Activity log
Every operator action and customer event, chronologically, with attribution.
Activity log streams from
audit_log once webhooks land. Built-in fields: actor, action, resource, payload, IP hash, user-agent.