Every record keeps its own history

What, by whom, when

Created and changed are written in the same transaction as the change itself: the trail entry and the edit commit together, or not at all. An empty edit never produces a line; if nothing changed, there is nothing to record. You read the history newest first, without going looking for it.

The person stays named

The name of whoever acted is captured at write time, not looked up later when you read the trail. While the account exists, its live name wins; once someone leaves, you read 'Name (deleted)' rather than the work quietly becoming 'the system'. An audit trail whose actor evaporates is not an audit trail.

From, to

For an edit, each changed field shows its old and new value: from, to. It tracks the record's own definition fields, not freeform notes or custom fields. So you read exactly what changed, and nothing beyond it.

• Only fields that actually changed make the entry
• Statuses, dates and amounts rendered readably, not as raw code
• No freeform text or custom fields in the trail

Right under the record

The trail appears as a panel on the detail page, below the working surfaces: the work first, the history under it. The panel is a summary of the most recent entries and says so plainly when there is more. On the client hub, on projects and on contacts, each reads the same central trail.

Audit, not notifications

The activity log is separate from notifications: notifications are about delivery, the audit trail about what changed. Everything is scoped per organisation and enforced with RLS, like every other table. Reading the trail takes an explicit permission; recording it is a side effect of a change you were already allowed to make.