# Mutation evidence emission (TEN-WP-0011-T04)

Statute §9.6. Companion §6. Current event classes are **attributive**:
no control in this engine branches on an event's presence. Role grants
as *facts* are live PIP input; the *events* are the trail.

## Bound

The local `events` table and the local `audit_outbox` prove that the
records they hold were not altered or truncated after arrival. They do
not prove an event happened, and absence is not evidence of
non-occurrence. They share this service's runtime database credential,
so they are not independent custody.

Independent custody belongs to `audit-core`. This engine POSTs
`/v1/events` and holds no SQL, no admin, and no rewrite path against
audit-core's store. The external copy therefore cannot be rewritten
through tenant-engine's database credential.

## Trade (declared)

| Step | Atomic with mutation? | If it fails |
| --- | --- | --- |
| Insert local `events` row | yes (same transaction) | mutation rolls back |
| Insert local `audit_outbox` row | yes (same transaction) | mutation rolls back |
| Drain outbox to audit-core | **no** — after commit | mutation already succeeded; row stays pending |

Emission is **non-blocking**. Unavailable audit-core MUST NOT fail-open
a mutation (the fact is already written) and MUST NOT fail-closed a
mutation (attributive evidence is not load-bearing). Completeness is
not claimed. If a future control starts branching on these events, that
class must be reclassified load-bearing before it ships, and this trade
revisited.

## Envelope

`audit-core.event.v1alpha1`. `source` is `tenant-engine`. See
`tenant_engine.audit_core.envelope_for`. Duplicate event ids are 200
and not retried; 400/409 dead-letter; 503/transport retry.

## Credentials

No secret in Git. Production sender token is projected as
`TENANT_ENGINE_AUDIT_CORE_TOKEN_FILE`, routed through `warden route`
(`audit-core` sender registration), never through a State Hub message.
Sender registration itself is requested as `AUDIT-IN-0002`.

## Backfill

**Decision:** no backfill of pre-cutover event classes. Those rows stay
in the local table. Reconstructing them into audit-core would mint
evidence this engine cannot prove was complete at the time. New
mutations from this workplan onward enqueue the outbox.

## Configuration

| Env var | Default | Meaning |
| --- | --- | --- |
| `TENANT_ENGINE_AUDIT_CORE_URL` | unset | Drain is skipped; outbox rows stay pending. |
| `TENANT_ENGINE_AUDIT_CORE_TOKEN_FILE` | unset | Bearer token file for POST /v1/events. |
| `TENANT_ENGINE_AUDIT_CORE_TIMEOUT_SECONDS` | `3` | Drain timeout. |