The audit trail
It records what changed. Never what it was.
Every write that touches a row also writes a line saying which table, which row, and which fields moved — in the same transaction as the change itself. What it deliberately leaves out is the value. Not the old one, not the new one.
One batch, or neither happens.
Every write in this codebase goes through a single batched transaction — there's no path that writes a row as one step and something else as a second, separate step, because a failure between them would leave a change on record with nothing saying it happened. The audit line rides in the same batch as the write it describes, for the same reason the codebase never splits a task's status from its history entry: half of a transaction is worse than none of it, because it looks complete.
So an audit entry either exists alongside the change it describes, or the change never happened at all. There's no window where one exists without the other.
Enough to answer "did this change," never enough to answer "to what."
That's a deliberate line, not a shortcut. A deal's value, a decision's rationale, a contact's details — those are exactly the kind of thing this system already refuses to write to a log. Not one log statement exists in the source, and no token has ever reached one. The audit trail holds itself to the same restraint: knowing a field moved is enough for accountability. A second copy of the value it moved to is a second thing to secure, for a benefit nobody's shown yet.
- KeptTable name, row id, which field or fields changed, and when.
- KeptWhich write caused it — the same request that changed the row.
- Never keptThe value before the change.
- Never keptThe value after the change.
Accountability, not recovery.
This doesn't replace an undo. retract_capture still only reaches the most recent capture — anything older has no way back, and a contact update has no undo at all. Knowing that a deal's value changed on a given date doesn't tell you what it changed from. Those are different problems, and only one of them is solved here.
There's also no read tool for the audit trail yet, and no dashboard to browse it in — there's no dashboard for anything. Today it's a table, reachable by querying the database directly, not a question you can ask Claude in conversation. That's a real gap, named rather than smoothed over.