- Write cloud.file_uploaded audit row in same transaction as reconciliation - Audit payload is metadata-only: filename, size_bytes, connection_id, provider_item_id, parent_ref - No provider URLs, tokens, bytes, or document text in audit metadata (T-13-02) - Non-success paths (conflict, offline, reauth_required) bypass audit write (T-13-21) - Import get_client_ip from deps.utils and write_audit_log from services.audit