# Field-history Audit V2 activation contract

Audit V2 has one production activation state. Backend startup resolves the
MySQL outbox store, validates the required tables and indexes, performs a
rollback-only write/retention probe, and completes the worker's real initial
claim before marking the process ready. Producer emission, worker consumption,
and replacement of the legacy update writer become reachable together. There
are no independent producer or worker environment gates and no supported
partially active mode.

The `_System_AuditLog` capacity policy is:

- index history reads by `(ObjectApiName, RecordId, FieldName, ChangedAt)`;
- retain rows for at least 78 whole UTC calendar months from `ChangedAt`;
- apply no row-count deletion cap;
- hard-delete expired rows in bounded batches using the exclusive cutoff
  `ChangedAt < UTC-month-start(now) - 78 months`; and
- run retention immediately when the audit worker starts and hourly afterward.

Write-side skip or sampling is deliberately declined. Audit V2 durably records
every non-PII field diff received from the mutation path; sampling would create
permanent gaps that readers cannot distinguish from "no change". `trackHistory`
continues to control temporal read eligibility in Field History projections,
not durable capture. The separate `_System_FlowAuditLog` policy is unchanged.

The activation schema changes are additive, but that does not establish a
binary-downgrade contract. Audit V2 currently activates on the single backend
instance; no serviceified runtime/worker cluster or mixed-version deployment
exists. After activation, directly selecting a prior binary against the forward
database is unsupported, and operational recovery proceeds through a subsequent
release. Retained release artifacts do not certify database compatibility, and
no compatibility is declared for binaries that enforce the obsolete 90-day or
1,000,000-row retention limits.