberJoinedParams as Ft, GdprArticle9Treatment as G, Account as Gi, SyncSchedule as Gn, SourceRef as Gr, UnreadStatus as Gt, CreatePolicy as H, PolicyActivityParams as Hi, SyncConnection as Hn, RasterMode as Hr, PipelineRunCompletedParams as Ht, RunMetadata as I, ConnectionActivityParams as Ii, CreateConnection as In, ModelEvent as Ir, Notification as It, HipaaDeidMethod as J, PasswordChange as Ji, SyncTriggerType as Jn, TabularAuditLog as Jr, Member as Jt, GdprSensitiveScope as K, AccountRef as Ki, SyncScheduleInput as Kn, TabularAuditEvent as Kr, UpdateNotificationSettings as Kt, RunStatusEvent as L, FileActivityParams as Li, GcsCredentials as Ln, OperatorId as Lr, NotificationEvent as Lt, PipelineRunPage as M, ActivityListQuery as Mi, ConnectionSync as Mn, ImageEntityRecord as Mr, ConnectionSyncFailedParams as Mt, PipelineRunStatus as N, ActivityPage as Ni, ConnectionSyncPage as Nn, ImageHint as Nr, MarkedReadStatus as Nt, ScopeParams as O, UsageReport as Oi, Connection as On, ImageAuditKind as Or, PipelineTriggerType as Ot, PipelineRunsQuery as P, ActivityPayload as Pi, ConnectionVerification as Pn, ImageLocation as Pr, MemberInvitedParams as Pt, LabelLocale as Q, ChatSession as Qn, TabularLocation as Qr, CreateInvite as Qt, AudioRedaction as R, InviteActivityParams as Ri, LlmConfig as Rn, PatternEvent as Rr, NotificationPage as Rt, CountryCode as S, RunTimeSeries as Si, ExportFormat as Sn, Category as Sr, Pipeline as St, LanguageSpan as T, TokenCounts as Ti, ValidationErrorDetail as Tn, EntityCoRef as Tr, PipelineStatus as Tt, DateGranularity as U, WebhookActivityParams as Ui, SyncDeletionPolicy as Un, Review as Ur, PipelineRunFailedParams as Ut, ConfidenceThreshold as V, PipelineRunActivityParams as Vi, StorageConfig as Vn, RangeOfUint as Vr, PipelineRunAnalyzedParams as Vt, DateStyle as W, WorkspaceActivityParams as Wi, SyncMode as Wn, RuleMatch as Wr, UnreadCountEvent as Wt, Label as X, UpdateAccount as Xi, ChatMessage as Xn, TabularEntityRecord as Xr, MemberSortField as Xt, ImageRedaction as Y, PublicAccount as Yi, UpdateConnection as Yn, TabularEntity as Yr, MemberPage as Yt, LabelEntry as Z, paths as Zi, ChatRole as Zn, TabularHint as Zr, UpdateMember as Zt, WebhookId as _, ProviderType as _i, FormatToken as _n, AudioHint as _r, TerminalFallback as _t, RetentionSettings as a, TextHint as ai, InviteSent as an, RegisteredRecognizer as ar, PciPanRender as at, WebhookStatus as b, RunDayEntry as bi, UpdateFile as bn, AuditHash as br, Waveform as bt, WorkspacePage as c, ApiToken as ci, ListInvites as cn, Signup as cr, PolicyDraft as ct, CreateWebhook as d, ApiTokenWithJWT as di, ComponentHealth as dn, AudioAuditEvent as dr, PolicySummaryPage as dt, TextAuditKind as ei, Invite as en, ChatToken as er, LabelScope as et, TestWebhook as f, CreateApiToken as fi, Health as fn, AudioAuditKind as fr, PolicyTemplate as ft, WebhookEvent as g, ModelUsageEntry as gi, FilePage as gn, AudioEntityRecord as gr, TemplateOrigin as gt, WebhookCreated as h, ModelUsage as hi, FileKind as hn, AudioEntity as hr, TabularRedaction as ht, RetentionOverride as i, TextEntityRecord as ii, InvitePreview as in, RecognizerCatalog as ir, PciDssPart as it, PipelineRun as j, ActivityExportQuery as ji, ConnectionPage as jn, ImageEntity as jr, ConnectionSyncCompletedParams as jt, Audit as k, WorkspaceAnalytics as ki, ConnectionConfig as kn, ImageAuditLog as kr, UpdatePipeline as kt, WorkspaceRole as l, ApiTokenPage as li, ReplyInvite as ln, Attribution as lr, PolicyRule as lt, Webhook as m, UpdateApiToken as mi, File as mn, AudioData as mr, Sha2Algorithm as mt, OcrPolicy as n, TextData as ni, InviteExpiration as nn, SendChatMessage as nr, LocalizedText as nt, UpdateWorkspace as o, TextLocation as oi, InviteSortField as on, AuthToken as or, Policy as ot, UpdateWebhook as p, TokenExpiration as pi, HealthStatus as pn, AudioAuditLog as pr, Predicate as pt, HipaaAccountNumbers as q, Handle as qi, SyncStatus as qn, TabularAuditKind as qr, ListMembers as qt, Retention as r, TextEntity as ri, InvitePage as rn, LabelCatalog as rr, ModalityRedactions as rt, Workspace as s, TimeSpan as si, InviteStatus as sn, Login as sr, PolicyDefinition as st, CreateWorkspace as t, TextAuditLog as ti, InviteCode as tn, CreateChatSession as tr, LanguageTag as tt, WorkspaceSettings as u, ApiTokenType as ui, SortOrder as un, AttributionKind as ur, PolicySummary as ut, WebhookPage as v, RecognizerId as vi, ListFiles as vn, AudioLocation as vr, TextRedaction as vt, LanguageProvenance as w, StorageKindEntry as wi, ErrorResponse as wn, Dpi as wr, PipelineFilter as wt, Confidence as x, RunStatusEntry as xi, DateWindow as xn, BoundingBox as xr, CreatePipeline as xt, WebhookResult as y, RunAnalytics as yi, ModalityToken as yn, AuditContext as yr, UpdatePolicy as yt, ClampBucket as z, MemberActivityParams as zi, OpenAiCredentials as zn, Point as zr, NotificationPayload as zt };
-//# sourceMappingURL=index-0_K3HaXB.d.ts.map
+export { LanguageTag as $, ModelUsageEntry as $i, CreateChatSession as $n, ImageRetag as $r, InviteCode as $t, PipelineRunPage as A, Handle as Aa, TextAuditEvent as Ai, ConnectionSync as An, Conflict as Ar, ConnectionSyncFailedParams as At, CreatePolicy as B, TextPattern as Bi, SyncConnection as Bn, ImageAuditEvent as Br, PipelineRunCompletedParams as Bt, Language as C, PipelineActivityParams as Ca, TabularManual as Ci, ValidationErrorDetail as Cn, Audit as Cr, PipelineStatus as Ct, ScopeMetadata as D, WorkspaceActivityParams as Da, TabularRefinement as Di, ConnectionConfig as Dn, Category as Dr, UpdatePipeline as Dt, Languages as E, WebhookActivityParams as Ea, TabularRedact as Ei, Connection as En, Calibration as Er, PipelineTriggerType as Et, RunStatusEvent as F, TextEntity as Fi, GcsCredentials as Fn, Dpi as Fr, NotificationEvent as Ft, HipaaAccountNumbers as G, ApiToken as Gi, SyncStatus as Gn, ImageEntity as Gr, ListMembers as Gt, DateStyle as H, TextRefinement as Hi, SyncMode as Hn, ImageAuditLog as Hr, UnreadCountEvent as Ht, AudioRedaction as I, TextHint as Ii, LlmConfig as In, EditSet as Ir, NotificationPage as It, Label as J, ApiTokenWithJWT as Ji, ChatMessage as Jn, ImageManual as Jr, MemberSortField as Jt, HipaaDeidMethod as K, ApiTokenPage as Ki, SyncTriggerType as Kn, ImageHint as Kr, Member as Kt, ClampBucket as L, TextLocation as Li, OpenAiCredentials as Ln, EntityCoRef as Lr, NotificationPayload as Lt, PipelineRunsQuery as M, PublicAccount as Ma, TextAuditLog as Mi, ConnectionVerification as Mn, Deduplication as Mr, MemberInvitedParams as Mt, RunId as N, UpdateAccount as Na, TextData as Ni, ConnectionsQuery as Nn, Dimensions as Nr, MemberJoinedParams as Nt, CreatePipelineRun as O, Account as Oa, TabularRetag as Oi, ConnectionId as On, CitedAttribution as Or, CursorPagination as Ot, RunMetadata as P, paths as Pa, TextEdit as Pi, CreateConnection as Pn, DocumentContext as Pr, Notification as Pt, LabelScope as Q, ModelUsage as Qi, ChatToken as Qn, ImageRefinement as Qr, Invite as Qt, Color as R, TextManual as Ri, S3Credentials as Rn, FreeformAttribution as Rr, NotificationSettings as Rt, CountryCode as S, MemberActivityParams as Sa, TabularLocation as Si, ErrorResponse as Sn, AudioRetag as Sr, PipelineFilter as St, LanguageSpan as T, PolicyActivityParams as Ta, TabularPattern as Ti, AzureCredentials as Tn, BoundingBox as Tr, PipelineSummaryPage as Tt, GdprArticle9Treatment as U, TextRetag as Ui, SyncSchedule as Un, ImageData as Ur, UnreadStatus as Ut, DateGranularity as V, TextRedact as Vi, SyncDeletionPolicy as Vn, ImageAuditKind as Vr, PipelineRunFailedParams as Vt, GdprSensitiveScope as W, TimeSpan as Wi, SyncScheduleInput as Wn, ImageEdit as Wr, UpdateNotificationSettings as Wt, LabelLocale as X, TokenExpiration as Xi, ChatSession as Xn, ImagePattern as Xr, CreateInvite as Xt, LabelEntry as Y, CreateApiToken as Yi, ChatRole as Yn, ImageModel as Yr, UpdateMember as Yt, LabelRef as Z, UpdateApiToken as Zi, ChatSessionPage as Zn, ImageRedact as Zr, GenerateInviteCode as Zt, WebhookId as _, ActivityPayload as _a, TabularAuditKind as _i, ModalityToken as _n, AudioManual as _r, UpdatePolicy as _t, RetentionSettings as a, RunTimeSeries as aa, Point as ai, InviteStatus as an, Login as ar, PolicyDefinition as at, WebhookStatus as b, FileActivityParams as ba, TabularEntity as bi, ExportFormat as bn, AudioRedact as br, Pipeline as bt, WorkspacePage as c, TokenCounts as ca, RasterMode as ci, SortOrder as cn, AudioAdd as cr, PolicySummary as ct, CreateWebhook as d, UsageReport as da, RuleMatch as di, HealthStatus as dn, AudioAuditLog as dr, Predicate as dt, ProviderType as ea, LeakProfile as ei, InviteExpiration as en, SendChatMessage as er, LocalizedText as et, TestWebhook as f, WorkspaceAnalytics as fa, Selection as fi, File as fn, AudioData as fr, Sha2Algorithm as ft, WebhookEvent as g, ActivityPage as ga, TabularAuditEvent as gi, ListFiles as gn, AudioLocation as gr, TextRedaction as gt, WebhookCreated as h, ActivityFilterQuery as ha, TabularAdd as hi, FormatToken as hn, AudioHint as hr, TerminalFallback as ht, RetentionOverride as i, RunStatusEntry as ia, PatternEvent as ii, InviteSortField as in, AuthToken as ir, Policy as it, PipelineRunStatus as j, PasswordChange as ja, TextAuditKind as ji, ConnectionSyncPage as jn, Contested as jr, MarkedReadStatus as jt, PipelineRun as k, AccountRef as ka, TextAdd as ki, ConnectionPage as kn, CodecParams as kr, ConnectionSyncCompletedParams as kt, WorkspaceRole as l, Usage as la, Redaction as li, ComponentHealth as ln, AudioAuditEvent as lr, PolicySummaryPage as lt, Webhook as m, ActivityExportOptions as ma, Suppress as mi, FilePage as mn, AudioEntity as mr, TemplateOrigin as mt, OcrPolicy as n, RunAnalytics as na, ModelEvent as ni, InvitePreview as nn, RecognizerCatalog as nr, PciDssPart as nt, UpdateWorkspace as o, StorageAnalytics as oa, Polygon as oi, ListInvites as on, Signup as or, PolicyDraft as ot, UpdateWebhook as p, Activity as pa, SourceRef as pi, FileKind as pn, AudioEdit as pr, TabularRedaction as pt, ImageRedaction as q, ApiTokenType as qi, UpdateConnection as qn, ImageLocation as qr, MemberPage as qt, Retention as r, RunDayEntry as ra, OperatorId as ri, InviteSent as rn, RegisteredRecognizer as rr, PciPanRender as rt, Workspace as s, StorageKindEntry as sa, RangeOfUint as si, ReplyInvite as sn, Attribution as sr, PolicyRule as st, CreateWorkspace as t, RecognizerId as ta, ManualIntent as ti, InvitePage as tn, LabelCatalog as tr, ModalityRedactions as tt, WorkspaceSettings as u, UsageAnalytics as ua, Report as ui, Health as un, AudioAuditKind as ur, PolicyTemplate as ut, WebhookPage as v, ActivityType as va, TabularAuditLog as vi, UpdateFile as vn, AudioModel as vr, Waveform as vt, LanguageProvenance as w, PipelineRunActivityParams as wa, TabularModel as wi, AnthropicCredentials as wn, AuditHash as wr, PipelineSummary as wt, Confidence as x, InviteActivityParams as xa, TabularHint as xi, ExportQuery as xn, AudioRefinement as xr, PipelineDefinition as xt, WebhookResult as y, ConnectionActivityParams as ya, TabularEdit as yi, DateWindow as yn, AudioPattern as yr, CreatePipeline as yt, ConfidenceThreshold as z, TextModel as zi, StorageConfig as zn, ImageAdd as zr, PipelineRunAnalyzedParams as zt };
+//# sourceMappingURL=index-BsijAKTe.d.ts.map