docs(saas): §4.15 status — audit tables now exist and are written

user-console records turns and tool calls (best-effort by construction, keyed
per-recorder); spend enforcement exists on the KPI leg. Current-state only.

Claude-Session: https://claude.ai/code/session_01XMyuXoP35dmLmEwsvXxMKq

Author: alsterg

docs/saas.md

@@ -932,11 +932,16 @@ The data has three natures, each in the store that fits its access pattern:
 - **KPIs / analytics → ClickHouse.** High-cardinality product analytics (tokens/cost per
   org·user·model·project, tool counts, success rates) — dimensions that would blow up
   Prometheus cardinality. Dual-emitted from the recorder services, _derived_ not raw.
-  **Status:** this is the one built leg — `agent_activity_kpi` is live with both writers
-  (llm-router per LLM call, mcp-server per tool call) and a cost-aggregation API
-  (`GET /v1/kpi/cost`). The Yugabyte audit rows (`agent_conversation_turns`,
-  `agent_tool_calls`) have schemas but **no writers yet** (`mcp-server/TODO.md`), and
-  `org_id`/`project_id` in KPI rows are zero until the identity contract carries them.
+  **Status:** `agent_activity_kpi` is live with both writers (llm-router per LLM
+  call, mcp-server per tool call), a caller-scoped cost-aggregation API
+  (`GET /v1/kpi/cost`), and spend enforcement built on top of it (off by
+  default). The Yugabyte audit tables now exist and are **written** —
+  user-console records turns and tool calls from the chat stream, keyed
+  `(task_id, source, turn_index)` so multiple recorders can be reconciled. The
+  record is **best-effort by construction** (bounded queue, written at turn
+  end; losses counted, never silent) — anything compliance-grade needs a
+  durable sink first (`user-console/TODO.md`). `org_id`/`project_id` in KPI
+  rows remain zero until the identity contract carries them.
 
 ```sql
 -- YugabyteDB (Postgres-compatible). One row per model turn, written by llm-router.