who changed what, as a property of the schema

Most systems have an audit trail in the sense that logs exist somewhere. Very few can answer, for one specific record, which person changed it and what the value was beforehand. That question decides disputes, and it is nearly always unanswerable after the fact, because the information was never written.

What landed here is an append-only trail at the data layer rather than in the application: one generic event record carrying the business, the actor, the entity, the action and the changed values; an actor column added to the tables that hold human decisions; and triggers installed where a change is a business event rather than routine traffic. The actor is read from the row when the write supplies it, and otherwise from a session-scoped identity, so the trail does not depend on every caller remembering to say who it is.

Two properties make it worth trusting. A write that changes nothing produces no event, so the trail records decisions rather than activity. And the migration was not applied to production on the strength of a review: it was exercised on a throwaway database, where the expected rows appeared, the no-op stayed silent, the fallback for a missing session identity behaved, and a full rollback followed by a clean re-apply worked.

What it proves: accountability was placed beneath the code, at the layer an omitted call cannot skip, which is the only place it survives contact with a large codebase.