@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js

@@ -1,15 +1,39 @@
 import { AuditApplicationReadAccess } from './audit-trail-config.shared.schemas.js';
+import { EngineOpenVocabulary } from '../../i18n/engine-open-vocabulary.shared.js';
+import { ApplicationConfigVocabulary } from '../../i18n/application-config-vocabulary.shared.js';
+import { AuditActorKind, AuditAgentActorSchema } from './audit-actor.shared.schemas.js';
+import { HumanDecision_Act, HumanDecision_Outcome, HumanDecision_Plane, HumanDecision_RefusalReason, HumanDecision_RequesterKind, HumanDecision_RouteChangeTrigger, HumanDecision_RouteKind, ReviewClockBasis, ReviewDeadlineKind, ReviewDeadlineOutcome, ReviewDeadlineStage, ReviewEscalationActionKind, } from '../../flows-actors/human-decision.shared.schemas.js';
+import { AutonomousPrincipalSource, AutonomousTurnRefusalReason, AutonomousTurnTrigger } from '../../flows-actors/autonomous-agents.shared.schemas.js';
+import { EvaluationDatasetExportRefusalReason } from '../../flows-actors/agent-work-decisions.shared.schemas.js';
+import { WorkUnitRefSchema } from '../../resources/work-unit.shared.schemas.js';
 import { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas.js';
 import { z } from "zod";
-import { ExternalProvider_Connection_DelegationMode } from "@wildo-ai/external-connectors-models";
+import '@wildo-ai/zod-decorators';
+import { AuthMethod } from "../../security/authentications/authentication.shared.schemas.js";
+import { FactorSatisfactionSource } from "../../security/authentications/service-provider-client-authentication.shared.schemas.js";
+import { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from "../../organizations/service-provider-client-controls.shared.schemas.js";
+import { ServiceProviderActivityFeedStatus } from "../../organizations/service-provider-activity-feed.shared.schemas.js";
+import { ExternalProvider_Connection_DelegationMode, RateBudgetCounting } from "@wildo-ai/external-connectors-models";
 import { GovernedDocumentInteractionSchema } from "../documents/governed-document-interactions.shared.schemas.js";
 import { PersonalDataCategory } from "../privacy/personal-data-category.shared.schemas.js";
+import { ExternalDataConflictDecisionSource, ExternalDataConflictWinner, ExternalDataOutboundUnknownAnswer, ExternalDataPipelinePassMode, ExternalDataPipelineResetMode } from '../../external-data/external-data-pipeline-pass-mode.shared.js';
+import { LegalHoldGround, LegalHoldPlacementTier, LegalHoldScopeKind } from "../privacy/legal-holds.shared.schemas.js";
+import { DataRetentionClass } from "../privacy/retention-schedule.shared.schemas.js";
+import { RetentionEnforcementOutcome } from "../privacy/retention-enforcement-records.shared.schemas.js";
+import { SubjectErasureExternalEffectStatus } from "../privacy/subject-erasure.shared.schemas.js";
+import { SubjectDataRecipientObligation, SubjectDataRecipientReach, SubjectDataRecipientRelevance, SubjectDataRecipientsStatementStatus, } from "../privacy/subject-data-recipients.shared.schemas.js";
 import { RegistrationAcquisitionChannel } from "../../config/entity-identity-config.shared.schemas.js";
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from "../../resources/resources.shared.schemas.js";
 import { CoreResourceOperation } from "../../resources/resources.shared.core.definitions.js";
 import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus, } from "../../security/authorizations/platform-access-grants.shared.schemas.js";
 import { SystemOfRecordPartitionAssignmentTransition } from "../../systems-of-record/system-of-record-partition-assignments.shared.schemas.js";
+import { DelegatedAdministrativeCapability, ServiceProviderCapabilityGrantEndCause } from "../../organizations/service-provider-capability-grants.shared.schemas.js";
+import { ServiceProviderExpertAdmissionPolicy, ServiceProviderExpertApprovalDenialReason, ServiceProviderRelationshipStatus, ServiceProviderRelationshipTransition, } from "../../organizations/service-provider-relationships.shared.schemas.js";
 import { ExecutionContext_ExecutionType, ExecutionContext_MachineCredentialSchema } from "../../runtime/execution-context.shared.schemas.js";
+import { InboundDeliveryRejectionReason, InboundDeliveryUnroutableReason, InboundResolvedScopeKind, InboundSourceKind } from "../../inbound/inbound-delivery.shared.schemas.js";
+import { InboundBelowMinimumDisposition, InboundChannelKind, InboundSenderAssurance, ReplyTokenDowngradeReason } from "../../inbound/inbound-channels.shared.schemas.js";
+import { ReplyTokenRevocationReason } from "../../inbound/conversation-threads.shared.schemas.js";
+import { InboundEmailLimit, InboundEmailWithheldReason, OrganizationEmailDomainRemovalTrigger, OrganizationEmailDomainStatus, OrganizationEmailDomainSuspensionReason, } from "../../notifications/inbound-email/inbound-email.shared.schemas.js";
 import { AuthScopeType, SsoConnectionType, } from "../../security/authentications/authentication.shared.schemas.js";
 import { WebhookEndpointProbeOutcome } from "../../notifications/m2m/webhook-config.shared.schemas.js";
 import { ProviderCredentialDeletionReason, ProviderOAuth2RevocationOutcomeValues, ProviderCredentialResolutionSource, } from "../../security/connected-accounts/provider-credentials.shared.schemas.js";
@@ -282,6 +306,12 @@ export var CoreAuditableEventType;
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a change to the authentication assurance
     // requirements (MFA / password / lockout) must be attributable and evidenced.
     CoreAuditableEventType["APPLICATION_AUTH_POLICY_CHANGED"] = "application_auth_policy_changed";
+    // Retention Enforcement (#1636)
+    // One per retention-class sweep run, by the system: per-class totals of what the run deleted, skipped and
+    // failed on. The queryable per-resource record is `retentionEnforcementRecords`; this event exists to reach
+    // the SIEM. Its row risk is HIGH when any resource failed, LOW otherwise.
+    // assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — records evidence that declared retention was enforced.
+    CoreAuditableEventType["RETENTION_ENFORCEMENT_RECORDED"] = "retention_enforcement_recorded";
     // Outbound M2M Webhook Events
     // An admin firing `webhookConfig.testEndpoint` makes the platform emit a signed HTTP
     // request to an operator-supplied URL. That is an outbound-traffic primitive reachable
@@ -290,6 +320,57 @@ export var CoreAuditableEventType;
     // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — outbound connection initiated from an
     // administrative surface is attributable and monitorable.
     CoreAuditableEventType["WEBHOOK_ENDPOINT_TEST_DISPATCHED"] = "webhook_endpoint_test_dispatched";
+    // Inbound Delivery Events (#1596)
+    // Every verified message another system sends the application leaves a trail from the wire to its
+    // outcome: refused at the door, stored, never routable, processed, failed and retried, dead, replayed.
+    // The terminal and refused transitions are the ones an operator investigates; ACCEPTED and PROCESSED
+    // make the successes countable too, so a SIEM can see a sender's volume and not only its failures.
+    // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a message whose signature, timestamp, size or media
+    // type does not verify is refused whole and the refusal is recorded.
+    CoreAuditableEventType["INBOUND_DELIVERY_REJECTED"] = "inbound_delivery_rejected";
+    // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a verified external message entering the system is recorded.
+    CoreAuditableEventType["INBOUND_DELIVERY_ACCEPTED"] = "inbound_delivery_accepted";
+    // assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — a message that resolves to no admissible scope is
+    // recorded as never run, rather than run somewhere it does not belong.
+    CoreAuditableEventType["INBOUND_DELIVERY_UNROUTABLE"] = "inbound_delivery_unroutable";
+    CoreAuditableEventType["INBOUND_DELIVERY_PROCESSED"] = "inbound_delivery_processed";
+    CoreAuditableEventType["INBOUND_DELIVERY_FAILED"] = "inbound_delivery_failed";
+    // assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — work a sender was told was received and that never
+    // completed is recorded as such, so it can be found and replayed.
+    CoreAuditableEventType["INBOUND_DELIVERY_DEAD"] = "inbound_delivery_dead";
+    // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — a privileged re-run of stored input is attributable
+    // and carries its written justification.
+    CoreAuditableEventType["INBOUND_DELIVERY_REPLAYED"] = "inbound_delivery_replayed";
+    // Inbound Channel Events (#1630) — a message on a channel, and the replies that answer it.
+    // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a message whose sender assurance is below the handler's
+    // minimum never reaches that handler, and what happened to it instead is recorded.
+    CoreAuditableEventType["INBOUND_DELIVERY_BELOW_ASSURANCE"] = "inbound_delivery_below_assurance";
+    // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every reply a handler sends on a thread is
+    // attributable to the delivery and thread it answered.
+    CoreAuditableEventType["INBOUND_REPLY_SENT"] = "inbound_reply_sent";
+    CoreAuditableEventType["INBOUND_REPLY_FAILED"] = "inbound_reply_failed";
+    // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a reply address (a bearer secret) stopping to bind replies is recorded with why.
+    CoreAuditableEventType["INBOUND_REPLY_TOKEN_REVOKED"] = "inbound_reply_token_revoked";
+    // assurance-control: WILDO.AUDIT.SECURITY_EVENT — a live reply address presented by a sender it was not issued
+    // to, or on an unauthenticated domain, is recorded: it is what a leaked address looks like.
+    CoreAuditableEventType["INBOUND_REPLY_TOKEN_DOWNGRADED"] = "inbound_reply_token_downgraded";
+    // Receiving Email Events (#1600) — the domains an organization proves, provisions and loses, the client
+    // mailboxes a firm keeps, and the parts of a received message that were not made available.
+    // assurance-control: WILDO.DATA.TENANT_ISOLATION — a claim on a domain is recorded; nothing routes on it until ownership is proven.
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_CLAIMED"] = "organization_email_domain_claimed";
+    // assurance-control: WILDO.DATA.TENANT_ISOLATION — the moment an organization proved it controls a domain, which decides where that domain's mail may go.
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED"] = "organization_email_domain_ownership_verified";
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_VERIFIED"] = "organization_email_domain_verified";
+    // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a domain whose ownership or records disappeared stops routing and sending, and the stop is recorded.
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_SUSPENDED"] = "organization_email_domain_suspended";
+    CoreAuditableEventType["ORGANIZATION_EMAIL_DOMAIN_REMOVED"] = "organization_email_domain_removed";
+    // assurance-control: WILDO.DATA.TENANT_ISOLATION — a mailbox routing a firm's domain into a client organization exists only under an active relationship, and is recorded.
+    CoreAuditableEventType["CLIENT_MAILBOX_CREATED"] = "client_mailbox_created";
+    CoreAuditableEventType["CLIENT_MAILBOX_REMOVED"] = "client_mailbox_removed";
+    // assurance-control: WILDO.SECURITY.INGESTED_CONTENT_INSPECTION — an attachment not proven clean is never exposed, and withholding it is recorded.
+    CoreAuditableEventType["INBOUND_EMAIL_ATTACHMENT_WITHHELD"] = "inbound_email_attachment_withheld";
+    // assurance-control: WILDO.OPERATIONS.RESOURCE_LIMIT — a message over a declared limit is kept as an envelope only, and recorded.
+    CoreAuditableEventType["INBOUND_EMAIL_REJECTED_LIMIT"] = "inbound_email_rejected_limit";
     // SCIM Directory Provisioning Events
     // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
     CoreAuditableEventType["SCIM_TOKEN_CREATED"] = "scim_token_created";
@@ -489,6 +570,105 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["RESOURCE_OPERATION_DENIED"] = "resource_operation_denied";
     CoreAuditableEventType["CROSS_TENANT_ADMINISTRATIVE_ACCESS"] = "cross_tenant_administrative_access";
     CoreAuditableEventType["PLATFORM_ACCESS_GRANT_LIFECYCLE"] = "platform_access_grant_lifecycle";
+    /**
+     * A legal hold was placed (#1634): from this instant every deletion path skips or refuses the held scope.
+     * HIGH — it suspends a tenant's retention schedule and its data subjects' erasures.
+     *
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.
+     */
+    CoreAuditableEventType["LEGAL_HOLD_PLACED"] = "legal_hold_placed";
+    /**
+     * A legal hold was released (#1634): deletion of its scope resumes on the next sweep, purge or erasure.
+     *
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.
+     */
+    CoreAuditableEventType["LEGAL_HOLD_RELEASED"] = "legal_hold_released";
+    /**
+     * A model-cost period aggregate was linked to the invoice that bills it (#1598). A retention-deciding act: the
+     * link is what keeps the aggregate past its tenant's deletion, for the statutory bookkeeping period.
+     *
+     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — only an aggregate an invoice bills outlives its tenant.
+     */
+    CoreAuditableEventType["MODEL_COST_AGGREGATE_INVOICE_LINKED"] = "model_cost_aggregate_invoice_linked";
+    /**
+     * An organization changed whether it keeps the CONTENT of its experts' corrections to agent work (#1599): the
+     * opt-in, its purpose, its reader role or its narrowing.
+     *
+     * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — every change to what the tenant keeps of its client material is recorded.
+     */
+    CoreAuditableEventType["CORRECTION_CAPTURE_SETTING_CHANGED"] = "correction_capture_setting_changed";
+    /**
+     * An organization recorded, changed or revoked its basis for exporting its experts' corrections as evaluation
+     * data (#1599).
+     *
+     * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — the authorisation an export relies on is recorded.
+     */
+    CoreAuditableEventType["EVALUATION_EXPORT_AUTHORIZATION_CHANGED"] = "evaluation_export_authorization_changed";
+    /** A tenant's corrections were exported as an evaluation dataset under its recorded authorisation (#1599). */
+    CoreAuditableEventType["EVALUATION_DATASET_EXPORTED"] = "evaluation_dataset_exported";
+    /**
+     * An export of a tenant's corrections was REFUSED: no ACTIVE authorisation of that organization (#1599 I7).
+     *
+     * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — a refused export is recorded, not only prevented.
+     */
+    CoreAuditableEventType["EVALUATION_DATASET_EXPORT_REFUSED"] = "evaluation_dataset_export_refused";
+    /**
+     * A service-provider relationship moved (#1597) — proposed, accepted, declined, suspended, resumed,
+     * scope amended, terminated, withdrawn or expired. ONE event for the relationship's whole life with a
+     * {@link ServiceProviderRelationshipTransition} field (the `platformAccessGrants` shape), written to
+     * BOTH the client's and the firm's trail so each reads the relationship's timeline in its own.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE"] = "service_provider_relationship_lifecycle";
+    /** A firm-owned OAuth client was admitted into, or removed from, a client organization (#1597, S3). */
+    CoreAuditableEventType["SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED"] = "service_provider_machine_client_admission_changed";
+    /** A firm assigned one of its experts to serve a client relationship (#1597). */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_ASSIGNED"] = "service_provider_expert_assigned";
+    /** A firm ended an expert's assignment to a client relationship (#1597). */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_UNASSIGNED"] = "service_provider_expert_unassigned";
+    /**
+     * A firm assigned an expert under a relationship whose client approves each expert, so the assignment now waits
+     * for the client's administrators (#1612). The approval is a human decision; this row carries its `decisionRef`,
+     * so it joins that decision's own REQUESTED / RESOLVED rows rather than duplicating them. Both organizations' trails.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED"] = "service_provider_expert_approval_requested";
+    /** The client approved the expert and the expert was admitted — a provider membership now exists (#1612). Both trails. */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED"] = "service_provider_expert_approval_granted";
+    /**
+     * The expert was NOT admitted (#1612): the client refused, or approved when the relationship, the expert's firm
+     * membership or the (person, client) slot no longer allowed it. `denialReason` says which. Both trails.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED"] = "service_provider_expert_approval_denied";
+    /** Nobody in the client answered before the approval's lapse; nothing was created (#1612). Both trails. */
+    CoreAuditableEventType["SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED"] = "service_provider_expert_approval_lapsed";
+    /**
+     * A client lent a service firm's experts a named administrative capability, until a stated end (#1631). HIGH, CRITICAL
+     * for a security-critical capability. Written to both organizations' trails.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_CAPABILITY_GRANTED"] = "service_provider_capability_granted";
+    /** A client revoked a lent capability — or the relationship ended, which revokes them all (#1631). Both trails. */
+    CoreAuditableEventType["SERVICE_PROVIDER_CAPABILITY_REVOKED"] = "service_provider_capability_revoked";
+    /**
+     * A client organization changed whether it trusts the firm's own identity provider's MFA on one relationship
+     * (#1633). HIGH: turning it on lets a proof made outside this application satisfy the client's authentication
+     * policy for the firm's experts. Written to the client's trail and the firm's.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_MFA_TRUST_CHANGED"] = "service_provider_mfa_trust_changed";
+    /**
+     * A firm's expert satisfied a CLIENT organization's authentication policy (#1633): a factor was recorded on the
+     * session for that client, with where it came from — a step-up answered here, or the firm's trusted identity
+     * provider. The client's answer to "was this expert's work MFA-protected, and by whom?". Client trail only.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED"] = "service_provider_client_authentication_satisfied";
+    /**
+     * A firm switched its expert-activity feed on or off (#1632). The record of a worker-monitoring decision: who,
+     * when, and whether the consultation notice was acknowledged. Firm trail.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED"] = "service_provider_activity_feed_decided";
+    /**
+     * A client organization changed how much a firm's activity feed may say about work done in it (#1632). Written to
+     * the client's trail and the firm's, so the firm sees why its feed went quiet.
+     */
+    CoreAuditableEventType["SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED"] = "service_provider_activity_feed_disclosure_changed";
     /**
      * A remote partition of a system of record was assigned to, moved between, or removed from an
      * organization unit.
@@ -608,7 +788,7 @@ export var CoreAuditableEventType;
     // the other two modes link it (#1382).
     CoreAuditableEventType["GOVERNED_DOCUMENT_INTERACTION_RECORDED"] = "governed_document_interaction_recorded";
     CoreAuditableEventType["SUBJECT_DATA_EXPORT"] = "subject_data_export";
-    // A resource LISTING was exported to a file (CSV/JSON) by an operator. Distinct from
+    // A resource LISTING was exported to a file (CSV, JSON or PDF) by an operator. Distinct from
     // SUBJECT_DATA_EXPORT, which answers a data subject's own right over their own data: this one is
     // an authorized operator taking rows they can already read and carrying them OUT of the system, so
     // the questions it must answer are "which resource, how many rows, and was it the page they were
@@ -629,6 +809,55 @@ export var CoreAuditableEventType;
     // probes the services tier never sees. Classified DATA_ACCESS / INFO: routine, authorized
     // operation — the value is the queryable trail, not an alarm.
     CoreAuditableEventType["HTTP_API_READ_THROUGH_ACCESS"] = "http_api_read_through_access";
+    // A row was WRITTEN THROUGH an HTTP-API resource binding (#1679) — a create, update or delete sent to a
+    // system of record the platform does not own, or refused before it was sent. The outbound twin of
+    // HTTP_API_READ_THROUGH_ACCESS and deliberately not folded into it: a read brings rows IN, this pushes a
+    // change OUT, and the reviewer's question is different — "who changed which row of which external
+    // system, which FIELDS did they change, and did it land". One event per write ATTEMPT, emitted at the
+    // adapter (the only tier that witnesses every remote write, repository-direct callers included), on
+    // every outcome: applied, refused before sending, refused by the remote, UNKNOWN, and replayed from an
+    // earlier attempt under the same Idempotency-Key. Carries field NAMES, never values: the trail must
+    // never become a second copy of what was written into someone else's system.
+    //
+    // Beside RESOURCE_OPERATION_PERFORMED, not instead of it, and the two cannot contradict each other:
+    // that row records that the OPERATION completed and is emitted only after it did; this one records
+    // what happened at the REMOTE and is emitted whatever the operation's fate. An applied write whose
+    // follow-up failed therefore shows this row (APPLIED) and no operation row — which is exactly the
+    // state the WRITE_APPLIED_FOLLOW_UP_FAILED answer describes.
+    CoreAuditableEventType["HTTP_API_WRITE_THROUGH"] = "http_api_write_through";
+    // A declared ACTION of a system of record was run (#1678) — a vendor operation that is not a row write (posting an
+    // invoice, confirming an order, an OData action), sent under the instance's service identity. One row per attempt that
+    // reached the remote, or was replayed from an earlier attempt under the same Idempotency-Key: applied, refused by the
+    // remote, of unknown outcome, replayed. Not folded into HTTP_API_WRITE_THROUGH: that row names the FIELDS a row write
+    // changed, this one names an OPERATION and whether it landed, and a reviewer asks different questions of each.
+    //
+    // It is also the action's OUTBOUND record, and subject-free in the #1712 sense: the instance, the action, the remote
+    // entity, the outcome and the time. No input VALUE (only the input's field names), no payload, no subject id — the
+    // record describes the application's egress, not a person. The initiating actor rides the audit row's own `userId`,
+    // as it does on every audit row; that is attribution, not a subject.
+    CoreAuditableEventType["SYSTEM_OF_RECORD_ACTION_EXECUTED"] = "system_of_record_action_executed";
+    // A declared ACTION of a system of record was REFUSED before anything was sent (#1678) — a non-owner organization, a
+    // role the caller does not hold, a context not admitted to initiate it, a record outside the caller's partition, an
+    // invalid input, a reused or missing Idempotency-Key. Its own type rather than an outcome of the row above because it
+    // is an AUTHORIZATION decision, classified and alerted on as one; the executed row is data access. Every refusal is
+    // recorded, so a probe for records one may not see leaves a trail even though it learns nothing.
+    CoreAuditableEventType["SYSTEM_OF_RECORD_ACTION_REFUSED"] = "system_of_record_action_refused";
+    // An operator RESET a pipeline through the admin door (#1734) — discarded its in-flight full pass (cursor, checkpoint,
+    // membership journal) and, for a full resync, its incremental watermark. Its own type because it is an administrative
+    // act on how a copy of a system of record is kept, not a read or a write of the records: the next run re-reads what
+    // the reset discarded, and the row names what that was, so a reviewer can tell a deliberate resync from a pipeline that
+    // lost its place. Classified ORG_MANAGEMENT / WARNING, like a platform configuration publication.
+    CoreAuditableEventType["EXTERNAL_DATA_PIPELINE_RESET"] = "external_data_pipeline_reset";
+    // An operator ANSWERED an outbound write of unknown outcome through the admin door (#2039): it landed (and, for a
+    // create, here is the remote key of the record found) or it did not (send it again). Its own type because it is a
+    // claim about ANOTHER system that nothing in the engine can check — the answer decides whether a record is linked or
+    // sent a second time — so the record is the control. Classified ORG_MANAGEMENT / WARNING, like a pipeline reset.
+    CoreAuditableEventType["EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED"] = "external_data_outbound_unknown_resolved";
+    // A BIDIRECTIONAL pipeline RESOLVED a row changed on both sides since they last agreed (#1723): the system of record's
+    // values were loaded over the local ones, or the local ones were kept to be sent over the remote ones. One side's change
+    // to the named fields is discarded, by the declared policy or an operator's choice, so the record is the control.
+    // Classified DATA_ACCESS / WARNING: data was overwritten, by design, and a reviewer reads it beside the write-through.
+    CoreAuditableEventType["EXTERNAL_DATA_CONFLICT_RESOLVED"] = "external_data_conflict_resolved";
     // A subject erasure INVOKED the declared external-erasure operation of an HTTP_API-bound
     // resource (ETL D6 stance 6b) — rows linked to the erased subject were DELETED in a system the
     // platform does not own (OData canonical DELETE / Odoo `unlink` / a declared REST_JSON call).
@@ -648,6 +877,15 @@ export var CoreAuditableEventType;
     // USER_LIFECYCLE / CRITICAL: one event per acknowledged resource per erasure, never a standing
     // posture.
     CoreAuditableEventType["HTTP_API_NON_ERASURE_ACKNOWLEDGED"] = "http_api_non_erasure_acknowledged";
+    // A subject erasure's outcome at ONE RECIPIENT of the subject's data — a provider the
+    // application's declared flows reach (#1710). One row per recipient per erasure, naming the recipient, whose
+    // account reached it, who owes the Art. 19 communication and the outcome (a registered effect's status, or the
+    // status the recipient's declared erasure stance decides: UNMEASURED when it declares none). The queryable half of
+    // the per-recipient receipt `SubjectErasureReport.recipients` carries, so an evidence collector can read per-vendor
+    // outcomes without the application persisting reports. Vendor facts only — no personal data. USER_LIFECYCLE / INFO
+    // for every outcome: severity is fixed per event type, so a reader separates the recipients whose data stayed live by
+    // the row's `status`, never by its severity.
+    CoreAuditableEventType["SUBJECT_ERASURE_RECIPIENT_OUTCOME"] = "subject_erasure_recipient_outcome";
     // The application CALLED a declared operation on a third-party provider — one event per outbound
     // call, on both the success and the failure path.
     //
@@ -709,36 +947,85 @@ export var CoreAuditableEventType;
     // assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the
     // real initiating user carried through whichever account it spent.
     CoreAuditableEventType["MCP_TOOL_CALL"] = "mcp_tool_call";
-    // A human APPROVER changed a proposed tool call's arguments and approved the changed call (#566).
-    //
-    // The strongest act available on the approval plane, and the reason it is its own member rather
-    // than a flag on some broader "approval decided" event: on every other decision the approver
-    // ASSENTS to a call the model authored, and here they AUTHOR one the model never proposed. An
-    // incident reader asking "who wrote the arguments this tool ran with" is asking a different
-    // question from "who let it run", and folding the two would make the first unanswerable by query.
+    // The application's BACKEND called a vendor to discharge an engine CAPABILITY (#1712): sent a
+    // transactional email or an SMS, called the billing provider, moved bytes to or from a storage vendor.
     //
-    // Emitted ONLY when the executed input differs from the proposed one. An ordinary approval is not
-    // this event and is deliberately not recorded here — the plane has no approval-decision trail at
-    // all yet, which is a separate gap with its own issue; adding half of one under this name would
-    // make `mcp_tool_call`'s mistake in the other direction, an event that answers two questions and
-    // neither well.
+    // A sibling of `PROVIDER_OPERATION_CALL`, not a case of it, for the reason `MCP_TOOL_CALL` is one: a
+    // capability call is not a CATALOGUE operation. It has no `operationId`, no catalogue `domain` and no
+    // declared READ/WRITE classification; its act is named by the capability and a closed action instead.
+    // Folding them would make "which catalogue operations ran" answer with emails. The ATTRIBUTION fields
+    // are identical, so "what did this application send to that vendor" is one shape of query over all three.
     //
-    // NAMES AND DIGESTS ONLY — never argument values. Identical reasoning to
-    // `RESOURCE_OPERATION_PERFORMED`'s `changedFields` / `fieldEvidence` split: audit rows replicate
-    // to the per-org SIEM and to an immutable ledger that cannot be scrubbed, so copying arbitrary
-    // tool arguments here would manufacture an unerasable duplicate of whatever a person typed, in
-    // direct conflict with GDPR Art. 17. The two digests prove executed ≠ proposed; the key names say
-    // WHICH arguments a person authored. Neither can leak content.
+    // NO SUBJECT by construction, and that is a decision rather than an omission. #412 declined any
+    // persisted record of a sent email — even metadata-only, recipient and template included — because it
+    // would be a new personal-data store owing export, erasure and a retention class. So no field here
+    // names a recipient, a phone number, a file, a customer or a payload: the row describes the
+    // application's EGRESS, not the person the data is about. It still carries ATTRIBUTION like every audit
+    // row — the initiating actor where the egress knows one, and `connectionOwnerId`, whose account was
+    // spent (a person, for a file in their Drive) — which is why it exports at SUBJECT_DETAIL like its
+    // siblings. Email, SMS and billing are reached without an execution context and carry no actor.
     //
-    // Classified AUTHORIZATION / WARNING. Authorization because the act IS a human authorization
-    // decision, not a data access. WARNING rather than CRITICAL for the same reading the OAuth grant
-    // rows take: it is notable, dashboard-worthy and worth reviewing, and it is an AUTHORIZED action
-    // taken by an identified person with the pause in front of them — reserving CRITICAL for the rows
-    // that mean something is wrong is what keeps a severity filter usable.
+    // Classified DATA_ACCESS / INFO for its siblings' reason: routine, authorized activity whose value is
+    // the queryable trail rather than an alarm.
     //
-    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the approver who authored the
-    // executed arguments is recorded beside proof that they differed from the proposal.
-    CoreAuditableEventType["AGENT_TOOL_APPROVAL_MODIFIED"] = "agent_tool_approval_modified";
+    // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every physical call a capability
+    // makes to a vendor is recorded with its provider, capability and outcome.
+    CoreAuditableEventType["PROVIDER_CAPABILITY_CALL"] = "provider_capability_call";
+    // ── Human decisions on an agent's work (#1594) ──
+    // One family for BOTH planes — the conversational tool approval and the actor-system suspension —
+    // keyed by one `decisionRef`. Every row carries names and ids only: no argument values and no
+    // digests (#1595 D5), because a trail that holds what an agent was about to write cannot be scrubbed.
+    // All AUTHORIZATION: each records who may, or did, authorize an agent's action.
+    /** A decision was raised and is waiting. Actor: the requester's principal, with the agent. */
+    CoreAuditableEventType["HUMAN_DECISION_REQUESTED"] = "human_decision_requested";
+    /**
+     * A decision ended — answered, lapsed, withdrawn, or its requester's authority lapsed. Exactly one
+     * per `decisionRef`, written only by whoever won the compare-and-swap that released the pause.
+     * `outcome` says which; a SIEM that wants modified approvals filters on it.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every human decision on an agent's action is recorded once, with its decider and outcome.
+     */
+    CoreAuditableEventType["HUMAN_DECISION_RESOLVED"] = "human_decision_resolved";
+    /** A decision was moved to another person (an answerer's handover, or a supervisor's takeover). */
+    CoreAuditableEventType["HUMAN_DECISION_REASSIGNED"] = "human_decision_reassigned";
+    /** A decision was escalated — moved up, never denied. */
+    CoreAuditableEventType["HUMAN_DECISION_ESCALATED"] = "human_decision_escalated";
+    /** A role-routed decision was claimed by one holder, or given back to the role (`claimed: false`). */
+    CoreAuditableEventType["HUMAN_DECISION_CLAIMED"] = "human_decision_claimed";
+    /** Someone tried to act on a decision and the predicate refused them. WARNING: the refusal is the evidence. */
+    CoreAuditableEventType["HUMAN_DECISION_ANSWER_REFUSED"] = "human_decision_answer_refused";
+    // #1628 — deadlines. A deadline changes who is asked and who is told, never the outcome, so none of
+    // these rows is a decision: RESOLVED stays the one row that says how a decision ended.
+    /** A decision's CLAIM or DECISION deadline passed with nobody having taken or answered it. Actor: the application. */
+    CoreAuditableEventType["HUMAN_DECISION_DEADLINE_MISSED"] = "human_decision_deadline_missed";
+    /**
+     * A deadline stage's escalation rule fired: who was notified, and — for a REASSIGN rule — whether its
+     * target resolved and could answer. Actor: the application.
+     *
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — every rule-driven change to who is asked about an agent's action is recorded, including a reassignment refused because its target could not answer.
+     */
+    CoreAuditableEventType["HUMAN_DECISION_ESCALATION_FIRED"] = "human_decision_escalation_fired";
+    /** A person admitted to answer stopped the decision's CLAIM and DECISION clocks, naming a declared pause state. */
+    CoreAuditableEventType["HUMAN_DECISION_CLOCK_PAUSED"] = "human_decision_clock_paused";
+    /** A person admitted to answer restarted the clocks; the paused time was added to both deadlines. */
+    CoreAuditableEventType["HUMAN_DECISION_CLOCK_RESUMED"] = "human_decision_clock_resumed";
+    // ── Autonomous agents (#1611) ──
+    // An agent that runs with nobody on a socket, under a tenant-granted machine credential. The binding is
+    // a grant of standing authority, so both directions are recorded; every turn the entry point starts or
+    // refuses is recorded too, so an unattended action is never unexplained.
+    /**
+     * An autonomous agent may now run in an organization: a client of that organization was bound to it,
+     * or a firm's client that runs it was admitted by the organization's service-provider relationship.
+     *
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — granting an agent standing authority to act unattended is recorded.
+     */
+    CoreAuditableEventType["AUTONOMOUS_AGENT_BOUND"] = "autonomous_agent_bound";
+    /** An autonomous agent may no longer run in an organization: its binding or its admission was removed. */
+    CoreAuditableEventType["AUTONOMOUS_AGENT_UNBOUND"] = "autonomous_agent_unbound";
+    /** The autonomous entry point opened a turn. Actor: the machine principal it resolved. */
+    CoreAuditableEventType["AUTONOMOUS_AGENT_TURN_STARTED"] = "autonomous_agent_turn_started";
+    /** The autonomous entry point refused to open a turn, and created nothing. WARNING: `reason` says why. */
+    CoreAuditableEventType["AUTONOMOUS_AGENT_TURN_REFUSED"] = "autonomous_agent_turn_refused";
     // ── OAuth2 / OIDC Provider Events (Wildo AS the authorization server) ──
     // Distinct from the `OAUTH2_*` family above, which records Wildo CONSUMING an
     // EXTERNAL social OAuth provider. These record the app-issued OAuth2/OIDC provider
@@ -888,6 +1175,52 @@ export var ProviderOperationScopeCheck;
     /** The grant recorded its scopes and lacks at least one required scope. The call was refused before any request. */
     ProviderOperationScopeCheck["MISSING"] = "missing";
 })(ProviderOperationScopeCheck || (ProviderOperationScopeCheck = {}));
+/**
+ * WHICH engine capability an outbound capability call discharged (#1712) — the egress, not the vendor.
+ *
+ * Deliberately not {@link EngineCapability}: file storage is not an engine capability (a storage is selected
+ * per field, not per application), and email is two capabilities (transactional and marketing) with one
+ * egress. The finer engine capability, where one exists, rides `engineCapability` beside it.
+ */
+export var ProviderCapabilityEgress;
+(function (ProviderCapabilityEgress) {
+    ProviderCapabilityEgress["EMAIL"] = "email";
+    ProviderCapabilityEgress["SMS"] = "sms";
+    ProviderCapabilityEgress["BILLING"] = "billing";
+    ProviderCapabilityEgress["FILE_STORAGE"] = "file_storage";
+    /** A captcha vendor's backend verification of a token a public form submitted (#1735). */
+    ProviderCapabilityEgress["CAPTCHA"] = "captcha";
+})(ProviderCapabilityEgress || (ProviderCapabilityEgress = {}));
+/** WHAT a capability call did (#1712). One member per act the egress performs; billing names its adapter method apart. */
+export var ProviderCapabilityCallAction;
+(function (ProviderCapabilityCallAction) {
+    ProviderCapabilityCallAction["EMAIL_SEND"] = "email_send";
+    ProviderCapabilityCallAction["SMS_SEND"] = "sms_send";
+    /** One call of the billing adapter; `billingOperation` names which. */
+    ProviderCapabilityCallAction["BILLING_OPERATION"] = "billing_operation";
+    ProviderCapabilityCallAction["FILE_STORAGE_UPLOAD"] = "file_storage_upload";
+    ProviderCapabilityCallAction["FILE_STORAGE_DOWNLOAD"] = "file_storage_download";
+    ProviderCapabilityCallAction["FILE_STORAGE_READ_METADATA"] = "file_storage_read_metadata";
+    ProviderCapabilityCallAction["FILE_STORAGE_DELETE"] = "file_storage_delete";
+    /** One token sent to a captcha vendor's verification endpoint (reCAPTCHA `siteverify`). */
+    ProviderCapabilityCallAction["CAPTCHA_VERIFY"] = "captcha_verify";
+})(ProviderCapabilityCallAction || (ProviderCapabilityCallAction = {}));
+/**
+ * How ONE capability call ended, as far as the application can know (#1712).
+ *
+ * Three members, not two, because a call can leave and never be answered: an email whose transport timed out after
+ * the request was sent may or may not have been accepted. Reporting that as a failure would invite a resend the
+ * vendor may already have honoured; reporting it as a success would claim what nobody observed.
+ */
+export var ProviderCapabilityCallOutcome;
+(function (ProviderCapabilityCallOutcome) {
+    /** The vendor answered and accepted the call. */
+    ProviderCapabilityCallOutcome["SUCCEEDED"] = "succeeded";
+    /** The call was refused — by the vendor, or before it left (a missing credential, a refused request). */
+    ProviderCapabilityCallOutcome["FAILED"] = "failed";
+    /** The call left and its result was not observed (a timeout or a broken connection after sending). */
+    ProviderCapabilityCallOutcome["OUTCOME_UNKNOWN"] = "outcome_unknown";
+})(ProviderCapabilityCallOutcome || (ProviderCapabilityCallOutcome = {}));
 export var ProviderOperationDenialReason;
 (function (ProviderOperationDenialReason) {
     /**
@@ -1076,6 +1409,18 @@ export var ResourceOperationDenialReason;
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
      */
     ResourceOperationDenialReason["STEP_UP_REQUIRED_BY_FRESHNESS"] = "step_up_required_by_freshness";
+    /**
+     * A service firm's expert was refused in a CLIENT organization because the client organization type's
+     * authentication policy asks for a factor the session has not satisfied FOR THAT CLIENT (#1633).
+     *
+     * Distinct from the two above because the party that demanded the proof is a third one: not the operation, not the
+     * expert's own user type, but the TENANT the expert is working in. A reviewer reading the client's trail sees its
+     * own policy being enforced on outside staff; the row carries the relationship through the usual attribution.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["STEP_UP_REQUIRED_BY_CLIENT_ORGANIZATION_POLICY"] = "step_up_required_by_client_organization_policy";
 })(ResourceOperationDenialReason || (ResourceOperationDenialReason = {}));
 /** SSO configuration change type. */
 export var SsoConfigChangeType;
@@ -1842,8 +2187,8 @@ export var OrganizationTypeAssignmentBasis;
 export const AuditableEvent_Organization_TypeAssignedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED),
     organizationId: z.string(),
-    /** The declared organization type now stored on the row. */
-    organizationType: z.string(),
+    /** The declared organization type now stored on the row, shown as its word (`system_enums.OrganizationType.<type>`). */
+    organizationType: z.string().systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE),
     /**
      * The type the row stored before, when it stored one the configuration no longer declares. Absent for an organization
      * that had no type. Recorded because this assignment REPLACES a value someone once chose: a type removed from the
@@ -2290,7 +2635,8 @@ export const AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSc
 //
 // ## Why a provider ref and a slug, and nothing about the value
 //
-// A reader needs to know WHICH authority moved. `providerRef` + `secretSlug` say that completely.
+// A reader needs to know WHICH authority moved. `connectionRef` + `secretSlug` say that completely — the
+// stored credential's key (#1670) — and `providerRef` says which ref the act went through.
 // A fingerprint of the value was considered and rejected: it is a stable oracle for confirming a
 // guessed secret, so it would put a verification oracle into the one store designed never to
 // forget.
@@ -2304,6 +2650,13 @@ export const AuditableEvent_OrganizationProviderCredential_SetEventDataSchema =
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     /** The acting administrator. Absent only on a system-initiated write, which none exists today. */
     setBy: z.string().optional(),
@@ -2322,6 +2675,13 @@ export const AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchem
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     rotatedBy: z.string().optional(),
     credentialId: z.string(),
@@ -2344,6 +2704,18 @@ export const AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema =
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
+    /**
+     * The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several
+     * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.
+     */
+    providerPackageName: z.string().optional(),
     secretSlug: z.string(),
     resolvedFrom: z.enum(ProviderCredentialResolutionSource),
     /** Absent when `resolvedFrom` is the deployment environment — there is no row to name. */
@@ -2369,6 +2741,13 @@ export const AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchem
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     deletedBy: z.string().optional(),
     credentialId: z.string(),
@@ -2381,10 +2760,13 @@ export const AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchem
      * a trail that says "we deleted our copy" and one that says whether the person's access was
      * actually withdrawn where it lives.
      *
-     * ABSENT rather than a member when nothing was attempted — an organization purge through the raw
-     * repository has no token to hand back. `not_declared` is the ordinary answer for a vendor whose
-     * revocation is not RFC 7009-shaped, and for a pasted credential that was never a grant; it is a
-     * recorded fact, not a failure.
+     * Written by EVERY door that destroys a credential: the revoke doors (#545), and since #1711 the
+     * cascade observers for a subject erasure, a hard delete of the user row, the invitation sweep and an
+     * organization purge — each reads the token out of the pre-deletion row the cascade hands over. ABSENT
+     * only on a row written before #1711, when the cascades attempted nothing. `not_declared` is the
+     * ordinary answer for a vendor whose revocation is not RFC 7009-shaped, and for a pasted credential that
+     * was never a grant; it is a recorded fact, not a failure. There is no retry: the token existed only in
+     * the destroyed row, so this value is the whole record.
      */
     vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),
 });
@@ -2409,6 +2791,13 @@ export const AuditableEvent_UserProviderCredential_SetEventDataSchema = z.object
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     credentialId: z.string(),
 });
@@ -2420,9 +2809,12 @@ export const AuditableEvent_UserProviderCredential_SetEventDataSchema = z.object
  *
  * `grantedScopes` is what the VENDOR said it issued, not what was asked for. The two differ often
  * enough to matter: a vendor may narrow a request against what the account is permitted, and the
- * answer to "what could this application actually do as them" is the granted set. Optional because
- * several vendors return no scope at all on a token response, and an empty array would assert
- * something stronger than silence.
+ * answer to "what could this application actually do as them" is the granted set. Since #1671 it is the
+ * set the stored grant RECORDS after this authorization: a token answer without `scope` granted what was
+ * requested (RFC 6749 §5.1), and a re-authorization of a vendor that accumulates consent unites the new
+ * answer with the previous consent (`consentAccumulated`). Optional because a grant may record none, and an
+ * empty array would assert something stronger than silence.
+ * spec-cite: RFC 6749 §5.1 (the `scope` row of the access token response).
  *
  * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party
  * delegated access, and the authorization's extent is recorded with it.
@@ -2431,6 +2823,18 @@ export const AuditableEvent_UserProviderConnection_GrantedEventDataSchema = z.ob
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
+    /**
+     * The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several
+     * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.
+     */
+    providerPackageName: z.string().optional(),
     secretSlug: z.string(),
     credentialId: z.string(),
     grantedScopes: z.array(z.string()).optional(),
@@ -2448,6 +2852,17 @@ export const AuditableEvent_UserProviderConnection_GrantedEventDataSchema = z.ob
      * which is exactly the sequence worth being able to see.
      */
     replacedExistingConnection: z.boolean(),
+    /**
+     * Present when this authorization GREW an existing grant (#1671): the scopes the re-authorization was started to
+     * add, the operation whose refusal offered it and the package whose code that operation is (an opted-in
+     * augmentation's, or the ref's own). `addedForOperationId` is as the start request named it; the scopes were
+     * checked against the connection's ceiling. `consentAccumulated` says whether the stored granted set was united
+     * with the previous consent (a vendor that accumulates consent) or replaced by a restated authorization.
+     */
+    addedScopes: z.array(z.string()).optional(),
+    addedForOperationId: z.string().optional(),
+    addedForPackageName: z.string().optional(),
+    consentAccumulated: z.boolean().optional(),
 });
 /**
  * An ORGANIZATION's delegated authorization toward a vendor was granted.
@@ -2466,6 +2881,18 @@ export const AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchem
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED),
     organizationId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
+    /**
+     * The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several
+     * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.
+     */
+    providerPackageName: z.string().optional(),
     secretSlug: z.string(),
     credentialId: z.string(),
     grantedByUserId: z.string().optional(),
@@ -2480,6 +2907,11 @@ export const AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchem
     delegation: z.enum(ExternalProvider_Connection_DelegationMode).optional(),
     /** The grantor acknowledged, before consenting at the vendor, that the whole organization will use their account. */
     organizationWideUseAcknowledged: z.boolean().optional(),
+    /** See the person's event: the re-authorization that grew the grant (#1671). */
+    addedScopes: z.array(z.string()).optional(),
+    addedForOperationId: z.string().optional(),
+    addedForPackageName: z.string().optional(),
+    consentAccumulated: z.boolean().optional(),
 });
 /**
  * The stored VALUE changed for a person's credential that already existed.
@@ -2495,6 +2927,13 @@ export const AuditableEvent_UserProviderCredential_RotatedEventDataSchema = z.ob
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     credentialId: z.string(),
     /** When the value it replaced was set — how long the retired secret was live. */
@@ -2515,6 +2954,18 @@ export const AuditableEvent_UserProviderCredential_UsedEventDataSchema = z.objec
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
+    /**
+     * The npm package that owns the ref the grant was spent or granted through (#1725). On a shared connection several
+     * refs — from several packages — spend one grant, so the connection alone does not say whose code acted.
+     */
+    providerPackageName: z.string().optional(),
     secretSlug: z.string(),
     resolvedFrom: z.enum(ProviderCredentialResolutionSource),
     credentialId: z.string(),
@@ -2543,6 +2994,13 @@ export const AuditableEvent_UserProviderCredential_DeletedEventDataSchema = z.ob
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED),
     userId: z.string(),
     providerRef: z.string(),
+    /**
+     * The CONNECTION the credential belongs to (#1670) — the row's key and what its seal binds. `providerRef`
+     * beside it names the ref the act went through (or, on a write, the ref that created the row); the two
+     * differ once several refs of one vendor share a connection (#1725). Optional only because rows written
+     * before #1670 in the immutable trail do not carry it; every emitter since sets it.
+     */
+    connectionRef: z.string().optional(),
     secretSlug: z.string(),
     deletedBy: z.string().optional(),
     credentialId: z.string(),
@@ -2555,10 +3013,13 @@ export const AuditableEvent_UserProviderCredential_DeletedEventDataSchema = z.ob
      * a trail that says "we deleted our copy" and one that says whether the person's access was
      * actually withdrawn where it lives.
      *
-     * ABSENT rather than a member when nothing was attempted — an organization purge through the raw
-     * repository has no token to hand back. `not_declared` is the ordinary answer for a vendor whose
-     * revocation is not RFC 7009-shaped, and for a pasted credential that was never a grant; it is a
-     * recorded fact, not a failure.
+     * Written by EVERY door that destroys a credential: the revoke doors (#545), and since #1711 the
+     * cascade observers for a subject erasure, a hard delete of the user row, the invitation sweep and an
+     * organization purge — each reads the token out of the pre-deletion row the cascade hands over. ABSENT
+     * only on a row written before #1711, when the cascades attempted nothing. `not_declared` is the
+     * ordinary answer for a vendor whose revocation is not RFC 7009-shaped, and for a pasted credential that
+     * was never a grant; it is a recorded fact, not a failure. There is no retry: the token existed only in
+     * the destroyed row, so this value is the whole record.
      */
     vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),
 });
@@ -2593,6 +3054,214 @@ export const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema = z.ob
     /** `jti` of the signed probe, for correlation with the consumer's own logs. */
     signatureJti: z.string(),
 });
+// Inbound Delivery Event Data Schemas (#1596)
+//
+// None of these carries the payload, a header value or an error message: the payload is the sender's
+// data (routinely a client's personal data) and lives on the delivery row, which is erased with its
+// organization. The trail names the delivery and says what happened to it.
+const InboundDeliveryAuditBase = {
+    sourceKind: z.enum(InboundSourceKind),
+    /** `{providerRef}:{endpointKey}`, `app` for an application endpoint. */
+    sourceKey: z.string(),
+};
+export const AuditableEvent_InboundDelivery_RejectedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_REJECTED),
+    ...InboundDeliveryAuditBase,
+    reason: z.enum(InboundDeliveryRejectionReason),
+    /**
+     * How many identical refusals (same source, same reason) this row records. Refusals are aggregated to
+     * one row per source and reason per minute, so a flood of unsigned requests cannot grow the audit trail
+     * without bound: the first refusal of a window is written at once (1), and the ones folded after it are
+     * written when the window closes, as one row carrying their count. Summing `refusalCount` over the rows
+     * gives the number of refusals — no row is counted twice. The one count that can be lost is the window
+     * open when the backend process stops.
+     */
+    refusalCount: z.number().int().positive(),
+});
+export const AuditableEvent_InboundDelivery_AcceptedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    resolvedScopeKind: z.enum(InboundResolvedScopeKind),
+    organizationId: z.string().optional(),
+    /**
+     * The channel and how well the sender was known when the delivery was accepted (#1630, I8) — the record
+     * of what a handler's work was triggered by. Identification only: the handler's roles are its declared
+     * `actingRoles` whatever this says. Never the sender's address.
+     */
+    channel: z.enum(InboundChannelKind),
+    senderAssurance: z.enum(InboundSenderAssurance),
+});
+export const AuditableEvent_InboundDelivery_UnroutableEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    reason: z.enum(InboundDeliveryUnroutableReason),
+});
+export const AuditableEvent_InboundDelivery_ProcessedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    attempt: z.number().int().positive(),
+});
+export const AuditableEvent_InboundDelivery_FailedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_FAILED),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    attempt: z.number().int().positive(),
+    /** A classification (an error type or reference), never an error message. */
+    errorCode: z.string(),
+    nextAttemptAt: z.date(),
+});
+export const AuditableEvent_InboundDelivery_DeadEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_DEAD),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    attempts: z.number().int().positive(),
+    errorCode: z.string(),
+});
+export const AuditableEvent_InboundDelivery_ReplayedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED),
+    ...InboundDeliveryAuditBase,
+    inboundDeliveryId: z.string(),
+    handlerRef: z.string(),
+    replayedBy: z.string(),
+    /** The operator's written reason — free text, so this event's bag is SUBJECT_DETAIL for export. */
+    justification: z.string(),
+});
+// Inbound Channel Event Data Schemas (#1630). Ids and named outcomes only — never an address, a subject
+// or a body: the correspondence lives in its thread and channel record, erasable there.
+export const AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE),
+    channel: z.enum(InboundChannelKind),
+    /** The handler selected for the message, whose minimum it did not meet. */
+    handlerRef: z.string(),
+    senderAssurance: z.enum(InboundSenderAssurance),
+    minimumSenderAssurance: z.enum(InboundSenderAssurance),
+    disposition: z.enum(InboundBelowMinimumDisposition),
+    /** For `ROUTED_TO_BELOW_MINIMUM_HANDLER`: the handler that received it instead, and its delivery. */
+    belowMinimumHandlerRef: z.string().optional(),
+    inboundDeliveryId: z.string().optional(),
+    /** The channel's id for the message (the provider message id for email). */
+    channelMessageId: z.string(),
+    organizationId: z.string(),
+});
+const InboundReplyAuditBase = {
+    channel: z.enum(InboundChannelKind),
+    threadId: z.string(),
+    conversationMessageId: z.string(),
+    submissionId: z.string(),
+};
+export const AuditableEvent_InboundReply_SentEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_SENT),
+    ...InboundReplyAuditBase,
+    templateRef: z.string(),
+    recipientCount: z.number().int().positive(),
+    /** True when the provider reported it had already accepted this submission — a retried send, not a second email. */
+    deduplicated: z.boolean(),
+});
+export const AuditableEvent_InboundReply_FailedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_FAILED),
+    ...InboundReplyAuditBase,
+    /** A classification, never an error message. */
+    failureCode: z.string(),
+});
+export const AuditableEvent_InboundReplyToken_RevokedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED),
+    threadId: z.string(),
+    replyTokenId: z.string(),
+    reason: z.enum(ReplyTokenRevocationReason),
+});
+export const AuditableEvent_InboundReplyToken_DowngradedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED),
+    threadId: z.string(),
+    replyTokenId: z.string(),
+    reason: z.enum(ReplyTokenDowngradeReason),
+    /** The level the message was given instead of `THREAD_TOKEN_BOUND`. */
+    derivedAssurance: z.enum(InboundSenderAssurance),
+});
+// Receiving Email Event Data Schemas (#1600). A domain and a client mailbox address are an ORGANIZATION's
+// infrastructure, not a person's data, so they are named. A received message is named by its row id only:
+// its sender, subject and filenames live in the `inboundEmails` row, erasable there.
+const OrganizationEmailDomainAuditBase = {
+    organizationId: z.string(),
+    organizationEmailDomainId: z.string(),
+    domain: z.string(),
+};
+export const AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED),
+    ...OrganizationEmailDomainAuditBase,
+    sending: z.boolean(),
+    receiving: z.boolean(),
+});
+export const AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED),
+    ...OrganizationEmailDomainAuditBase,
+    providerRef: z.string(),
+    providerDomainId: z.string(),
+});
+export const AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED),
+    ...OrganizationEmailDomainAuditBase,
+    /** What the provider answered: VERIFIED, FAILED, or still PROVIDER_PENDING (its verification is asynchronous). */
+    status: z.enum(OrganizationEmailDomainStatus),
+});
+export const AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED),
+    ...OrganizationEmailDomainAuditBase,
+    reason: z.enum(OrganizationEmailDomainSuspensionReason),
+});
+export const AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED),
+    ...OrganizationEmailDomainAuditBase,
+    trigger: z.enum(OrganizationEmailDomainRemovalTrigger),
+    /** Whether a provider domain existed and was deleted there (false for a claim that never proved ownership). */
+    providerDomainDeleted: z.boolean(),
+});
+/**
+ * A client mailbox links two organizations, so the event is written to BOTH trails: the firm that owns the mailbox,
+ * and the client whose organization it routes mail into. `organizationId` is the trail the row is in.
+ */
+const ClientMailboxAuditBase = {
+    organizationId: z.string(),
+    clientMailboxId: z.string(),
+    address: z.string(),
+    emailDomainId: z.string(),
+    serviceProviderRelationshipId: z.string(),
+    /** The firm that owns the domain and the mailbox. */
+    firmOrganizationId: z.string(),
+    /** The client organization the mailbox routes into. */
+    clientOrganizationId: z.string(),
+};
+export const AuditableEvent_ClientMailbox_CreatedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.CLIENT_MAILBOX_CREATED),
+    ...ClientMailboxAuditBase,
+});
+export const AuditableEvent_ClientMailbox_RemovedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.CLIENT_MAILBOX_REMOVED),
+    ...ClientMailboxAuditBase,
+});
+export const AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD),
+    organizationId: z.string(),
+    inboundEmailId: z.string(),
+    reason: z.enum(InboundEmailWithheldReason),
+    /** The stored (quarantined) file, when one was stored. */
+    fileId: z.string().optional(),
+});
+export const AuditableEvent_InboundEmail_RejectedLimitEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT),
+    organizationId: z.string(),
+    inboundEmailId: z.string(),
+    limit: z.enum(InboundEmailLimit),
+    sizeBytes: z.number().int().nonnegative(),
+    attachmentCount: z.number().int().nonnegative(),
+});
 // SCIM Directory Provisioning Event Data Schemas
 export const AuditableEvent_SCIM_TokenCreatedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.SCIM_TOKEN_CREATED),
@@ -3259,6 +3928,101 @@ export const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.objec
  * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION
  * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.
  */
+/**
+ * The fields both legal-hold events carry: which hold, which tenant, what it covers and on what ground.
+ * The `justification` / `releaseReason` prose is NOT carried — it is free text most likely to name a third
+ * party, and it stays on the hold row, which the tenant and the operator can read.
+ */
+const LegalHoldAuditEventFields = {
+    holdId: z.string(),
+    heldOrganizationId: z.string(),
+    scopeKind: z.enum(LegalHoldScopeKind),
+    legalGround: z.enum(LegalHoldGround),
+    placementTier: z.enum(LegalHoldPlacementTier),
+    /** `RESOURCE_ROWS` only. */
+    heldResourceType: z.string().optional(),
+    /** `RESOURCE_ROWS` only: how many rows the hold lists (absent = every row of the resource type). */
+    heldRowCount: z.number().int().min(0).optional(),
+    /** `DATA_SUBJECT` only. */
+    subjectUserId: z.string().optional(),
+};
+/** A legal hold was placed (#1634). */
+export const AuditableEvent_LegalHoldPlaced_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.LEGAL_HOLD_PLACED),
+    ...LegalHoldAuditEventFields,
+    placedByUserId: z.string(),
+});
+/**
+ * A model-cost period aggregate was linked to its invoice (#1598). Identifiers, the period and the currency
+ * only: no amount (the aggregate row holds it), no personal data.
+ */
+export const AuditableEvent_ModelCostAggregateInvoiceLinked_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED),
+    aggregateId: z.string(),
+    /** The tenant whose cost the aggregate records, and whose invoice it is. */
+    billedOrganizationId: z.string(),
+    /** First instant of the aggregate's calendar month (UTC), ISO. */
+    periodStart: z.string(),
+    currency: z.string(),
+    organizationInvoiceRefId: z.string(),
+    /** The administrator (or the billing flow's principal) who linked it. */
+    linkedByUserId: z.string().optional(),
+});
+/** An organization's content-capture setting changed (#1599). The setting, never any content. */
+export const AuditableEvent_CorrectionCaptureSettingChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED),
+    settingOrganizationId: z.string(),
+    /** `metadata_only` / `with_content`, before and after. */
+    previousContentCapture: z.string().optional(),
+    contentCapture: z.string(),
+    /** Whether a purpose is stated (the purpose text is on the setting row, not on the trail). */
+    purposeStated: z.boolean(),
+    contentReaderRole: z.string().optional(),
+    narrowedToCaseCount: z.number().int().min(0),
+    changedByUserId: z.string().optional(),
+});
+/** An organization's evaluation-export authorisation changed (#1599). The basis and counts, never case identities. */
+export const AuditableEvent_EvaluationExportAuthorizationChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED),
+    authorizationOrganizationId: z.string(),
+    status: z.string(),
+    previousStatus: z.string().optional(),
+    /** Absent when the authorisation holds none (NOT_GRANTED). */
+    basis: z.string().optional(),
+    clientConsentCount: z.number().int().min(0),
+    excludedCaseCount: z.number().int().min(0),
+    changedByUserId: z.string().optional(),
+});
+/** An evaluation dataset was exported (#1599). The ledger row names every record; the trail names the export. */
+export const AuditableEvent_EvaluationDatasetExported_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EVALUATION_DATASET_EXPORTED),
+    exportId: z.string(),
+    exportOrganizationId: z.string(),
+    agentRef: z.string(),
+    basis: z.string(),
+    recordCount: z.number().int().min(0),
+    windowFrom: z.string(),
+    windowTo: z.string(),
+    destination: z.string(),
+    exportedByUserId: z.string().optional(),
+});
+/** An evaluation-dataset export was refused (#1599 I7). */
+export const AuditableEvent_EvaluationDatasetExportRefused_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED),
+    exportOrganizationId: z.string(),
+    agentRef: z.string(),
+    /** Why: no authorisation recorded, or it is revoked. */
+    reason: z.enum(EvaluationDatasetExportRefusalReason),
+    attemptedByUserId: z.string().optional(),
+});
+/** A legal hold was released (#1634). */
+export const AuditableEvent_LegalHoldReleased_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.LEGAL_HOLD_RELEASED),
+    ...LegalHoldAuditEventFields,
+    releasedByUserId: z.string(),
+    /** How long the hold was in force, so a reviewer sees the suspension window without a join. */
+    heldForSeconds: z.number().int().min(0),
+});
 export const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE),
     /** Which transition this row records. */
@@ -3305,6 +4069,198 @@ export const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.obj
      */
     grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),
 });
+/**
+ * One transition in the life of a service-provider relationship (#1597).
+ *
+ * Read it to answer "which firm could reach this tenant, under what scope, since when — and who decided".
+ * Written once to the CLIENT's trail and once to the FIRM's: the same facts, each organization reading
+ * them in its own tenant. `purpose` and `decisionReason` are free text people typed, so they are carried
+ * for the tenants' own trails and are NOT exported to a SIEM by default.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING
+ */
+export const AuditableEvent_ServiceProviderRelationshipLifecycle_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE),
+    transition: z.enum(ServiceProviderRelationshipTransition),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    resultingStatus: z.enum(ServiceProviderRelationshipStatus),
+    /** The role the relationship confers after this transition. */
+    role: z.string(),
+    /** Its scope after this transition; empty ⇒ organization-wide. */
+    organizationUnitIds: z.array(z.string()),
+    endsAt: z.date().optional(),
+    proposedByOrganizationId: z.string(),
+    /** The person who acted, and on which side. Absent for the expiry sweep. */
+    actorUserId: z.string().optional(),
+    actorOrganizationId: z.string().optional(),
+    purpose: z.string().optional(),
+    decisionReason: z.string().optional(),
+    /** How the firm's experts are admitted after this transition (#1612) — what `EXPERT_ADMISSION_POLICY_CHANGED` changed. */
+    expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional(),
+});
+/** A firm machine client admitted into / removed from a client organization under a relationship (#1597, S3). */
+export const AuditableEvent_ServiceProviderMachineClientAdmissionChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED),
+    admitted: z.boolean(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    oauthClientId: z.string(),
+    actorUserId: z.string().optional(),
+});
+/** An expert assigned to a client relationship by their firm (#1597). */
+export const AuditableEvent_ServiceProviderExpertAssigned_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED),
+    assignmentId: z.string(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    expertUserId: z.string(),
+    actorUserId: z.string().optional(),
+});
+/** An expert's assignment to a client relationship ended by their firm (#1597). */
+export const AuditableEvent_ServiceProviderExpertUnassigned_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED),
+    assignmentId: z.string(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    expertUserId: z.string(),
+    actorUserId: z.string().optional(),
+});
+/**
+ * The facts every per-expert approval event carries (#1612). Identical in the client's and the firm's trail — which
+ * is why none of them names the client administrator who answered: the firm reads its copy, and the decider is on
+ * the decision's own `human_decision_resolved` row in the CLIENT's trail, joined by `decisionRef`.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING
+ */
+const ServiceProviderExpertApprovalEventShape = {
+    /** The human decision this approval is — the key that joins every row about it. */
+    decisionRef: z.string().trim().min(1),
+    assignmentId: z.string(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    expertUserId: z.string(),
+};
+/** A firm's assignment now waits for the client's approval (#1612). Actor: the firm administrator who assigned. */
+export const AuditableEvent_ServiceProviderExpertApprovalRequested_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED),
+    ...ServiceProviderExpertApprovalEventShape,
+    /** The policy that made the assignment wait — the client's, read at assignment time. */
+    expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy),
+    /** The role the expert would receive. */
+    role: z.string(),
+    actorUserId: z.string().optional(),
+});
+/** The client approved, and the expert was admitted (#1612). */
+export const AuditableEvent_ServiceProviderExpertApprovalGranted_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED),
+    ...ServiceProviderExpertApprovalEventShape,
+    role: z.string(),
+});
+/** The expert was not admitted (#1612). */
+export const AuditableEvent_ServiceProviderExpertApprovalDenied_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED),
+    ...ServiceProviderExpertApprovalEventShape,
+    denialReason: z.enum(ServiceProviderExpertApprovalDenialReason),
+});
+/** Nobody answered in time (#1612). */
+export const AuditableEvent_ServiceProviderExpertApprovalLapsed_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED),
+    ...ServiceProviderExpertApprovalEventShape,
+});
+/**
+ * The facts of one delegated capability grant (#1631), identical in the client's and the firm's trail: which
+ * capability, lent through which relationship, until when.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ */
+const ServiceProviderCapabilityGrantEventShape = {
+    grantId: z.string(),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    capability: z.enum(DelegatedAdministrativeCapability),
+    /** Whether only an owner could lend it — the CRITICAL rows. */
+    securityCritical: z.boolean(),
+    endsAt: z.date(),
+    /** The client person who acted. Absent when the relationship's end revoked it with nobody acting. */
+    actorUserId: z.string().optional(),
+};
+/** A capability was lent (#1631). */
+export const AuditableEvent_ServiceProviderCapabilityGranted_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED),
+    ...ServiceProviderCapabilityGrantEventShape,
+});
+/** A lent capability was revoked (#1631). */
+export const AuditableEvent_ServiceProviderCapabilityRevoked_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED),
+    ...ServiceProviderCapabilityGrantEventShape,
+    /** True when the relationship's ending revoked it, rather than a client administrator. */
+    byRelationshipEnd: z.boolean(),
+    /**
+     * Why it ended (#1631 review F10): a client administrator revoked it, the relationship ended, or the relationship was
+     * narrowed to organization units (which no capability can be carried by). Tells a narrowing apart from a manual
+     * revocation, which `byRelationshipEnd` alone cannot.
+     */
+    endCause: z.enum(ServiceProviderCapabilityGrantEndCause).optional(),
+    /** How many standing credentials the firm had obtained under the grant were ended with it (review F2). */
+    endedCredentials: z.number().int().nonnegative().optional(),
+});
+/** A client's decision about trusting a firm's identity provider's MFA on one relationship (#1633). */
+export const AuditableEvent_ServiceProviderMfaTrustChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    previousProviderMfaTrust: z.enum(ServiceProviderMfaTrust),
+    providerMfaTrust: z.enum(ServiceProviderMfaTrust),
+    actorUserId: z.string().optional(),
+});
+/**
+ * A factor recorded on an expert's session for one client organization (#1633).
+ *
+ * Names the factor and its SOURCE, never the proof itself. `identityProviderOrganizationId` is present exactly when
+ * the source is the firm's trusted identity provider.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+ */
+export const AuditableEvent_ServiceProviderClientAuthenticationSatisfied_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED),
+    organizationId: z.string(),
+    relationshipId: z.string(),
+    providerOrganizationId: z.string(),
+    expertUserId: z.string(),
+    factor: z.enum(AuthMethod),
+    source: z.enum(FactorSatisfactionSource),
+    identityProviderOrganizationId: z.string().optional(),
+});
+/** A firm's decision about collecting activity metadata on its own experts' client work (#1632). */
+export const AuditableEvent_ServiceProviderActivityFeedDecided_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED),
+    providerOrganizationId: z.string(),
+    previousStatus: z.enum(ServiceProviderActivityFeedStatus),
+    status: z.enum(ServiceProviderActivityFeedStatus),
+    acknowledgedWorkerConsultationNotice: z.boolean(),
+    actorUserId: z.string().optional(),
+});
+/** A client's decision about how much a firm's activity feed may say about work in it (#1632). */
+export const AuditableEvent_ServiceProviderActivityFeedDisclosureChanged_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED),
+    relationshipId: z.string(),
+    clientOrganizationId: z.string(),
+    providerOrganizationId: z.string(),
+    previousActivityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure),
+    activityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure),
+    actorUserId: z.string().optional(),
+});
 /**
  * One transition in the life of a system-of-record partition assignment.
  *
@@ -3675,6 +4631,13 @@ export const AuditableEvent_SubjectDataExport_EventDataSchema = z.object({
     fieldsWithheldAsNonDisclosable: z.array(z.string()),
     /** Tenant scope, when the export ran org-scoped. */
     organizationId: z.string().optional(),
+    /**
+     * Whether the application declares its subject-data recipients (#1710) — `declared` or `not-declared`. The value an
+     * evidence collector tallies: an export answering Art. 15(1)(c) from a declaration, versus one that could not.
+     */
+    recipientsStatus: z.enum(SubjectDataRecipientsStatementStatus),
+    /** The recipients (provider refs) the export named for this subject, sorted. Systems of record are accounted on their own lane. */
+    recipientRefs: z.array(z.string().trim().min(1)),
 });
 /**
  * A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.
@@ -3711,7 +4674,7 @@ export const AuditableEvent_CollectionDataExport_EventDataSchema = z.object({
     resourceType: z.string().trim().min(1),
     /** The LIST/SEARCH operation whose result set was exported. */
     sourceOperationIdentifier: z.string().trim().min(1),
-    /** `csv` | `json` — the rendered wire format. */
+    /** The rendered wire format — a `ResourceCollectionExportFormat` value (`csv`, `json` or `pdf`). */
     format: z.string().trim().min(1),
     /** `visible_page` | `full_result_set` — see the docstring; this is the field that matters most. */
     rowScope: z.string().trim().min(1),
@@ -3780,6 +4743,96 @@ export const AuditableEvent_ProviderOperationCall_EventDataSchema = z.object({
     executionType: z.string().optional(),
     /** The tenant the REQUEST was scoped to — see `connectionOwnerScope`. */
     organizationId: z.string().optional(),
+    /**
+     * The package that CONTRIBUTED this operation when it is not the provider's own (#1672) — an augmentation
+     * an application opted into, adding operations to a provider it does not own. Absent for an operation the
+     * provider's own module declares.
+     *
+     * The question it answers is the one a shared grant raises: when a call spends a connection the base
+     * provider owns, whose code wrote the request? Without it a reviewer sees the base ref and cannot tell the
+     * base's own operation from a third party's.
+     */
+    augmentationPackage: z.string().optional(),
+    /** The installed version of {@link augmentationPackage}, as `wildo config sync` recorded it. */
+    augmentationPackageVersion: z.string().optional(),
+    /**
+     * The CONNECTION whose grant the call spent (#1725) — the declared base of a shared connection, or the ref itself.
+     * On a shared connection `providerRef` names only the ref the call went THROUGH; this names the grant.
+     */
+    connectionRef: z.string().optional(),
+    /** The npm package that owns `providerRef` — whose code the call ran, when several packages share one grant. */
+    providerPackageName: z.string().optional(),
+    /**
+     * The resource AUDIENCE whose token was attached (#1725) — `graph`, `dataverse` — when the connection's grant spans
+     * several resources. Absent for a provider that mints one token for one resource.
+     */
+    tokenAudience: z.string().optional(),
+    /**
+     * What the call's RATE BUDGETS cost it (#1729). A vendor's allowance belongs to the connection (and, where the vendor
+     * counts per account, to the account it spends), so every call names the budgets it drew on — keys only, never a
+     * count of anyone's traffic — how long it waited for room, and whether the count was the deployment's SHARED one or
+     * this process's alone. On a refusal, `exhaustedBudgetKey` names the budget that was still full: an exhausted
+     * allowance is visible here instead of arriving as a vendor `429`.
+     */
+    rateBudget: z.object({
+        budgetKeys: z.array(z.string()),
+        counting: z.enum(RateBudgetCounting),
+        waitedMs: z.number().nonnegative(),
+        exhaustedBudgetKey: z.string().optional(),
+    }).optional(),
+});
+/**
+ * The backend CALLED a vendor to discharge an engine capability (#1712) — see the enum member for why this is
+ * neither a catalogue operation call nor a record about the data's subject.
+ *
+ * One event per PHYSICAL call the egress controls, on the success and the failure path. The granularity is the
+ * egress's own act: one email submission, one SMS, one storage verb, one billing adapter call. A billing adapter
+ * call that pages through a list may make several HTTP requests to the vendor under one row, as an agent turn does
+ * under one `providerCallRecords` row; the count is of the application's acts, not of the vendor's requests.
+ *
+ * No field names a subject — no recipient, number, file, customer or payload — so the schema, not a redaction
+ * step, is what keeps it out of the personal-data population.
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — records which vendor each capability reached,
+ * with what outcome, for every call the application made.
+ */
+export const AuditableEvent_ProviderCapabilityCall_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.PROVIDER_CAPABILITY_CALL),
+    /** The egress the call went out through. */
+    capability: z.enum(ProviderCapabilityEgress),
+    /** What it did. */
+    action: z.enum(ProviderCapabilityCallAction),
+    /**
+     * The vendor: the provider ref the capability resolved (`resend`, `twilio`, `stripe`), or, for file storage, the
+     * storage the file is kept in (`wildo_managed`, `google_drive`).
+     */
+    providerRef: z.string().trim().min(1),
+    /** The engine capability the egress served, when it serves several (email: transactional or marketing). */
+    engineCapability: z.string().optional(),
+    /** The billing adapter method, for {@link ProviderCapabilityCallAction.BILLING_OPERATION}. A method NAME, never its arguments. */
+    billingOperation: z.string().optional(),
+    outcome: z.enum(ProviderCapabilityCallOutcome),
+    /** HTTP status of the vendor's answer, when the egress observes one. */
+    status: z.number().int().optional(),
+    /**
+     * The failure KIND (an error type or a submission outcome), never the vendor's prose, which may quote the request. The
+     * recorder keeps it to an identifier-shaped token and replaces anything else with `unclassified`, so an SDK error
+     * that carried text in its code cannot put that text on the trail.
+     */
+    failureKind: z.string().optional(),
+    /** WHOSE account the call spent: `application` | `organization` | `user` — the vocabulary its siblings use. */
+    connectionOwnerScope: z.string().trim().min(1),
+    /**
+     * The owner's id; absent for the application's own account. For a person's Drive this is the file's LINKER, who may
+     * not be the reader — the reason this event exports at SUBJECT_DETAIL.
+     */
+    connectionOwnerId: z.string().optional(),
+    /** The REAL initiating user, when the egress runs under an execution context that has one. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that acted, when the egress runs under an execution context. */
+    executionType: z.string().optional(),
+    /** The tenant the call was made for, when the egress knows one (an email sent for an organization). */
+    organizationId: z.string().optional(),
 });
 /**
  * The browser door REFUSED a provider operation (#367) — see the enum member for why this is not a
@@ -3848,7 +4901,10 @@ export const AuditableEvent_McpToolCall_EventDataSchema = z.object({
     destinationHost: z.string().trim().min(1),
     /** The tool called. Absent when the attempt failed before any tool was chosen (discovery). */
     toolName: z.string().optional(),
-    /** The client's outcome kind — `ok`, `refused_target`, `unreachable`, `timed_out`, `protocol_error`, `tool_error`. */
+    /**
+     * The client's outcome kind — `ok`, `refused_target`, `unreachable`, `timed_out`, `protocol_error`, `tool_error`, or
+     * `rate_budget_exhausted` (the connection's rate budget stayed full; nothing was sent — #1938).
+     */
     outcome: z.string().trim().min(1),
     /**
      * WHOSE ACCOUNT the call spent: `user` | `organization`. Absent when no credential was resolved,
@@ -3874,45 +4930,211 @@ export const AuditableEvent_McpToolCall_EventDataSchema = z.object({
     agentRef: z.string().optional(),
 });
 /**
- * A human approver AUTHORED the arguments an approval-gated tool ran with (#566).
- *
- * One row per MODIFIED approval — never per approval. See the enum member's docstring for why an
- * ordinary approval is not this event, and for why no argument VALUE appears in this schema.
- *
- * `proposedInputDigest` / `executedInputDigest` are the model SDK's own canonical input digests, the
- * same values its approval signature is computed over. That is what makes them evidence rather than
- * a convenience: a reader holding the executed call can recompute the second and see it match, and
- * the two differing is proof that the call which ran is not the call which was proposed — with no
- * copy of either payload on the trail.
- *
- * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records that an authorization
- * decision REWROTE the act it authorized, and who made it.
+ * The fields every human-decision event carries: which decision, on which plane, raised by which
+ * agent's work, routed how. Ids and names only (#1595 D5).
  */
-export const AuditableEvent_AgentToolApprovalModified_EventDataSchema = z.object({
-    eventType: z.literal(CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED),
-    /** The conversational execution whose turn was paused. */
+const HumanDecisionEventBaseShape = {
+    /** The one decision id (`HumanDecision_Request.decisionId`), shared by both planes and every row about this decision. */
+    decisionRef: z.string().trim().min(1),
+    /** The execution whose work is waiting — the conversational execution or the actor-system execution. */
     executionId: z.string().trim().min(1),
-    /** The pending decision's id — correlates this row with the pause and the resume in the logs. */
-    approvalId: z.string().trim().min(1),
-    /** The actor system the turn belongs to. */
-    systemRef: z.string().trim().min(1),
-    /** The agent whose declaration gated the tool, so a trail reads back to a configuration. */
-    agentRef: z.string().trim().min(1),
-    /** The approval-gated tool, as the model was shown it. */
-    toolName: z.string().trim().min(1),
-    /** Canonical digest of the arguments the MODEL proposed. */
-    proposedInputDigest: z.string().trim().min(1),
-    /** Canonical digest of the arguments that actually RAN. Differs from the above by construction. */
-    executedInputDigest: z.string().trim().min(1),
-    /**
-     * The argument NAMES the approver changed, sorted. Names only — a field name is not personal data,
-     * which is exactly why it is always safe and always recorded.
-     */
-    modifiedArgumentKeys: z.array(z.string()),
-    /** The approver. Absent never happens on this plane — only a present human can answer — but the envelope owns the field. */
-    approverUserId: z.string().optional(),
-    /** The tenant the turn was scoped to. */
+    plane: z.enum(HumanDecision_Plane),
+    /** The actor system the work belongs to. */
+    systemRef: z.string().trim().min(1).optional(),
+    /** The agent whose gate raised the decision. */
+    agentRef: z.string().trim().min(1).optional(),
+    /** The gated tool, when the decision is a tool approval. */
+    toolName: z.string().trim().min(1).optional(),
+    routeKind: z.enum(HumanDecision_RouteKind),
+    /** The route's eligible role — the floor every holder must meet. Absent for OWNER. */
+    routeEligibleRole: z.string().trim().min(1).optional(),
+    /** The tenant the decision is routed within. */
     organizationId: z.string().optional(),
+};
+/** A decision was raised. */
+export const AuditableEvent_HumanDecisionRequested_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_REQUESTED),
+    ...HumanDecisionEventBaseShape,
+    requesterKind: z.enum(HumanDecision_RequesterKind),
+    /** ASSIGNEE routes only: who it was routed to. */
+    assigneeUserId: z.string().optional(),
+    /** When answering is refused. Absent means the decision does not lapse. */
+    expiresAt: z.string().optional(),
+    /** #1628: the armed CLAIM deadline, and the clock it counts on. Absent on the actor plane before a host arms one. */
+    claimDeadlineAt: z.string().optional(),
+    claimClockBasis: z.enum(ReviewClockBasis).optional(),
+    /** #1628: the armed DECISION deadline, and the clock it counts on. */
+    decisionDeadlineAt: z.string().optional(),
+    decisionClockBasis: z.enum(ReviewClockBasis).optional(),
+});
+/** A decision ended. Exactly one per `decisionRef`. */
+export const AuditableEvent_HumanDecisionResolved_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_RESOLVED),
+    ...HumanDecisionEventBaseShape,
+    outcome: z.enum(HumanDecision_Outcome),
+    /** The person who decided. Absent for LAPSED and for a WITHDRAWN nobody answered. */
+    decidedByUserId: z.string().optional(),
+    /** The decider's roles in the decision's organization at the moment they decided. */
+    deciderRoles: z.array(z.string()).optional(),
+    /** The route role that admitted the decider (ROLE and ASSIGNEE routes). */
+    admittedByRouteRole: z.string().optional(),
+    /** ACCEPTED_WITH_MODIFICATIONS: the argument NAMES the decider changed, sorted. Never their values. */
+    modifiedArgumentNames: z.array(z.string()).default([]),
+    /** Whether the decider gave a reason. The reason itself stays in the transcript, not on the trail. */
+    reasonGiven: z.boolean(),
+    /** LAPSED only: a person who answered after the deadline, whose answer was therefore refused. */
+    lateDecisionUserId: z.string().optional(),
+    /** #1628: whether each armed service target was met. A clock that was never armed is absent, never guessed. */
+    deadlineOutcomes: z.partialRecord(z.enum(ReviewDeadlineKind), z.enum(ReviewDeadlineOutcome)).optional(),
+});
+/** A decision was moved — reassigned or escalated. */
+const HumanDecisionMoveShape = {
+    ...HumanDecisionEventBaseShape,
+    /** Who held it before the move. Absent when it moved off a ROLE route nobody had claimed. */
+    fromAssigneeUserId: z.string().optional(),
+    /** Who holds it now. */
+    toAssigneeUserId: z.string().trim().min(1),
+    /** The route version after the move; an answer read under an older version loses. */
+    routeVersion: z.number().int().nonnegative(),
+    /** Whether the mover gave a reason. The reason itself is not recorded here. */
+    reasonGiven: z.boolean(),
+};
+export const AuditableEvent_HumanDecisionReassigned_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_REASSIGNED),
+    ...HumanDecisionMoveShape,
+    /** #1628: a person's move, or a deadline's REASSIGN rule — so a rule-driven move is never read as a choice. */
+    trigger: z.enum(HumanDecision_RouteChangeTrigger),
+    /** ESCALATION_RULE only: the stage whose rule moved it. */
+    stage: z.enum(ReviewDeadlineStage).optional(),
+});
+export const AuditableEvent_HumanDecisionEscalated_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ESCALATED),
+    ...HumanDecisionMoveShape,
+    /** True when the target came from the gate's declared `escalateTo`, false when the escalator named it. */
+    toDeclaredTarget: z.boolean(),
+});
+/** A role-routed decision was claimed (`claimed: true`) or given back to its role (`claimed: false`). */
+export const AuditableEvent_HumanDecisionClaimed_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLAIMED),
+    ...HumanDecisionEventBaseShape,
+    claimed: z.boolean(),
+    /** The holder who claimed, or who gave it back. */
+    assigneeUserId: z.string().trim().min(1),
+    routeVersion: z.number().int().nonnegative(),
+});
+/** Someone tried to act on a decision and was refused. The decision is unchanged. */
+export const AuditableEvent_HumanDecisionAnswerRefused_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED),
+    ...HumanDecisionEventBaseShape,
+    act: z.enum(HumanDecision_Act),
+    reason: z.enum(HumanDecision_RefusalReason),
+    /** Who tried. Absent when the attempt carried no person at all (a machine principal). */
+    attemptedByUserId: z.string().optional(),
+});
+/** A CLAIM or DECISION deadline passed (#1628). The decision is unchanged and still answerable. */
+export const AuditableEvent_HumanDecisionDeadlineMissed_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED),
+    ...HumanDecisionEventBaseShape,
+    kind: z.enum(ReviewDeadlineKind),
+    /** The deadline that passed, after any pause was added to it. */
+    deadlineAt: z.string().trim().min(1),
+    basis: z.enum(ReviewClockBasis),
+});
+/**
+ * A deadline stage's rule fired (#1628). Ids and counts only: who was told is the route's candidates at
+ * that moment, recorded as a count so the row holds no list of people that would need scrubbing.
+ */
+export const AuditableEvent_HumanDecisionEscalationFired_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED),
+    ...HumanDecisionEventBaseShape,
+    stage: z.enum(ReviewDeadlineStage),
+    /** What the stage did. A REASSIGN whose target did not resolve, or could not answer, did NOTIFY instead. */
+    action: z.enum(ReviewEscalationActionKind),
+    /** Whether a REASSIGN rule was declared for this stage and attempted. */
+    reassignAttempted: z.boolean(),
+    /** REASSIGN attempted: whether its target resolved to someone who may answer. False: the decision did not move. */
+    targetResolved: z.boolean().optional(),
+    /** REASSIGN attempted and refused: why the resolved target may not answer (#1594 I8). */
+    targetRefusalReason: z.enum(HumanDecision_RefusalReason).optional(),
+    /** REASSIGN applied: who held it before (absent for an unclaimed ROLE route) and who holds it now. */
+    fromAssigneeUserId: z.string().optional(),
+    toAssigneeUserId: z.string().optional(),
+    /** REASSIGN applied: the route version after the move. */
+    routeVersion: z.number().int().nonnegative().optional(),
+    /** How many people were told. Zero is recorded, not hidden: it is the finding. */
+    recipientCount: z.number().int().nonnegative(),
+});
+/** A person stopped a decision's CLAIM and DECISION clocks (#1628). The lapse keeps running. */
+export const AuditableEvent_HumanDecisionClockPaused_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED),
+    ...HumanDecisionEventBaseShape,
+    /** The gate-declared pause state. An application identifier, never free text. */
+    pauseStateRef: z.string().trim().min(1),
+    pausedByUserId: z.string().trim().min(1),
+});
+/** A person restarted a decision's clocks (#1628); `pausedMs` was added to both service targets. */
+export const AuditableEvent_HumanDecisionClockResumed_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED),
+    ...HumanDecisionEventBaseShape,
+    pauseStateRef: z.string().trim().min(1),
+    resumedByUserId: z.string().trim().min(1),
+    /** How long this pause lasted, in wall-clock milliseconds. */
+    pausedMs: z.number().int().nonnegative(),
+});
+/**
+ * The fields every autonomous-agent binding event carries (#1611). Ids and refs only: an agent's
+ * instruction lives in the application's code, and a turn's input stays in its transcript.
+ */
+const AutonomousAgentBindingEventShape = {
+    /** The application-declared autonomous agent. */
+    autonomousAgentRef: z.string().trim().min(1),
+    /** The organization the agent may (or may no longer) act in. */
+    organizationId: z.string().trim().min(1),
+    /** The OAuth client whose authority the agent's turns carry. */
+    oauthClientId: z.string().trim().min(1),
+    principalSource: z.enum(AutonomousPrincipalSource),
+    /** RELATIONSHIP_ADMITTED_CLIENT only: the firm that owns the client. */
+    providerOrganizationId: z.string().trim().min(1).optional(),
+    /** RELATIONSHIP_ADMITTED_CLIENT only: the relationship whose admission carries it. */
+    serviceProviderRelationshipId: z.string().trim().min(1).optional(),
+};
+export const AuditableEvent_AutonomousAgent_BoundEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND),
+    ...AutonomousAgentBindingEventShape,
+});
+export const AuditableEvent_AutonomousAgent_UnboundEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND),
+    ...AutonomousAgentBindingEventShape,
+});
+/** The fields every autonomous-turn event carries: which agent, where, on which occurrence, started by what. */
+const AutonomousAgentTurnEventShape = {
+    autonomousAgentRef: z.string().trim().min(1),
+    organizationId: z.string().trim().min(1),
+    /** The schedule occurrence or the inbound delivery id. The same occurrence twice is one turn. */
+    occurrenceKey: z.string().trim().min(1),
+    trigger: z.enum(AutonomousTurnTrigger),
+    /** The case the turn was started for, when one was named. */
+    caseRef: WorkUnitRefSchema.optional(),
+};
+export const AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED),
+    ...AutonomousAgentTurnEventShape,
+    /** The conversational execution the turn runs in. Deterministic from the agent, organization and occurrence. */
+    executionId: z.string().trim().min(1),
+    systemRef: z.string().trim().min(1),
+    oauthClientId: z.string().trim().min(1),
+    principalSource: z.enum(AutonomousPrincipalSource),
+});
+export const AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED),
+    ...AutonomousAgentTurnEventShape,
+    reason: z.enum(AutonomousTurnRefusalReason),
+    /** OVER_BUDGET: the budget gate's own reason (exhausted, or unverifiable). */
+    budgetDenialReason: z.string().trim().min(1).optional(),
+    /** RUNTIME_REFUSED: the runtime's error code. */
+    runtimeErrorCode: z.string().trim().min(1).optional(),
+    /** The OAuth client, when one had been resolved before the refusal. */
+    oauthClientId: z.string().trim().min(1).optional(),
 });
 /**
  * Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in
@@ -3938,8 +5160,13 @@ export const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object(
     resourceType: z.string().trim().min(1),
     /** The read-family member executed: `read` | `list` | `count` | `search`. */
     operationIdentifier: z.string().trim().min(1),
-    /** The provider the binding resolves credentials/base-URL through (e.g. `odoo`). */
-    providerRef: z.string().trim().min(1),
+    /**
+     * The system-of-record INSTANCE the binding reads (`systemsOfRecord.<name>`, #1055). Was `providerRef`
+     * until #1679 found the emitters had sent `systemOfRecord` since #1055 while this schema still named the
+     * retired provider field — a trail whose declared shape and whose rows disagreed about the one field
+     * that says WHICH external system was reached.
+     */
+    systemOfRecord: z.string().trim().min(1),
     /** The remote entity (OData entity set / Odoo model / declared REST surface). */
     remoteEntityRef: z.string().trim().min(1),
     /** The transport dialect spoken (`odata` | `rest-json` | `odoo-jsonrpc`). */
@@ -3954,6 +5181,35 @@ export const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object(
     resourceId: z.string().optional(),
     /** Rows returned (list/search), or the count answered (count). Absent for a single READ. */
     rowCount: z.number().int().nonnegative().optional(),
+    /*
+     * ── A PIPELINE RUN's extras (`operationIdentifier: 'externalDataPipelineRun'`) ─────────────
+     *
+     * The run service has emitted `rejectedRows` and `completedPass` since the pipeline landed, and this
+     * schema never declared them — a trail whose rows carried fields its declared shape did not name.
+     * Declared together with the pass mode (#1682) and the erasure-suppression count (#1746), all optional
+     * because a read-through operation has none.
+     */
+    /** Rows the pipeline's transform rejected this run (reported per row in the run log; never loaded). */
+    rejectedRows: z.number().int().nonnegative().optional(),
+    /**
+     * Whether the run finished its pass. Read with `pipelinePassMode`: on a FULL run it means the whole
+     * remote population was read; on an INCREMENTAL run, every change since the watermark was.
+     */
+    completedPass: z.boolean().optional(),
+    /** Which track the run advanced (#1682) — a full pass or an incremental one. */
+    pipelinePassMode: z.enum(ExternalDataPipelinePassMode).optional(),
+    /**
+     * Source rows the run did NOT load because a subject erasure suppresses their remote records (#1746) — the
+     * evidence that an erasure survived the next pass. A count, never a key.
+     *
+     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — a pipeline run records how many erased records it declined to re-import.
+     */
+    suppressedRows: z.number().int().nonnegative().optional(),
+    /**
+     * Of those suppressed records, how many still have a LIVE row in the destination — an erasure that committed while an
+     * earlier pass was loading, and that pass wrote the row back (#1746). Above zero is an erasure that did not hold.
+     */
+    liveSuppressedRows: z.number().int().nonnegative().optional(),
 });
 /**
  * A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding
@@ -3977,8 +5233,8 @@ export const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({
     subjectIds: z.array(z.string().trim().min(1)).min(1),
     /** The HTTP_API-bound Wildo resource whose declared erasure operation ran. */
     resourceType: z.string().trim().min(1),
-    /** The provider the binding resolves credentials/base-URL through. */
-    providerRef: z.string().trim().min(1),
+    /** The system-of-record INSTANCE the erasure reached (`systemsOfRecord.<name>`) — see the read-through schema for the rename. */
+    systemOfRecord: z.string().trim().min(1),
     /** The remote entity (OData entity set / Odoo model / declared REST surface). */
     remoteEntityRef: z.string().trim().min(1),
     /** The transport dialect spoken (`odata` | `rest-json` | `odoo-jsonrpc`). */
@@ -3988,6 +5244,267 @@ export const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({
     /** Tenant scope, when the erasure request carried one. */
     organizationId: z.string().optional(),
 });
+/**
+ * What became of ONE write sent (or about to be sent) through an HTTP-API binding (#1679).
+ *
+ * Distinct members because each one sends a reviewer somewhere different, and two of them are the
+ * answers a client must not read as "not written".
+ */
+export var HttpApiWriteThroughOutcome;
+(function (HttpApiWriteThroughOutcome) {
+    /** The system of record applied the write. */
+    HttpApiWriteThroughOutcome["APPLIED"] = "applied";
+    /**
+     * The ENGINE refused before anything was sent — a non-owner organization, a partition outside the
+     * caller's grant, an engine-owned field in the payload. Nothing reached the remote.
+     */
+    HttpApiWriteThroughOutcome["REFUSED"] = "refused";
+    /** The request was sent and the system of record refused it with a definite answer; nothing was applied. */
+    HttpApiWriteThroughOutcome["REMOTE_REFUSED"] = "remote_refused";
+    /**
+     * The request was sent and nobody knows whether it was applied — a timeout, a connection dropped after
+     * the request left, a gateway answering for the vendor. A retry under the same Idempotency-Key answers
+     * this again rather than sending a second write.
+     */
+    HttpApiWriteThroughOutcome["OUTCOME_UNKNOWN"] = "outcome_unknown";
+    /**
+     * A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent: the outcome was
+     * replayed from the first attempt's record. Recorded so the second RESOURCE_OPERATION_PERFORMED row such a
+     * retry produces is visibly one that changed nothing remote.
+     */
+    HttpApiWriteThroughOutcome["REPLAYED"] = "replayed";
+})(HttpApiWriteThroughOutcome || (HttpApiWriteThroughOutcome = {}));
+/**
+ * A row was written THROUGH an HTTP-API resource binding, or a write was refused (#1679) — see the enum
+ * member's docstring for the vocabulary argument and the relation to RESOURCE_OPERATION_PERFORMED.
+ *
+ * MINIMISATION is the shape of this schema: it names the FIELDS written and never their values. The
+ * values live in the system of record; a copy here would be a second store of that system's content, one
+ * the application's erasure never reaches. `writtenFieldNames` are the LOCAL names the caller sent,
+ * because those are the names a reviewer of this application reads.
+ *
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — every write sent into an external system through the shared
+ * service identity is recorded with the real initiating user, the row it reached and the fields it changed.
+ */
+export const AuditableEvent_HttpApiWriteThrough_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.HTTP_API_WRITE_THROUGH),
+    /** The Wildo resource whose binding was written through. */
+    resourceType: z.string().trim().min(1),
+    /** The write verb: `create` | `update` | `delete` — the core operation, so OCSF refines its activity from it. */
+    operationIdentifier: z.string().trim().min(1),
+    /** The system-of-record INSTANCE written (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    /** The remote entity (OData entity set / Odoo model / declared REST surface). */
+    remoteEntityRef: z.string().trim().min(1),
+    /** The transport dialect spoken. */
+    dialect: z.string().trim().min(1),
+    outcome: z.enum(HttpApiWriteThroughOutcome),
+    /**
+     * The written row's synthesized id — its remote key. Present for an update or delete (addressed by it)
+     * and for an applied or replayed create (the remote assigned it). Absent for a create that was refused
+     * or whose outcome is unknown, because no key exists that the engine could honestly name.
+     */
+    resourceId: z.string().optional(),
+    /** The LOCAL names of the fields the write carried, sorted. Never their values. Empty for a delete. */
+    writtenFieldNames: z.array(z.string()),
+    /** The stable refusal code for REFUSED, REMOTE_REFUSED and OUTCOME_UNKNOWN (a `SystemOfRecordErrorCode`, or the transport kind). */
+    refusalCode: z.string().optional(),
+    /** The REAL initiating user — absent only for genuine machine/internal executions. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that acted. */
+    executionType: z.string().optional(),
+    /** The organization the write was scoped to — the owner organization when it was admitted. */
+    organizationId: z.string().optional(),
+    /** The organization unit whose partition the row belongs to, when the instance is partitioned. */
+    organizationUnitId: z.string().optional(),
+    /**
+     * The LOCAL row whose change the write carried — present only for a write an OUTBOUND pipeline sent (#1690), which is
+     * how a reviewer tells such a write from a caller's write through a read-through resource. `initiatorUserId` is then
+     * the member whose change the pass sent, not whoever triggered the pass.
+     */
+    localResourceId: z.string().optional(),
+});
+/**
+ * What became of ONE declared system-of-record action that was sent, or replayed (#1678). Refusals before sending are a
+ * separate event type ({@link CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED}).
+ */
+export var SystemOfRecordActionOutcome;
+(function (SystemOfRecordActionOutcome) {
+    /** The system of record performed the action. */
+    SystemOfRecordActionOutcome["APPLIED"] = "applied";
+    /** The action was sent and the system of record refused it with a definite answer; nothing was applied. */
+    SystemOfRecordActionOutcome["REMOTE_REFUSED"] = "remote_refused";
+    /**
+     * The action was sent and nobody knows whether it was performed — a timeout, a connection dropped after the request
+     * left, a gateway answering for the vendor, or an answer the engine could not read after the vendor answered success.
+     * A retry under the same Idempotency-Key answers this again rather than acting twice.
+     */
+    SystemOfRecordActionOutcome["OUTCOME_UNKNOWN"] = "outcome_unknown";
+    /** A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent. */
+    SystemOfRecordActionOutcome["REPLAYED"] = "replayed";
+})(SystemOfRecordActionOutcome || (SystemOfRecordActionOutcome = {}));
+/**
+ * A declared system-of-record action was run (#1678) — see the enum member for the vocabulary argument.
+ *
+ * MINIMISATION is the shape: the input's field NAMES, never their values, and no result. The values live in the system
+ * of record; a copy here would be a second store of that system's content, one no erasure reaches.
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every physical action call to a system of record is
+ * recorded with the instance, the action, the remote entity and its outcome.
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — the real initiating actor is recorded through the shared service identity.
+ */
+export const AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED),
+    /** The system-of-record INSTANCE acted on (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    /** The application's name for the action (`postInvoice`), as the binding declares it. */
+    action: z.string().trim().min(1),
+    /** The read-through resource whose binding declares the action. */
+    resourceType: z.string().trim().min(1),
+    /** The remote entity or model the call was made on (`account.move`, an OData entity set or action import). */
+    remoteEntityRef: z.string().trim().min(1),
+    /** The call shape (`odoo-execute-kw` | `odata-bound-action` | `odata-unbound-action`). Spelled as a string: see `dialect` on the read-through row. */
+    callShape: z.string().trim().min(1),
+    outcome: z.enum(SystemOfRecordActionOutcome),
+    /** Whether the action is declared as changing remote state. */
+    writes: z.boolean(),
+    /** The target record's synthesized id — a remote KEY, never a person's id. Absent for a record-free action. */
+    targetResourceId: z.string().optional(),
+    /** The LOCAL names of the input fields the call carried, sorted. Never their values. */
+    inputFieldNames: z.array(z.string()),
+    /** The stable code for REMOTE_REFUSED and OUTCOME_UNKNOWN (a `SystemOfRecordErrorCode`, or the transport kind). */
+    failureCode: z.string().optional(),
+    /** The REAL initiating user — absent only for machine and system executions. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that acted. */
+    executionType: z.string().optional(),
+    /** The organization the action was run for — the owner organization, once admitted. */
+    organizationId: z.string().optional(),
+    /** The organization unit whose partition the action landed in, when the instance is partitioned and it is known. */
+    organizationUnitId: z.string().optional(),
+});
+/**
+ * A declared system-of-record action was REFUSED before anything was sent (#1678).
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every refusal of an action on a system of record is
+ * recorded with the caller, the instance, the action and the rule that refused it.
+ */
+export const AuditableEvent_SystemOfRecordActionRefused_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED),
+    systemOfRecord: z.string().trim().min(1),
+    action: z.string().trim().min(1),
+    /** The declaring resource, when the action was found at all (absent for ACTION_NOT_DECLARED). */
+    resourceType: z.string().optional(),
+    /** The target the caller named, for a record-targeted action. */
+    targetResourceId: z.string().optional(),
+    /** The `SystemOfRecordErrorCode` that refused it. */
+    refusalCode: z.string().trim().min(1),
+    /** The partition rule that refused it, for ACTION_PARTITION_REFUSED (`SystemOfRecordWritePartitionRefusal`). */
+    refusalReason: z.string().optional(),
+    initiatorUserId: z.string().optional(),
+    executionType: z.string().optional(),
+    /** The organization the caller initiated the action for — possibly NOT the owner, which is what a reviewer looks for. */
+    organizationId: z.string().optional(),
+});
+/**
+ * An operator reset a pipeline (#1734) — see {@link CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET}.
+ *
+ * The DISCARDED state is the point of the row: the pass id, cursor and watermark are remote POSITIONS (an id, a
+ * continuation link, a timestamp), never record content, and they are what lets a reviewer say which part of a sync
+ * the reset threw away. The door is authenticated by the application admin secret, which names no person, so the
+ * row's `userId` is empty; `statedOperator` is who the operator SAID they are, recorded as a statement, and `reason`
+ * is their own words — which is why the event exports at SUBJECT_DETAIL.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's reset of a pipeline is recorded with what it discarded
+ * and why.
+ */
+export const AuditableEvent_ExternalDataPipelineReset_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET),
+    /** The destination resource whose pipeline was reset. */
+    pipelineResourceType: z.string().trim().min(1),
+    /** The system-of-record instance the pipeline reads (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    resetMode: z.enum(ExternalDataPipelineResetMode),
+    /** Why, in the operator's words. Required by the door. */
+    reason: z.string().trim().min(1).max(2000),
+    /** Who the operator said they are, when they said. A statement, not an authenticated identity. */
+    statedOperator: z.string().trim().min(1).max(200).optional(),
+    /** Whether the pipeline had a state row at all. A reset of a pipeline that never ran discards nothing. */
+    stateFound: z.boolean(),
+    /** The discarded full pass's id; null when no pass was in flight. */
+    discardedPassId: z.string().nullable(),
+    /** The discarded full pass's cursor — a remote position; null at the start of a pass or with none in flight. */
+    discardedCursor: z.string().nullable(),
+    /** When the discarded pass started, ISO-8601; null when none was in flight. */
+    discardedPassStartedAt: z.string().nullable(),
+    /** The discarded incremental watermark (FULL_RESYNC only) — a remote position; null when none was discarded. */
+    discardedIncrementalWatermark: z.string().nullable(),
+    /** The discarded in-flight incremental cursor (FULL_RESYNC only); null when none was discarded. */
+    discardedIncrementalCursor: z.string().nullable(),
+});
+/**
+ * An operator answered an outbound write of unknown outcome (#2039) — see
+ * {@link CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED}.
+ *
+ * Like the reset, the door is authenticated by the application admin secret, which names no person: the row's `userId`
+ * is empty, `statedOperator` is who the operator SAID they are, and `reason` is their own words (SUBJECT_DETAIL on
+ * export). `remoteKey` is the remote record's identity the operator supplied, never record content.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's answer about another system's state is recorded with
+ * what it changed locally and why.
+ */
+export const AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED),
+    /** The OUTBOUND pipeline's destination resource. */
+    pipelineResourceType: z.string().trim().min(1),
+    /** The system-of-record instance the pipeline sends to (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    /** The destination row whose change was of unknown outcome. */
+    localResourceId: z.string().trim().min(1),
+    /** The write that was of unknown outcome, as its core operation (`create` / `update`). */
+    operationIdentifier: z.string().trim().min(1),
+    answer: z.enum(ExternalDataOutboundUnknownAnswer),
+    /** The remote key the operator supplied for an applied CREATE; null otherwise. */
+    remoteKey: z.string().nullable(),
+    /** Whether the answer wrote that key onto the local row (false when the row already held the same key). */
+    remoteKeyWritten: z.boolean(),
+    /** Whether a change is still owed after the answer: a NOT_APPLIED answer, or a local change made since the send. */
+    changeStillOwed: z.boolean(),
+    /** Why, in the operator's words. Required by the door. */
+    reason: z.string().trim().min(1).max(2000),
+    /** Who the operator said they are, when they said. A statement, not an authenticated identity. */
+    statedOperator: z.string().trim().min(1).max(200).optional(),
+});
+/**
+ * A BIDIRECTIONAL pipeline resolved a conflict on one row (#1723) — see
+ * {@link CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED}. Identities and field NAMES only, never a field's
+ * value: the row says which side's change to which fields was discarded, and the values are in the two systems.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — a resolution that overwrites one side's data is recorded with the row,
+ * the fields, the winning side and who chose it.
+ */
+export const AuditableEvent_ExternalDataConflictResolved_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED),
+    /** The BIDIRECTIONAL pipeline's destination resource. */
+    pipelineResourceType: z.string().trim().min(1),
+    /** The system-of-record instance on the other side (`systemsOfRecord.<name>`). */
+    systemOfRecord: z.string().trim().min(1),
+    /** The local row. */
+    localResourceId: z.string().trim().min(1),
+    /** The remote record's key. */
+    remoteKey: z.string().trim().min(1),
+    winner: z.enum(ExternalDataConflictWinner),
+    decidedBy: z.enum(ExternalDataConflictDecisionSource),
+    /**
+     * The local fields whose values differ between the two sides, and so are overwritten on the LOSING side: loaded over
+     * now when the remote side wins, sent over by the next outbound pass when the local side wins.
+     */
+    overwrittenFieldNames: z.array(z.string().min(1)),
+    /** The record's row version on the system of record when the conflict was resolved; null when it carried none. */
+    remoteVersion: z.string().nullable(),
+    /** The version the two sides last agreed on; null when they never had. */
+    agreedVersion: z.string().nullable(),
+});
 /**
  * A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound
  * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).
@@ -4011,8 +5528,8 @@ export const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.ob
     subjectIds: z.array(z.string().trim().min(1)).min(1),
     /** The HTTP_API-bound Wildo resource whose rows remain un-erased. */
     resourceType: z.string().trim().min(1),
-    /** The provider the binding resolves credentials/base-URL through. */
-    providerRef: z.string().trim().min(1),
+    /** The system-of-record INSTANCE the rows remain in (`systemsOfRecord.<name>`) — see the read-through schema for the rename. */
+    systemOfRecord: z.string().trim().min(1),
     /** The remote entity (OData entity set / Odoo model / declared REST surface). */
     remoteEntityRef: z.string().trim().min(1),
     /** The transport dialect spoken (`odata` | `rest-json` | `odoo-jsonrpc`). */
@@ -4026,6 +5543,40 @@ export const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.ob
     /** Tenant scope, when the erasure request carried one. */
     organizationId: z.string().optional(),
 });
+/**
+ * A subject erasure's outcome at one RECIPIENT of the subject's data (#1710) — see
+ * {@link CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME}.
+ *
+ * Art. 19 asks the controller to communicate an erasure "to each recipient to whom the personal data have been
+ * disclosed" and to tell the data subject who they are on request; this row records, per recipient, what the erasure
+ * did and who owes that communication. `status` is absent for a recipient reached with the TENANT's account, which is
+ * the tenant's to notify and never the operator's effect to run.
+ * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — every recipient the application declares is accounted for
+ * at every erasure, and one that no effect reached is recorded as unmeasured rather than passing silently.
+ */
+export const AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME),
+    /** The erased subject's resource type. */
+    subjectResourceType: z.string().trim().min(1),
+    /** The erased subject rows. */
+    subjectIds: z.array(z.string().trim().min(1)).min(1),
+    /** The recipient: a provider ref. */
+    recipientRef: z.string().trim().min(1),
+    /** `SubjectDataRecipientReach` — whose account reached it. */
+    reach: z.enum(SubjectDataRecipientReach),
+    /** `SubjectDataRecipientObligation` — who owes the Art. 19 communication. */
+    obligation: z.enum(SubjectDataRecipientObligation),
+    /** `SubjectDataRecipientRelevance` — carries this subject's data, or may have received it. */
+    relevance: z.enum(SubjectDataRecipientRelevance),
+    /** `SubjectErasureExternalEffectStatus` at the recipient. Absent for a tenant-account recipient. */
+    status: z.enum(SubjectErasureExternalEffectStatus).optional(),
+    /** The effects that answered for it (`billing-provider`, `recipient:<ref>`, …). */
+    effectRefs: z.array(z.string().trim().min(1)),
+    /** Tenant scope, when the erasure request carried one. */
+    organizationId: z.string().optional(),
+});
 /**
  * Audit-log event for cross-frontend session handoff issuance
  * (cross-app-jwt-propagation Step 2).
@@ -4366,6 +5917,59 @@ export const AuditableEvent_BaseSchema = z.object({
     // observation of what they did.
     clientInstanceId: z.string().isDBIndexed().isSummaryField().optional()
         .dataCategories(PersonalDataCategory.IDENTITY),
+    /**
+     * The KIND of principal whose authority was used ({@link AuditActorKind}) — `userId` names the
+     * principal, this says what kind it is. Filled by `_createAuditLog` on every row it writes, and by
+     * nothing else. It resolves from the principal the emitter NAMES when there is one (a sign-in is
+     * audited under a pre-auth context, which is true of the request and wrong about who acted), else
+     * from the request `ExecutionContext`, else — last resort — from the actor id the emitter wrote.
+     * Optional in the schema only because rows written before it existed carry none.
+     *
+     * It is the PRINCIPAL's kind and never the agent's: whether an agent acted is `agentActor`'s presence.
+     */
+    actorKind: z.enum(AuditActorKind).systemEnum('AuditActorKind').isDBIndexed().isSummaryField().optional(),
+    /**
+     * Which AI agent performed the action, and in which execution — present ONLY when an agent acted
+     * ({@link AuditAgentActorSchema}). Taken from the request `ExecutionContext`, else from the ambient
+     * agent frame the framework opens around every tool call, so a tool that builds its own context or
+     * writes as the system is attributed without doing anything. Identifiers only: never argument
+     * values, never digests of them.
+     *
+     * USAGE — its `agentExecutionId` is a pseudonymous key into a transcript the user owns; erasing the
+     * transcript leaves the key resolving to nothing, which is what keeps an unscrubbable ledger
+     * compatible with erasure.
+     */
+    agentActor: AuditAgentActorSchema.optional().dataCategories(PersonalDataCategory.USAGE),
+    /**
+     * The external OAuth client a person delegated to (`actorKind = DELEGATED_CLIENT`) — the verified
+     * token's `azp`, captured after the audience check and never from a header. An opaque string: a
+     * client identified by an HTTPS URL has no row to join to. Evidence only.
+     */
+    delegatingClientId: z.string().isSummaryField().optional(),
+    /**
+     * The machine credential a MACHINE principal authenticated with (`actorKind = MACHINE`): an API key's
+     * or OAuth client's id, or — for a shared platform secret that has no credential record — its stable
+     * name, never its value. Recorded here and never in a `*By` field, whose contract is "a user id or a
+     * sentinel".
+     */
+    principalCredentialId: z.string().isSummaryField().optional(),
+    /**
+     * The service-provider relationship the principal acted THROUGH (#1597) — present only on a row written
+     * in a CLIENT organization by an expert or firm machine client that a live relationship admitted there.
+     * Derived by `_createAuditLog` from the role entry for the row's organization, never supplied by an
+     * emitter. Indexed because the client filters its own trail by relationship ("what did firm X do here?").
+     */
+    actingViaServiceProviderRelationshipId: z.string().isDBIndexed().isSummaryField().optional(),
+    /** The firm behind {@link actingViaServiceProviderRelationshipId}; present exactly when it is. Evidence only. */
+    providerOrganizationId: z.string().isSummaryField().optional(),
+    /**
+     * Where the second factor that satisfied the CLIENT organization's authentication policy came from, on a row a
+     * firm's expert caused in that client (#1633) — present only when the client's policy required one and the
+     * session satisfied it for that client. Derived by `_createAuditLog` from the request's context for the row's own
+     * organization, never supplied by an emitter. The client's answer to "was this action MFA-protected, and by whom?".
+     */
+    serviceProviderFactorSource: z.enum(FactorSatisfactionSource).systemEnum('FactorSatisfactionSource').isSummaryField().optional()
+        .describe('On an action a service firm\'s expert took inside a client organization whose policy requires a second factor: where the factor that satisfied that policy came from, a step-up to this application or the firm\'s own identity provider the client trusts. Absent when the client\'s policy required none.'),
     riskLevel: z.enum(ResourceOperationRiskLevel).isSummaryField(),
     // USAGE — an audit row is a record of what a principal DID. The event type and its data together
     // are the observation, so both carry the category; `riskLevel`, `eventCategory` and `severity` are
@@ -4376,7 +5980,11 @@ export const AuditableEvent_BaseSchema = z.object({
     // immutable ledger cannot be scrubbed. This declaration is about the audit row's OWN fields, which
     // hold personal data whether or not anyone wanted them to — and a notice must say so precisely
     // BECAUSE they are unerasable.
-    eventType: z.string().isSummaryField().dataCategories(PersonalDataCategory.USAGE),
+    //
+    // `.systemEnum(CORE_AUDITABLE_EVENT_TYPE)` names the OPEN vocabulary the value belongs to (#1791): the field stays a
+    // string (whoever emits an event writes its type), and every trail shows the type's word
+    // (`system_enums.CoreAuditableEventType.<value>`) instead of its wire value, the missing word showing the value.
+    eventType: z.string().systemEnum(EngineOpenVocabulary.CORE_AUDITABLE_EVENT_TYPE).isSummaryField().dataCategories(PersonalDataCategory.USAGE),
     eventData: AuditableEvent_DataSchema.dataCategories(PersonalDataCategory.USAGE),
     /** Populated by service layer via getAuditEventClassification(). Required for CREATE (audit logs are REPOSITORY_ONLY, no API). */
     eventCategory: z.enum(AuditEventCategory).isSummaryField(),
@@ -4386,6 +5994,34 @@ export const AuditableEvent_BaseSchema = z.object({
     updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate()
 });
 // Type-safe discriminated union for TypeScript validation (used in service layer)
+/**
+ * One retention-class sweep run, summarised per class (#1636). Counts only — no row id, no field value, no
+ * person: the per-resource detail is in the `retentionEnforcementRecords` row the same run wrote.
+ */
+export const AuditableEvent_RetentionEnforcementRecorded_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED),
+    /** The run's `runRef`, shared with every enforcement record it wrote. */
+    runRef: z.string(),
+    /** The instant the run computed its cutoffs from, ISO. */
+    sweptAt: z.string(),
+    /** FAILED when any resource failed; else DEFERRED_BY_CEILING when any stopped at the ceiling; else COMPLETED. */
+    outcome: z.enum(RetentionEnforcementOutcome),
+    boundResourceCount: z.number().int().min(0),
+    deletedCount: z.number().int().min(0),
+    /** Enforcement records this run could not write. Non-zero fails the run: its enforcement is unevidenced. */
+    recordWriteFailureCount: z.number().int().min(0),
+    classes: z.array(z.object({
+        retentionClass: z.enum(DataRetentionClass),
+        resourceCount: z.number().int().min(0),
+        deletedCount: z.number().int().min(0),
+        completedCount: z.number().int().min(0),
+        deferredByCeilingCount: z.number().int().min(0),
+        failedCount: z.number().int().min(0),
+        skippedCount: z.number().int().min(0),
+        /** Absent when no hold check ran for any resource of the class (#1634). */
+        heldSkippedCount: z.number().int().min(0).optional(),
+    })),
+});
 export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType', [
     AuditableEvent_User_LoginEventDataSchema,
     AuditableEvent_User_LogoutEventDataSchema,
@@ -4433,7 +6069,33 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema,
     AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchema,
     AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema,
+    AuditableEvent_RetentionEnforcementRecorded_EventDataSchema,
     AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema,
+    AuditableEvent_InboundDelivery_RejectedEventDataSchema,
+    AuditableEvent_InboundDelivery_AcceptedEventDataSchema,
+    AuditableEvent_InboundDelivery_UnroutableEventDataSchema,
+    AuditableEvent_InboundDelivery_ProcessedEventDataSchema,
+    AuditableEvent_InboundDelivery_FailedEventDataSchema,
+    AuditableEvent_InboundDelivery_DeadEventDataSchema,
+    AuditableEvent_InboundDelivery_ReplayedEventDataSchema,
+    AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema,
+    AuditableEvent_InboundReply_SentEventDataSchema,
+    AuditableEvent_InboundReply_FailedEventDataSchema,
+    AuditableEvent_InboundReplyToken_RevokedEventDataSchema,
+    AuditableEvent_InboundReplyToken_DowngradedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema,
+    AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema,
+    AuditableEvent_ClientMailbox_CreatedEventDataSchema,
+    AuditableEvent_ClientMailbox_RemovedEventDataSchema,
+    AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema,
+    AuditableEvent_InboundEmail_RejectedLimitEventDataSchema,
+    AuditableEvent_AutonomousAgent_BoundEventDataSchema,
+    AuditableEvent_AutonomousAgent_UnboundEventDataSchema,
+    AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema,
+    AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema,
     AuditableEvent_SCIM_TokenCreatedEventDataSchema,
     AuditableEvent_SCIM_TokenRevokedEventDataSchema,
     AuditableEvent_SCIM_UserProvisionedEventDataSchema,
@@ -4470,6 +6132,27 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema,
     AuditableEvent_PlatformDirectoryAccess_EventDataSchema,
     AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema,
+    AuditableEvent_LegalHoldPlaced_EventDataSchema,
+    AuditableEvent_LegalHoldReleased_EventDataSchema,
+    AuditableEvent_ModelCostAggregateInvoiceLinked_EventDataSchema,
+    AuditableEvent_CorrectionCaptureSettingChanged_EventDataSchema,
+    AuditableEvent_EvaluationExportAuthorizationChanged_EventDataSchema,
+    AuditableEvent_EvaluationDatasetExported_EventDataSchema,
+    AuditableEvent_EvaluationDatasetExportRefused_EventDataSchema,
+    AuditableEvent_ServiceProviderRelationshipLifecycle_EventDataSchema,
+    AuditableEvent_ServiceProviderMachineClientAdmissionChanged_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertAssigned_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertUnassigned_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertApprovalRequested_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertApprovalGranted_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertApprovalDenied_EventDataSchema,
+    AuditableEvent_ServiceProviderExpertApprovalLapsed_EventDataSchema,
+    AuditableEvent_ServiceProviderCapabilityGranted_EventDataSchema,
+    AuditableEvent_ServiceProviderCapabilityRevoked_EventDataSchema,
+    AuditableEvent_ServiceProviderMfaTrustChanged_EventDataSchema,
+    AuditableEvent_ServiceProviderClientAuthenticationSatisfied_EventDataSchema,
+    AuditableEvent_ServiceProviderActivityFeedDecided_EventDataSchema,
+    AuditableEvent_ServiceProviderActivityFeedDisclosureChanged_EventDataSchema,
     AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema,
     AuditableEvent_RetainedDataAccess_EventDataSchema,
     AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema,
@@ -4477,10 +6160,17 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_CollectionDataExport_EventDataSchema,
     AuditableEvent_User_SessionEvictedEventDataSchema,
     AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,
+    AuditableEvent_HttpApiWriteThrough_EventDataSchema,
+    AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema,
+    AuditableEvent_SystemOfRecordActionRefused_EventDataSchema,
+    AuditableEvent_ExternalDataPipelineReset_EventDataSchema,
+    AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema,
+    AuditableEvent_ExternalDataConflictResolved_EventDataSchema,
     AuditableEvent_ProviderOperationCall_EventDataSchema,
     AuditableEvent_ProviderOperationDenied_EventDataSchema,
     AuditableEvent_HttpApiExternalErasure_EventDataSchema,
     AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,
+    AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema,
     AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema,
     AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema,
     AuditableEvent_OAuth_ConsentGrantedEventDataSchema,