## Problem/Motivation ### Rows have no trace ID Sites that trace requests with OpenTelemetry have a W3C Trace Context trace ID for every request. It is shared by the request's database queries and exceptions, and it can travel to other systems through `traceparent`. Nothing links an audit row to it. #3620442 first did this with a context contributor writing to `context_permanent`. That only reaches entries recorded through `AuditTrail::record()`, has no index, and keeps the ID signed for good. ### `correlation_id` is kept too long, and lost at the wrong time `correlation_id` is the caller's free text, and the schema expects business references in it, so it can carry personal data. Today: - No purge clears it. It stays on the live row until the row itself is purged. - An archive does not carry it, so a restored row comes back without it, while the restorer says "the row goes back as it was written". Neither matches how audit_trail treats data that may be personal. That data lives in `context_transient`, which the transient purge clears before the row is archived. The settings refuse any other order, because an archive file is frozen by its `file_hash`, and data written into it stays until the file is purged. Keeping the ID also keeps a link: rows grouped by one ID after the transient purge can point back to an actor the purge removed, through any row of the group whose signed fields name a user. A trace ID raises the same questions. It is random when generated, but the client chooses it when a trace continues from an incoming `traceparent` header. ## Proposed resolution Treat both IDs as transient data: kept as long as `context_transient`, cleared with it, never signed. - **A `trace_id` column** on `audit_trail` and `audit_trail_outbox`: `varchar(32)`, ASCII, indexed, NULL when there is no trace. Unsigned, like `correlation_id`. - **A trace ID provider service** in base, returning NULL. A module that knows the current trace decorates it (#3620442 does, for OpenTelemetry). - **Filled by the writer**, so every chained row gets it: entries from `record()`, from the PSR-3 logger, and the rows audit_trail writes about its own chains. It is read when the entry is written and travels in the outbox with it, so a cron flush never stamps its own trace on earlier entries. - **The transient purge clears both IDs** with `context_transient`. Neither is signed, so verification is not affected. - **Archives carry an ID only when it is still set**, which happens only when the transient purge is turned off and the transient bytes reach the archive too. The ID then goes on the row line next to `id`, outside the signed payload, and restore puts it back. A line without it restores NULL. - **Entries page:** a trace ID filter next to the correlation ID one, and the trace ID on the entry detail page. - **Docs:** both IDs follow the transient tier; neither is signed; callers must not put personal data in `correlation_id` all the same. Writing the keys only when an ID is set keeps the row line unchanged in the normal case, so rebuilding a lost archive file from its live rows still produces the bytes `file_hash` expects. The one case left: a site with the transient purge turned off, whose rows carry a correlation ID, and whose segment was archived before this change. Its rebuild would include the new key and be refused. The rebuild could fall back to the old line shape when the new one does not match. ## Remaining tasks - Schema, writer, outbox and provider service. - Transient purge, archive and restore changes, including the rebuild case above. - Entries page filter and detail. - Kernel tests: the transient purge clears both IDs, which fails on the current code; with the transient purge off, both IDs survive archive and restore; an entry staged in the outbox keeps the trace ID of the request that wrote it, not of the flush. - Docs. ## User interface changes A trace ID filter on the entries page, and the trace ID on the entry detail page. ## API changes A new trace ID provider service, returning NULL by default. ## Data model changes A `trace_id` column on `audit_trail` and `audit_trail_outbox`. The transient purge now also clears `correlation_id` and `trace_id`. Archive row lines gain `correlation_id` and `trace_id` keys when those are set. No update hook: pre-beta. AI-Generated: Yes (Claude Code was used to help draft this issue summary. I reviewed it.)