Package-level declarations

One query as an audit trail sees it: who asked (caller; Wow does not own identity), what shape of query on which model version, under which restrictions, and what came back. It never carries a filter value, so no personal data from the query reaches the audit log.

Logs every failed query by who must act on it:

Sees the outcome of every query a gateway runs: the hook a host's metrics (9.x QueryMetricsObserver, wired by the host in 6.2c), logs (QueryLogObserver) and audit trail implement. A query ends in exactly one of onComplete, onError and onCancel; when audits is set, onAudit follows with its QueryAudit. A cross-tenant query is audited whatever the observers: its audit is logged at INFO (QueryAudit.CROSS_TENANT_LOGGER).