Module audit 

The record a run leaves behind.

Observable polling, the watchdog and the corner kill switch all make a run safe to watch. This makes one safe to not watch: a flow that ran at 3am, or one a model drove, otherwise answers “what did it actually do” with nothing at all.

One line per event, NDJSON — the format the line protocol already speaks, appendable and greppable. Everything here is pure: the caller supplies the clock and owns the file, because neither belongs in a crate with no platform dependencies.

What a record can never contain

Typed text. A type step carries whatever was typed, which is how passwords end up in log files. Nothing here strips it, because nothing here ever sees it: Step::summary renders Type as "type N chars", and these records are built from StepReport, which carries that summary and never the step. The property holds by construction rather than by remembering, and there is a test pinning it.

Enums

Event

One line of the log.