-- Payload-boundary proof (excerpt) — source: system/core/scripts/002_audit_events.sql
--
-- This is the hashed-payload construction inside audit_capture_direct. The two label columns the
-- 20260507c migration touched (entity_label_snapshot, actor_label) are NOT among these 15 fields —
-- the comment states it outright ("Labels excluded by design"). Because the hash is computed over
-- v_payload only, mutating a label column cannot alter any row's event_hash. That is why chain
-- integrity survived the incident, and why the finding was a discipline problem (indistinguishable
-- scrub-vs-mutation) rather than a broken chain.
--
-- No redaction required: this is framework scaffold SQL, not application or customer data.

  -- Field order MUST match audit_verify_chain exactly. Labels excluded by design.
  v_payload := jsonb_build_object(
    'id',             v_new_id,
    'chain_seq',      v_new_chain_seq,
    'account_id',     v_account_id,
    'actor_kind',     v_actor_kind,
    'actor_id',       v_actor_id,
    'action',         v_action,
    'entity_type',    v_entity_type,
    'entity_id',      coalesce((to_jsonb(NEW)->>'id')::uuid, (to_jsonb(OLD)->>'id')::uuid),
    'before',         v_before,
    'after',          v_after,
    'changed_fields', v_changed,
    'request_id',     v_request_id,
    'source',         v_source,
    'created_at',     v_now
  );

  v_event_hash := public.audit_event_hash(v_payload, v_prev_hash);

-- The 15 hashed columns: id, chain_seq, account_id, actor_kind, actor_id, action, entity_type,
-- entity_id, before, after, changed_fields, request_id, source, created_at (+ the chained prev_hash).
-- entity_label_snapshot and actor_label appear nowhere in this list.
