Dedicated security history and refusal recording

Context

The dedicated trail explains security decisions beyond ordinary row history. It avoids credential material and attributes successful changes within their transaction.

Retention and missing recovery events remain product/implementation findings. A separately attempted refusal record is not a guarantee that every refusal was durably recorded.

Decision

Retain the observed append-only writer interface and post-rollback refusal recording, while treating general database immutability and credential-payload rejection as unproved and allowing authorized scoped-history purge.

Alternatives Considered

Use ordinary database record history for all security explanation. Row history does not supply refused attempts, sign-in context, delegation classification or affected-holder summaries.

Consequences

Refusal recording uses a separate transaction after rollback, which has its own possible write failure.

Workspace-scoped security events are purged under the current retention default while deletion requests retain their staff decision record.

Retirement recovery still lacks a dedicated security event.