@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js

@@ -1,12 +1,42 @@
+import { AuditApplicationReadAccess } from './audit-trail-config.shared.schemas.js';
+import { EngineOpenVocabulary } from '../../i18n/engine-open-vocabulary.shared.js';
+import { ApplicationConfigVocabulary } from '../../i18n/application-config-vocabulary.shared.js';
+import { AuditActorKind, AuditAgentActorSchema } from './audit-actor.shared.schemas.js';
+import { HumanDecision_Act, HumanDecision_Outcome, HumanDecision_Plane, HumanDecision_RefusalReason, HumanDecision_RequesterKind, HumanDecision_RouteChangeTrigger, HumanDecision_RouteKind, ReviewClockBasis, ReviewDeadlineKind, ReviewDeadlineOutcome, ReviewDeadlineStage, ReviewEscalationActionKind, } from '../../flows-actors/human-decision.shared.schemas.js';
+import { AutonomousPrincipalSource, AutonomousTurnRefusalReason, AutonomousTurnTrigger } from '../../flows-actors/autonomous-agents.shared.schemas.js';
+import { EvaluationDatasetExportRefusalReason } from '../../flows-actors/agent-work-decisions.shared.schemas.js';
+import { WorkUnitRefSchema } from '../../resources/work-unit.shared.schemas.js';
+import { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas.js';
 import { z } from "zod";
+import '@wildo-ai/zod-decorators';
+import { AuthMethod } from "../../security/authentications/authentication.shared.schemas.js";
+import { FactorSatisfactionSource } from "../../security/authentications/service-provider-client-authentication.shared.schemas.js";
+import { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from "../../organizations/service-provider-client-controls.shared.schemas.js";
+import { ServiceProviderActivityFeedStatus } from "../../organizations/service-provider-activity-feed.shared.schemas.js";
+import { ExternalProvider_Connection_DelegationMode, RateBudgetCounting } from "@wildo-ai/external-connectors-models";
+import { GovernedDocumentInteractionSchema } from "../documents/governed-document-interactions.shared.schemas.js";
 import { PersonalDataCategory } from "../privacy/personal-data-category.shared.schemas.js";
+import { ExternalDataConflictDecisionSource, ExternalDataConflictWinner, ExternalDataOutboundUnknownAnswer, ExternalDataPipelinePassMode, ExternalDataPipelineResetMode } from '../../external-data/external-data-pipeline-pass-mode.shared.js';
+import { LegalHoldGround, LegalHoldPlacementTier, LegalHoldScopeKind } from "../privacy/legal-holds.shared.schemas.js";
+import { DataRetentionClass } from "../privacy/retention-schedule.shared.schemas.js";
+import { RetentionEnforcementOutcome } from "../privacy/retention-enforcement-records.shared.schemas.js";
+import { SubjectErasureExternalEffectStatus } from "../privacy/subject-erasure.shared.schemas.js";
+import { SubjectDataRecipientObligation, SubjectDataRecipientReach, SubjectDataRecipientRelevance, SubjectDataRecipientsStatementStatus, } from "../privacy/subject-data-recipients.shared.schemas.js";
+import { RegistrationAcquisitionChannel } from "../../config/entity-identity-config.shared.schemas.js";
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from "../../resources/resources.shared.schemas.js";
 import { CoreResourceOperation } from "../../resources/resources.shared.core.definitions.js";
 import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus, } from "../../security/authorizations/platform-access-grants.shared.schemas.js";
-import { ExecutionContext_ExecutionType } from "../../runtime/execution-context.shared.schemas.js";
+import { SystemOfRecordPartitionAssignmentTransition } from "../../systems-of-record/system-of-record-partition-assignments.shared.schemas.js";
+import { DelegatedAdministrativeCapability, ServiceProviderCapabilityGrantEndCause } from "../../organizations/service-provider-capability-grants.shared.schemas.js";
+import { ServiceProviderExpertAdmissionPolicy, ServiceProviderExpertApprovalDenialReason, ServiceProviderRelationshipStatus, ServiceProviderRelationshipTransition, } from "../../organizations/service-provider-relationships.shared.schemas.js";
+import { ExecutionContext_ExecutionType, ExecutionContext_MachineCredentialSchema } from "../../runtime/execution-context.shared.schemas.js";
+import { InboundDeliveryRejectionReason, InboundDeliveryUnroutableReason, InboundResolvedScopeKind, InboundSourceKind } from "../../inbound/inbound-delivery.shared.schemas.js";
+import { InboundBelowMinimumDisposition, InboundChannelKind, InboundSenderAssurance, ReplyTokenDowngradeReason } from "../../inbound/inbound-channels.shared.schemas.js";
+import { ReplyTokenRevocationReason } from "../../inbound/conversation-threads.shared.schemas.js";
+import { InboundEmailLimit, InboundEmailWithheldReason, OrganizationEmailDomainRemovalTrigger, OrganizationEmailDomainStatus, OrganizationEmailDomainSuspensionReason, } from "../../notifications/inbound-email/inbound-email.shared.schemas.js";
 import { AuthScopeType, SsoConnectionType, } from "../../security/authentications/authentication.shared.schemas.js";
 import { WebhookEndpointProbeOutcome } from "../../notifications/m2m/webhook-config.shared.schemas.js";
-import { ProviderCredentialDeletionReason, ProviderCredentialResolutionSource, } from "../../security/connected-accounts/provider-credentials.shared.schemas.js";
+import { ProviderCredentialDeletionReason, ProviderOAuth2RevocationOutcomeValues, ProviderCredentialResolutionSource, } from "../../security/connected-accounts/provider-credentials.shared.schemas.js";
 export var CoreAuditableEventType;
 (function (CoreAuditableEventType) {
     // Authentication Events
@@ -106,6 +136,11 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["ORGANIZATION_CREATED"] = "organization_created";
     // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
     CoreAuditableEventType["ORGANIZATION_UPDATED"] = "organization_updated";
+    /**
+     * The engine assigned an organization its `type`, at boot, with no actor — see
+     * {@link AuditableEvent_Organization_TypeAssignedEventDataSchema} for why this is not an `ORGANIZATION_UPDATED`.
+     */
+    CoreAuditableEventType["ORGANIZATION_TYPE_ASSIGNED"] = "organization_type_assigned";
     CoreAuditableEventType["ORGANIZATION_DELETED"] = "organization_deleted";
     /** The tenant was MARKED for deletion (soft-delete). Its access dies here; its data dies at the purge. */
     CoreAuditableEventType["ORGANIZATION_DELETION_REQUESTED"] = "organization_deletion_requested";
@@ -168,11 +203,47 @@ export var CoreAuditableEventType;
     // SSO Authentication Events
     CoreAuditableEventType["USER_SSO_LOGIN"] = "user_sso_login";
     CoreAuditableEventType["USER_SSO_LOGIN_FAILED"] = "user_sso_login_failed";
+    /**
+     * A tenant that mandates its identity provider refused a local sign-in or an acquisition.
+     *
+     * Emitted since #1214/#1242 by `_enforceEnterpriseSsoOnLocalFirstFactor` (every local first-factor
+     * door), by the grace-login gate's three refusal clauses, and by the registration door's
+     * `blockForSSODomains` block. `enforcementPolicy` carries WHICH clause refused, because "the tenant
+     * allows no fallback" and "this account has spent its grace logins" have different remedies and a
+     * bare `sso_required` cannot tell them apart.
+     *
+     * ONE refusal site remains unwired and is tracked on #1242: the SOCIAL-vs-enforcement refusal in
+     * `oauth2-authentication.backend.service.ts`, whose sibling provider-restriction refusal ten lines
+     * below it already emits `logOAuth2ProviderBlocked`.
+     *
+     * Deliberately NOT emitted by the fail-closed refusals that share the same error — a Redis read
+     * that failed, the outer catch. Those are infrastructure outcomes, and recording them as an
+     * enforcement decision would assert a policy judgement nobody made.
+     */
     CoreAuditableEventType["USER_SSO_ENFORCEMENT_BLOCKED"] = "user_sso_enforcement_blocked";
     CoreAuditableEventType["USER_TOKEN_REFRESHED"] = "user_token_refreshed";
     // Organization Security Management Events
+    // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
+    // Every SSO-config write is HIGH or CRITICAL (UPDATE, CREATE, and the three domain-ownership verbs),
+    // and its authentication-authority blocks carry `.isAuditEvidence()`, so the row names what changed
+    // and its before/after values. Its emit method had no caller and was removed (#591).
     CoreAuditableEventType["ORGANIZATION_SSO_CONFIGURATION_CHANGED"] = "organization_sso_configuration_changed";
+    /** A change to where an organization's security events are exported: enabled, or a field other than the destination edited. INFO. */
     CoreAuditableEventType["ORGANIZATION_SIEM_EXPORT_CONFIGURED"] = "organization_siem_export_configured";
+    /**
+     * Security-event export was turned OFF (#986). Its own kind, at CRITICAL, because the envelope's rule
+     * is that severity is a property of the event TYPE and danger rides the row's `riskLevel` — and
+     * `riskLevel` never reaches the SIEM. As one INFO kind, "export disabled" was filtered out by any
+     * organization that raised its severity minimum, on the one destination that most needed it.
+     * Delivered to the destination that STOPPED, as its last event (`dispatchToRetiredSiemSink`).
+     */
+    CoreAuditableEventType["ORGANIZATION_SIEM_EXPORT_DISABLED"] = "organization_siem_export_disabled";
+    /**
+     * Security-event export was re-pointed at another destination (#986). WARNING: a destination move is
+     * how an attacker who reached the tenant's administration diverts the trail. Delivered to BOTH the
+     * old and the new destination.
+     */
+    CoreAuditableEventType["ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED"] = "organization_siem_export_destination_changed";
     // Organization Provider Credential Events
     //
     // An organization's OWN credential toward a third party. The four verbs are separate members
@@ -223,6 +294,7 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["ORGANIZATION_PROVIDER_CONNECTION_GRANTED"] = "organization_provider_connection_granted";
     CoreAuditableEventType["USER_PROVIDER_CONNECTION_GRANTED"] = "user_provider_connection_granted";
     // Application Security Configuration Events
+    // Also records the effective authored audit-viewer admission policy, with independently typed before/after evidence.
     // The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout
     // requirements) is STATIC application configuration authored in code and taken into effect at
     // backend startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is
@@ -234,6 +306,12 @@ export var CoreAuditableEventType;
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance
     // requirements (MFA / password / lockout) must be attributable and evidenced.
     CoreAuditableEventType["APPLICATION_AUTH_POLICY_CHANGED"] = "application_auth_policy_changed";
+    // Retention Enforcement (#1636)
+    // One per retention-class sweep run, by the system: per-class totals of what the run deleted, skipped and
+    // failed on. The queryable per-resource record is `retentionEnforcementRecords`; this event exists to reach
+    // the SIEM. Its row risk is HIGH when any resource failed, LOW otherwise.
+    // assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — records evidence that declared retention was enforced.
+    CoreAuditableEventType["RETENTION_ENFORCEMENT_RECORDED"] = "retention_enforcement_recorded";
     // Outbound M2M Webhook Events
     // An admin firing `webhookConfig.testEndpoint` makes the platform emit a signed HTTP
     // request to an operator-supplied URL. That is an outbound-traffic primitive reachable
@@ -242,12 +320,71 @@ export var CoreAuditableEventType;
     // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — outbound connection initiated from an
     // administrative surface is attributable and monitorable.
     CoreAuditableEventType["WEBHOOK_ENDPOINT_TEST_DISPATCHED"] = "webhook_endpoint_test_dispatched";
+    // Inbound Delivery Events (#1596)
+    // Every verified message another system sends the application leaves a trail from the wire to its
+    // outcome: refused at the door, stored, never routable, processed, failed and retried, dead, replayed.
+    // The terminal and refused transitions are the ones an operator investigates; ACCEPTED and PROCESSED
+    // make the successes countable too, so a SIEM can see a sender's volume and not only its failures.
+    // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a message whose signature, timestamp, size or media
+    // type does not verify is refused whole and the refusal is recorded.
+    CoreAuditableEventType["INBOUND_DELIVERY_REJECTED"] = "inbound_delivery_rejected";
+    // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a verified external message entering the system is recorded.
+    CoreAuditableEventType["INBOUND_DELIVERY_ACCEPTED"] = "inbound_delivery_accepted";
+    // assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — a message that resolves to no admissible scope is
+    // recorded as never run, rather than run somewhere it does not belong.
+    CoreAuditableEventType["INBOUND_DELIVERY_UNROUTABLE"] = "inbound_delivery_unroutable";
+    CoreAuditableEventType["INBOUND_DELIVERY_PROCESSED"] = "inbound_delivery_processed";
+    CoreAuditableEventType["INBOUND_DELIVERY_FAILED"] = "inbound_delivery_failed";
+    // assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — work a sender was told was received and that never
+    // completed is recorded as such, so it can be found and replayed.
+    CoreAuditableEventType["INBOUND_DELIVERY_DEAD"] = "inbound_delivery_dead";
+    // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — a privileged re-run of stored input is attributable
+    // and carries its written justification.
+    CoreAuditableEventType["INBOUND_DELIVERY_REPLAYED"] = "inbound_delivery_replayed";
+    // Inbound Channel Events (#1630) — a message on a channel, and the replies that answer it.
+    // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a message whose sender assurance is below the handler's
+    // minimum never reaches that handler, and what happened to it instead is recorded.
+    CoreAuditableEventType["INBOUND_DELIVERY_BELOW_ASSURANCE"] = "inbound_delivery_below_assurance";
+    // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every reply a handler sends on a thread is
+    // attributable to the delivery and thread it answered.
+    CoreAuditableEventType["INBOUND_REPLY_SENT"] = "inbound_reply_sent";
+    CoreAuditableEventType["INBOUND_REPLY_FAILED"] = "inbound_reply_failed";
+    // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a reply address (a bearer secret) stopping to bind replies is recorded with why.
+    CoreAuditableEventType["INBOUND_REPLY_TOKEN_REVOKED"] = "inbound_reply_token_revoked";
+    // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a live reply address presented by a sender it was not issued
+    // to, or on an unauthenticated domain, is recorded: it is what a leaked address looks like.
+    CoreAuditableEventType["INBOUND_REPLY_TOKEN_DOWNGRADED"] = "inbound_reply_token_downgraded";
+    // Receiving Email Events (#1600) — the domains an organization proves, provisions and loses, the client
+    // mailboxes a firm keeps, and the parts of a received message that were not made available.
+    // assurance-control: WILDO.DATA.TENANT_ISOLATION — a claim on a domain is recorded; nothing routes on it until ownership is proven.
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_CLAIMED"] = "organization_email_domain_claimed";
+    // assurance-control: WILDO.DATA.TENANT_ISOLATION — the moment an organization proved it controls a domain, which decides where that domain's mail may go.
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED"] = "organization_email_domain_ownership_verified";
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_VERIFIED"] = "organization_email_domain_verified";
+    // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a domain whose ownership or records disappeared stops routing and sending, and the stop is recorded.
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_SUSPENDED"] = "organization_email_domain_suspended";
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_REMOVED"] = "organization_email_domain_removed";
+    // assurance-control: WILDO.DATA.TENANT_ISOLATION — a mailbox routing a firm's domain into a client organization exists only under an active relationship, and is recorded.
+    CoreAuditableEventType["CLIENT_MAILBOX_CREATED"] = "client_mailbox_created";
+    CoreAuditableEventType["CLIENT_MAILBOX_REMOVED"] = "client_mailbox_removed";
+    // assurance-control: WILDO.SECURITY.INGESTED_CONTENT_INSPECTION — an attachment not proven clean is never exposed, and withholding it is recorded.
+    CoreAuditableEventType["INBOUND_EMAIL_ATTACHMENT_WITHHELD"] = "inbound_email_attachment_withheld";
+    // assurance-control: WILDO.OPERATIONS.RESOURCE_LIMIT — a message over a declared limit is kept as an envelope only, and recorded.
+    CoreAuditableEventType["INBOUND_EMAIL_REJECTED_LIMIT"] = "inbound_email_rejected_limit";
     // SCIM Directory Provisioning Events
     // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
     CoreAuditableEventType["SCIM_TOKEN_CREATED"] = "scim_token_created";
+    // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
+    // `revoke_token` is a HIGH operation and `isActive` carries `.isAuditEvidence()`. Its emit method had no
+    // caller and was removed (#591), so a requirement body must not demand this member.
     CoreAuditableEventType["SCIM_TOKEN_REVOKED"] = "scim_token_revoked";
+    // audit-event-unemitted: covered by the generic row — `generate_token` is HIGH. See SCIM_TOKEN_REVOKED.
     CoreAuditableEventType["SCIM_TOKEN_GENERATED"] = "scim_token_generated";
+    // audit-event-unemitted: covered by the generic row — `rotate_token` is HIGH. See SCIM_TOKEN_REVOKED.
     CoreAuditableEventType["SCIM_TOKEN_ROTATED"] = "scim_token_rotated";
+    // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
+    // The provisioning-config UPDATE is HIGH and `autoCreateUsers`, `autoDeactivateUsers`, `defaultRole`,
+    // `organizationUnitMapping` and `defaultUnitRole` carry `.isAuditEvidence()`. Emit method removed (#591).
     CoreAuditableEventType["SCIM_PROVISIONING_CONFIG_UPDATED"] = "scim_provisioning_config_updated";
     CoreAuditableEventType["SCIM_PROVISIONING_FAILED"] = "scim_provisioning_failed";
     CoreAuditableEventType["SCIM_USER_PROVISIONED"] = "scim_user_provisioned";
@@ -329,6 +466,15 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["FILE_UPLOAD_GRANT_ISSUED"] = "file_upload_grant_issued";
     CoreAuditableEventType["FILE_UPLOAD_GRANT_REDEEMED"] = "file_upload_grant_redeemed";
     CoreAuditableEventType["FILE_UPLOAD_GRANT_REVOKED"] = "file_upload_grant_revoked";
+    /**
+     * File share links (#1567). A share is a bearer link that serves ONE file to whoever holds it, with no
+     * session at all — the widest disclosure the file plane can make, so minting one is audited like a
+     * grant. `ISSUED` carries the file, its owning record/field binding, the expiry and the use budget —
+     * never the token value. `REVOKED` is "stop sharing this file" (`DELETE /files/:fileId/shares`) and
+     * carries how many live links it ended; a revocation that ended none records nothing.
+     */
+    CoreAuditableEventType["FILE_SHARE_LINK_ISSUED"] = "file_share_link_issued";
+    CoreAuditableEventType["FILE_SHARE_LINKS_REVOKED"] = "file_share_links_revoked";
     // File content-inspection outcomes (#506)
     /**
      * A scanner concluded that an uploaded file is INFECTED, and the file was quarantined.
@@ -424,6 +570,126 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["RESOURCE_OPERATION_DENIED"] = "resource_operation_denied";
     CoreAuditableEventType["CROSS_TENANT_ADMINISTRATIVE_ACCESS"] = "cross_tenant_administrative_access";
     CoreAuditableEventType["PLATFORM_ACCESS_GRANT_LIFECYCLE"] = "platform_access_grant_lifecycle";
+    /**
+     * A legal hold was placed (#1634): from this instant every deletion path skips or refuses the held scope.
+     * HIGH — it suspends a tenant's retention schedule and its data subjects' erasures.
+     *
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.
+     */
+    CoreAuditableEventType["LEGAL_HOLD_PLACED"] = "legal_hold_placed";
+    /**
+     * A legal hold was released (#1634): deletion of its scope resumes on the next sweep, purge or erasure.
+     *
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.
+     */
+    CoreAuditableEventType["LEGAL_HOLD_RELEASED"] = "legal_hold_released";
+    /**
+     * A model-cost period aggregate was linked to the invoice that bills it (#1598). A retention-deciding act: the
+     * link is what keeps the aggregate past its tenant's deletion, for the statutory bookkeeping period.
+     *
+     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — only an aggregate an invoice bills outlives its tenant.
+     */
+    CoreAuditableEventType["MODEL_COST_AGGREGATE_INVOICE_LINKED"] = "model_cost_aggregate_invoice_linked";
+    /**
+     * An organization changed whether it keeps the CONTENT of its experts' corrections to agent work (#1599): the
+     * opt-in, its purpose, its reader role or its narrowing.
+     *
+     * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — every change to what the tenant keeps of its client material is recorded.
+     */
+    CoreAuditableEventType["CORRECTION_CAPTURE_SETTING_CHANGED"] = "correction_capture_setting_changed";
+    /**
+     * An organization recorded, changed or revoked its basis for exporting its experts' corrections as evaluation
+     * data (#1599).
+     *
+     * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — the authorisation an export relies on is recorded.
+     */
+    CoreAuditableEventType["EVALUATION_EXPORT_AUTHORIZATION_CHANGED"] = "evaluation_export_authorization_changed";
+    /** A tenant's corrections were exported as an evaluation dataset under its recorded authorisation (#1599). */
+    CoreAuditableEventType["EVALUATION_DATASET_EXPORTED"] = "evaluation_dataset_exported";
+    /**
+     * An export of a tenant's corrections was REFUSED: no ACTIVE authorisation of that organization (#1599 I7).
+     *
+     * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — a refused export is recorded, not only prevented.
+     */
+    CoreAuditableEventType["EVALUATION_DATASET_EXPORT_REFUSED"] = "evaluation_dataset_export_refused";
+    /**
+     * A service-provider relationship moved (#1597) — proposed, accepted, declined, suspended, resumed,
+     * scope amended, terminated, withdrawn or expired. ONE event for the relationship's whole life with a
+     * {@link ServiceProviderRelationshipTransition} field (the `platformAccessGrants` shape), written to
+     * BOTH the client's and the firm's trail so each reads the relationship's timeline in its own.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE"] = "service_provider_relationship_lifecycle";
+    /** A firm-owned OAuth client was admitted into, or removed from, a client organization (#1597, S3). */
+    CoreAuditableEventType["SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED"] = "service_provider_machine_client_admission_changed";
+    /** A firm assigned one of its experts to serve a client relationship (#1597). */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_ASSIGNED"] = "service_provider_expert_assigned";
+    /** A firm ended an expert's assignment to a client relationship (#1597). */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_UNASSIGNED"] = "service_provider_expert_unassigned";
+    /**
+     * A firm assigned an expert under a relationship whose client approves each expert, so the assignment now waits
+     * for the client's administrators (#1612). The approval is a human decision; this row carries its `decisionRef`,
+     * so it joins that decision's own REQUESTED / RESOLVED rows rather than duplicating them. Both organizations' trails.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED"] = "service_provider_expert_approval_requested";
+    /** The client approved the expert and the expert was admitted — a provider membership now exists (#1612). Both trails. */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED"] = "service_provider_expert_approval_granted";
+    /**
+     * The expert was NOT admitted (#1612): the client refused, or approved when the relationship, the expert's firm
+     * membership or the (person, client) slot no longer allowed it. `denialReason` says which. Both trails.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED"] = "service_provider_expert_approval_denied";
+    /** Nobody in the client answered before the approval's lapse; nothing was created (#1612). Both trails. */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED"] = "service_provider_expert_approval_lapsed";
+    /**
+     * A client lent a service firm's experts a named administrative capability, until a stated end (#1631). HIGH, CRITICAL
+     * for a security-critical capability. Written to both organizations' trails.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_CAPABILITY_GRANTED"] = "service_provider_capability_granted";
+    /** A client revoked a lent capability — or the relationship ended, which revokes them all (#1631). Both trails. */
+    CoreAuditableEventType["SERVICE_PROVIDER_CAPABILITY_REVOKED"] = "service_provider_capability_revoked";
+    /**
+     * A client organization changed whether it trusts the firm's own identity provider's MFA on one relationship
+     * (#1633). HIGH: turning it on lets a proof made outside this application satisfy the client's authentication
+     * policy for the firm's experts. Written to the client's trail and the firm's.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_MFA_TRUST_CHANGED"] = "service_provider_mfa_trust_changed";
+    /**
+     * A firm's expert satisfied a CLIENT organization's authentication policy (#1633): a factor was recorded on the
+     * session for that client, with where it came from — a step-up answered here, or the firm's trusted identity
+     * provider. The client's answer to "was this expert's work MFA-protected, and by whom?". Client trail only.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED"] = "service_provider_client_authentication_satisfied";
+    /**
+     * A firm switched its expert-activity feed on or off (#1632). The record of a worker-monitoring decision: who,
+     * when, and whether the consultation notice was acknowledged. Firm trail.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED"] = "service_provider_activity_feed_decided";
+    /**
+     * A client organization changed how much a firm's activity feed may say about work done in it (#1632). Written to
+     * the client's trail and the firm's, so the firm sees why its feed went quiet.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED"] = "service_provider_activity_feed_disclosure_changed";
+    /**
+     * A remote partition of a system of record was assigned to, moved between, or removed from an
+     * organization unit.
+     *
+     * ONE event for the whole life of the edge, with a {@link SystemOfRecordPartitionAssignmentTransition}
+     * field — the `platformAccessGrants` shape rather than three event types. Three types would put the
+     * same row's timeline in three buckets a reviewer has to reassemble, and the questions an auditor
+     * actually asks ("who has been able to see the German company, and since when?") are answered by
+     * reading one bucket in order.
+     *
+     * ## Why this exists beside the automatic row
+     *
+     * All three write verbs are HIGH, which is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so
+     * `RESOURCE_OPERATION_PERFORMED` already fires for each. What that row cannot carry is the thing a
+     * reviewer needs: which unit, and — on a move — which unit it was BEFORE. A generic operation row
+     * says an assignment changed; this one says what it changed from and to.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the reach of each remote partition is recorded.
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of the full life of that reach.
+     */
+    CoreAuditableEventType["SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE"] = "system_of_record_partition_assignment_lifecycle";
     /**
      * An operator enumerated an APPLICATION-WIDE directory — a collection read that is deliberately
      * not confined to any one tenant.
@@ -481,6 +747,8 @@ export var CoreAuditableEventType;
     // is more sensitive than a read, so it is audited as its own distinct event
     // rather than folded into SYSTEM_CONTEXT_READ.
     CoreAuditableEventType["SYSTEM_CONTEXT_WRITE"] = "system_context_write";
+    /** Platform owner publication of application/service configuration; safe field names, caller and outcome only. */
+    CoreAuditableEventType["PLATFORM_CONFIGURATION_PUBLICATION"] = "platform_configuration_publication";
     // Retained-Data (Impersonalization) Access Events
     // Emitted when a privileged SEE-THROUGH read reveals RETAINED (impersonalized-and-retained) records
     // that the default retention hide-predicate keeps hidden. SYSTEM_CONTEXT_READ names only the RUNTIME
@@ -497,8 +765,30 @@ export var CoreAuditableEventType;
     // and what was in it?". The four routed export operations this capability replaced emitted
     // NOTHING at all, which is the gap this closes. Classified DATA_ACCESS / WARNING: an authorized
     // but maximally-sensitive disclosure, not an anomaly.
+    // A person MET a governed document — was shown a notice, acknowledged one, accepted terms,
+    // gave or withdrew a consent — and WHICH RELEASE they met (issue #54).
+    //
+    // The identity is the point. `documentRef` + `releaseId` + `releaseVersion` names a file in a
+    // commit, so a reviewer asking "what exactly did this person accept" reads the terms as they
+    // stood rather than as they stand now. Nothing here is digest-sealed: the previous lane's
+    // interaction RECEIPTS were removed with the rest of the sealed publication machine on
+    // 2026-08-28, and `.claude/rules/one-source-of-truth.md` Rule 0 keeps none of it.
+    //
+    // Classified USER_LIFECYCLE / INFO, beside USER_REGISTERED, because it records a change in the
+    // person's relationship with the OPERATOR rather than a read of data or an access decision.
+    // INFO because recording an acceptance is routine expected activity whose whole value is that the
+    // trail can be queried years later; an alarm on it would fire on every registration. What is NOT
+    // routine rides the payload instead — `releaseApprovalState` says whether anybody had approved
+    // the document at the moment a person was bound by it.
+    //
+    // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person's decision about a governed document is
+    // recorded against the exact release version in force at that instant, together with the notice they
+    // were given before being asked (`acceptanceMode`) — or, when the surface declared none, an advisory
+    // saying so. It does NOT claim the document was SHOWN: only `EXPLICIT_AFTER_READING` presents it, and
+    // the other two modes link it (#1382).
+    CoreAuditableEventType["GOVERNED_DOCUMENT_INTERACTION_RECORDED"] = "governed_document_interaction_recorded";
     CoreAuditableEventType["SUBJECT_DATA_EXPORT"] = "subject_data_export";
-    // A resource LISTING was exported to a file (CSV/JSON) by an operator. Distinct from
+    // A resource LISTING was exported to a file (CSV, JSON or PDF) by an operator. Distinct from
     // SUBJECT_DATA_EXPORT, which answers a data subject's own right over their own data: this one is
     // an authorized operator taking rows they can already read and carrying them OUT of the system, so
     // the questions it must answer are "which resource, how many rows, and was it the page they were
@@ -519,6 +809,55 @@ export var CoreAuditableEventType;
     // probes the services tier never sees. Classified DATA_ACCESS / INFO: routine, authorized
     // operation — the value is the queryable trail, not an alarm.
     CoreAuditableEventType["HTTP_API_READ_THROUGH_ACCESS"] = "http_api_read_through_access";
+    // A row was WRITTEN THROUGH an HTTP-API resource binding (#1679) — a create, update or delete sent to a
+    // system of record the platform does not own, or refused before it was sent. The outbound twin of
+    // HTTP_API_READ_THROUGH_ACCESS and deliberately not folded into it: a read brings rows IN, this pushes a
+    // change OUT, and the reviewer's question is different — "who changed which row of which external
+    // system, which FIELDS did they change, and did it land". One event per write ATTEMPT, emitted at the
+    // adapter (the only tier that witnesses every remote write, repository-direct callers included), on
+    // every outcome: applied, refused before sending, refused by the remote, UNKNOWN, and replayed from an
+    // earlier attempt under the same Idempotency-Key. Carries field NAMES, never values: the trail must
+    // never become a second copy of what was written into someone else's system.
+    //
+    // Beside RESOURCE_OPERATION_PERFORMED, not instead of it, and the two cannot contradict each other:
+    // that row records that the OPERATION completed and is emitted only after it did; this one records
+    // what happened at the REMOTE and is emitted whatever the operation's fate. An applied write whose
+    // follow-up failed therefore shows this row (APPLIED) and no operation row — which is exactly the
+    // state the WRITE_APPLIED_FOLLOW_UP_FAILED answer describes.
+    CoreAuditableEventType["HTTP_API_WRITE_THROUGH"] = "http_api_write_through";
+    // A declared ACTION of a system of record was run (#1678) — a vendor operation that is not a row write (posting an
+    // invoice, confirming an order, an OData action), sent under the instance's service identity. One row per attempt that
+    // reached the remote, or was replayed from an earlier attempt under the same Idempotency-Key: applied, refused by the
+    // remote, of unknown outcome, replayed. Not folded into HTTP_API_WRITE_THROUGH: that row names the FIELDS a row write
+    // changed, this one names an OPERATION and whether it landed, and a reviewer asks different questions of each.
+    //
+    // It is also the action's OUTBOUND record, and subject-free in the #1712 sense: the instance, the action, the remote
+    // entity, the outcome and the time. No input VALUE (only the input's field names), no payload, no subject id — the
+    // record describes the application's egress, not a person. The initiating actor rides the audit row's own `userId`,
+    // as it does on every audit row; that is attribution, not a subject.
+    CoreAuditableEventType["SYSTEM_OF_RECORD_ACTION_EXECUTED"] = "system_of_record_action_executed";
+    // A declared ACTION of a system of record was REFUSED before anything was sent (#1678) — a non-owner organization, a
+    // role the caller does not hold, a context not admitted to initiate it, a record outside the caller's partition, an
+    // invalid input, a reused or missing Idempotency-Key. Its own type rather than an outcome of the row above because it
+    // is an AUTHORIZATION decision, classified and alerted on as one; the executed row is data access. Every refusal is
+    // recorded, so a probe for records one may not see leaves a trail even though it learns nothing.
+    CoreAuditableEventType["SYSTEM_OF_RECORD_ACTION_REFUSED"] = "system_of_record_action_refused";
+    // An operator RESET a pipeline through the admin door (#1734) — discarded its in-flight full pass (cursor, checkpoint,
+    // membership journal) and, for a full resync, its incremental watermark. Its own type because it is an administrative
+    // act on how a copy of a system of record is kept, not a read or a write of the records: the next run re-reads what
+    // the reset discarded, and the row names what that was, so a reviewer can tell a deliberate resync from a pipeline that
+    // lost its place. Classified ORG_MANAGEMENT / WARNING, like a platform configuration publication.
+    CoreAuditableEventType["EXTERNAL_DATA_PIPELINE_RESET"] = "external_data_pipeline_reset";
+    // An operator ANSWERED an outbound write of unknown outcome through the admin door (#2039): it landed (and, for a
+    // create, here is the remote key of the record found) or it did not (send it again). Its own type because it is a
+    // claim about ANOTHER system that nothing in the engine can check — the answer decides whether a record is linked or
+    // sent a second time — so the record is the control. Classified ORG_MANAGEMENT / WARNING, like a pipeline reset.
+    CoreAuditableEventType["EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED"] = "external_data_outbound_unknown_resolved";
+    // A BIDIRECTIONAL pipeline RESOLVED a row changed on both sides since they last agreed (#1723): the system of record's
+    // values were loaded over the local ones, or the local ones were kept to be sent over the remote ones. One side's change
+    // to the named fields is discarded, by the declared policy or an operator's choice, so the record is the control.
+    // Classified DATA_ACCESS / WARNING: data was overwritten, by design, and a reviewer reads it beside the write-through.
+    CoreAuditableEventType["EXTERNAL_DATA_CONFLICT_RESOLVED"] = "external_data_conflict_resolved";
     // A subject erasure INVOKED the declared external-erasure operation of an HTTP_API-bound
     // resource (ETL D6 stance 6b) — rows linked to the erased subject were DELETED in a system the
     // platform does not own (OData canonical DELETE / Odoo `unlink` / a declared REST_JSON call).
@@ -538,6 +877,15 @@ export var CoreAuditableEventType;
     // USER_LIFECYCLE / CRITICAL: one event per acknowledged resource per erasure, never a standing
     // posture.
     CoreAuditableEventType["HTTP_API_NON_ERASURE_ACKNOWLEDGED"] = "http_api_non_erasure_acknowledged";
+    // A subject erasure's outcome at ONE RECIPIENT of the subject's data — a provider the
+    // application's declared flows reach (#1710). One row per recipient per erasure, naming the recipient, whose
+    // account reached it, who owes the Art. 19 communication and the outcome (a registered effect's status, or the
+    // status the recipient's declared erasure stance decides: UNMEASURED when it declares none). The queryable half of
+    // the per-recipient receipt `SubjectErasureReport.recipients` carries, so an evidence collector can read per-vendor
+    // outcomes without the application persisting reports. Vendor facts only — no personal data. USER_LIFECYCLE / INFO
+    // for every outcome: severity is fixed per event type, so a reader separates the recipients whose data stayed live by
+    // the row's `status`, never by its severity.
+    CoreAuditableEventType["SUBJECT_ERASURE_RECIPIENT_OUTCOME"] = "subject_erasure_recipient_outcome";
     // The application CALLED a declared operation on a third-party provider — one event per outbound
     // call, on both the success and the failure path.
     //
@@ -563,6 +911,21 @@ export var CoreAuditableEventType;
     // assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound call made on a user's behalf is
     // recorded with the real initiating user carried through whichever account it spent.
     CoreAuditableEventType["PROVIDER_OPERATION_CALL"] = "provider_operation_call";
+    // A signed-in person's BROWSER asked for a provider operation and the door REFUSED it (#367).
+    //
+    // A sibling of `PROVIDER_OPERATION_CALL`, not a failure case of it, because nothing was called: the
+    // refusal happens before any catalogue lookup, credential read or outbound request, so the call
+    // member's required `method`, `domain` and `classification` do not exist for it — an operation the
+    // application never declared browser-reachable may not even be in the catalogue. What it records is
+    // an ACCESS DECISION, which is the other half of "record access decisions" for this door, exactly as
+    // `RESOURCE_OPERATION_DENIED` is for the resource authorizer.
+    //
+    // Classified AUTHORIZATION / WARNING for that sibling's reason: a refusal is not routine traffic, and a
+    // run of them against one operation is a person probing what a browser can make the backend do.
+    //
+    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals at the browser door to a
+    // third-party operation are attributable and reviewable.
+    CoreAuditableEventType["PROVIDER_OPERATION_DENIED"] = "provider_operation_denied";
     // An AGENT reached an MCP server on somebody's behalf (#491).
     //
     // A sibling of `PROVIDER_OPERATION_CALL`, not a case of it, and the split is the same one that
@@ -584,36 +947,85 @@ export var CoreAuditableEventType;
     // assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the
     // real initiating user carried through whichever account it spent.
     CoreAuditableEventType["MCP_TOOL_CALL"] = "mcp_tool_call";
-    // A human APPROVER changed a proposed tool call's arguments and approved the changed call (#566).
+    // The application's BACKEND called a vendor to discharge an engine CAPABILITY (#1712): sent a
+    // transactional email or an SMS, called the billing provider, moved bytes to or from a storage vendor.
     //
-    // The strongest act available on the approval plane, and the reason it is its own member rather
-    // than a flag on some broader "approval decided" event: on every other decision the approver
-    // ASSENTS to a call the model authored, and here they AUTHOR one the model never proposed. An
-    // incident reader asking "who wrote the arguments this tool ran with" is asking a different
-    // question from "who let it run", and folding the two would make the first unanswerable by query.
+    // A sibling of `PROVIDER_OPERATION_CALL`, not a case of it, for the reason `MCP_TOOL_CALL` is one: a
+    // capability call is not a CATALOGUE operation. It has no `operationId`, no catalogue `domain` and no
+    // declared READ/WRITE classification; its act is named by the capability and a closed action instead.
+    // Folding them would make "which catalogue operations ran" answer with emails. The ATTRIBUTION fields
+    // are identical, so "what did this application send to that vendor" is one shape of query over all three.
     //
-    // Emitted ONLY when the executed input differs from the proposed one. An ordinary approval is not
-    // this event and is deliberately not recorded here — the plane has no approval-decision trail at
-    // all yet, which is a separate gap with its own issue; adding half of one under this name would
-    // make `mcp_tool_call`'s mistake in the other direction, an event that answers two questions and
-    // neither well.
+    // NO SUBJECT by construction, and that is a decision rather than an omission. #412 declined any
+    // persisted record of a sent email — even metadata-only, recipient and template included — because it
+    // would be a new personal-data store owing export, erasure and a retention class. So no field here
+    // names a recipient, a phone number, a file, a customer or a payload: the row describes the
+    // application's EGRESS, not the person the data is about. It still carries ATTRIBUTION like every audit
+    // row — the initiating actor where the egress knows one, and `connectionOwnerId`, whose account was
+    // spent (a person, for a file in their Drive) — which is why it exports at SUBJECT_DETAIL like its
+    // siblings. Email, SMS and billing are reached without an execution context and carry no actor.
     //
-    // NAMES AND DIGESTS ONLY — never argument values. Identical reasoning to
-    // `RESOURCE_OPERATION_PERFORMED`'s `changedFields` / `fieldEvidence` split: audit rows replicate
-    // to the per-org SIEM and to an immutable ledger that cannot be scrubbed, so copying arbitrary
-    // tool arguments here would manufacture an unerasable duplicate of whatever a person typed, in
-    // direct conflict with GDPR Art. 17. The two digests prove executed ≠ proposed; the key names say
-    // WHICH arguments a person authored. Neither can leak content.
+    // Classified DATA_ACCESS / INFO for its siblings' reason: routine, authorized activity whose value is
+    // the queryable trail rather than an alarm.
     //
-    // Classified AUTHORIZATION / WARNING. Authorization because the act IS a human authorization
-    // decision, not a data access. WARNING rather than CRITICAL for the same reading the OAuth grant
-    // rows take: it is notable, dashboard-worthy and worth reviewing, and it is an AUTHORIZED action
-    // taken by an identified person with the pause in front of them — reserving CRITICAL for the rows
-    // that mean something is wrong is what keeps a severity filter usable.
-    //
-    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the approver who authored the
-    // executed arguments is recorded beside proof that they differed from the proposal.
-    CoreAuditableEventType["AGENT_TOOL_APPROVAL_MODIFIED"] = "agent_tool_approval_modified";
+    // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every physical call a capability
+    // makes to a vendor is recorded with its provider, capability and outcome.
+    CoreAuditableEventType["PROVIDER_CAPABILITY_CALL"] = "provider_capability_call";
+    // ── Human decisions on an agent's work (#1594) ──
+    // One family for BOTH planes — the conversational tool approval and the actor-system suspension —
+    // keyed by one `decisionRef`. Every row carries names and ids only: no argument values and no
+    // digests (#1595 D5), because a trail that holds what an agent was about to write cannot be scrubbed.
+    // All AUTHORIZATION: each records who may, or did, authorize an agent's action.
+    /** A decision was raised and is waiting. Actor: the requester's principal, with the agent. */
+    CoreAuditableEventType["HUMAN_DECISION_REQUESTED"] = "human_decision_requested";
+    /**
+     * A decision ended — answered, lapsed, withdrawn, or its requester's authority lapsed. Exactly one
+     * per `decisionRef`, written only by whoever won the compare-and-swap that released the pause.
+     * `outcome` says which; a SIEM that wants modified approvals filters on it.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every human decision on an agent's action is recorded once, with its decider and outcome.
+     */
+    CoreAuditableEventType["HUMAN_DECISION_RESOLVED"] = "human_decision_resolved";
+    /** A decision was moved to another person (an answerer's handover, or a supervisor's takeover). */
+    CoreAuditableEventType["HUMAN_DECISION_REASSIGNED"] = "human_decision_reassigned";
+    /** A decision was escalated — moved up, never denied. */
+    CoreAuditableEventType["HUMAN_DECISION_ESCALATED"] = "human_decision_escalated";
+    /** A role-routed decision was claimed by one holder, or given back to the role (`claimed: false`). */
+    CoreAuditableEventType["HUMAN_DECISION_CLAIMED"] = "human_decision_claimed";
+    /** Someone tried to act on a decision and the predicate refused them. WARNING: the refusal is the evidence. */
+    CoreAuditableEventType["HUMAN_DECISION_ANSWER_REFUSED"] = "human_decision_answer_refused";
+    // #1628 — deadlines. A deadline changes who is asked and who is told, never the outcome, so none of
+    // these rows is a decision: RESOLVED stays the one row that says how a decision ended.
+    /** A decision's CLAIM or DECISION deadline passed with nobody having taken or answered it. Actor: the application. */
+    CoreAuditableEventType["HUMAN_DECISION_DEADLINE_MISSED"] = "human_decision_deadline_missed";
+    /**
+     * A deadline stage's escalation rule fired: who was notified, and — for a REASSIGN rule — whether its
+     * target resolved and could answer. Actor: the application.
+     *
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — every rule-driven change to who is asked about an agent's action is recorded, including a reassignment refused because its target could not answer.
+     */
+    CoreAuditableEventType["HUMAN_DECISION_ESCALATION_FIRED"] = "human_decision_escalation_fired";
+    /** A person admitted to answer stopped the decision's CLAIM and DECISION clocks, naming a declared pause state. */
+    CoreAuditableEventType["HUMAN_DECISION_CLOCK_PAUSED"] = "human_decision_clock_paused";
+    /** A person admitted to answer restarted the clocks; the paused time was added to both deadlines. */
+    CoreAuditableEventType["HUMAN_DECISION_CLOCK_RESUMED"] = "human_decision_clock_resumed";
+    // ── Autonomous agents (#1611) ──
+    // An agent that runs with nobody on a socket, under a tenant-granted machine credential. The binding is
+    // a grant of standing authority, so both directions are recorded; every turn the entry point starts or
+    // refuses is recorded too, so an unattended action is never unexplained.
+    /**
+     * An autonomous agent may now run in an organization: a client of that organization was bound to it,
+     * or a firm's client that runs it was admitted by the organization's service-provider relationship.
+     *
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — granting an agent standing authority to act unattended is recorded.
+     */
+    CoreAuditableEventType["AUTONOMOUS_AGENT_BOUND"] = "autonomous_agent_bound";
+    /** An autonomous agent may no longer run in an organization: its binding or its admission was removed. */
+    CoreAuditableEventType["AUTONOMOUS_AGENT_UNBOUND"] = "autonomous_agent_unbound";
+    /** The autonomous entry point opened a turn. Actor: the machine principal it resolved. */
+    CoreAuditableEventType["AUTONOMOUS_AGENT_TURN_STARTED"] = "autonomous_agent_turn_started";
+    /** The autonomous entry point refused to open a turn, and created nothing. WARNING: `reason` says why. */
+    CoreAuditableEventType["AUTONOMOUS_AGENT_TURN_REFUSED"] = "autonomous_agent_turn_refused";
     // ── OAuth2 / OIDC Provider Events (Wildo AS the authorization server) ──
     // Distinct from the `OAUTH2_*` family above, which records Wildo CONSUMING an
     // EXTERNAL social OAuth provider. These record the app-issued OAuth2/OIDC provider
@@ -736,6 +1148,113 @@ export function describeAuditVocabulary(lead, meanings) {
     const legend = Object.entries(meanings).map(([value, words]) => `- \`${value}\`: ${words.meaning}`).join('\n');
     return `${lead}\n\nValues:\n${legend}`;
 }
+/**
+ * Why the browser door to a provider operation refused a request (#367). A CLOSED vocabulary: the door
+ * resolves exactly one of these per refusal, in the order listed, and a reviewer groups by it.
+ *
+ * Deliberately NOT a reuse of {@link ResourceOperationDenialReason}. The two doors ask different
+ * questions of different declarations — that one checks an operation variant's roles and a row's scope,
+ * this one checks an application's browser-reachability policy and whose third-party account is named —
+ * and sharing members would make "insufficient roles" mean two things in one column.
+ */
+/**
+ * What a provider operation's `requiredScopes` check concluded for one call (#979).
+ *
+ * Carried on {@link AuditableEvent_ProviderOperationCall_EventDataSchema} only when the operation declares required
+ * scopes; an operation declaring none carries no scope field at all, rather than a verdict about nothing.
+ */
+export var ProviderOperationScopeCheck;
+(function (ProviderOperationScopeCheck) {
+    /** The grant recorded its scopes and every required one is among them. The call proceeded. */
+    ProviderOperationScopeCheck["VERIFIED"] = "verified";
+    /**
+     * The spent credential records no granted scopes — a pasted key, the application's own credential, or a vendor
+     * that did not echo `scope`. The call proceeded UNCHECKED, and this row is what says so.
+     */
+    ProviderOperationScopeCheck["NOT_RECORDED"] = "not_recorded";
+    /** The grant recorded its scopes and lacks at least one required scope. The call was refused before any request. */
+    ProviderOperationScopeCheck["MISSING"] = "missing";
+})(ProviderOperationScopeCheck || (ProviderOperationScopeCheck = {}));
+/**
+ * WHICH engine capability an outbound capability call discharged (#1712) — the egress, not the vendor.
+ *
+ * Deliberately not {@link EngineCapability}: file storage is not an engine capability (a storage is selected
+ * per field, not per application), and email is two capabilities (transactional and marketing) with one
+ * egress. The finer engine capability, where one exists, rides `engineCapability` beside it.
+ */
+export var ProviderCapabilityEgress;
+(function (ProviderCapabilityEgress) {
+    ProviderCapabilityEgress["EMAIL"] = "email";
+    ProviderCapabilityEgress["SMS"] = "sms";
+    ProviderCapabilityEgress["BILLING"] = "billing";
+    ProviderCapabilityEgress["FILE_STORAGE"] = "file_storage";
+    /** A captcha vendor's backend verification of a token a public form submitted (#1735). */
+    ProviderCapabilityEgress["CAPTCHA"] = "captcha";
+})(ProviderCapabilityEgress || (ProviderCapabilityEgress = {}));
+/** WHAT a capability call did (#1712). One member per act the egress performs; billing names its adapter method apart. */
+export var ProviderCapabilityCallAction;
+(function (ProviderCapabilityCallAction) {
+    ProviderCapabilityCallAction["EMAIL_SEND"] = "email_send";
+    ProviderCapabilityCallAction["SMS_SEND"] = "sms_send";
+    /** One call of the billing adapter; `billingOperation` names which. */
+    ProviderCapabilityCallAction["BILLING_OPERATION"] = "billing_operation";
+    ProviderCapabilityCallAction["FILE_STORAGE_UPLOAD"] = "file_storage_upload";
+    ProviderCapabilityCallAction["FILE_STORAGE_DOWNLOAD"] = "file_storage_download";
+    ProviderCapabilityCallAction["FILE_STORAGE_READ_METADATA"] = "file_storage_read_metadata";
+    ProviderCapabilityCallAction["FILE_STORAGE_DELETE"] = "file_storage_delete";
+    /** One token sent to a captcha vendor's verification endpoint (reCAPTCHA `siteverify`). */
+    ProviderCapabilityCallAction["CAPTCHA_VERIFY"] = "captcha_verify";
+})(ProviderCapabilityCallAction || (ProviderCapabilityCallAction = {}));
+/**
+ * How ONE capability call ended, as far as the application can know (#1712).
+ *
+ * Three members, not two, because a call can leave and never be answered: an email whose transport timed out after
+ * the request was sent may or may not have been accepted. Reporting that as a failure would invite a resend the
+ * vendor may already have honoured; reporting it as a success would claim what nobody observed.
+ */
+export var ProviderCapabilityCallOutcome;
+(function (ProviderCapabilityCallOutcome) {
+    /** The vendor answered and accepted the call. */
+    ProviderCapabilityCallOutcome["SUCCEEDED"] = "succeeded";
+    /** The call was refused — by the vendor, or before it left (a missing credential, a refused request). */
+    ProviderCapabilityCallOutcome["FAILED"] = "failed";
+    /** The call left and its result was not observed (a timeout or a broken connection after sending). */
+    ProviderCapabilityCallOutcome["OUTCOME_UNKNOWN"] = "outcome_unknown";
+})(ProviderCapabilityCallOutcome || (ProviderCapabilityCallOutcome = {}));
+export var ProviderOperationDenialReason;
+(function (ProviderOperationDenialReason) {
+    /**
+     * The caller authenticated without a person — an application API key, a machine identity. This door
+     * exists for a signed-in person's browser, and the policy's roles and the target-authorization port
+     * both reason about a person; a backend caller has the executor and the typed client instead.
+     */
+    ProviderOperationDenialReason["MISSING_USER_SESSION"] = "missing_user_session";
+    /**
+     * The application's `providers.browserOperations` names no policy for this provider and operation.
+     * The fail-closed default: nothing is reachable from a browser unless declared. Also the answer for an
+     * operation that does not exist, so a refusal never reveals what a catalogue contains.
+     */
+    ProviderOperationDenialReason["NOT_BROWSER_REACHABLE"] = "not_browser_reachable";
+    /** The request names a connection shape — owner scope × delegation — the operation's policy does not admit. */
+    ProviderOperationDenialReason["CONNECTION_NOT_ADMITTED"] = "connection_not_admitted";
+    /**
+     * The policy declares roles and the target is the caller's OWN user account, over which nobody holds a
+     * role. A policy mistake rather than a caller's, recorded as its own reason so it is not read as a
+     * person lacking a role they could be granted.
+     */
+    ProviderOperationDenialReason["ROLES_NOT_APPLICABLE_TO_TARGET"] = "roles_not_applicable_to_target";
+    /**
+     * The target-authorization port refused: the caller named an organization they do not belong to
+     * organization-wide, or a user account that is not their own.
+     */
+    ProviderOperationDenialReason["TARGET_NOT_AUTHORIZED"] = "target_not_authorized";
+    /**
+     * The caller may act for the account, and holds none of the policy's roles — after hierarchy
+     * expansion, in the scope of that account. Checked AFTER {@link TARGET_NOT_AUTHORIZED}, so a person
+     * naming a tenant they do not belong to is recorded as that, not as a person short of a role.
+     */
+    ProviderOperationDenialReason["INSUFFICIENT_ROLES"] = "insufficient_roles";
+})(ProviderOperationDenialReason || (ProviderOperationDenialReason = {}));
 /**
  * Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly
  * one of these per refusal, and a SOC dashboard groups by it.
@@ -747,6 +1266,20 @@ export function describeAuditVocabulary(lead, meanings) {
  */
 export var ResourceOperationDenialReason;
 (function (ResourceOperationDenialReason) {
+    /**
+     * The application requires consent purposes before it may be used
+     * (`compliance.serviceConsentRequirement`), and this person has not granted them (#534). The person is
+     * authenticated and may hold every role the operation needs; what is missing is their own decision.
+     * Distinct from every role/scope reason, because the remedy is the person's choice, not an administrator's.
+     */
+    ResourceOperationDenialReason["SERVICE_CONSENT_REQUIRED"] = "service_consent_required";
+    /**
+     * ONE operation declared the purpose its own processing rests on
+     * (`ResourceOperationConsentGateDeclaration`), and this person has not granted it (#1258 Step 3).
+     * Distinct from {@link SERVICE_CONSENT_REQUIRED}: only this operation was refused, never the whole
+     * application.
+     */
+    ResourceOperationDenialReason["CAPABILITY_CONSENT_REQUIRED"] = "capability_consent_required";
     /**
      * No initiator identity or roles on the execution context. Fail-closed: the authorizer refuses
      * rather than assuming an anonymous caller.
@@ -813,6 +1346,81 @@ export var ResourceOperationDenialReason;
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
      */
     ResourceOperationDenialReason["APPLICATION_WIDE_ELEVATION_MISSING"] = "application_wide_elevation_missing";
+    /**
+     * The caller tried to GRANT authority it does not itself hold — a privilege-escalation attempt,
+     * refused by the role-ceiling gate (`assertRequestedRolesWithinCallerCeiling`).
+     *
+     * Its own member rather than {@link INSUFFICIENT_ROLES}, for the same reason
+     * {@link APPLICATION_WIDE_ELEVATION_MISSING} is: the caller PASSED the operation's role check —
+     * an `ORG_ADMIN` really may update a membership — and was refused on the CONTENT of the write.
+     * Folding the two together would make the single refusal an access review most wants to see
+     * indistinguishable from the everyday "you are not an admin", and a reviewer asking "has anyone
+     * tried to escalate?" would have nothing to count.
+     *
+     * Uniquely among the members here, the row carries {@link
+     * AuditableEvent_ResourceOperationDenied_EventDataSchema.escalatedRoles} — the roles that were
+     * actually asked for. `requiredRoles` and `initiatorRoles` cannot express it: neither is the set
+     * the caller tried to confer on somebody else.
+     *
+     * Raised OUTSIDE the authorization phase — the gate runs in custom-implementation prefixes, after
+     * the authorizer has returned — so it does not reach `classifyAuthorizationDenial`. The gate emits
+     * it directly through the same chokepoint, keeping the dedup window, the logarithmic escalation
+     * ladder and the loss counters.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an attempt to grant authority the caller does
+     * not hold is refused AND recorded.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["ROLE_CEILING_EXCEEDED"] = "role_ceiling_exceeded";
+    /**
+     * A high-impact action was refused because the operation ITSELF demands a fresh re-proof of
+     * identity (`requiresStepUpAuthentication`), and the caller presented none.
+     *
+     * The caller is authenticated and may hold every role the operation needs. What is missing is a
+     * ceremony, so this belongs with {@link SERVICE_CONSENT_REQUIRED} rather than with
+     * {@link INSUFFICIENT_ROLES}: the remedy is an act by the same person, not a grant by an
+     * administrator.
+     *
+     * Paired with {@link STEP_UP_REQUIRED_BY_FRESHNESS} for the reason the two consent members are
+     * paired — the missing thing is the same and the party that DEMANDED it is not, and the two read
+     * very differently in a review. A burst of these is somebody repeatedly attempting an action the
+     * application has declared dangerous; a burst of the other is sessions ageing out.
+     *
+     * Raised OUTSIDE the authorization phase, like {@link ROLE_CEILING_EXCEEDED}: the step-up gate is
+     * a private check at the services-registry tier that throws without passing through the
+     * authorizer, so it reaches no `classifyAuthorizationDenial`. It emits through the same chokepoint
+     * instead, keeping the dedup window, the escalation ladder and the loss counters.
+     *
+     * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a refused high-impact action is
+     * recorded, not merely refused.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["STEP_UP_REQUIRED_BY_OPERATION"] = "step_up_required_by_operation";
+    /**
+     * The same refusal, demanded by the USER TYPE's freshness policy (`UserTypeAuthPolicy.stepUpAuth`)
+     * rather than by the operation: the caller's authentication is older than the declared maximum age.
+     *
+     * Distinct from {@link STEP_UP_REQUIRED_BY_OPERATION} because the two send a reviewer to different
+     * places — one to the operation's own declaration, the other to the user-type policy — and because
+     * only this one varies with how long a person has been signed in. The refusal's own error context
+     * already carried the distinction before either was audited; this keeps it in the durable record.
+     *
+     * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["STEP_UP_REQUIRED_BY_FRESHNESS"] = "step_up_required_by_freshness";
+    /**
+     * A service firm's expert was refused in a CLIENT organization because the client organization type's
+     * authentication policy asks for a factor the session has not satisfied FOR THAT CLIENT (#1633).
+     *
+     * Distinct from the two above because the party that demanded the proof is a third one: not the operation, not the
+     * expert's own user type, but the TENANT the expert is working in. A reviewer reading the client's trail sees its
+     * own policy being enforced on outside staff; the row carries the relationship through the usual attribution.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["STEP_UP_REQUIRED_BY_CLIENT_ORGANIZATION_POLICY"] = "step_up_required_by_client_organization_policy";
 })(ResourceOperationDenialReason || (ResourceOperationDenialReason = {}));
 /** SSO configuration change type. */
 export var SsoConfigChangeType;
@@ -880,7 +1488,32 @@ export var MachineAccessOperation;
     MachineAccessOperation["A2A_TASKS_LIST"] = "a2a_tasks_list";
     MachineAccessOperation["MCP_TOOLS_LIST"] = "mcp_tools_list";
     MachineAccessOperation["MCP_TOOLS_CALL"] = "mcp_tools_call";
+    /**
+     * A MACHINE principal's READ / LIST / SEARCH on a DECLARED cross-tenant REST door
+     * (`admitsCrossTenantPlatformAdministration`) — today the application audit-log door.
+     *
+     * Deliberately NOT every REST call a machine makes: the plain resource API is audited per operation
+     * through `RESOURCE_OPERATION_PERFORMED`, which carries `machineCredentialId`. These three exist because a
+     * declared crossing's only other row, `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, is written per TENANT REACHED —
+     * so a machine read returning only application-wide rows, or nothing, left no row naming who read (#297).
+     * One member per verb, like the A2A task members: a LIST enumerates, a READ fetches a row somebody named.
+     */
+    MachineAccessOperation["API_READ"] = "api_read";
+    MachineAccessOperation["API_LIST"] = "api_list";
+    MachineAccessOperation["API_SEARCH"] = "api_search";
 })(MachineAccessOperation || (MachineAccessOperation = {}));
+const API_READ_MACHINE_ACCESS_OPERATIONS = {
+    [CoreResourceOperation.READ]: MachineAccessOperation.API_READ,
+    [CoreResourceOperation.LIST]: MachineAccessOperation.API_LIST,
+    [CoreResourceOperation.SEARCH]: MachineAccessOperation.API_SEARCH,
+};
+/**
+ * The MACHINE_ACCESS identifier for an executed REST read, or `undefined` for any verb that is not one.
+ * The one place the core-operation → audit-vocabulary mapping lives, so a recorder never spells it.
+ */
+export function resolveApiReadMachineAccessOperation(operation) {
+    return operation === undefined ? undefined : API_READ_MACHINE_ACCESS_OPERATIONS[operation];
+}
 export const AuditableEventTypeSchema = z.union([
     z.enum(CoreAuditableEventType),
     z.string()
@@ -1011,9 +1644,9 @@ export const AuditableEvent_MachineAccess_EventDataSchema = z.object({
      * single authorization axis; recorded so a SIEM sees the authority the access ran under.
      */
     roles: z.array(z.string()).optional(),
-    /** ResourceServerKind of the surface accessed: `a2a` | `mcp`. */
+    /** ResourceServerKind of the surface accessed: `a2a` | `mcp` | `api` (a declared cross-tenant REST read). */
     resourceServer: z.string(),
-    /** The resource-server audience / agent endpoint / systemRef the token was bound to and hit. */
+    /** A2A/MCP: the resource-server audience / agent endpoint / systemRef hit. `api`: the resource type read. */
     resourceIdentifier: z.string().optional(),
     /** Normalised MachineAccessOperation value (e.g. `a2a_message_send`, `mcp_tools_call`). */
     operationIdentifier: z.string(),
@@ -1263,6 +1896,15 @@ export const AuditableEvent_OrganizationMember_RoleChangedEventDataSchema = z.ob
     /** Which write path produced the change — the operation identifier (`create`, `update`, …). */
     operation: z.string(),
     changedBy: z.string(),
+    /**
+     * The actor's stated reason, on the paths that REQUIRE one — today `grantOwnership`, the
+     * platform-tier repair door that crosses into a tenant the caller is not a member of. There the
+     * justification is the whole control: no downstream check can second-guess an operator acting
+     * outside the tenant, so the record of WHY is what makes the crossing accountable. It was required
+     * on the request and discarded at the service boundary until #593. Absent on `create` / `update`,
+     * which collect none. Bounded by the request DTO (1000 characters).
+     */
+    justification: z.string().optional(),
 });
 /**
  * Per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.
@@ -1470,6 +2112,104 @@ export const AuditableEvent_Organization_UpdatedEventDataSchema = z.object({
     changes: z.record(z.string(), z.any()),
     updatedBy: z.string(),
 });
+/**
+ * WHY an organization was assigned the type it now carries, when no person chose it.
+ *
+ * A closed vocabulary, deliberately named rather than implied: the assignment is only defensible because the answer
+ * was DERIVED, and a reader of the audit row must be able to see which derivation produced it without re-deriving
+ * the application's configuration — or its membership rows — as they stood at that boot. The two members answer
+ * from different evidence, which is exactly why a single "derived" value would not do: one is a fact about the
+ * DECLARATION and stays true however the tenant changes, the other is a fact about the ORGANIZATION on one day.
+ */
+export var OrganizationTypeAssignmentBasis;
+(function (OrganizationTypeAssignmentBasis) {
+    /**
+     * The application declares exactly one organization type, so an organization whose type resolves to nothing —
+     * none stored, or one the declaration no longer carries — can only be that type: it is the only policy the
+     * application has. Nothing is guessed, and nothing about the organization was read.
+     */
+    OrganizationTypeAssignmentBasis["SOLE_DECLARED_TYPE"] = "sole_declared_type";
+    /**
+     * The application declares several organization types, and exactly one of them covers every user type held by
+     * this organization's own members — so the others are types this organization cannot be. Nothing is guessed: it
+     * is the coverage test the first-administrator organization's type is already derived by, asked of the members.
+     *
+     * Narrower than {@link SOLE_DECLARED_TYPE} in what it proves. It reports the answer for the membership as it
+     * stood at that boot; an organization whose members later span two declared types would not derive again. That is
+     * why the row records the basis rather than only the outcome — a reviewer asking "could this have been wrong?"
+     * needs to know which question was answered.
+     */
+    OrganizationTypeAssignmentBasis["MEMBER_USER_TYPES"] = "member_user_types";
+    /**
+     * An operator promoted this organization to the one that OWNS the application, through
+     * `organizations.promoteToOwnerOrganization` (#1054).
+     *
+     * The odd one out of the three, and deliberately kept in the same event rather than given its own.
+     * What the event records is "this organization's `type` changed, and here is what decided it" — true
+     * of all three — and an access reviewer asking "how did this tenant come to be typed this way?" must
+     * find one row wherever the answer lies, not two events they have to know to look for separately.
+     *
+     * What differs is everything a derivation does not have: there IS an actor (the audit row carries
+     * them, and {@link AuditableEvent_Organization_TypeAssignedEventData.justification} carries their
+     * stated reason), the previous type is always present, and the decision was a human's. A row
+     * carrying this basis is the only one on which `justification` may appear — the other two are
+     * derivations, and a derivation has nothing to justify.
+     */
+    OrganizationTypeAssignmentBasis["OPERATOR_PROMOTION"] = "operator_promotion";
+})(OrganizationTypeAssignmentBasis || (OrganizationTypeAssignmentBasis = {}));
+/**
+ * An organization whose type resolved to nothing — none stored, or one no longer declared — was assigned one by the
+ * engine at boot.
+ *
+ * ## Why this is its own event rather than an `ORGANIZATION_UPDATED`
+ *
+ * An organization's type is not a label. It decides which user types its members hold, which authentication
+ * methods they may use, and which step-up policy applies to them — so assigning one changes what every member of
+ * that tenant can do at sign-in. Folded into a generic `changes` map it would be an authentication-relevant
+ * change with no actor, filed where an access review does not look.
+ *
+ * ## Who the actor is, per basis
+ *
+ * For the two DERIVATIONS there is none, and that is the point: organizations minted before the type was required
+ * (the platform's own seeds, the first-administrator bootstrap) were typeless, and the engine repairs them before
+ * the first read that would refuse them. `basis` is what makes that repair legible as a derivation instead of a
+ * write nobody made, and those rows carry no `userId` because the application-scope repair has no initiator.
+ *
+ * For {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION} there IS one. It rides where every other
+ * operator action's actor does — on the audit ROW, resolved from the execution context — rather than as a field
+ * here, so an access review reads it the same way it reads a suspension or an ownership grant. What this schema
+ * adds for that basis is the one thing the row cannot carry: the operator's stated REASON (`RESOURCE_OPERATION_PERFORMED`
+ * carries no request payload, which is how `grantOwnership`'s required justification went unrecorded for months — #593).
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an authentication-relevant attribute of a tenant changed, and the
+ * record says what decided it and, when a person did, who and why.
+ */
+export const AuditableEvent_Organization_TypeAssignedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED),
+    organizationId: z.string(),
+    /** The declared organization type now stored on the row, shown as its word (`system_enums.OrganizationType.<type>`). */
+    organizationType: z.string().systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE),
+    /**
+     * The type the row stored before, when it stored one the configuration no longer declares. Absent for an organization
+     * that had no type. Recorded because this assignment REPLACES a value someone once chose: a type removed from the
+     * declaration by mistake is recovered from exactly this field.
+     */
+    previousType: z.string().optional(),
+    basis: z.enum(OrganizationTypeAssignmentBasis),
+    /**
+     * The operator's stated reason, on the ONE basis that has a person behind it —
+     * {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION}, whose `requestDto` requires it.
+     *
+     * Optional on the schema because the two derivation bases have nothing to justify: a required field
+     * would force the boot repair to invent a sentence, and an invented justification is worse than an
+     * absent one — it reads as a decision somebody made.
+     *
+     * Recorded HERE rather than left on the request because a required field nothing stores is a promise
+     * nobody keeps, and `RESOURCE_OPERATION_PERFORMED` (which the CRITICAL promotion also emits) carries
+     * no request payload.
+     */
+    justification: z.string().optional(),
+});
 export const AuditableEvent_Organization_DeletedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETED),
     organizationId: z.string(),
@@ -1618,13 +2358,14 @@ export const AuditableEvent_Organization_ActivatedEventDataSchema = z.object({
  */
 export const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknown());
 /**
- * The application's authored authentication policy changed between two boots.
+ * The application's authored authentication or audit-viewer admission policy changed between two boots.
  *
  * The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout
  * requirements) is STATIC application configuration authored in code and taken into effect at backend
  * startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is a
  * security-posture decision that, before this event, left no product-side record: only the source
- * history showed it. This event closes that gap.
+ * history showed it. This event closes that gap. The effective `auditTrail.applicationReadAccess`
+ * posture is recorded separately from the user-type snapshots and compared independently.
  *
  * It is emitted at boot, by the system, when the resolved policy snapshot differs from the last one
  * recorded in the trail (detected by comparing against the most recent event of this type for the
@@ -1642,28 +2383,15 @@ export const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknow
  */
 export const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED),
-    /*
-     * NO `applicationId` HERE — removed 2026-09-09, and the removal is the fix for a real defect.
-     *
-     * The row this payload rides on ALREADY carries `applicationId` as its scope column, injected by
-     * the repository's write-path enrichment from the writer's own execution context. A second copy in
-     * the payload could only ever agree with it or contradict it, and it contradicted it: the boot
-     * emitter had no application id to hand — `appIdentity.applicationId` is merged in for the FRONTEND
-     * projection only — so it passed `appIdentity.appName`, the SLUG, into both. Measured on the
-     * dogfood trail: 2,175 rows carried the correct id and this event's one row carried `wonder-todos`,
-     * which made it reachable through no API, on the door built for exactly that population (#317).
-     *
-     * Dropping the field is what makes the two-copies question unaskable, rather than answering it
-     * again per emitter. Nothing read it: no SIEM projection, no OCSF mapping, no consumer. Old stored
-     * rows keep parsing — `z.object` strips an unknown key rather than refusing it — so the change is
-     * a shrink with no migration.
-     */
-    /** Which user types' policies differed from the previously-recorded snapshot. Sorted, non-empty. */
+    // The owning application identity lives on the audit row, resolved by the shared writer before
+    // database/SIEM/immutable-sink fanout. It is not duplicated inside this policy payload.
+    /** Which user types' policies differed. Sorted; empty when only the audit-viewer access posture changed. */
     changedUserTypes: z.array(z.string()),
     /**
      * A stable digest of the `after` snapshot. Boot change-detection compares the current digest
      * against the digest carried by the most recent recorded event of this type; equal digests are the
-     * signal to emit nothing, so the trail carries one row per genuine change, not one per boot.
+     * authentication-policy comparison. Audit-viewer access is compared independently; equal digests
+     * alone do not suppress an access-policy change.
      */
     snapshotDigest: z.string(),
     /**
@@ -1673,6 +2401,15 @@ export const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.obj
     before: z.record(z.string(), ApplicationAuthPolicySnapshotSchema).nullable(),
     /** The per-user-type policy snapshot that took effect at this boot. Keys are user-type identifiers. */
     after: z.record(z.string(), ApplicationAuthPolicySnapshotSchema),
+    /**
+     * Effective audit-viewer access posture, separately typed from authentication user types.
+     * Absent on historical events predating this evidence. A null before means no prior recorded
+     * policy is known, not that an earlier deployment was strict or role based.
+     */
+    auditApplicationReadAccess: z.object({
+        before: z.enum(AuditApplicationReadAccess).nullable(),
+        after: z.enum(AuditApplicationReadAccess),
+    }).optional(),
 });
 /**
  * A governed lifecycle transition changed a subject's `status`.
@@ -1747,6 +2484,7 @@ export const AuditableEvent_OrganizationUnit_UpdatedEventDataSchema = z.object({
 });
 // SSO Authentication Event Data Schemas
 export const AuditableEvent_User_SSOLoginEventDataSchema = z.object({
+    assurance: ExternalAssuranceAssessmentSchema.optional(),
     eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN),
     userId: z.string(),
     email: z.email(),
@@ -1787,6 +2525,7 @@ export const AuditableEvent_User_SSOLoginEventDataSchema = z.object({
     }
 });
 export const AuditableEvent_User_SSOLoginFailedEventDataSchema = z.object({
+    assurance: ExternalAssuranceAssessmentSchema.optional(),
     eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN_FAILED),
     email: z.email().optional(),
     providerRef: z.string().optional(),
@@ -1799,15 +2538,46 @@ export const AuditableEvent_User_SSOLoginFailedEventDataSchema = z.object({
     ipAddress: z.string(),
     userAgent: z.string(),
 });
+/**
+ * A sign-in was refused because the claiming scope requires SSO (#1242).
+ *
+ * `organizationId` was REQUIRED here, and that is what made the event unemittable at half its own
+ * refusal sites: `enforcement.requireSSO` lives on the POLYMORPHIC SSO config, so an APPLICATION-scope
+ * policy refuses sign-ins for the application itself and there is no organization to name. Requiring
+ * one would have left exactly those refusals with no trail — the outcome this CRITICAL event exists to
+ * prevent. It now carries either scope and refuses anything but exactly one, following
+ * `EMERGENCY_ACCESS_USED`, which was widened for the same reason on the same config.
+ *
+ * `attemptedProviderRef` and `attemptedConnectionType` are OPTIONAL because two of the four refusal
+ * sites have no attempted provider at all: a password sign-in and a registration are refused BECAUSE
+ * no SSO was attempted. Requiring them would have forced a placeholder, and a placeholder in an
+ * audit row is worse than an absent field — it is a fact nobody can distinguish from a real one.
+ */
 export const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED),
     email: z.email(),
-    attemptedProviderRef: z.string(),
-    attemptedConnectionType: z.enum(SsoConnectionType),
-    organizationId: z.string(),
+    attemptedProviderRef: z.string().optional(),
+    attemptedConnectionType: z.enum(SsoConnectionType).optional(),
+    scopeType: z.enum(AuthScopeType),
+    organizationId: z.string().optional(),
+    applicationId: z.string().optional(),
     enforcementPolicy: z.string(),
     ipAddress: z.string(),
     userAgent: z.string(),
+}).superRefine((event, ctx) => {
+    const hasOrganizationScope = event.scopeType === AuthScopeType.ORGANIZATION
+        && event.organizationId !== undefined
+        && event.applicationId === undefined;
+    const hasApplicationScope = event.scopeType === AuthScopeType.APPLICATION
+        && event.applicationId !== undefined
+        && event.organizationId === undefined;
+    if (!hasOrganizationScope && !hasApplicationScope) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['scopeType'],
+            message: 'SSO-enforcement-blocked events require exactly one explicit tenant scope',
+        });
+    }
 });
 export const AuditableEvent_User_TokenRefreshedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.USER_TOKEN_REFRESHED),
@@ -1825,13 +2595,33 @@ export const AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema
     affectedProviderRef: z.string().optional(),
     changes: z.record(z.string(), z.any()).optional(),
 });
-export const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z.object({
-    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED),
+/**
+ * The fields every SIEM export-configuration event carries; three kinds share them (#986) and differ
+ * only in what they SAY happened, which is what a SIEM rule keys on.
+ */
+const SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS = {
     organizationId: z.string(),
     changedBy: z.string(),
     changeType: z.enum(SiemExportChangeType),
+    /** The destination HOST only — a collector secret can live in the URL path, and this row is immutable. */
     webhookUrlDomain: z.string().optional(),
     eventFormatConfigured: z.string().optional(),
+    /** NAMES of the configuration fields the write changed; never their values (the credential is among them). */
+    changedFields: z.array(z.string()).optional(),
+};
+export const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED),
+    ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,
+});
+/** Export turned OFF (#986). Same fields; its own kind so it classifies CRITICAL. */
+export const AuditableEvent_Organization_SIEMExportDisabledEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED),
+    ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,
+});
+/** Export re-pointed at another destination (#986). Same fields; its own kind so it classifies WARNING. */
+export const AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED),
+    ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,
 });
 // Organization Provider Credential Event Data Schemas
 //
@@ -1845,7 +2635,8 @@ export const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z
 //
 // ## Why a provider ref and a slug, and nothing about the value
 //
-// A reader needs to know WHICH authority moved. `providerRef` + `secretSlug` say that completely.
+// A reader needs to know WHICH authority moved. `connectionRef` + `secretSlug` say that completely — the
+// stored credential's key (#1670) — and `providerRef` says which ref the act went through.
 // A fingerprint of the value was considered and rejected: it is a stable oracle for confirming a
 // guessed secret, so it would put a verification oracle into the one store designed never to
 // forget.
@@ -1859,6 +2650,13 @@ export const AuditableEvent_OrganizationProviderCredential_SetEventDataSchema =
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     /** The acting administrator. Absent only on a system-initiated write, which none exists today. */
     setBy: z.string().optional(),
@@ -1877,6 +2675,13 @@ export const AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchem
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     rotatedBy: z.string().optional(),
     credentialId: z.string(),
@@ -1899,10 +2704,29 @@ export const AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema =
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
+    /**
+     * The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several
+     * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.
+     */
+    providerPackageName: z.string().optional(),
     secretSlug: z.string(),
     resolvedFrom: z.enum(ProviderCredentialResolutionSource),
     /** Absent when `resolvedFrom` is the deployment environment — there is no row to name. */
     credentialId: z.string().optional(),
+    /**
+     * WHOSE credential was spent: the member who set it. For a USER-delegated organization connection
+     * that is the person whose own vendor account every member's call acts through — the vendor
+     * attributes the act to them, so the trail must too (decision on wildo-ai/wildo-ai#18). Absent for
+     * a deployment-environment resolution, and for a row set with no recorded member.
+     */
+    credentialSetByUserId: z.string().optional(),
 });
 /**
  * The grant ended — by the tenant removing it, or by the tenant itself being purged.
@@ -1917,10 +2741,34 @@ export const AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchem
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     deletedBy: z.string().optional(),
     credentialId: z.string(),
     reason: z.enum(ProviderCredentialDeletionReason),
+    /**
+     * What telling the VENDOR achieved, when the delete ended an OAuth2 grant (#545).
+     *
+     * Deleting our copy stops the application using a token; it does not end the grant at the vendor,
+     * and a refresh token frequently never expires on its own. So this field is the difference between
+     * a trail that says "we deleted our copy" and one that says whether the person's access was
+     * actually withdrawn where it lives.
+     *
+     * Written by EVERY door that destroys a credential: the revoke doors (#545), and since #1711 the
+     * cascade observers for a subject erasure, a hard delete of the user row, the invitation sweep and an
+     * organization purge — each reads the token out of the pre-deletion row the cascade hands over. ABSENT
+     * only on a row written before #1711, when the cascades attempted nothing. `not_declared` is the
+     * ordinary answer for a vendor whose revocation is not RFC 7009-shaped, and for a pasted credential that
+     * was never a grant; it is a recorded fact, not a failure. There is no retry: the token existed only in
+     * the destroyed row, so this value is the whole record.
+     */
+    vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),
 });
 /**
  * A PERSON connected their own account at a third party to this application.
@@ -1943,6 +2791,13 @@ export const AuditableEvent_UserProviderCredential_SetEventDataSchema = z.object
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     credentialId: z.string(),
 });
@@ -1954,9 +2809,12 @@ export const AuditableEvent_UserProviderCredential_SetEventDataSchema = z.object
  *
  * `grantedScopes` is what the VENDOR said it issued, not what was asked for. The two differ often
  * enough to matter: a vendor may narrow a request against what the account is permitted, and the
- * answer to "what could this application actually do as them" is the granted set. Optional because
- * several vendors return no scope at all on a token response, and an empty array would assert
- * something stronger than silence.
+ * answer to "what could this application actually do as them" is the granted set. Since #1671 it is the
+ * set the stored grant RECORDS after this authorization: a token answer without `scope` granted what was
+ * requested (RFC 6749 §5.1), and a re-authorization of a vendor that accumulates consent unites the new
+ * answer with the previous consent (`consentAccumulated`). Optional because a grant may record none, and an
+ * empty array would assert something stronger than silence.
+ * spec-cite: RFC 6749 §5.1 (the `scope` row of the access token response).
  *
  * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party
  * delegated access, and the authorization's extent is recorded with it.
@@ -1965,6 +2823,18 @@ export const AuditableEvent_UserProviderConnection_GrantedEventDataSchema = z.ob
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
+    /**
+     * The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several
+     * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.
+     */
+    providerPackageName: z.string().optional(),
     secretSlug: z.string(),
     credentialId: z.string(),
     grantedScopes: z.array(z.string()).optional(),
@@ -1982,6 +2852,17 @@ export const AuditableEvent_UserProviderConnection_GrantedEventDataSchema = z.ob
      * which is exactly the sequence worth being able to see.
      */
     replacedExistingConnection: z.boolean(),
+    /**
+     * Present when this authorization GREW an existing grant (#1671): the scopes the re-authorization was started to
+     * add, the operation whose refusal offered it and the package whose code that operation is (an opted-in
+     * augmentation's, or the ref's own). `addedForOperationId` is as the start request named it; the scopes were
+     * checked against the connection's ceiling. `consentAccumulated` says whether the stored granted set was united
+     * with the previous consent (a vendor that accumulates consent) or replaced by a restated authorization.
+     */
+    addedScopes: z.array(z.string()).optional(),
+    addedForOperationId: z.string().optional(),
+    addedForPackageName: z.string().optional(),
+    consentAccumulated: z.boolean().optional(),
 });
 /**
  * An ORGANIZATION's delegated authorization toward a vendor was granted.
@@ -2000,12 +2881,37 @@ export const AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchem
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
+    /**
+     * The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several
+     * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.
+     */
+    providerPackageName: z.string().optional(),
     secretSlug: z.string(),
     credentialId: z.string(),
     grantedByUserId: z.string().optional(),
     grantedScopes: z.array(z.string()).optional(),
     accountRef: z.string().optional(),
     replacedExistingConnection: z.boolean(),
+    /**
+     * On whose behalf the linked account acts. `user` means `grantedByUserId` linked THEIR OWN vendor
+     * account for the organization, and every member's call will act through it (decision on
+     * wildo-ai/wildo-ai#18) — which is why the grantor is named and the acknowledgement below recorded.
+     */
+    delegation: z.enum(ExternalProvider_Connection_DelegationMode).optional(),
+    /** The grantor acknowledged, before consenting at the vendor, that the whole organization will use their account. */
+    organizationWideUseAcknowledged: z.boolean().optional(),
+    /** See the person's event: the re-authorization that grew the grant (#1671). */
+    addedScopes: z.array(z.string()).optional(),
+    addedForOperationId: z.string().optional(),
+    addedForPackageName: z.string().optional(),
+    consentAccumulated: z.boolean().optional(),
 });
 /**
  * The stored VALUE changed for a person's credential that already existed.
@@ -2021,6 +2927,13 @@ export const AuditableEvent_UserProviderCredential_RotatedEventDataSchema = z.ob
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     credentialId: z.string(),
     /** When the value it replaced was set — how long the retired secret was live. */
@@ -2041,30 +2954,74 @@ export const AuditableEvent_UserProviderCredential_UsedEventDataSchema = z.objec
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
+    /**
+     * The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several
+     * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.
+     */
+    providerPackageName: z.string().optional(),
     secretSlug: z.string(),
     resolvedFrom: z.enum(ProviderCredentialResolutionSource),
     credentialId: z.string(),
 });
 /**
- * The person's grant ended — by them removing it, or by their own erasure.
+ * The person's grant ended — by them removing it, by their own erasure, or by their account being deleted.
  *
  * `reason` matters more here than on the organization sibling. A credential removed by a cascade
  * from a subject-erasure request is EVIDENCE that the erasure reached this store, and it is the
  * evidence an operator produces when asked whether a person's third-party keys were destroyed. The
  * row itself is gone by then, so the event is all that remains.
  *
+ * `deletedBy` exists for the one reason whose actor is NOT the person: `reason: USER_DELETED`, an
+ * account deletion (#1016) — an administrator's hard delete or the invitation sweep reaping a pending
+ * user — where it names the deleting principal (the administrator's user id, or the `SYSTEM` sentinel).
+ * Absent on the owner's own revoke, whose actor is `userId` by construction.
+ *
  * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority
  * was withdrawn.
- * assurance-control: WILDO.PRIVACY.ERASURE — evidence that erasure destroyed the subject's
- * third-party credentials.
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — evidence that erasure destroyed the
+ * subject's third-party credentials: one row per destroyed credential with `reason: USER_ERASED`,
+ * written by the credential resource's parent-cascade removal observer because the erasure cascade
+ * removes these rows through the raw repository (#975).
  */
 export const AuditableEvent_UserProviderCredential_DeletedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
+    deletedBy: z.string().optional(),
     credentialId: z.string(),
     reason: z.enum(ProviderCredentialDeletionReason),
+    /**
+     * What telling the VENDOR achieved, when the delete ended an OAuth2 grant (#545).
+     *
+     * Deleting our copy stops the application using a token; it does not end the grant at the vendor,
+     * and a refresh token frequently never expires on its own. So this field is the difference between
+     * a trail that says "we deleted our copy" and one that says whether the person's access was
+     * actually withdrawn where it lives.
+     *
+     * Written by EVERY door that destroys a credential: the revoke doors (#545), and since #1711 the
+     * cascade observers for a subject erasure, a hard delete of the user row, the invitation sweep and an
+     * organization purge — each reads the token out of the pre-deletion row the cascade hands over. ABSENT
+     * only on a row written before #1711, when the cascades attempted nothing. `not_declared` is the
+     * ordinary answer for a vendor whose revocation is not RFC 7009-shaped, and for a pasted credential that
+     * was never a grant; it is a recorded fact, not a failure. There is no retry: the token existed only in
+     * the destroyed row, so this value is the whole record.
+     */
+    vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),
 });
 // Outbound M2M Webhook Event Data Schemas
 /**
@@ -2097,17 +3054,225 @@ export const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema = z.ob
     /** `jti` of the signed probe, for correlation with the consumer's own logs. */
     signatureJti: z.string(),
 });
-// SCIM Directory Provisioning Event Data Schemas
-export const AuditableEvent_SCIM_TokenCreatedEventDataSchema = z.object({
-    eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_CREATED),
-    organizationId: z.string(),
-    tokenDisplayName: z.string(),
-    createdByUserId: z.string(),
-    expiresAt: z.string().optional(),
-    ipAddress: z.string(),
-    userAgent: z.string(),
+// Inbound Delivery Event Data Schemas (#1596)
+//
+// None of these carries the payload, a header value or an error message: the payload is the sender's
+// data (routinely a client's personal data) and lives on the delivery row, which is erased with its
+// organization. The trail names the delivery and says what happened to it.
+const InboundDeliveryAuditBase = {
+    sourceKind: z.enum(InboundSourceKind),
+    /** `{providerRef}:{endpointKey}`, `app` for an application endpoint. */
+    sourceKey: z.string(),
+};
+export const AuditableEvent_InboundDelivery_RejectedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_REJECTED),
+    ...InboundDeliveryAuditBase,
+    reason: z.enum(InboundDeliveryRejectionReason),
+    /**
+     * How many identical refusals (same source, same reason) this row records. Refusals are aggregated to
+     * one row per source and reason per minute, so a flood of unsigned requests cannot grow the audit trail
+     * without bound: the first refusal of a window is written at once (1), and the ones folded after it are
+     * written when the window closes, as one row carrying their count. Summing `refusalCount` over the rows
+     * gives the number of refusals — no row is counted twice. The one count that can be lost is the window
+     * open when the backend process stops.
+     */
+    refusalCount: z.number().int().positive(),
 });
-export const AuditableEvent_SCIM_TokenRevokedEventDataSchema = z.object({
+export const AuditableEvent_InboundDelivery_AcceptedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    resolvedScopeKind: z.enum(InboundResolvedScopeKind),
+    organizationId: z.string().optional(),
+    /**
+     * The channel and how well the sender was known when the delivery was accepted (#1630, I8) — the record
+     * of what a handler's work was triggered by. Identification only: the handler's roles are its declared
+     * `actingRoles` whatever this says. Never the sender's address.
+     */
+    channel: z.enum(InboundChannelKind),
+    senderAssurance: z.enum(InboundSenderAssurance),
+});
+export const AuditableEvent_InboundDelivery_UnroutableEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    reason: z.enum(InboundDeliveryUnroutableReason),
+});
+export const AuditableEvent_InboundDelivery_ProcessedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    attempt: z.number().int().positive(),
+});
+export const AuditableEvent_InboundDelivery_FailedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_FAILED),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    attempt: z.number().int().positive(),
+    /** A classification (an error type or reference), never an error message. */
+    errorCode: z.string(),
+    nextAttemptAt: z.date(),
+});
+export const AuditableEvent_InboundDelivery_DeadEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_DEAD),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    attempts: z.number().int().positive(),
+    errorCode: z.string(),
+});
+export const AuditableEvent_InboundDelivery_ReplayedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    replayedBy: z.string(),
+    /** The operator's written reason — free text, so this event's bag is SUBJECT_DETAIL for export. */
+    justification: z.string(),
+});
+// Inbound Channel Event Data Schemas (#1630). Ids and named outcomes only — never an address, a subject
+// or a body: the correspondence lives in its thread and channel record, erasable there.
+export const AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE),
+    channel: z.enum(InboundChannelKind),
+    /** The handler selected for the message, whose minimum it did not meet. */
+    handlerRef: z.string(),
+    senderAssurance: z.enum(InboundSenderAssurance),
+    minimumSenderAssurance: z.enum(InboundSenderAssurance),
+    disposition: z.enum(InboundBelowMinimumDisposition),
+    /** For `ROUTED_TO_BELOW_MINIMUM_HANDLER`: the handler that received it instead, and its delivery. */
+    belowMinimumHandlerRef: z.string().optional(),
+    inboundDeliveryId: z.string().optional(),
+    /** The channel's id for the message (the provider message id for email). */
+    channelMessageId: z.string(),
+    organizationId: z.string(),
+});
+const InboundReplyAuditBase = {
+    channel: z.enum(InboundChannelKind),
+    threadId: z.string(),
+    conversationMessageId: z.string(),
+    submissionId: z.string(),
+};
+export const AuditableEvent_InboundReply_SentEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_SENT),
+    ...InboundReplyAuditBase,
+    templateRef: z.string(),
+    recipientCount: z.number().int().positive(),
+    /** True when the provider reported it had already accepted this submission — a retried send, not a second email. */
+    deduplicated: z.boolean(),
+});
+export const AuditableEvent_InboundReply_FailedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_FAILED),
+    ...InboundReplyAuditBase,
+    /** A classification, never an error message. */
+    failureCode: z.string(),
+});
+export const AuditableEvent_InboundReplyToken_RevokedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED),
+    threadId: z.string(),
+    replyTokenId: z.string(),
+    reason: z.enum(ReplyTokenRevocationReason),
+});
+export const AuditableEvent_InboundReplyToken_DowngradedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED),
+    threadId: z.string(),
+    replyTokenId: z.string(),
+    reason: z.enum(ReplyTokenDowngradeReason),
+    /** The level the message was given instead of `THREAD_TOKEN_BOUND`. */
+    derivedAssurance: z.enum(InboundSenderAssurance),
+});
+// Receiving Email Event Data Schemas (#1600). A domain and a client mailbox address are an ORGANIZATION's
+// infrastructure, not a person's data, so they are named. A received message is named by its row id only:
+// its sender, subject and filenames live in the `inboundEmails` row, erasable there.
+const OrganizationEmailDomainAuditBase = {
+    organizationId: z.string(),
+    organizationEmailDomainId: z.string(),
+    domain: z.string(),
+};
+export const AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED),
+    ...OrganizationEmailDomainAuditBase,
+    sending: z.boolean(),
+    receiving: z.boolean(),
+});
+export const AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED),
+    ...OrganizationEmailDomainAuditBase,
+    providerRef: z.string(),
+    providerDomainId: z.string(),
+});
+export const AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED),
+    ...OrganizationEmailDomainAuditBase,
+    /** What the provider answered: VERIFIED, FAILED, or still PROVIDER_PENDING (its verification is asynchronous). */
+    status: z.enum(OrganizationEmailDomainStatus),
+});
+export const AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED),
+    ...OrganizationEmailDomainAuditBase,
+    reason: z.enum(OrganizationEmailDomainSuspensionReason),
+});
+export const AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED),
+    ...OrganizationEmailDomainAuditBase,
+    trigger: z.enum(OrganizationEmailDomainRemovalTrigger),
+    /** Whether a provider domain existed and was deleted there (false for a claim that never proved ownership). */
+    providerDomainDeleted: z.boolean(),
+});
+/**
+ * A client mailbox links two organizations, so the event is written to BOTH trails: the firm that owns the mailbox,
+ * and the client whose organization it routes mail into. `organizationId` is the trail the row is in.
+ */
+const ClientMailboxAuditBase = {
+    organizationId: z.string(),
+    clientMailboxId: z.string(),
+    address: z.string(),
+    emailDomainId: z.string(),
+    serviceProviderRelationshipId: z.string(),
+    /** The firm that owns the domain and the mailbox. */
+    firmOrganizationId: z.string(),
+    /** The client organization the mailbox routes into. */
+    clientOrganizationId: z.string(),
+};
+export const AuditableEvent_ClientMailbox_CreatedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.CLIENT_MAILBOX_CREATED),
+    ...ClientMailboxAuditBase,
+});
+export const AuditableEvent_ClientMailbox_RemovedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.CLIENT_MAILBOX_REMOVED),
+    ...ClientMailboxAuditBase,
+});
+export const AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD),
+    organizationId: z.string(),
+    inboundEmailId: z.string(),
+    reason: z.enum(InboundEmailWithheldReason),
+    /** The stored (quarantined) file, when one was stored. */
+    fileId: z.string().optional(),
+});
+export const AuditableEvent_InboundEmail_RejectedLimitEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT),
+    organizationId: z.string(),
+    inboundEmailId: z.string(),
+    limit: z.enum(InboundEmailLimit),
+    sizeBytes: z.number().int().nonnegative(),
+    attachmentCount: z.number().int().nonnegative(),
+});
+// SCIM Directory Provisioning Event Data Schemas
+export const AuditableEvent_SCIM_TokenCreatedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_CREATED),
+    organizationId: z.string(),
+    tokenDisplayName: z.string(),
+    createdByUserId: z.string(),
+    expiresAt: z.string().optional(),
+    ipAddress: z.string(),
+    userAgent: z.string(),
+});
+export const AuditableEvent_SCIM_TokenRevokedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_REVOKED),
     organizationId: z.string(),
     tokenDisplayName: z.string(),
@@ -2190,6 +3355,18 @@ export const AuditableEvent_User_RegisteredEventDataSchema = z.object({
     email: z.string(),
     ipAddress: z.string(),
     userAgent: z.string(),
+    /**
+     * HOW the account was acquired — the same vocabulary the registration policy is authored in, so "who
+     * registered through which door" is answered by the trail rather than reconstructed from neighbouring
+     * events. A first social or enterprise sign-in creates an account exactly as `/auth/register` does, and
+     * until #1141 only the password door recorded it.
+     *
+     * Optional on the schema only because rows written before the field existed carry none; every emitter
+     * states it (`logUserRegistered` requires it).
+     */
+    acquisitionChannel: z.enum(RegistrationAcquisitionChannel).optional(),
+    /** The external identity provider that vouched for the account, for a social or enterprise sign-in. */
+    providerRef: z.string().optional(),
 });
 export const AuditableEvent_User_EmailVerifiedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.USER_EMAIL_VERIFIED),
@@ -2545,7 +3722,8 @@ export const AuditableEvent_FieldAccess_EventDataSchema = z.object({
  *
  * ## Correlation across a cascade
  *
- * Every execution surface emits — API, internal call, and repository-only — so one tenant deletion
+ * The framework-managed lane covers API, internal call and repository-only writes; OVERRIDE_ALL
+ * implementations own their committed emission. A framework-managed tenant deletion
  * produces one row per cascaded child. The top-level `correlationId` is inherited by every sub-call
  * context and preserved across mid-flight operation corrections, so it groups the whole fan-out to one request;
  * `subCallDepth` separates the initiating operation (0) from what it cascaded into.
@@ -2554,7 +3732,8 @@ export const AuditableEvent_FieldAccess_EventDataSchema = z.object({
  *
  * `changedFields` names every field the write touched — a field NAME is not personal data, so it is
  * always safe and always recorded. `fieldEvidence` carries before/after VALUES only for fields the
- * schema marks `.isAuditEvidence()`.
+ * schema marks `.isAuditEvidence()`. The separate `reason` records an explicitly selected operator
+ * justification, not an arbitrary request payload or a copy of a mutable resource reason field.
  *
  * Values are limited on purpose: audit rows replicate to the per-org SIEM and to the immutable
  * ledger, and **the immutable ledger cannot be scrubbed** — so copying arbitrary personal data into
@@ -2584,10 +3763,26 @@ export const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.objec
     /** `true` for the bulk form, whose subject is a set rather than one row. */
     isBulkOperation: z.boolean().optional(),
     // ── Subject ──
-    /** The row acted on. Absent for bulk operations, which name a count instead. */
+    /** The row acted on. Absent for bulk operations, whose subject is the set below. */
     resourceId: z.string().optional(),
     /** Bulk operations only: how many rows the write affected. */
     affectedRecordCount: z.number().optional(),
+    /**
+     * Bulk operations only: WHICH rows the write affected.
+     *
+     * A count answers "how much"; a trail has to answer "what". Without this, one actor changing
+     * forty rows left a single record saying `affectedRecordCount: 40` and naming none of them — so
+     * the question an investigator asks first, "who changed THIS row", had no answer for any write
+     * that was not single-row, which is exactly the case where one actor touches many records at once.
+     *
+     * Bounded by the batch maximum a synchronous bulk already enforces, so this is a complete list
+     * rather than a sample: the background lane does not produce it at all, because it runs the
+     * single-row twin per id and each row audits itself.
+     *
+     * Rides `eventData`, which the audit store persists as an unparsed record — so naming the rows
+     * costs no column and no migration.
+     */
+    affectedResourceIds: z.array(z.string()).optional(),
     // ── Principal (the row's `userId` / `organizationId` / `applicationId` carry the identity) ──
     /**
      * The caller's roles AS THEY WERE at decision time. Roles are the framework's single
@@ -2604,6 +3799,12 @@ export const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.objec
     /** `0` for the operation the caller invoked; deeper for what it cascaded into. */
     subCallDepth: z.number(),
     // ── Effect ──
+    /**
+     * Operator justification explicitly selected from the request by the operation's audit contract.
+     * Historical evidence, independent of mutable resource fields such as cancellationReason.
+     * It is not inferred from arbitrary request fields and must not contain secrets.
+     */
+    reason: z.string().optional(),
     /** Every field the write touched. Names only — always safe, always recorded. */
     changedFields: z.array(z.string()).optional(),
     /**
@@ -2727,6 +3928,101 @@ export const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.objec
  * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION
  * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.
  */
+/**
+ * The fields both legal-hold events carry: which hold, which tenant, what it covers and on what ground.
+ * The `justification` / `releaseReason` prose is NOT carried — it is free text most likely to name a third
+ * party, and it stays on the hold row, which the tenant and the operator can read.
+ */
+const LegalHoldAuditEventFields = {
+    holdId: z.string(),
+    heldOrganizationId: z.string(),
+    scopeKind: z.enum(LegalHoldScopeKind),
+    legalGround: z.enum(LegalHoldGround),
+    placementTier: z.enum(LegalHoldPlacementTier),
+    /** `RESOURCE_ROWS` only. */
+    heldResourceType: z.string().optional(),
+    /** `RESOURCE_ROWS` only: how many rows the hold lists (absent = every row of the resource type). */
+    heldRowCount: z.number().int().min(0).optional(),
+    /** `DATA_SUBJECT` only. */
+    subjectUserId: z.string().optional(),
+};
+/** A legal hold was placed (#1634). */
+export const AuditableEvent_LegalHoldPlaced_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.LEGAL_HOLD_PLACED),
+    ...LegalHoldAuditEventFields,
+    placedByUserId: z.string(),
+});
+/**
+ * A model-cost period aggregate was linked to its invoice (#1598). Identifiers, the period and the currency
+ * only: no amount (the aggregate row holds it), no personal data.
+ */
+export const AuditableEvent_ModelCostAggregateInvoiceLinked_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED),
+    aggregateId: z.string(),
+    /** The tenant whose cost the aggregate records, and whose invoice it is. */
+    billedOrganizationId: z.string(),
+    /** First instant of the aggregate's calendar month (UTC), ISO. */
+    periodStart: z.string(),
+    currency: z.string(),
+    organizationInvoiceRefId: z.string(),
+    /** The administrator (or the billing flow's principal) who linked it. */
+    linkedByUserId: z.string().optional(),
+});
+/** An organization's content-capture setting changed (#1599). The setting, never any content. */
+export const AuditableEvent_CorrectionCaptureSettingChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED),
+    settingOrganizationId: z.string(),
+    /** `metadata_only` / `with_content`, before and after. */
+    previousContentCapture: z.string().optional(),
+    contentCapture: z.string(),
+    /** Whether a purpose is stated (the purpose text is on the setting row, not on the trail). */
+    purposeStated: z.boolean(),
+    contentReaderRole: z.string().optional(),
+    narrowedToCaseCount: z.number().int().min(0),
+    changedByUserId: z.string().optional(),
+});
+/** An organization's evaluation-export authorisation changed (#1599). The basis and counts, never case identities. */
+export const AuditableEvent_EvaluationExportAuthorizationChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED),
+    authorizationOrganizationId: z.string(),
+    status: z.string(),
+    previousStatus: z.string().optional(),
+    /** Absent when the authorisation holds none (NOT_GRANTED). */
+    basis: z.string().optional(),
+    clientConsentCount: z.number().int().min(0),
+    excludedCaseCount: z.number().int().min(0),
+    changedByUserId: z.string().optional(),
+});
+/** An evaluation dataset was exported (#1599). The ledger row names every record; the trail names the export. */
+export const AuditableEvent_EvaluationDatasetExported_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EVALUATION_DATASET_EXPORTED),
+    exportId: z.string(),
+    exportOrganizationId: z.string(),
+    agentRef: z.string(),
+    basis: z.string(),
+    recordCount: z.number().int().min(0),
+    windowFrom: z.string(),
+    windowTo: z.string(),
+    destination: z.string(),
+    exportedByUserId: z.string().optional(),
+});
+/** An evaluation-dataset export was refused (#1599 I7). */
+export const AuditableEvent_EvaluationDatasetExportRefused_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED),
+    exportOrganizationId: z.string(),
+    agentRef: z.string(),
+    /** Why: no authorisation recorded, or it is revoked. */
+    reason: z.enum(EvaluationDatasetExportRefusalReason),
+    attemptedByUserId: z.string().optional(),
+});
+/** A legal hold was released (#1634). */
+export const AuditableEvent_LegalHoldReleased_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.LEGAL_HOLD_RELEASED),
+    ...LegalHoldAuditEventFields,
+    releasedByUserId: z.string(),
+    /** How long the hold was in force, so a reviewer sees the suspension window without a join. */
+    heldForSeconds: z.number().int().min(0),
+});
 export const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE),
     /** Which transition this row records. */
@@ -2766,6 +4062,243 @@ export const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.obj
     decidedByUserId: z.string().optional(),
     /** Their stated reason, when they gave one. */
     decisionReason: z.string().optional(),
+    /**
+     * The machine credential an application-wide grant is bound to, when it is (#297). Present on EVERY transition
+     * of such a grant, so the second administrator's signature and every later reader see which credential the
+     * elevation reaches — a request naming a machine must never read, in the trail, as the requester's own window.
+     */
+    grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),
+});
+/**
+ * One transition in the life of a service-provider relationship (#1597).
+ *
+ * Read it to answer "which firm could reach this tenant, under what scope, since when — and who decided".
+ * Written once to the CLIENT's trail and once to the FIRM's: the same facts, each organization reading
+ * them in its own tenant. `purpose` and `decisionReason` are free text people typed, so they are carried
+ * for the tenants' own trails and are NOT exported to a SIEM by default.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING
+ */
+export const AuditableEvent_ServiceProviderRelationshipLifecycle_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE),
+    transition: z.enum(ServiceProviderRelationshipTransition),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    resultingStatus: z.enum(ServiceProviderRelationshipStatus),
+    /** The role the relationship confers after this transition. */
+    role: z.string(),
+    /** Its scope after this transition; empty ⇒ organization-wide. */
+    organizationUnitIds: z.array(z.string()),
+    endsAt: z.date().optional(),
+    proposedByOrganizationId: z.string(),
+    /** The person who acted, and on which side. Absent for the expiry sweep. */
+    actorUserId: z.string().optional(),
+    actorOrganizationId: z.string().optional(),
+    purpose: z.string().optional(),
+    decisionReason: z.string().optional(),
+    /** How the firm's experts are admitted after this transition (#1612) — what `EXPERT_ADMISSION_POLICY_CHANGED` changed. */
+    expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional(),
+});
+/** A firm machine client admitted into / removed from a client organization under a relationship (#1597, S3). */
+export const AuditableEvent_ServiceProviderMachineClientAdmissionChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED),
+    admitted: z.boolean(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    oauthClientId: z.string(),
+    actorUserId: z.string().optional(),
+});
+/** An expert assigned to a client relationship by their firm (#1597). */
+export const AuditableEvent_ServiceProviderExpertAssigned_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED),
+    assignmentId: z.string(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    expertUserId: z.string(),
+    actorUserId: z.string().optional(),
+});
+/** An expert's assignment to a client relationship ended by their firm (#1597). */
+export const AuditableEvent_ServiceProviderExpertUnassigned_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED),
+    assignmentId: z.string(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    expertUserId: z.string(),
+    actorUserId: z.string().optional(),
+});
+/**
+ * The facts every per-expert approval event carries (#1612). Identical in the client's and the firm's trail — which
+ * is why none of them names the client administrator who answered: the firm reads its copy, and the decider is on
+ * the decision's own `human_decision_resolved` row in the CLIENT's trail, joined by `decisionRef`.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING
+ */
+const ServiceProviderExpertApprovalEventShape = {
+    /** The human decision this approval is — the key that joins every row about it. */
+    decisionRef: z.string().trim().min(1),
+    assignmentId: z.string(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    expertUserId: z.string(),
+};
+/** A firm's assignment now waits for the client's approval (#1612). Actor: the firm administrator who assigned. */
+export const AuditableEvent_ServiceProviderExpertApprovalRequested_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED),
+    ...ServiceProviderExpertApprovalEventShape,
+    /** The policy that made the assignment wait — the client's, read at assignment time. */
+    expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy),
+    /** The role the expert would receive. */
+    role: z.string(),
+    actorUserId: z.string().optional(),
+});
+/** The client approved, and the expert was admitted (#1612). */
+export const AuditableEvent_ServiceProviderExpertApprovalGranted_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED),
+    ...ServiceProviderExpertApprovalEventShape,
+    role: z.string(),
+});
+/** The expert was not admitted (#1612). */
+export const AuditableEvent_ServiceProviderExpertApprovalDenied_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED),
+    ...ServiceProviderExpertApprovalEventShape,
+    denialReason: z.enum(ServiceProviderExpertApprovalDenialReason),
+});
+/** Nobody answered in time (#1612). */
+export const AuditableEvent_ServiceProviderExpertApprovalLapsed_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED),
+    ...ServiceProviderExpertApprovalEventShape,
+});
+/**
+ * The facts of one delegated capability grant (#1631), identical in the client's and the firm's trail: which
+ * capability, lent through which relationship, until when.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ */
+const ServiceProviderCapabilityGrantEventShape = {
+    grantId: z.string(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    capability: z.enum(DelegatedAdministrativeCapability),
+    /** Whether only an owner could lend it — the CRITICAL rows. */
+    securityCritical: z.boolean(),
+    endsAt: z.date(),
+    /** The client person who acted. Absent when the relationship's end revoked it with nobody acting. */
+    actorUserId: z.string().optional(),
+};
+/** A capability was lent (#1631). */
+export const AuditableEvent_ServiceProviderCapabilityGranted_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED),
+    ...ServiceProviderCapabilityGrantEventShape,
+});
+/** A lent capability was revoked (#1631). */
+export const AuditableEvent_ServiceProviderCapabilityRevoked_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED),
+    ...ServiceProviderCapabilityGrantEventShape,
+    /** True when the relationship's ending revoked it, rather than a client administrator. */
+    byRelationshipEnd: z.boolean(),
+    /**
+     * Why it ended (#1631 review F10): a client administrator revoked it, the relationship ended, or the relationship was
+     * narrowed to organization units (which no capability can be carried by). Tells a narrowing apart from a manual
+     * revocation, which `byRelationshipEnd` alone cannot.
+     */
+    endCause: z.enum(ServiceProviderCapabilityGrantEndCause).optional(),
+    /** How many standing credentials the firm had obtained under the grant were ended with it (review F2). */
+    endedCredentials: z.number().int().nonnegative().optional(),
+});
+/** A client's decision about trusting a firm's identity provider's MFA on one relationship (#1633). */
+export const AuditableEvent_ServiceProviderMfaTrustChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    previousProviderMfaTrust: z.enum(ServiceProviderMfaTrust),
+    providerMfaTrust: z.enum(ServiceProviderMfaTrust),
+    actorUserId: z.string().optional(),
+});
+/**
+ * A factor recorded on an expert's session for one client organization (#1633).
+ *
+ * Names the factor and its SOURCE, never the proof itself. `identityProviderOrganizationId` is present exactly when
+ * the source is the firm's trusted identity provider.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+ */
+export const AuditableEvent_ServiceProviderClientAuthenticationSatisfied_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED),
+    organizationId: z.string(),
+    relationshipId: z.string(),
+    providerOrganizationId: z.string(),
+    expertUserId: z.string(),
+    factor: z.enum(AuthMethod),
+    source: z.enum(FactorSatisfactionSource),
+    identityProviderOrganizationId: z.string().optional(),
+});
+/** A firm's decision about collecting activity metadata on its own experts' client work (#1632). */
+export const AuditableEvent_ServiceProviderActivityFeedDecided_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED),
+    providerOrganizationId: z.string(),
+    previousStatus: z.enum(ServiceProviderActivityFeedStatus),
+    status: z.enum(ServiceProviderActivityFeedStatus),
+    acknowledgedWorkerConsultationNotice: z.boolean(),
+    actorUserId: z.string().optional(),
+});
+/** A client's decision about how much a firm's activity feed may say about work in it (#1632). */
+export const AuditableEvent_ServiceProviderActivityFeedDisclosureChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    previousActivityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure),
+    activityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure),
+    actorUserId: z.string().optional(),
+});
+/**
+ * One transition in the life of a system-of-record partition assignment.
+ *
+ * Read it to answer "who could see this remote company, and when did that start or stop". The row
+ * names both units on a move, so a timeline reconstructed from these events is complete without
+ * joining anything: each row carries the state it left as well as the state it reached.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ */
+export const AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE),
+    /** Which transition this row records. */
+    transition: z.enum(SystemOfRecordPartitionAssignmentTransition),
+    /** The assignment row, so its whole timeline can be reassembled. */
+    assignmentId: z.string(),
+    /** The declared instance — `systemsOfRecord.<name>`. Instance, never vendor: two Odoo deployments have unrelated company ids. */
+    system: z.string(),
+    /** The partition's key as the remote spells it, in canonical text. */
+    remoteKey: z.string(),
+    /**
+     * The unit the partition belongs to AFTER this transition.
+     *
+     * Absent exactly when the transition is `UNASSIGNED` — there is no resulting unit, and writing the
+     * departed one here would make an unassignment read as an assignment to the unit that lost it.
+     */
+    organizationUnitId: z.string().optional(),
+    /**
+     * The unit the partition belonged to BEFORE this transition.
+     *
+     * Present on `REASSIGNED` and `UNASSIGNED`, absent on `ASSIGNED`. This is the field the automatic
+     * `RESOURCE_OPERATION_PERFORMED` row cannot carry, and the reason this event type exists.
+     */
+    previousOrganizationUnitId: z.string().optional(),
+    /** The operator's stated reason. Recorded on every transition, not only the first. */
+    justification: z.string().optional(),
+    /** The operator who made the change. */
+    assignedByUserId: z.string().optional(),
 });
 export const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS),
@@ -2813,6 +4346,12 @@ export const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.
     initiatorRoles: z.array(z.string()),
     /** How the call was initiated — separates a human operator from framework machinery. */
     executionType: z.enum(ExecutionContext_ExecutionType),
+    /**
+     * The credential that read, when the reader is a MACHINE. A machine has no `userId`, so without this the
+     * row names no reader at all — an assurance collector's reads would be unattributable in the very trail it
+     * measures, and could not be told apart from its own earlier runs (#297). Absent for a human operator.
+     */
+    machineCredential: ExecutionContext_MachineCredentialSchema.optional(),
 });
 /**
  * An application-wide directory enumeration.
@@ -2900,6 +4439,30 @@ export const AuditableEvent_ResourceOperationDenied_EventDataSchema = z.object({
      * the operation's config as it stood that day.
      */
     requiredRoles: z.array(z.string()).optional(),
+    /**
+     * The roles the caller tried to GRANT and could not — present only on
+     * {@link ResourceOperationDenialReason.ROLE_CEILING_EXCEEDED}.
+     *
+     * A third set, distinct from both of its neighbours and not expressible by either: `requiredRoles`
+     * is what the OPERATION demanded of the caller, `initiatorRoles` is what the caller HELD, and this
+     * is what the caller attempted to confer on somebody else. It is the whole content of an
+     * escalation attempt — "an ORG_ADMIN asked for ORG_OWNER" — and without it the row says only that
+     * a ceiling was hit.
+     *
+     * Only the REFUSED subset is recorded, not the whole requested array: the roles the caller was
+     * entitled to grant are not evidence of anything, and the difference is what a reviewer reads.
+     */
+    escalatedRoles: z.array(z.string()).optional(),
+    /**
+     * The surface the person called, when the refusal happened on one that is NOT a resource operation — a
+     * manual-controller route (`GET /api/v1/charts/:chartId/data`) or a WebSocket event (`badge:get`).
+     *
+     * On such a surface the operation fields above name only the context it was authorized under (an
+     * application read), which on its own cannot tell a chart from a feature resolution (#534 third review L3).
+     * Absent on a resource operation, whose operation fields already ARE the surface. Carries a route TEMPLATE
+     * where one is known, so the trail records which door was refused rather than which row was asked for.
+     */
+    refusedSurface: z.string().optional(),
     /**
      * The caller's roles AS THEY WERE at decision time — empty when the refusal WAS the absence of
      * them ({@link ResourceOperationDenialReason.MISSING_INITIATOR}).
@@ -2969,6 +4532,58 @@ export const AuditableEvent_RetainedDataAccess_EventDataSchema = z.object({
     organizationId: z.string().optional(),
     ipAddress: z.string().optional(),
 });
+/**
+ * A person met a governed document, and this is the release they met.
+ *
+ * `interaction` is the composed record from `composeGovernedDocumentInteraction`, which has already
+ * refused anything the release does not permit and marked anything the workflow has not finished.
+ * It is nested rather than flattened so there is ONE shape for a governed-document interaction — a
+ * second, flatter copy here would be a second thing to keep in step with the release vocabulary.
+ *
+ * The SUBJECT is the audit envelope's own actor attribution plus `userId` here, never a third
+ * spelling inside the record; see the interaction schema's JSDoc for why.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD
+ */
+export const AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED),
+    /**
+     * The identified person who met the document. Absent exactly when `anonymousUserId` is present
+     * (#1258 Step 5) — a signed-in registrant or an already-identified reader has one; a visitor
+     * reading a public notice before ever creating an account does not.
+     */
+    userId: z.string().optional(),
+    /**
+     * The pre-identity visitor who met the document, when nobody is signed in (#1258 Step 5).
+     * `AnonymousUser._id` / `ExecutionContext.anonymousUserId` — the same identity Step 1's consent
+     * carry is keyed on, never a second visitor-identity concept.
+     */
+    anonymousUserId: z.string().optional(),
+    /** What they did, which release they did it to, and that release's standing at the time. */
+    interaction: GovernedDocumentInteractionSchema,
+    /**
+     * TRUE-but-unfinished notes carried from composition — today, that the release was UNAPPROVED.
+     *
+     * Recorded rather than discarded because an advisory is the only trace that the mechanism
+     * proceeded deliberately rather than by omission.
+     */
+    advisoryKinds: z.array(z.string()),
+    ipAddress: z.string().optional(),
+}).superRefine((event, context) => {
+    // Exactly one subject, never zero (a record naming nobody is not a record) and never both (two
+    // identities for one act is two different claims about who acted).
+    const hasUser = event.userId !== undefined;
+    const hasAnonymous = event.anonymousUserId !== undefined;
+    if (hasUser === hasAnonymous) {
+        context.addIssue({
+            code: 'custom',
+            path: hasUser ? ['anonymousUserId'] : ['userId'],
+            message: hasUser
+                ? 'a governed-document interaction names both userId and anonymousUserId — exactly one subject met the document'
+                : 'a governed-document interaction names neither userId nor anonymousUserId — a record must name who met the document',
+        });
+    }
+});
 /**
  * A DATA SUBJECT EXPORT — the compliance record of the framework assembling everything it holds
  * about one person and disclosing it.
@@ -3016,6 +4631,13 @@ export const AuditableEvent_SubjectDataExport_EventDataSchema = z.object({
     fieldsWithheldAsNonDisclosable: z.array(z.string()),
     /** Tenant scope, when the export ran org-scoped. */
     organizationId: z.string().optional(),
+    /**
+     * Whether the application declares its subject-data recipients (#1710) — `declared` or `not-declared`. The value an
+     * evidence collector tallies: an export answering Art. 15(1)(c) from a declaration, versus one that could not.
+     */
+    recipientsStatus: z.enum(SubjectDataRecipientsStatementStatus),
+    /** The recipients (provider refs) the export named for this subject, sorted. Systems of record are accounted on their own lane. */
+    recipientRefs: z.array(z.string().trim().min(1)),
 });
 /**
  * A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.
@@ -3052,7 +4674,7 @@ export const AuditableEvent_CollectionDataExport_EventDataSchema = z.object({
     resourceType: z.string().trim().min(1),
     /** The LIST/SEARCH operation whose result set was exported. */
     sourceOperationIdentifier: z.string().trim().min(1),
-    /** `csv` | `json` — the rendered wire format. */
+    /** The rendered wire format — a `ResourceCollectionExportFormat` value (`csv`, `json` or `pdf`). */
     format: z.string().trim().min(1),
     /** `visible_page` | `full_result_set` — see the docstring; this is the field that matters most. */
     rowScope: z.string().trim().min(1),
@@ -3108,12 +4730,149 @@ export const AuditableEvent_ProviderOperationCall_EventDataSchema = z.object({
     status: z.number().int().optional(),
     /** Present when the call failed, naming the failure KIND rather than the vendor's prose. */
     failureKind: z.string().optional(),
+    /**
+     * The `requiredScopes` verdict (#979) — present only when the operation declares required scopes. `not_recorded`
+     * is the one to read twice: the call went out without its scopes being checked.
+     */
+    scopeCheck: z.enum(ProviderOperationScopeCheck).optional(),
+    /** The required scopes the grant lacked — present with `scopeCheck: missing`. Scope names only, never a token. */
+    missingScopes: z.array(z.string()).optional(),
     /** The REAL initiating user — absent only for genuine machine/internal executions. */
     initiatorUserId: z.string().optional(),
     /** The execution type that acted, for the machine/internal cases. */
     executionType: z.string().optional(),
     /** The tenant the REQUEST was scoped to — see `connectionOwnerScope`. */
     organizationId: z.string().optional(),
+    /**
+     * The package that CONTRIBUTED this operation when it is not the provider's own (#1672) — an augmentation
+     * an application opted into, adding operations to a provider it does not own. Absent for an operation the
+     * provider's own module declares.
+     *
+     * The question it answers is the one a shared grant raises: when a call spends a connection the base
+     * provider owns, whose code wrote the request? Without it a reviewer sees the base ref and cannot tell the
+     * base's own operation from a third party's.
+     */
+    augmentationPackage: z.string().optional(),
+    /** The installed version of {@link augmentationPackage}, as `wildo config sync` recorded it. */
+    augmentationPackageVersion: z.string().optional(),
+    /**
+     * The CONNECTION whose grant the call spent (#1725) — the declared base of a shared connection, or the ref itself.
+     * On a shared connection `providerRef` names only the ref the call went THROUGH; this names the grant.
+     */
+    connectionRef: z.string().optional(),
+    /** The npm package that owns `providerRef` — whose code the call ran, when several packages share one grant. */
+    providerPackageName: z.string().optional(),
+    /**
+     * The resource AUDIENCE whose token was attached (#1725) — `graph`, `dataverse` — when the connection's grant spans
+     * several resources. Absent for a provider that mints one token for one resource.
+     */
+    tokenAudience: z.string().optional(),
+    /**
+     * What the call's RATE BUDGETS cost it (#1729). A vendor's allowance belongs to the connection (and, where the vendor
+     * counts per account, to the account it spends), so every call names the budgets it drew on — keys only, never a
+     * count of anyone's traffic — how long it waited for room, and whether the count was the deployment's SHARED one or
+     * this process's alone. On a refusal, `exhaustedBudgetKey` names the budget that was still full: an exhausted
+     * allowance is visible here instead of arriving as a vendor `429`.
+     */
+    rateBudget: z.object({
+        budgetKeys: z.array(z.string()),
+        counting: z.enum(RateBudgetCounting),
+        waitedMs: z.number().nonnegative(),
+        exhaustedBudgetKey: z.string().optional(),
+    }).optional(),
+});
+/**
+ * The backend CALLED a vendor to discharge an engine capability (#1712) — see the enum member for why this is
+ * neither a catalogue operation call nor a record about the data's subject.
+ *
+ * One event per PHYSICAL call the egress controls, on the success and the failure path. The granularity is the
+ * egress's own act: one email submission, one SMS, one storage verb, one billing adapter call. A billing adapter
+ * call that pages through a list may make several HTTP requests to the vendor under one row, as an agent turn does
+ * under one `providerCallRecords` row; the count is of the application's acts, not of the vendor's requests.
+ *
+ * No field names a subject — no recipient, number, file, customer or payload — so the schema, not a redaction
+ * step, is what keeps it out of the personal-data population.
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — records which vendor each capability reached,
+ * with what outcome, for every call the application made.
+ */
+export const AuditableEvent_ProviderCapabilityCall_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.PROVIDER_CAPABILITY_CALL),
+    /** The egress the call went out through. */
+    capability: z.enum(ProviderCapabilityEgress),
+    /** What it did. */
+    action: z.enum(ProviderCapabilityCallAction),
+    /**
+     * The vendor: the provider ref the capability resolved (`resend`, `twilio`, `stripe`), or, for file storage, the
+     * storage the file is kept in (`wildo_managed`, `google_drive`).
+     */
+    providerRef: z.string().trim().min(1),
+    /** The engine capability the egress served, when it serves several (email: transactional or marketing). */
+    engineCapability: z.string().optional(),
+    /** The billing adapter method, for {@link ProviderCapabilityCallAction.BILLING_OPERATION}. A method NAME, never its arguments. */
+    billingOperation: z.string().optional(),
+    outcome: z.enum(ProviderCapabilityCallOutcome),
+    /** HTTP status of the vendor's answer, when the egress observes one. */
+    status: z.number().int().optional(),
+    /**
+     * The failure KIND (an error type or a submission outcome), never the vendor's prose, which may quote the request. The
+     * recorder keeps it to an identifier-shaped token and replaces anything else with `unclassified`, so an SDK error
+     * that carried text in its code cannot put that text on the trail.
+     */
+    failureKind: z.string().optional(),
+    /** WHOSE account the call spent: `application` | `organization` | `user` — the vocabulary its siblings use. */
+    connectionOwnerScope: z.string().trim().min(1),
+    /**
+     * The owner's id; absent for the application's own account. For a person's Drive this is the file's LINKER, who may
+     * not be the reader — the reason this event exports at SUBJECT_DETAIL.
+     */
+    connectionOwnerId: z.string().optional(),
+    /** The REAL initiating user, when the egress runs under an execution context that has one. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that acted, when the egress runs under an execution context. */
+    executionType: z.string().optional(),
+    /** The tenant the call was made for, when the egress knows one (an email sent for an organization). */
+    organizationId: z.string().optional(),
+});
+/**
+ * The browser door REFUSED a provider operation (#367) — see the enum member for why this is not a
+ * failed call.
+ *
+ * Ids and shape only, like its call sibling: the request's `input` is never recorded. What the caller
+ * ASKED FOR is recorded even when it names nothing real, because a refusal records an attempt rather
+ * than proving the provider or operation exists.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ */
+export const AuditableEvent_ProviderOperationDenied_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.PROVIDER_OPERATION_DENIED),
+    denialReason: z.enum(ProviderOperationDenialReason),
+    /** The provider the request named. */
+    providerRef: z.string().trim().min(1),
+    /** The operation id the request named. */
+    operationId: z.string().trim().min(1),
+    /** The account the request asked to spend: `application` | `organization` | `user`. */
+    connectionOwnerScope: z.string().trim().min(1),
+    /** The owner's id, absent for an application-owned request. */
+    connectionOwnerId: z.string().optional(),
+    /** `service` | `user`, as requested. */
+    connectionDelegation: z.string().trim().min(1),
+    /**
+     * The roles the policy required — present on {@link ProviderOperationDenialReason.INSUFFICIENT_ROLES}
+     * and {@link ProviderOperationDenialReason.ROLES_NOT_APPLICABLE_TO_TARGET}.
+     */
+    requiredRoles: z.array(z.string()).optional(),
+    /**
+     * The roles the caller held IN THE SCOPE THAT WAS CHECKED, at decision time — present on
+     * {@link ProviderOperationDenialReason.INSUFFICIENT_ROLES}, so the row explains itself.
+     */
+    heldRoles: z.array(z.string()).optional(),
+    /** The refused person. Absent only on {@link ProviderOperationDenialReason.MISSING_USER_SESSION}. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that asked, which is what explains a missing user. */
+    executionType: z.string().optional(),
+    /** The tenant the REQUEST was scoped to. */
+    organizationId: z.string().optional(),
 });
 /**
  * An agent reached an MCP server — the outbound trail for a tool call that leaves the trust
@@ -3142,7 +4901,10 @@ export const AuditableEvent_McpToolCall_EventDataSchema = z.object({
     destinationHost: z.string().trim().min(1),
     /** The tool called. Absent when the attempt failed before any tool was chosen (discovery). */
     toolName: z.string().optional(),
-    /** The client's outcome kind — `ok`, `refused_target`, `unreachable`, `timed_out`, `protocol_error`, `tool_error`. */
+    /**
+     * The client's outcome kind — `ok`, `refused_target`, `unreachable`, `timed_out`, `protocol_error`, `tool_error`, or
+     * `rate_budget_exhausted` (the connection's rate budget stayed full; nothing was sent — #1938).
+     */
     outcome: z.string().trim().min(1),
     /**
      * WHOSE ACCOUNT the call spent: `user` | `organization`. Absent when no credential was resolved,
@@ -3154,6 +4916,12 @@ export const AuditableEvent_McpToolCall_EventDataSchema = z.object({
     connectionOwnerScope: z.string().optional(),
     /** The credential row that was spent, for the audit trail. */
     credentialId: z.string().optional(),
+    /**
+     * WHOSE credential it was: the member who set an organization credential. For an organization-lent
+     * member account (decision on wildo-ai/wildo-ai#18) that is the person the far server attributes the
+     * call to, captured at call time rather than joined later, since a reconnect moves it.
+     */
+    credentialSetByUserId: z.string().optional(),
     /** The REAL initiating user — absent only for genuine machine/internal executions. */
     initiatorUserId: z.string().optional(),
     /** The tenant the turn was scoped to — see `connectionOwnerScope`. */
@@ -3162,45 +4930,211 @@ export const AuditableEvent_McpToolCall_EventDataSchema = z.object({
     agentRef: z.string().optional(),
 });
 /**
- * A human approver AUTHORED the arguments an approval-gated tool ran with (#566).
- *
- * One row per MODIFIED approval — never per approval. See the enum member's docstring for why an
- * ordinary approval is not this event, and for why no argument VALUE appears in this schema.
- *
- * `proposedInputDigest` / `executedInputDigest` are the model SDK's own canonical input digests, the
- * same values its approval signature is computed over. That is what makes them evidence rather than
- * a convenience: a reader holding the executed call can recompute the second and see it match, and
- * the two differing is proof that the call which ran is not the call which was proposed — with no
- * copy of either payload on the trail.
- *
- * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records that an authorization
- * decision REWROTE the act it authorized, and who made it.
+ * The fields every human-decision event carries: which decision, on which plane, raised by which
+ * agent's work, routed how. Ids and names only (#1595 D5).
  */
-export const AuditableEvent_AgentToolApprovalModified_EventDataSchema = z.object({
-    eventType: z.literal(CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED),
-    /** The conversational execution whose turn was paused. */
+const HumanDecisionEventBaseShape = {
+    /** The one decision id (`HumanDecision_Request.decisionId`), shared by both planes and every row about this decision. */
+    decisionRef: z.string().trim().min(1),
+    /** The execution whose work is waiting — the conversational execution or the actor-system execution. */
     executionId: z.string().trim().min(1),
-    /** The pending decision's id — correlates this row with the pause and the resume in the logs. */
-    approvalId: z.string().trim().min(1),
-    /** The actor system the turn belongs to. */
-    systemRef: z.string().trim().min(1),
-    /** The agent whose declaration gated the tool, so a trail reads back to a configuration. */
-    agentRef: z.string().trim().min(1),
-    /** The approval-gated tool, as the model was shown it. */
-    toolName: z.string().trim().min(1),
-    /** Canonical digest of the arguments the MODEL proposed. */
-    proposedInputDigest: z.string().trim().min(1),
-    /** Canonical digest of the arguments that actually RAN. Differs from the above by construction. */
-    executedInputDigest: z.string().trim().min(1),
-    /**
-     * The argument NAMES the approver changed, sorted. Names only — a field name is not personal data,
-     * which is exactly why it is always safe and always recorded.
-     */
-    modifiedArgumentKeys: z.array(z.string()),
-    /** The approver. Absent never happens on this plane — only a present human can answer — but the envelope owns the field. */
-    approverUserId: z.string().optional(),
-    /** The tenant the turn was scoped to. */
+    plane: z.enum(HumanDecision_Plane),
+    /** The actor system the work belongs to. */
+    systemRef: z.string().trim().min(1).optional(),
+    /** The agent whose gate raised the decision. */
+    agentRef: z.string().trim().min(1).optional(),
+    /** The gated tool, when the decision is a tool approval. */
+    toolName: z.string().trim().min(1).optional(),
+    routeKind: z.enum(HumanDecision_RouteKind),
+    /** The route's eligible role — the floor every holder must meet. Absent for OWNER. */
+    routeEligibleRole: z.string().trim().min(1).optional(),
+    /** The tenant the decision is routed within. */
     organizationId: z.string().optional(),
+};
+/** A decision was raised. */
+export const AuditableEvent_HumanDecisionRequested_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_REQUESTED),
+    ...HumanDecisionEventBaseShape,
+    requesterKind: z.enum(HumanDecision_RequesterKind),
+    /** ASSIGNEE routes only: who it was routed to. */
+    assigneeUserId: z.string().optional(),
+    /** When answering is refused. Absent means the decision does not lapse. */
+    expiresAt: z.string().optional(),
+    /** #1628: the armed CLAIM deadline, and the clock it counts on. Absent on the actor plane before a host arms one. */
+    claimDeadlineAt: z.string().optional(),
+    claimClockBasis: z.enum(ReviewClockBasis).optional(),
+    /** #1628: the armed DECISION deadline, and the clock it counts on. */
+    decisionDeadlineAt: z.string().optional(),
+    decisionClockBasis: z.enum(ReviewClockBasis).optional(),
+});
+/** A decision ended. Exactly one per `decisionRef`. */
+export const AuditableEvent_HumanDecisionResolved_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_RESOLVED),
+    ...HumanDecisionEventBaseShape,
+    outcome: z.enum(HumanDecision_Outcome),
+    /** The person who decided. Absent for LAPSED and for a WITHDRAWN nobody answered. */
+    decidedByUserId: z.string().optional(),
+    /** The decider's roles in the decision's organization at the moment they decided. */
+    deciderRoles: z.array(z.string()).optional(),
+    /** The route role that admitted the decider (ROLE and ASSIGNEE routes). */
+    admittedByRouteRole: z.string().optional(),
+    /** ACCEPTED_WITH_MODIFICATIONS: the argument NAMES the decider changed, sorted. Never their values. */
+    modifiedArgumentNames: z.array(z.string()).default([]),
+    /** Whether the decider gave a reason. The reason itself stays in the transcript, not on the trail. */
+    reasonGiven: z.boolean(),
+    /** LAPSED only: a person who answered after the deadline, whose answer was therefore refused. */
+    lateDecisionUserId: z.string().optional(),
+    /** #1628: whether each armed service target was met. A clock that was never armed is absent, never guessed. */
+    deadlineOutcomes: z.partialRecord(z.enum(ReviewDeadlineKind), z.enum(ReviewDeadlineOutcome)).optional(),
+});
+/** A decision was moved — reassigned or escalated. */
+const HumanDecisionMoveShape = {
+    ...HumanDecisionEventBaseShape,
+    /** Who held it before the move. Absent when it moved off a ROLE route nobody had claimed. */
+    fromAssigneeUserId: z.string().optional(),
+    /** Who holds it now. */
+    toAssigneeUserId: z.string().trim().min(1),
+    /** The route version after the move; an answer read under an older version loses. */
+    routeVersion: z.number().int().nonnegative(),
+    /** Whether the mover gave a reason. The reason itself is not recorded here. */
+    reasonGiven: z.boolean(),
+};
+export const AuditableEvent_HumanDecisionReassigned_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_REASSIGNED),
+    ...HumanDecisionMoveShape,
+    /** #1628: a person's move, or a deadline's REASSIGN rule — so a rule-driven move is never read as a choice. */
+    trigger: z.enum(HumanDecision_RouteChangeTrigger),
+    /** ESCALATION_RULE only: the stage whose rule moved it. */
+    stage: z.enum(ReviewDeadlineStage).optional(),
+});
+export const AuditableEvent_HumanDecisionEscalated_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ESCALATED),
+    ...HumanDecisionMoveShape,
+    /** True when the target came from the gate's declared `escalateTo`, false when the escalator named it. */
+    toDeclaredTarget: z.boolean(),
+});
+/** A role-routed decision was claimed (`claimed: true`) or given back to its role (`claimed: false`). */
+export const AuditableEvent_HumanDecisionClaimed_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLAIMED),
+    ...HumanDecisionEventBaseShape,
+    claimed: z.boolean(),
+    /** The holder who claimed, or who gave it back. */
+    assigneeUserId: z.string().trim().min(1),
+    routeVersion: z.number().int().nonnegative(),
+});
+/** Someone tried to act on a decision and was refused. The decision is unchanged. */
+export const AuditableEvent_HumanDecisionAnswerRefused_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED),
+    ...HumanDecisionEventBaseShape,
+    act: z.enum(HumanDecision_Act),
+    reason: z.enum(HumanDecision_RefusalReason),
+    /** Who tried. Absent when the attempt carried no person at all (a machine principal). */
+    attemptedByUserId: z.string().optional(),
+});
+/** A CLAIM or DECISION deadline passed (#1628). The decision is unchanged and still answerable. */
+export const AuditableEvent_HumanDecisionDeadlineMissed_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED),
+    ...HumanDecisionEventBaseShape,
+    kind: z.enum(ReviewDeadlineKind),
+    /** The deadline that passed, after any pause was added to it. */
+    deadlineAt: z.string().trim().min(1),
+    basis: z.enum(ReviewClockBasis),
+});
+/**
+ * A deadline stage's rule fired (#1628). Ids and counts only: who was told is the route's candidates at
+ * that moment, recorded as a count so the row holds no list of people that would need scrubbing.
+ */
+export const AuditableEvent_HumanDecisionEscalationFired_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED),
+    ...HumanDecisionEventBaseShape,
+    stage: z.enum(ReviewDeadlineStage),
+    /** What the stage did. A REASSIGN whose target did not resolve, or could not answer, did NOTIFY instead. */
+    action: z.enum(ReviewEscalationActionKind),
+    /** Whether a REASSIGN rule was declared for this stage and attempted. */
+    reassignAttempted: z.boolean(),
+    /** REASSIGN attempted: whether its target resolved to someone who may answer. False: the decision did not move. */
+    targetResolved: z.boolean().optional(),
+    /** REASSIGN attempted and refused: why the resolved target may not answer (#1594 I8). */
+    targetRefusalReason: z.enum(HumanDecision_RefusalReason).optional(),
+    /** REASSIGN applied: who held it before (absent for an unclaimed ROLE route) and who holds it now. */
+    fromAssigneeUserId: z.string().optional(),
+    toAssigneeUserId: z.string().optional(),
+    /** REASSIGN applied: the route version after the move. */
+    routeVersion: z.number().int().nonnegative().optional(),
+    /** How many people were told. Zero is recorded, not hidden: it is the finding. */
+    recipientCount: z.number().int().nonnegative(),
+});
+/** A person stopped a decision's CLAIM and DECISION clocks (#1628). The lapse keeps running. */
+export const AuditableEvent_HumanDecisionClockPaused_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED),
+    ...HumanDecisionEventBaseShape,
+    /** The gate-declared pause state. An application identifier, never free text. */
+    pauseStateRef: z.string().trim().min(1),
+    pausedByUserId: z.string().trim().min(1),
+});
+/** A person restarted a decision's clocks (#1628); `pausedMs` was added to both service targets. */
+export const AuditableEvent_HumanDecisionClockResumed_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED),
+    ...HumanDecisionEventBaseShape,
+    pauseStateRef: z.string().trim().min(1),
+    resumedByUserId: z.string().trim().min(1),
+    /** How long this pause lasted, in wall-clock milliseconds. */
+    pausedMs: z.number().int().nonnegative(),
+});
+/**
+ * The fields every autonomous-agent binding event carries (#1611). Ids and refs only: an agent's
+ * instruction lives in the application's code, and a turn's input stays in its transcript.
+ */
+const AutonomousAgentBindingEventShape = {
+    /** The application-declared autonomous agent. */
+    autonomousAgentRef: z.string().trim().min(1),
+    /** The organization the agent may (or may no longer) act in. */
+    organizationId: z.string().trim().min(1),
+    /** The OAuth client whose authority the agent's turns carry. */
+    oauthClientId: z.string().trim().min(1),
+    principalSource: z.enum(AutonomousPrincipalSource),
+    /** RELATIONSHIP_ADMITTED_CLIENT only: the firm that owns the client. */
+    providerOrganizationId: z.string().trim().min(1).optional(),
+    /** RELATIONSHIP_ADMITTED_CLIENT only: the relationship whose admission carries it. */
+    serviceProviderRelationshipId: z.string().trim().min(1).optional(),
+};
+export const AuditableEvent_AutonomousAgent_BoundEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND),
+    ...AutonomousAgentBindingEventShape,
+});
+export const AuditableEvent_AutonomousAgent_UnboundEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND),
+    ...AutonomousAgentBindingEventShape,
+});
+/** The fields every autonomous-turn event carries: which agent, where, on which occurrence, started by what. */
+const AutonomousAgentTurnEventShape = {
+    autonomousAgentRef: z.string().trim().min(1),
+    organizationId: z.string().trim().min(1),
+    /** The schedule occurrence or the inbound delivery id. The same occurrence twice is one turn. */
+    occurrenceKey: z.string().trim().min(1),
+    trigger: z.enum(AutonomousTurnTrigger),
+    /** The case the turn was started for, when one was named. */
+    caseRef: WorkUnitRefSchema.optional(),
+};
+export const AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED),
+    ...AutonomousAgentTurnEventShape,
+    /** The conversational execution the turn runs in. Deterministic from the agent, organization and occurrence. */
+    executionId: z.string().trim().min(1),
+    systemRef: z.string().trim().min(1),
+    oauthClientId: z.string().trim().min(1),
+    principalSource: z.enum(AutonomousPrincipalSource),
+});
+export const AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED),
+    ...AutonomousAgentTurnEventShape,
+    reason: z.enum(AutonomousTurnRefusalReason),
+    /** OVER_BUDGET: the budget gate's own reason (exhausted, or unverifiable). */
+    budgetDenialReason: z.string().trim().min(1).optional(),
+    /** RUNTIME_REFUSED: the runtime's error code. */
+    runtimeErrorCode: z.string().trim().min(1).optional(),
+    /** The OAuth client, when one had been resolved before the refusal. */
+    oauthClientId: z.string().trim().min(1).optional(),
 });
 /**
  * Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in
@@ -3226,8 +5160,13 @@ export const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object(
     resourceType: z.string().trim().min(1),
     /** The read-family member executed: `read` | `list` | `count` | `search`. */
     operationIdentifier: z.string().trim().min(1),
-    /** The provider the binding resolves credentials/base-URL through (e.g. `odoo`). */
-    providerRef: z.string().trim().min(1),
+    /**
+     * The system-of-record INSTANCE the binding reads (`systemsOfRecord.<name>`, #1055). Was `providerRef`
+     * until #1679 found the emitters had sent `systemOfRecord` since #1055 while this schema still named the
+     * retired provider field — a trail whose declared shape and whose rows disagreed about the one field
+     * that says WHICH external system was reached.
+     */
+    systemOfRecord: z.string().trim().min(1),
     /** The remote entity (OData entity set / Odoo model / declared REST surface). */
     remoteEntityRef: z.string().trim().min(1),
     /** The transport dialect spoken (`odata` | `rest-json` | `odoo-jsonrpc`). */
@@ -3242,6 +5181,35 @@ export const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object(
     resourceId: z.string().optional(),
     /** Rows returned (list/search), or the count answered (count). Absent for a single READ. */
     rowCount: z.number().int().nonnegative().optional(),
+    /*
+     * ── A PIPELINE RUN's extras (`operationIdentifier: 'externalDataPipelineRun'`) ─────────────
+     *
+     * The run service has emitted `rejectedRows` and `completedPass` since the pipeline landed, and this
+     * schema never declared them — a trail whose rows carried fields its declared shape did not name.
+     * Declared together with the pass mode (#1682) and the erasure-suppression count (#1746), all optional
+     * because a read-through operation has none.
+     */
+    /** Rows the pipeline's transform rejected this run (reported per row in the run log; never loaded). */
+    rejectedRows: z.number().int().nonnegative().optional(),
+    /**
+     * Whether the run finished its pass. Read with `pipelinePassMode`: on a FULL run it means the whole
+     * remote population was read; on an INCREMENTAL run, every change since the watermark was.
+     */
+    completedPass: z.boolean().optional(),
+    /** Which track the run advanced (#1682) — a full pass or an incremental one. */
+    pipelinePassMode: z.enum(ExternalDataPipelinePassMode).optional(),
+    /**
+     * Source rows the run did NOT load because a subject erasure suppresses their remote records (#1746) — the
+     * evidence that an erasure survived the next pass. A count, never a key.
+     *
+     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — a pipeline run records how many erased records it declined to re-import.
+     */
+    suppressedRows: z.number().int().nonnegative().optional(),
+    /**
+     * Of those suppressed records, how many still have a LIVE row in the destination — an erasure that committed while an
+     * earlier pass was loading, and that pass wrote the row back (#1746). Above zero is an erasure that did not hold.
+     */
+    liveSuppressedRows: z.number().int().nonnegative().optional(),
 });
 /**
  * A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding
@@ -3253,6 +5221,9 @@ export const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object(
  * assurance-control: WILDO.AUDIT.ATTRIBUTION — the outbound deletion names the subject it served
  * and the external system it reached; the erasure report is the per-request receipt, this row is
  * the queryable trail.
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure that deleted rows in an external
+ * system leaves a durable record naming that system and how many rows it deleted there.
  */
 export const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE),
@@ -3262,8 +5233,8 @@ export const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({
     subjectIds: z.array(z.string().trim().min(1)).min(1),
     /** The HTTP_API-bound Wildo resource whose declared erasure operation ran. */
     resourceType: z.string().trim().min(1),
-    /** The provider the binding resolves credentials/base-URL through. */
-    providerRef: z.string().trim().min(1),
+    /** The system-of-record INSTANCE the erasure reached (`systemsOfRecord.<name>`) — see the read-through schema for the rename. */
+    systemOfRecord: z.string().trim().min(1),
     /** The remote entity (OData entity set / Odoo model / declared REST surface). */
     remoteEntityRef: z.string().trim().min(1),
     /** The transport dialect spoken (`odata` | `rest-json` | `odoo-jsonrpc`). */
@@ -3273,6 +5244,267 @@ export const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({
     /** Tenant scope, when the erasure request carried one. */
     organizationId: z.string().optional(),
 });
+/**
+ * What became of ONE write sent (or about to be sent) through an HTTP-API binding (#1679).
+ *
+ * Distinct members because each one sends a reviewer somewhere different, and two of them are the
+ * answers a client must not read as "not written".
+ */
+export var HttpApiWriteThroughOutcome;
+(function (HttpApiWriteThroughOutcome) {
+    /** The system of record applied the write. */
+    HttpApiWriteThroughOutcome["APPLIED"] = "applied";
+    /**
+     * The ENGINE refused before anything was sent — a non-owner organization, a partition outside the
+     * caller's grant, an engine-owned field in the payload. Nothing reached the remote.
+     */
+    HttpApiWriteThroughOutcome["REFUSED"] = "refused";
+    /** The request was sent and the system of record refused it with a definite answer; nothing was applied. */
+    HttpApiWriteThroughOutcome["REMOTE_REFUSED"] = "remote_refused";
+    /**
+     * The request was sent and nobody knows whether it was applied — a timeout, a connection dropped after
+     * the request left, a gateway answering for the vendor. A retry under the same Idempotency-Key answers
+     * this again rather than sending a second write.
+     */
+    HttpApiWriteThroughOutcome["OUTCOME_UNKNOWN"] = "outcome_unknown";
+    /**
+     * A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent: the outcome was
+     * replayed from the first attempt's record. Recorded so the second RESOURCE_OPERATION_PERFORMED row such a
+     * retry produces is visibly one that changed nothing remote.
+     */
+    HttpApiWriteThroughOutcome["REPLAYED"] = "replayed";
+})(HttpApiWriteThroughOutcome || (HttpApiWriteThroughOutcome = {}));
+/**
+ * A row was written THROUGH an HTTP-API resource binding, or a write was refused (#1679) — see the enum
+ * member's docstring for the vocabulary argument and the relation to RESOURCE_OPERATION_PERFORMED.
+ *
+ * MINIMISATION is the shape of this schema: it names the FIELDS written and never their values. The
+ * values live in the system of record; a copy here would be a second store of that system's content, one
+ * the application's erasure never reaches. `writtenFieldNames` are the LOCAL names the caller sent,
+ * because those are the names a reviewer of this application reads.
+ *
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — every write sent into an external system through the shared
+ * service identity is recorded with the real initiating user, the row it reached and the fields it changed.
+ */
+export const AuditableEvent_HttpApiWriteThrough_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HTTP_API_WRITE_THROUGH),
+    /** The Wildo resource whose binding was written through. */
+    resourceType: z.string().trim().min(1),
+    /** The write verb: `create` | `update` | `delete` — the core operation, so OCSF refines its activity from it. */
+    operationIdentifier: z.string().trim().min(1),
+    /** The system-of-record INSTANCE written (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    /** The remote entity (OData entity set / Odoo model / declared REST surface). */
+    remoteEntityRef: z.string().trim().min(1),
+    /** The transport dialect spoken. */
+    dialect: z.string().trim().min(1),
+    outcome: z.enum(HttpApiWriteThroughOutcome),
+    /**
+     * The written row's synthesized id — its remote key. Present for an update or delete (addressed by it)
+     * and for an applied or replayed create (the remote assigned it). Absent for a create that was refused
+     * or whose outcome is unknown, because no key exists that the engine could honestly name.
+     */
+    resourceId: z.string().optional(),
+    /** The LOCAL names of the fields the write carried, sorted. Never their values. Empty for a delete. */
+    writtenFieldNames: z.array(z.string()),
+    /** The stable refusal code for REFUSED, REMOTE_REFUSED and OUTCOME_UNKNOWN (a `SystemOfRecordErrorCode`, or the transport kind). */
+    refusalCode: z.string().optional(),
+    /** The REAL initiating user — absent only for genuine machine/internal executions. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that acted. */
+    executionType: z.string().optional(),
+    /** The organization the write was scoped to — the owner organization when it was admitted. */
+    organizationId: z.string().optional(),
+    /** The organization unit whose partition the row belongs to, when the instance is partitioned. */
+    organizationUnitId: z.string().optional(),
+    /**
+     * The LOCAL row whose change the write carried — present only for a write an OUTBOUND pipeline sent (#1690), which is
+     * how a reviewer tells such a write from a caller's write through a read-through resource. `initiatorUserId` is then
+     * the member whose change the pass sent, not whoever triggered the pass.
+     */
+    localResourceId: z.string().optional(),
+});
+/**
+ * What became of ONE declared system-of-record action that was sent, or replayed (#1678). Refusals before sending are a
+ * separate event type ({@link CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED}).
+ */
+export var SystemOfRecordActionOutcome;
+(function (SystemOfRecordActionOutcome) {
+    /** The system of record performed the action. */
+    SystemOfRecordActionOutcome["APPLIED"] = "applied";
+    /** The action was sent and the system of record refused it with a definite answer; nothing was applied. */
+    SystemOfRecordActionOutcome["REMOTE_REFUSED"] = "remote_refused";
+    /**
+     * The action was sent and nobody knows whether it was performed — a timeout, a connection dropped after the request
+     * left, a gateway answering for the vendor, or an answer the engine could not read after the vendor answered success.
+     * A retry under the same Idempotency-Key answers this again rather than acting twice.
+     */
+    SystemOfRecordActionOutcome["OUTCOME_UNKNOWN"] = "outcome_unknown";
+    /** A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent. */
+    SystemOfRecordActionOutcome["REPLAYED"] = "replayed";
+})(SystemOfRecordActionOutcome || (SystemOfRecordActionOutcome = {}));
+/**
+ * A declared system-of-record action was run (#1678) — see the enum member for the vocabulary argument.
+ *
+ * MINIMISATION is the shape: the input's field NAMES, never their values, and no result. The values live in the system
+ * of record; a copy here would be a second store of that system's content, one no erasure reaches.
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every physical action call to a system of record is
+ * recorded with the instance, the action, the remote entity and its outcome.
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — the real initiating actor is recorded through the shared service identity.
+ */
+export const AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED),
+    /** The system-of-record INSTANCE acted on (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    /** The application's name for the action (`postInvoice`), as the binding declares it. */
+    action: z.string().trim().min(1),
+    /** The read-through resource whose binding declares the action. */
+    resourceType: z.string().trim().min(1),
+    /** The remote entity or model the call was made on (`account.move`, an OData entity set or action import). */
+    remoteEntityRef: z.string().trim().min(1),
+    /** The call shape (`odoo-execute-kw` | `odata-bound-action` | `odata-unbound-action`). Spelled as a string: see `dialect` on the read-through row. */
+    callShape: z.string().trim().min(1),
+    outcome: z.enum(SystemOfRecordActionOutcome),
+    /** Whether the action is declared as changing remote state. */
+    writes: z.boolean(),
+    /** The target record's synthesized id — a remote KEY, never a person's id. Absent for a record-free action. */
+    targetResourceId: z.string().optional(),
+    /** The LOCAL names of the input fields the call carried, sorted. Never their values. */
+    inputFieldNames: z.array(z.string()),
+    /** The stable code for REMOTE_REFUSED and OUTCOME_UNKNOWN (a `SystemOfRecordErrorCode`, or the transport kind). */
+    failureCode: z.string().optional(),
+    /** The REAL initiating user — absent only for machine and system executions. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that acted. */
+    executionType: z.string().optional(),
+    /** The organization the action was run for — the owner organization, once admitted. */
+    organizationId: z.string().optional(),
+    /** The organization unit whose partition the action landed in, when the instance is partitioned and it is known. */
+    organizationUnitId: z.string().optional(),
+});
+/**
+ * A declared system-of-record action was REFUSED before anything was sent (#1678).
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every refusal of an action on a system of record is
+ * recorded with the caller, the instance, the action and the rule that refused it.
+ */
+export const AuditableEvent_SystemOfRecordActionRefused_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED),
+    systemOfRecord: z.string().trim().min(1),
+    action: z.string().trim().min(1),
+    /** The declaring resource, when the action was found at all (absent for ACTION_NOT_DECLARED). */
+    resourceType: z.string().optional(),
+    /** The target the caller named, for a record-targeted action. */
+    targetResourceId: z.string().optional(),
+    /** The `SystemOfRecordErrorCode` that refused it. */
+    refusalCode: z.string().trim().min(1),
+    /** The partition rule that refused it, for ACTION_PARTITION_REFUSED (`SystemOfRecordWritePartitionRefusal`). */
+    refusalReason: z.string().optional(),
+    initiatorUserId: z.string().optional(),
+    executionType: z.string().optional(),
+    /** The organization the caller initiated the action for — possibly NOT the owner, which is what a reviewer looks for. */
+    organizationId: z.string().optional(),
+});
+/**
+ * An operator reset a pipeline (#1734) — see {@link CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET}.
+ *
+ * The DISCARDED state is the point of the row: the pass id, cursor and watermark are remote POSITIONS (an id, a
+ * continuation link, a timestamp), never record content, and they are what lets a reviewer say which part of a sync
+ * the reset threw away. The door is authenticated by the application admin secret, which names no person, so the
+ * row's `userId` is empty; `statedOperator` is who the operator SAID they are, recorded as a statement, and `reason`
+ * is their own words — which is why the event exports at SUBJECT_DETAIL.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's reset of a pipeline is recorded with what it discarded
+ * and why.
+ */
+export const AuditableEvent_ExternalDataPipelineReset_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET),
+    /** The destination resource whose pipeline was reset. */
+    pipelineResourceType: z.string().trim().min(1),
+    /** The system-of-record instance the pipeline reads (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    resetMode: z.enum(ExternalDataPipelineResetMode),
+    /** Why, in the operator's words. Required by the door. */
+    reason: z.string().trim().min(1).max(2000),
+    /** Who the operator said they are, when they said. A statement, not an authenticated identity. */
+    statedOperator: z.string().trim().min(1).max(200).optional(),
+    /** Whether the pipeline had a state row at all. A reset of a pipeline that never ran discards nothing. */
+    stateFound: z.boolean(),
+    /** The discarded full pass's id; null when no pass was in flight. */
+    discardedPassId: z.string().nullable(),
+    /** The discarded full pass's cursor — a remote position; null at the start of a pass or with none in flight. */
+    discardedCursor: z.string().nullable(),
+    /** When the discarded pass started, ISO-8601; null when none was in flight. */
+    discardedPassStartedAt: z.string().nullable(),
+    /** The discarded incremental watermark (FULL_RESYNC only) — a remote position; null when none was discarded. */
+    discardedIncrementalWatermark: z.string().nullable(),
+    /** The discarded in-flight incremental cursor (FULL_RESYNC only); null when none was discarded. */
+    discardedIncrementalCursor: z.string().nullable(),
+});
+/**
+ * An operator answered an outbound write of unknown outcome (#2039) — see
+ * {@link CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED}.
+ *
+ * Like the reset, the door is authenticated by the application admin secret, which names no person: the row's `userId`
+ * is empty, `statedOperator` is who the operator SAID they are, and `reason` is their own words (SUBJECT_DETAIL on
+ * export). `remoteKey` is the remote record's identity the operator supplied, never record content.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's answer about another system's state is recorded with
+ * what it changed locally and why.
+ */
+export const AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED),
+    /** The OUTBOUND pipeline's destination resource. */
+    pipelineResourceType: z.string().trim().min(1),
+    /** The system-of-record instance the pipeline sends to (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    /** The destination row whose change was of unknown outcome. */
+    localResourceId: z.string().trim().min(1),
+    /** The write that was of unknown outcome, as its core operation (`create` / `update`). */
+    operationIdentifier: z.string().trim().min(1),
+    answer: z.enum(ExternalDataOutboundUnknownAnswer),
+    /** The remote key the operator supplied for an applied CREATE; null otherwise. */
+    remoteKey: z.string().nullable(),
+    /** Whether the answer wrote that key onto the local row (false when the row already held the same key). */
+    remoteKeyWritten: z.boolean(),
+    /** Whether a change is still owed after the answer: a NOT_APPLIED answer, or a local change made since the send. */
+    changeStillOwed: z.boolean(),
+    /** Why, in the operator's words. Required by the door. */
+    reason: z.string().trim().min(1).max(2000),
+    /** Who the operator said they are, when they said. A statement, not an authenticated identity. */
+    statedOperator: z.string().trim().min(1).max(200).optional(),
+});
+/**
+ * A BIDIRECTIONAL pipeline resolved a conflict on one row (#1723) — see
+ * {@link CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED}. Identities and field NAMES only, never a field's
+ * value: the row says which side's change to which fields was discarded, and the values are in the two systems.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — a resolution that overwrites one side's data is recorded with the row,
+ * the fields, the winning side and who chose it.
+ */
+export const AuditableEvent_ExternalDataConflictResolved_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED),
+    /** The BIDIRECTIONAL pipeline's destination resource. */
+    pipelineResourceType: z.string().trim().min(1),
+    /** The system-of-record instance on the other side (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    /** The local row. */
+    localResourceId: z.string().trim().min(1),
+    /** The remote record's key. */
+    remoteKey: z.string().trim().min(1),
+    winner: z.enum(ExternalDataConflictWinner),
+    decidedBy: z.enum(ExternalDataConflictDecisionSource),
+    /**
+     * The local fields whose values differ between the two sides, and so are overwritten on the LOSING side: loaded over
+     * now when the remote side wins, sent over by the next outbound pass when the local side wins.
+     */
+    overwrittenFieldNames: z.array(z.string().min(1)),
+    /** The record's row version on the system of record when the conflict was resolved; null when it carried none. */
+    remoteVersion: z.string().nullable(),
+    /** The version the two sides last agreed on; null when they never had. */
+    agreedVersion: z.string().nullable(),
+});
 /**
  * A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound
  * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).
@@ -3284,6 +5516,9 @@ export const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({
  *
  * assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per
  * resource, per erasure request, never as a standing posture.
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — a store the erasure deliberately did not
+ * reach is recorded as such, so the accounting cannot read as complete.
  */
 export const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED),
@@ -3293,8 +5528,8 @@ export const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.ob
     subjectIds: z.array(z.string().trim().min(1)).min(1),
     /** The HTTP_API-bound Wildo resource whose rows remain un-erased. */
     resourceType: z.string().trim().min(1),
-    /** The provider the binding resolves credentials/base-URL through. */
-    providerRef: z.string().trim().min(1),
+    /** The system-of-record INSTANCE the rows remain in (`systemsOfRecord.<name>`) — see the read-through schema for the rename. */
+    systemOfRecord: z.string().trim().min(1),
     /** The remote entity (OData entity set / Odoo model / declared REST surface). */
     remoteEntityRef: z.string().trim().min(1),
     /** The transport dialect spoken (`odata` | `rest-json` | `odoo-jsonrpc`). */
@@ -3308,6 +5543,40 @@ export const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.ob
     /** Tenant scope, when the erasure request carried one. */
     organizationId: z.string().optional(),
 });
+/**
+ * A subject erasure's outcome at one RECIPIENT of the subject's data (#1710) — see
+ * {@link CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME}.
+ *
+ * Art. 19 asks the controller to communicate an erasure "to each recipient to whom the personal data have been
+ * disclosed" and to tell the data subject who they are on request; this row records, per recipient, what the erasure
+ * did and who owes that communication. `status` is absent for a recipient reached with the TENANT's account, which is
+ * the tenant's to notify and never the operator's effect to run.
+ * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — every recipient the application declares is accounted for
+ * at every erasure, and one that no effect reached is recorded as unmeasured rather than passing silently.
+ */
+export const AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME),
+    /** The erased subject's resource type. */
+    subjectResourceType: z.string().trim().min(1),
+    /** The erased subject rows. */
+    subjectIds: z.array(z.string().trim().min(1)).min(1),
+    /** The recipient: a provider ref. */
+    recipientRef: z.string().trim().min(1),
+    /** `SubjectDataRecipientReach` — whose account reached it. */
+    reach: z.enum(SubjectDataRecipientReach),
+    /** `SubjectDataRecipientObligation` — who owes the Art. 19 communication. */
+    obligation: z.enum(SubjectDataRecipientObligation),
+    /** `SubjectDataRecipientRelevance` — carries this subject's data, or may have received it. */
+    relevance: z.enum(SubjectDataRecipientRelevance),
+    /** `SubjectErasureExternalEffectStatus` at the recipient. Absent for a tenant-account recipient. */
+    status: z.enum(SubjectErasureExternalEffectStatus).optional(),
+    /** The effects that answered for it (`billing-provider`, `recipient:<ref>`, …). */
+    effectRefs: z.array(z.string().trim().min(1)),
+    /** Tenant scope, when the erasure request carried one. */
+    organizationId: z.string().optional(),
+});
 /**
  * Audit-log event for cross-frontend session handoff issuance
  * (cross-app-jwt-propagation Step 2).
@@ -3548,16 +5817,23 @@ export const AuditableEvent_DataSchema = z.record(z.string(), z.any());
 export const AuditableEvent_BaseSchema = z.object({
     _id: z.string().isPrimaryKey().isSummaryField(),
     /**
-     * Store-agnostic, server-minted correlation key (UUID). The Mongo `_id` is
+     * Store-agnostic, server-assigned correlation key (UUID). The Mongo `_id` is
      * THIS store's primary key, but immudb (and any future audit sink) has its
      * own native key — so cross-store correlation needs an id that belongs to the
-     * EVENT, not to one store. Minted in `AuditLogsBackendService._createAuditLog`
+     * EVENT, not to one store. Fixed in `AuditLogsBackendService._createAuditLog`
+     * — minted there, or supplied deterministically by a deferred recording (#535) —
      * BEFORE the DB write and carried on BOTH the DB row AND the provider fan-out
      * emission, so the Phase-3 completeness reconciler can match DB rows ⇄ immudb
      * records (and `AuditLogVerification.verifyAuditEvent(eventId)` resolves the
      * same key). Not the primary key: `_id` stays the DB PK.
+     *
+     * UNIQUE, because it names ONE event (#535). A caller that delivers an event at least once — an outbox relay replaying
+     * an audit record after a crash — supplies a deterministic `eventId`, and a redelivery then collides here instead of
+     * writing a second row. immudb (write-if-absent by `eventId`) and every SIEM wire format (whose dedup key is this
+     * value) are idempotent on the same id, so all three destinations agree on "once". Sparse, as `.isUnique()` defaults:
+     * a row written before `eventId` existed carries none and is not a duplicate of another.
      */
-    eventId: z.string().isDBIndexed(),
+    eventId: z.string().isDBIndexed().isUnique(),
     // Note: .optional() must come AFTER decorators to preserve optionality in TypeScript type inference
     userId: z.string().isSummaryField().optional(),
     /**
@@ -3641,6 +5917,59 @@ export const AuditableEvent_BaseSchema = z.object({
     // observation of what they did.
     clientInstanceId: z.string().isDBIndexed().isSummaryField().optional()
         .dataCategories(PersonalDataCategory.IDENTITY),
+    /**
+     * The KIND of principal whose authority was used ({@link AuditActorKind}) — `userId` names the
+     * principal, this says what kind it is. Filled by `_createAuditLog` on every row it writes, and by
+     * nothing else. It resolves from the principal the emitter NAMES when there is one (a sign-in is
+     * audited under a pre-auth context, which is true of the request and wrong about who acted), else
+     * from the request `ExecutionContext`, else — last resort — from the actor id the emitter wrote.
+     * Optional in the schema only because rows written before it existed carry none.
+     *
+     * It is the PRINCIPAL's kind and never the agent's: whether an agent acted is `agentActor`'s presence.
+     */
+    actorKind: z.enum(AuditActorKind).systemEnum('AuditActorKind').isDBIndexed().isSummaryField().optional(),
+    /**
+     * Which AI agent performed the action, and in which execution — present ONLY when an agent acted
+     * ({@link AuditAgentActorSchema}). Taken from the request `ExecutionContext`, else from the ambient
+     * agent frame the framework opens around every tool call, so a tool that builds its own context or
+     * writes as the system is attributed without doing anything. Identifiers only: never argument
+     * values, never digests of them.
+     *
+     * USAGE — its `agentExecutionId` is a pseudonymous key into a transcript the user owns; erasing the
+     * transcript leaves the key resolving to nothing, which is what keeps an unscrubbable ledger
+     * compatible with erasure.
+     */
+    agentActor: AuditAgentActorSchema.optional().dataCategories(PersonalDataCategory.USAGE),
+    /**
+     * The external OAuth client a person delegated to (`actorKind = DELEGATED_CLIENT`) — the verified
+     * token's `azp`, captured after the audience check and never from a header. An opaque string: a
+     * client identified by an HTTPS URL has no row to join to. Evidence only.
+     */
+    delegatingClientId: z.string().isSummaryField().optional(),
+    /**
+     * The machine credential a MACHINE principal authenticated with (`actorKind = MACHINE`): an API key's
+     * or OAuth client's id, or — for a shared platform secret that has no credential record — its stable
+     * name, never its value. Recorded here and never in a `*By` field, whose contract is "a user id or a
+     * sentinel".
+     */
+    principalCredentialId: z.string().isSummaryField().optional(),
+    /**
+     * The service-provider relationship the principal acted THROUGH (#1597) — present only on a row written
+     * in a CLIENT organization by an expert or firm machine client that a live relationship admitted there.
+     * Derived by `_createAuditLog` from the role entry for the row's organization, never supplied by an
+     * emitter. Indexed because the client filters its own trail by relationship ("what did firm X do here?").
+     */
+    actingViaServiceProviderRelationshipId: z.string().isDBIndexed().isSummaryField().optional(),
+    /** The firm behind {@link actingViaServiceProviderRelationshipId}; present exactly when it is. Evidence only. */
+    providerOrganizationId: z.string().isSummaryField().optional(),
+    /**
+     * Where the second factor that satisfied the CLIENT organization's authentication policy came from, on a row a
+     * firm's expert caused in that client (#1633) — present only when the client's policy required one and the
+     * session satisfied it for that client. Derived by `_createAuditLog` from the request's context for the row's own
+     * organization, never supplied by an emitter. The client's answer to "was this action MFA-protected, and by whom?".
+     */
+    serviceProviderFactorSource: z.enum(FactorSatisfactionSource).systemEnum('FactorSatisfactionSource').isSummaryField().optional()
+        .describe('On an action a service firm\'s expert took inside a client organization whose policy requires a second factor: where the factor that satisfied that policy came from, a step-up to this application or the firm\'s own identity provider the client trusts. Absent when the client\'s policy required none.'),
     riskLevel: z.enum(ResourceOperationRiskLevel).isSummaryField(),
     // USAGE — an audit row is a record of what a principal DID. The event type and its data together
     // are the observation, so both carry the category; `riskLevel`, `eventCategory` and `severity` are
@@ -3651,7 +5980,11 @@ export const AuditableEvent_BaseSchema = z.object({
     // immutable ledger cannot be scrubbed. This declaration is about the audit row's OWN fields, which
     // hold personal data whether or not anyone wanted them to — and a notice must say so precisely
     // BECAUSE they are unerasable.
-    eventType: z.string().isSummaryField().dataCategories(PersonalDataCategory.USAGE),
+    //
+    // `.systemEnum(CORE_AUDITABLE_EVENT_TYPE)` names the OPEN vocabulary the value belongs to (#1791): the field stays a
+    // string (whoever emits an event writes its type), and every trail shows the type's word
+    // (`system_enums.CoreAuditableEventType.<value>`) instead of its wire value, the missing word showing the value.
+    eventType: z.string().systemEnum(EngineOpenVocabulary.CORE_AUDITABLE_EVENT_TYPE).isSummaryField().dataCategories(PersonalDataCategory.USAGE),
     eventData: AuditableEvent_DataSchema.dataCategories(PersonalDataCategory.USAGE),
     /** Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). */
     eventCategory: z.enum(AuditEventCategory).isSummaryField(),
@@ -3661,6 +5994,34 @@ export const AuditableEvent_BaseSchema = z.object({
     updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate()
 });
 // Type-safe discriminated union for TypeScript validation (used in service layer)
+/**
+ * One retention-class sweep run, summarised per class (#1636). Counts only — no row id, no field value, no
+ * person: the per-resource detail is in the `retentionEnforcementRecords` row the same run wrote.
+ */
+export const AuditableEvent_RetentionEnforcementRecorded_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED),
+    /** The run's `runRef`, shared with every enforcement record it wrote. */
+    runRef: z.string(),
+    /** The instant the run computed its cutoffs from, ISO. */
+    sweptAt: z.string(),
+    /** FAILED when any resource failed; else DEFERRED_BY_CEILING when any stopped at the ceiling; else COMPLETED. */
+    outcome: z.enum(RetentionEnforcementOutcome),
+    boundResourceCount: z.number().int().min(0),
+    deletedCount: z.number().int().min(0),
+    /** Enforcement records this run could not write. Non-zero fails the run: its enforcement is unevidenced. */
+    recordWriteFailureCount: z.number().int().min(0),
+    classes: z.array(z.object({
+        retentionClass: z.enum(DataRetentionClass),
+        resourceCount: z.number().int().min(0),
+        deletedCount: z.number().int().min(0),
+        completedCount: z.number().int().min(0),
+        deferredByCeilingCount: z.number().int().min(0),
+        failedCount: z.number().int().min(0),
+        skippedCount: z.number().int().min(0),
+        /** Absent when no hold check ran for any resource of the class (#1634). */
+        heldSkippedCount: z.number().int().min(0).optional(),
+    })),
+});
 export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType', [
     AuditableEvent_User_LoginEventDataSchema,
     AuditableEvent_User_LogoutEventDataSchema,
@@ -3673,6 +6034,7 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_User_AppRolesChangedEventDataSchema,
     AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema,
     AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema,
+    AuditableEvent_Organization_TypeAssignedEventDataSchema,
     AuditableEvent_OrganizationMember_InvitedEventDataSchema,
     AuditableEvent_OrganizationMember_JoinedEventDataSchema,
     AuditableEvent_OrganizationMember_UpdatedEventDataSchema,
@@ -3700,12 +6062,40 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_User_TokenRefreshedEventDataSchema,
     AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema,
     AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema,
+    AuditableEvent_Organization_SIEMExportDisabledEventDataSchema,
+    AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema,
     AuditableEvent_OrganizationProviderCredential_SetEventDataSchema,
     AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema,
     AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema,
     AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema,
     AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema,
+    AuditableEvent_RetentionEnforcementRecorded_EventDataSchema,
     AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema,
+    AuditableEvent_InboundDelivery_RejectedEventDataSchema,
+    AuditableEvent_InboundDelivery_AcceptedEventDataSchema,
+    AuditableEvent_InboundDelivery_UnroutableEventDataSchema,
+    AuditableEvent_InboundDelivery_ProcessedEventDataSchema,
+    AuditableEvent_InboundDelivery_FailedEventDataSchema,
+    AuditableEvent_InboundDelivery_DeadEventDataSchema,
+    AuditableEvent_InboundDelivery_ReplayedEventDataSchema,
+    AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema,
+    AuditableEvent_InboundReply_SentEventDataSchema,
+    AuditableEvent_InboundReply_FailedEventDataSchema,
+    AuditableEvent_InboundReplyToken_RevokedEventDataSchema,
+    AuditableEvent_InboundReplyToken_DowngradedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema,
+    AuditableEvent_ClientMailbox_CreatedEventDataSchema,
+    AuditableEvent_ClientMailbox_RemovedEventDataSchema,
+    AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema,
+    AuditableEvent_InboundEmail_RejectedLimitEventDataSchema,
+    AuditableEvent_AutonomousAgent_BoundEventDataSchema,
+    AuditableEvent_AutonomousAgent_UnboundEventDataSchema,
+    AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema,
+    AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema,
     AuditableEvent_SCIM_TokenCreatedEventDataSchema,
     AuditableEvent_SCIM_TokenRevokedEventDataSchema,
     AuditableEvent_SCIM_UserProvisionedEventDataSchema,
@@ -3742,14 +6132,45 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema,
     AuditableEvent_PlatformDirectoryAccess_EventDataSchema,
     AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema,
+    AuditableEvent_LegalHoldPlaced_EventDataSchema,
+    AuditableEvent_LegalHoldReleased_EventDataSchema,
+    AuditableEvent_ModelCostAggregateInvoiceLinked_EventDataSchema,
+    AuditableEvent_CorrectionCaptureSettingChanged_EventDataSchema,
+    AuditableEvent_EvaluationExportAuthorizationChanged_EventDataSchema,
+    AuditableEvent_EvaluationDatasetExported_EventDataSchema,
+    AuditableEvent_EvaluationDatasetExportRefused_EventDataSchema,
+    AuditableEvent_ServiceProviderRelationshipLifecycle_EventDataSchema,
+    AuditableEvent_ServiceProviderMachineClientAdmissionChanged_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertAssigned_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertUnassigned_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertApprovalRequested_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertApprovalGranted_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertApprovalDenied_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertApprovalLapsed_EventDataSchema,
+    AuditableEvent_ServiceProviderCapabilityGranted_EventDataSchema,
+    AuditableEvent_ServiceProviderCapabilityRevoked_EventDataSchema,
+    AuditableEvent_ServiceProviderMfaTrustChanged_EventDataSchema,
+    AuditableEvent_ServiceProviderClientAuthenticationSatisfied_EventDataSchema,
+    AuditableEvent_ServiceProviderActivityFeedDecided_EventDataSchema,
+    AuditableEvent_ServiceProviderActivityFeedDisclosureChanged_EventDataSchema,
+    AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema,
     AuditableEvent_RetainedDataAccess_EventDataSchema,
+    AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema,
     AuditableEvent_SubjectDataExport_EventDataSchema,
     AuditableEvent_CollectionDataExport_EventDataSchema,
     AuditableEvent_User_SessionEvictedEventDataSchema,
     AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,
+    AuditableEvent_HttpApiWriteThrough_EventDataSchema,
+    AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema,
+    AuditableEvent_SystemOfRecordActionRefused_EventDataSchema,
+    AuditableEvent_ExternalDataPipelineReset_EventDataSchema,
+    AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema,
+    AuditableEvent_ExternalDataConflictResolved_EventDataSchema,
     AuditableEvent_ProviderOperationCall_EventDataSchema,
+    AuditableEvent_ProviderOperationDenied_EventDataSchema,
     AuditableEvent_HttpApiExternalErasure_EventDataSchema,
     AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,
+    AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema,
     AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema,
     AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema,
     AuditableEvent_OAuth_ConsentGrantedEventDataSchema,