Interventions are logged first; the audit event follows

Context

Sensitive staff changes need actor and reason evidence.

Decision

Write local intervention accountability atomically, then attempt its audit message after commit.

Alternatives Considered

Auditing inside the transaction could block interventions on a remote outage. Local logging alone leaves the intended Platform audit integration incomplete.

Consequences

The local record survives audit failure. The default audit fixture and fixed console approval reasons remain control gaps.