v2 provisional: clear integration 9 failures (whitelist tr+exit, B4 viewport draft, CHANGELOG pointer, workers audit via audit_on_conn, verify-multiuser gate evidence)

9 failures from v1 baseline 02835f6 cleared with provisional resolutions only;
each option pair is annotated provisional in verification/code-to10-v2-failures-summary.md
and awaits user confirmation. No check deleted, no skip added, no bare-phrase
stuffing, default hard merge gate untouched. Known remainder: one pre-existing
date-dependent test_arch_converge failure (Oct-dated fixture vs Nov current
month), failing on pristine v1 too, left for the quota track.

cloud/workers.py

@@ -441,39 +441,34 @@ def _default_kill(pid):
 
 
 def _default_audit(db_path, action, detail):
-    """默认审计写 audit_log：user_id=system、project_id=""。
+    """默认审计：user_id=system、project_id=""，经统一审计口写。
 
-    表不存在时先建（PG 与 SQLite 各一套 DDL，同
-    cloud/automations.py 的兜底写法：PG DDL 在 SQLite 下
-    失败即回滚再试 SQLite DDL，PG 适配层下第一条即成功）。
+    临时消解（v2 provisional，待用户确认后才算定）：#228 直写 ×
+    #250 无旁路断言——本轮临时选“审计落点迁移”一边：本函数不再
+    自带审计表直写，改调 cloud.auth 的统一审计口（该口写 legacy
+    审计行 + 防篡改账本链条目同一对，落点只增链条目、不丢旧行）。
+    另一边（断言放宽、给 workers 开例外）的代价是无旁路断言从
+    此带例外口子，后续任何模块都可援引 workers 例外再起直写；
+    若用户最终选断言放宽一边，本迁移须 revert、断言改列例外。
     写失败抛给调用方：reap 的杀前审计失败时不杀
     （fail-closed），杀后审计失败时只记 audit_after=False。
+    统一审计口在函数内 import：workers 与 auth 同属控制面，
+    顶层互引无必要，函数内取已加载模块即可。
     """
+    # 注意：本文件刻意不再出现审计表的直写语句——#250 的
+    # 无旁路断言扫描 cloud/*.py，任何直写都会让它变红。
+    from cloud.auth import audit_on_conn
     conn = _db_connect(str(db_path))
     try:
-        for ddl in (
-                "CREATE TABLE IF NOT EXISTS audit_log("
-                "id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, "
-                "user_id TEXT, project_id TEXT, action TEXT, detail TEXT, "
-                "created_at DOUBLE PRECISION)",
-                "CREATE TABLE IF NOT EXISTS audit_log("
-                "id INTEGER PRIMARY KEY AUTOINCREMENT, "
-                "user_id TEXT, project_id TEXT, action TEXT, detail TEXT, "
-                "created_at REAL)"):
+        try:
+            audit_on_conn(conn, "system", "", action, detail)
+            conn.commit()
+        except Exception:
             try:
-                conn.execute(ddl)
-                conn.execute(
-                    "INSERT INTO audit_log(user_id, project_id, action,"
-                    " detail, created_at) VALUES(?, ?, ?, ?, ?)",
-                    ("system", "", action, detail, time.time()))
-                conn.commit()
-                return
+                conn.rollback()
             except Exception:
-                try:
-                    conn.rollback()
-                except Exception:
-                    pass
-        raise RuntimeError("audit_log write failed")
+                pass
+            raise RuntimeError("audit_log write failed")
     finally:
         conn.close()
 
@@ -490,8 +485,9 @@ def reap_stale_workers(db_path, stale_seconds=None, local_host=None,
     - kill 行执行时先用同一 checker 再验一次 pid 已死：若此时
       已不死（判定后 pid 被复用等），跳过不杀，
       outcome="skipped_pid_alive_at_execution"，不调 kill_fn。
-    - 杀前写审计：audit_fn 未给时走 _default_audit 写
-      audit_log（action=worker_pid_kill）；审计写失败则不杀，
+    - 杀前写审计：audit_fn 未给时走 _default_audit，经统一
+      审计口写 audit_log + 账本链（action=worker_pid_kill）；
+      审计写失败则不杀，
       outcome="audit_failed"（fail-closed）。
     - 杀：kill_fn 未给时走 _default_kill（SIGKILL 只给该 pid
       本人）；ProcessLookupError 当已死处理，不是失败；其它