feat: Mission 18 — High-Volume Runtime Event Trail

Unified runtime event logging across all subsystems (webhooks, runtime
execution, dispatch, email, inbox, Zoho sync) with retention policies,
correlation IDs, and support replay capabilities.

- RuntimeEventLog model with 4 composite indexes + JSON related_ids
- Non-throwing log_event() service with payload redaction (SG.*, Bearer, truncation)
- Instrumented ~30 flows: webhook (5), runtime (8), dispatch (6), inbox (2), email (3)
- Support Timeline API: workspace-scoped with JSON path filters
- Admin Runtime Events: cross-workspace list/detail with full filter set
- Frontend: TimelinePanel in inbox + admin runtime-events page
- Celery beat daily purge (03:00 UTC, batch 1000)
- Alembic migration e5f6g7h8i9j0
- 8 unit tests + 98 E2E tests passing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/alembic/versions/e5f6g7h8i9j0_mission_18_runtime_event_log.py

@@ -0,0 +1,56 @@
+"""Mission 18 — Runtime Event Log
+
+Revision ID: e5f6g7h8i9j0
+Revises: d4e5f6g7h8i9
+Create Date: 2026-02-27
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = "e5f6g7h8i9j0"
+down_revision = "d4e5f6g7h8i9"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "runtimeeventlog",
+        sa.Column("id", sa.Uuid(), nullable=False),
+        sa.Column("workspace_id", sa.Uuid(), nullable=True),
+        sa.Column("event_type", sa.String(), nullable=False),
+        sa.Column("source", sa.String(), nullable=False),
+        sa.Column("correlation_id", sa.String(), nullable=True),
+        sa.Column("related_ids", sa.JSON(), nullable=True),
+        sa.Column("actor_user_id", sa.Uuid(), nullable=True),
+        sa.Column("payload", sa.JSON(), nullable=True),
+        sa.Column("outcome", sa.String(), nullable=True),
+        sa.Column("error_message", sa.String(), nullable=True),
+        sa.Column("duration_ms", sa.Integer(), nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_runtimeeventlog_workspace_id", "runtimeeventlog", ["workspace_id"])
+    op.create_index("ix_runtimeeventlog_event_type", "runtimeeventlog", ["event_type"])
+    op.create_index("ix_runtimeeventlog_source", "runtimeeventlog", ["source"])
+    op.create_index("ix_runtimeeventlog_correlation_id", "runtimeeventlog", ["correlation_id"])
+    op.create_index("ix_runtimeeventlog_created_at", "runtimeeventlog", ["created_at"])
+    op.create_index("idx_rte_ws_created", "runtimeeventlog", ["workspace_id", "created_at"])
+    op.create_index("idx_rte_correlation", "runtimeeventlog", ["correlation_id"])
+    op.create_index("idx_rte_type_created", "runtimeeventlog", ["event_type", "created_at"])
+    op.create_index("idx_rte_source_created", "runtimeeventlog", ["source", "created_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("idx_rte_source_created", table_name="runtimeeventlog")
+    op.drop_index("idx_rte_type_created", table_name="runtimeeventlog")
+    op.drop_index("idx_rte_correlation", table_name="runtimeeventlog")
+    op.drop_index("idx_rte_ws_created", table_name="runtimeeventlog")
+    op.drop_index("ix_runtimeeventlog_created_at", table_name="runtimeeventlog")
+    op.drop_index("ix_runtimeeventlog_correlation_id", table_name="runtimeeventlog")
+    op.drop_index("ix_runtimeeventlog_source", table_name="runtimeeventlog")
+    op.drop_index("ix_runtimeeventlog_event_type", table_name="runtimeeventlog")
+    op.drop_index("ix_runtimeeventlog_workspace_id", table_name="runtimeeventlog")
+    op.drop_table("runtimeeventlog")

backend/app/api/v1/admin.py

@@ -25,6 +25,7 @@ from app.models.models import (
     Plan, PlanEntitlement, WorkspacePlan,
     WorkspaceEntitlementOverride, UsageMeter,
     AgencyAccount, AgencyMember, AgencyStatus, WorkspaceOwnership,
+    RuntimeEventLog,
 )
 from app.schemas.envelope import ResponseEnvelope, wrap_data, wrap_error
 from app.core.modules import module_cache, ALL_MODULES, MODULE_ADMIN_PORTAL
@@ -356,6 +357,92 @@ async def get_audit_log_detail(
     })
 
 
+# ─── Runtime Events Endpoints (Mission 18) ────────────────────────────────────
+
+def _rt_event_to_dict(e: RuntimeEventLog) -> dict:
+    return {
+        "id": str(e.id),
+        "workspace_id": str(e.workspace_id) if e.workspace_id else None,
+        "event_type": e.event_type,
+        "source": e.source,
+        "correlation_id": e.correlation_id,
+        "related_ids": e.related_ids,
+        "actor_user_id": str(e.actor_user_id) if e.actor_user_id else None,
+        "payload": e.payload,
+        "outcome": e.outcome,
+        "error_message": e.error_message,
+        "duration_ms": e.duration_ms,
+        "created_at": e.created_at.isoformat() if e.created_at else None,
+    }
+
+
+@router.get("/runtime-events", response_model=ResponseEnvelope[dict])
+async def list_runtime_events(
+    db: AsyncSession = Depends(get_db),
+    admin_user: User = Depends(require_superadmin),
+    skip: int = Query(0, ge=0),
+    limit: int = Query(50, ge=1, le=200),
+    workspace_id: Optional[str] = None,
+    source: Optional[str] = None,
+    event_type: Optional[str] = None,
+    outcome: Optional[str] = None,
+    correlation_id: Optional[str] = None,
+    date_from: Optional[str] = None,
+    date_to: Optional[str] = None,
+) -> Any:
+    """List all runtime events (admin only)."""
+    from datetime import datetime
+    query = select(RuntimeEventLog)
+
+    if workspace_id:
+        query = query.where(RuntimeEventLog.workspace_id == UUID(workspace_id))
+    if source:
+        query = query.where(RuntimeEventLog.source == source)
+    if event_type:
+        query = query.where(RuntimeEventLog.event_type == event_type)
+    if outcome:
+        query = query.where(RuntimeEventLog.outcome == outcome)
+    if correlation_id:
+        query = query.where(RuntimeEventLog.correlation_id == correlation_id)
+    if date_from:
+        try:
+            query = query.where(RuntimeEventLog.created_at >= datetime.fromisoformat(date_from))
+        except ValueError:
+            pass
+    if date_to:
+        try:
+            query = query.where(RuntimeEventLog.created_at <= datetime.fromisoformat(date_to))
+        except ValueError:
+            pass
+
+    count_query = select(func.count()).select_from(query.subquery())
+    total = (await db.execute(count_query)).scalar_one()
+
+    query = query.order_by(RuntimeEventLog.created_at.desc()).offset(skip).limit(limit)
+    entries = (await db.execute(query)).scalars().all()
+
+    return wrap_data({
+        "items": [_rt_event_to_dict(e) for e in entries],
+        "total": total,
+        "skip": skip,
+        "limit": limit,
+    })
+
+
+@router.get("/runtime-events/{event_id}", response_model=ResponseEnvelope[dict])
+async def get_runtime_event_detail(
+    event_id: str,
+    db: AsyncSession = Depends(get_db),
+    admin_user: User = Depends(require_superadmin),
+) -> Any:
+    """Get a single runtime event by ID (admin only)."""
+    entry = await db.get(RuntimeEventLog, UUID(event_id))
+    if not entry:
+        return wrap_error("Runtime event not found")
+
+    return wrap_data(_rt_event_to_dict(entry))
+
+
 # ─── Users Endpoints ─────────────────────────────────────────────────────────
 
 @router.get("/users", response_model=ResponseEnvelope[dict])

backend/app/api/v1/inbox.py

@@ -24,6 +24,7 @@ from app.services.dispatch_service import DispatchService
 from app.workers.tasks import dispatch_message_task
 from app.services.entitlements import require_entitlement
 from app.services.audit_service import audit_event
+from app.services.runtime_event_service import log_event
 
 router = APIRouter()
 
@@ -196,6 +197,10 @@ async def reply_to_conversation(
         entity_id=str(conversation_id), actor_user_id=current_user.id,
         outcome="success", workspace_id=workspace.id, request=request,
     )
+    await log_event(db, event_type="inbox.manual_reply", source="inbox",
+                    workspace_id=workspace.id, actor_user_id=current_user.id,
+                    related_ids={"conversation_id": str(conversation_id), "message_id": str(new_msg.id)},
+                    payload={"content_length": len(content), "platform": platform})
     await db.commit()
 
     # Enqueue dispatch
@@ -224,6 +229,7 @@ async def update_conversation_status(
     if not conv or conv.workspace_id != workspace.id:
         raise HTTPException(status_code=404, detail="Conversation not found")
         
+    old_status = conv.status.value if conv.status else None
     conv.status = ConversationStatus(new_status)
     conv.updated_at = datetime.utcnow()
     db.add(conv)
@@ -233,6 +239,10 @@ async def update_conversation_status(
         outcome="success", workspace_id=workspace.id, request=request,
         metadata={"new_status": new_status},
     )
+    await log_event(db, event_type="inbox.status_changed", source="inbox",
+                    workspace_id=workspace.id, actor_user_id=current_user.id,
+                    related_ids={"conversation_id": str(conversation_id)},
+                    payload={"old_status": old_status, "new_status": new_status})
     await db.commit()
 
     return wrap_data({"conversation_id": str(conv.id), "status": conv.status})

backend/app/api/v1/support_timeline.py

@@ -0,0 +1,123 @@
+"""
+Support Timeline Router — Mission 18
+Workspace-scoped runtime event timeline endpoints.
+"""
+from typing import Any, Optional
+from uuid import UUID
+from datetime import datetime
+
+from fastapi import APIRouter, Depends, Query
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import func as sa_func
+from sqlmodel import select, func
+
+from app.core.db import get_db
+from app.api.deps import get_active_workspace, require_role
+from app.models.models import Workspace, RuntimeEventLog
+from app.schemas.envelope import wrap_data, wrap_error
+
+router = APIRouter()
+
+
+def _event_to_dict(e: RuntimeEventLog) -> dict:
+    """Serialize a runtime event entry to a dict."""
+    return {
+        "id": str(e.id),
+        "workspace_id": str(e.workspace_id) if e.workspace_id else None,
+        "event_type": e.event_type,
+        "source": e.source,
+        "correlation_id": e.correlation_id,
+        "related_ids": e.related_ids,
+        "actor_user_id": str(e.actor_user_id) if e.actor_user_id else None,
+        "payload": e.payload,
+        "outcome": e.outcome,
+        "error_message": e.error_message,
+        "duration_ms": e.duration_ms,
+        "created_at": e.created_at.isoformat() if e.created_at else None,
+    }
+
+
+@router.get("/support/timeline")
+async def list_timeline_events(
+    db: AsyncSession = Depends(get_db),
+    workspace: Workspace = Depends(get_active_workspace),
+    _=Depends(require_role(["owner", "member", "viewer"])),
+    skip: int = Query(0, ge=0),
+    limit: int = Query(50, ge=1, le=200),
+    contact_id: Optional[str] = None,
+    conversation_id: Optional[str] = None,
+    execution_id: Optional[str] = None,
+    correlation_id: Optional[str] = None,
+    source: Optional[str] = None,
+    event_type: Optional[str] = None,
+    outcome: Optional[str] = None,
+    date_from: Optional[str] = None,
+    date_to: Optional[str] = None,
+) -> Any:
+    """List runtime event timeline scoped to the current workspace."""
+    query = select(RuntimeEventLog).where(RuntimeEventLog.workspace_id == workspace.id)
+
+    if source:
+        query = query.where(RuntimeEventLog.source == source)
+    if event_type:
+        query = query.where(RuntimeEventLog.event_type == event_type)
+    if outcome:
+        query = query.where(RuntimeEventLog.outcome == outcome)
+    if correlation_id:
+        query = query.where(RuntimeEventLog.correlation_id == correlation_id)
+
+    # JSON path filters on related_ids using json_extract (SQLite compatible)
+    if contact_id:
+        query = query.where(
+            sa_func.json_extract(RuntimeEventLog.related_ids, "$.contact_id") == contact_id
+        )
+    if conversation_id:
+        query = query.where(
+            sa_func.json_extract(RuntimeEventLog.related_ids, "$.conversation_id") == conversation_id
+        )
+    if execution_id:
+        query = query.where(
+            sa_func.json_extract(RuntimeEventLog.related_ids, "$.execution_instance_id") == execution_id
+        )
+
+    if date_from:
+        try:
+            dt = datetime.fromisoformat(date_from)
+            query = query.where(RuntimeEventLog.created_at >= dt)
+        except ValueError:
+            pass
+    if date_to:
+        try:
+            dt = datetime.fromisoformat(date_to)
+            query = query.where(RuntimeEventLog.created_at <= dt)
+        except ValueError:
+            pass
+
+    # Count
+    count_query = select(func.count()).select_from(query.subquery())
+    total = (await db.execute(count_query)).scalar_one()
+
+    query = query.order_by(RuntimeEventLog.created_at.desc()).offset(skip).limit(limit)
+    entries = (await db.execute(query)).scalars().all()
+
+    return wrap_data({
+        "items": [_event_to_dict(e) for e in entries],
+        "total": total,
+        "skip": skip,
+        "limit": limit,
+    })
+
+
+@router.get("/support/timeline/{event_id}")
+async def get_timeline_event_detail(
+    event_id: str,
+    db: AsyncSession = Depends(get_db),
+    workspace: Workspace = Depends(get_active_workspace),
+    _=Depends(require_role(["owner", "member", "viewer"])),
+) -> Any:
+    """Get a single runtime event entry (workspace-scoped)."""
+    entry = await db.get(RuntimeEventLog, UUID(event_id))
+    if not entry or entry.workspace_id != workspace.id:
+        return wrap_error("Runtime event not found")
+
+    return wrap_data(_event_to_dict(entry))

backend/app/api/v1/webhooks.py

@@ -15,6 +15,7 @@ from app.models.models import Integration, WebhookEventLog, WebhookStatus
 from app.workers.tasks import process_webhook_event
 from app.core.modules import require_module_enabled, MODULE_WEBHOOKS_INGESTION
 from app.services.entitlements import require_entitlement
+from app.services.runtime_event_service import log_event
 
 router = APIRouter()
 
@@ -81,14 +82,14 @@ async def whatsapp_webhook(
     # 1. Extract IDs
     phone_number_id = None
     event_id = None
-    
+
     try:
         entry = payload.get("entry", [])[0]
         change = entry.get("changes", [])[0]
         value = change.get("value", {})
         metadata = value.get("metadata", {})
         phone_number_id = metadata.get("phone_number_id")
-        
+
         messages = value.get("messages", [])
         if messages:
             event_id = messages[0].get("id")
@@ -97,9 +98,19 @@ async def whatsapp_webhook(
     except (IndexError, AttributeError):
         pass
 
+    await log_event(db, event_type="webhook.received", source="webhook",
+                    payload={"provider": "whatsapp", "phone_number_id": phone_number_id})
+
     # 2. Resolve Workspace
     workspace_id = await resolve_workspace(db, "whatsapp", phone_number_id) if phone_number_id else None
-    
+
+    if workspace_id:
+        await log_event(db, event_type="webhook.workspace_resolved", source="webhook",
+                        workspace_id=workspace_id, payload={"provider": "whatsapp"})
+    else:
+        await log_event(db, event_type="webhook.workspace_not_found", source="webhook",
+                        outcome="failure", payload={"provider": "whatsapp", "phone_number_id": phone_number_id})
+
     # 3. Store Event Log
     correlation_id = uuid4()
     event_log = WebhookEventLog(
@@ -110,11 +121,11 @@ async def whatsapp_webhook(
         correlation_id=correlation_id,
         status=WebhookStatus.RECEIVED
     )
-    
+
     if not workspace_id:
         event_log.status = WebhookStatus.FAILED
         event_log.last_error = "workspace_not_found"
-    
+
     try:
         db.add(event_log)
         await db.commit()
@@ -125,7 +136,11 @@ async def whatsapp_webhook(
     # 4. Dispatch Task ONLY if resolved
     if workspace_id:
         process_webhook_event.delay(str(event_log.id))
-        
+        await log_event(db, event_type="webhook.queued", source="webhook",
+                        workspace_id=workspace_id, correlation_id=str(correlation_id),
+                        related_ids={"webhook_event_id": str(event_log.id)})
+        await db.commit()
+
     return {"status": "ok", "correlation_id": str(correlation_id)}
 
 @router.post("/meta", dependencies=[Depends(require_module_enabled(MODULE_WEBHOOKS_INGESTION, "write"))])
@@ -137,15 +152,21 @@ async def meta_webhook(
 ):
     """Inbound Meta Webhook."""
     payload_bytes = await request.body()
-    
+
     # 1. Signature Check (SHA-256 preferred, fallback to SHA-1)
     if x_hub_signature_256:
         if not verify_meta_signature(payload_bytes, x_hub_signature_256, algorithm="sha256"):
             if settings.META_APP_SECRET:
+                await log_event(db, event_type="webhook.signature_invalid", source="webhook",
+                                outcome="failure", payload={"provider": "meta", "algorithm": "sha256"})
+                await db.commit()
                 raise HTTPException(status_code=403, detail="Invalid SHA-256 signature")
     elif x_hub_signature:
         if not verify_meta_signature(payload_bytes, x_hub_signature, algorithm="sha1"):
             if settings.META_APP_SECRET:
+                await log_event(db, event_type="webhook.signature_invalid", source="webhook",
+                                outcome="failure", payload={"provider": "meta", "algorithm": "sha1"})
+                await db.commit()
                 raise HTTPException(status_code=403, detail="Invalid SHA-1 signature")
 
     try:
@@ -156,27 +177,37 @@ async def meta_webhook(
     # 2. Extract IDs
     page_id = None
     event_id = None
-    
+
     try:
         entry = payload.get("entry", [])[0]
         page_id = entry.get("id")
-        
+
         messaging = entry.get("messaging", [])
         if messaging:
             event_id = messaging[0].get("message", {}).get("mid")
-        
+
         changes = entry.get("changes", [])
         if changes:
             event_id = changes[0].get("value", {}).get("leadgen_id")
-            
+
         if not event_id:
             event_id = f"meta_{hashlib.md5(payload_bytes).hexdigest()}"
     except (IndexError, AttributeError):
         pass
 
+    await log_event(db, event_type="webhook.received", source="webhook",
+                    payload={"provider": "meta", "page_id": page_id})
+
     # 3. Resolve Workspace
     workspace_id = await resolve_workspace(db, "meta", page_id) if page_id else None
-    
+
+    if workspace_id:
+        await log_event(db, event_type="webhook.workspace_resolved", source="webhook",
+                        workspace_id=workspace_id, payload={"provider": "meta"})
+    else:
+        await log_event(db, event_type="webhook.workspace_not_found", source="webhook",
+                        outcome="failure", payload={"provider": "meta", "page_id": page_id})
+
     # 4. Store & Dispatch
     correlation_id = uuid4()
     event_log = WebhookEventLog(
@@ -187,11 +218,11 @@ async def meta_webhook(
         correlation_id=correlation_id,
         status=WebhookStatus.RECEIVED
     )
-    
+
     if not workspace_id:
         event_log.status = WebhookStatus.FAILED
         event_log.last_error = "workspace_not_found"
-        
+
     try:
         db.add(event_log)
         await db.commit()
@@ -202,5 +233,9 @@ async def meta_webhook(
     # Dispatch ONLY if resolved
     if workspace_id:
         process_webhook_event.delay(str(event_log.id))
-        
+        await log_event(db, event_type="webhook.queued", source="webhook",
+                        workspace_id=workspace_id, correlation_id=str(correlation_id),
+                        related_ids={"webhook_event_id": str(event_log.id)})
+        await db.commit()
+
     return {"status": "ok", "correlation_id": str(correlation_id)}

backend/app/core/celery_app.py

@@ -1,4 +1,5 @@
 from celery import Celery
+from celery.schedules import crontab
 from app.core.config import settings
 
 celery_app = Celery(
@@ -26,6 +27,10 @@ celery_app.conf.beat_schedule = {
         "task": "app.workers.email_tasks.process_email_outbox",
         "schedule": 60.0,
     },
+    "purge_runtime_events_daily_0300": {
+        "task": "app.workers.tasks.purge_runtime_events_task",
+        "schedule": crontab(hour=3, minute=0),
+    },
 }
 
 celery_app.autodiscover_tasks(["app.workers"])

backend/app/core/config.py

@@ -60,6 +60,9 @@ class Settings(BaseSettings):
     APP_BASE_URL: Optional[str] = None # For constructing links
     EMAIL_VERIFICATION_GRACE_DAYS: int = 7
 
+    # Runtime Event Trail
+    RUNTIME_EVENT_RETENTION_DAYS: int = 30
+
     @model_validator(mode="after")
     def validate_email_settings(self) -> "Settings":
         import logging

backend/app/domain/runtime.py

@@ -25,6 +25,7 @@ from app.models.models import (
     ZohoLeadMapping
 )
 from app.integrations.zoho.adapter import ZohoAdapter
+from app.services.runtime_event_service import log_event
 
 logger = logging.getLogger(__name__)
 
@@ -106,6 +107,11 @@ async def execute_instance(instance_id: UUID):
                     instance.abort_reason = f"conversation_{conversation.status.value}"
                     instance.aborted_at = datetime.utcnow()
                     session.add(instance)
+                    await log_event(session, event_type="runtime.aborted_human_takeover", source="runtime",
+                                    workspace_id=instance.workspace_id, outcome="skipped",
+                                    related_ids={"execution_instance_id": str(instance_id),
+                                                 "conversation_id": str(conversation.id) if conversation else None},
+                                    payload={"reason": instance.abort_reason})
                     await session.commit()
                     return
 
@@ -114,12 +120,17 @@ async def execute_instance(instance_id: UUID):
                 execution_instance_id=instance.id,
                 node_id=UUID(current_node_id)
             )
-            
+
+            await log_event(session, event_type="runtime.step_started", source="runtime",
+                            workspace_id=instance.workspace_id,
+                            related_ids={"execution_instance_id": str(instance_id)},
+                            payload={"node_type": node_type, "node_id": current_node_id})
+
             try:
                 # Execution Logic per Node Type
                 output_data = {}
                 node_config = node.get("config", {})
-                
+
                 if node_type == "AI_REPLY":
                     output_data = await handle_ai_reply(session, instance, node_config)
                 elif node_type == "SEND_MESSAGE":
@@ -129,10 +140,16 @@ async def execute_instance(instance_id: UUID):
                 else:
                     logger.warning(f"Unknown node type: {node_type}")
 
+                step_duration_ms = int((time.time() - start_time) * 1000)
                 step_log.output_data = output_data
-                step_log.duration_ms = int((time.time() - start_time) * 1000)
+                step_log.duration_ms = step_duration_ms
                 session.add(step_log)
-                
+
+                await log_event(session, event_type="runtime.step_completed", source="runtime",
+                                workspace_id=instance.workspace_id, duration_ms=step_duration_ms,
+                                related_ids={"execution_instance_id": str(instance_id)},
+                                payload={"node_type": node_type, "node_id": current_node_id})
+
                 # Move to next node
                 next_nodes = edge_map.get(current_node_id, [])
                 if next_nodes:
@@ -141,16 +158,21 @@ async def execute_instance(instance_id: UUID):
                 else:
                     current_node_id = None
                     instance.status = ExecutionStatus.COMPLETED
-                
+
                 session.add(instance)
                 await session.commit()
-                
+
             except Exception as e:
                 logger.exception(f"Error executing node {current_node_id}")
                 step_log.error_message = str(e)
                 instance.status = ExecutionStatus.FAILED
                 session.add(step_log)
                 session.add(instance)
+                await log_event(session, event_type="runtime.step_failed", source="runtime",
+                                workspace_id=instance.workspace_id, outcome="failure",
+                                error_message=str(e), duration_ms=int((time.time() - start_time) * 1000),
+                                related_ids={"execution_instance_id": str(instance_id)},
+                                payload={"node_type": node_type, "node_id": current_node_id})
                 await session.commit()
                 break
 
@@ -180,6 +202,10 @@ async def handle_zoho_upsert(session: AsyncSession, instance: ExecutionInstance,
     if not contact:
         raise Exception("Contact not found")
 
+    await log_event(session, event_type="zoho.sync_started", source="zoho",
+                    workspace_id=instance.workspace_id,
+                    related_ids={"execution_instance_id": str(instance.id), "contact_id": str(instance.contact_id)})
+
     # 4. Prepare Payload via Service
     from app.services.zoho_payload_builder import build_zoho_payload
     # runtime.py's execute_instance has session, instance...
@@ -232,6 +258,10 @@ async def handle_zoho_upsert(session: AsyncSession, instance: ExecutionInstance,
                 await asyncio.sleep(wait_time)
                 continue
             else:
+                await log_event(session, event_type="zoho.sync_failed", source="zoho",
+                                workspace_id=instance.workspace_id, outcome="failure",
+                                error_message=str(e),
+                                related_ids={"execution_instance_id": str(instance.id), "contact_id": str(instance.contact_id)})
                 raise e # Permanent error or max retries
 
     # Check for Token Refresh
@@ -244,7 +274,12 @@ async def handle_zoho_upsert(session: AsyncSession, instance: ExecutionInstance,
     contact.zoho_lead_id = zoho_id
     contact.zoho_last_synced_at = datetime.utcnow()
     session.add(contact)
-    
+
+    await log_event(session, event_type="zoho.sync_succeeded", source="zoho",
+                    workspace_id=instance.workspace_id,
+                    related_ids={"execution_instance_id": str(instance.id), "contact_id": str(instance.contact_id)},
+                    payload={"zoho_lead_id": zoho_id, "action": action})
+
     return {"zoho_lead_id": zoho_id, "action": action}
 
 async def handle_ai_reply(session: AsyncSession, instance: ExecutionInstance, config: Dict[str, Any]) -> Dict[str, Any]:
@@ -323,6 +358,11 @@ async def handle_ai_reply(session: AsyncSession, instance: ExecutionInstance, co
     session.add(new_msg)
     await session.flush() # Get the ID for Celery
 
+    await log_event(session, event_type="runtime.ai_reply_generated", source="runtime",
+                    workspace_id=instance.workspace_id,
+                    related_ids={"execution_instance_id": str(instance.id), "message_id": str(new_msg.id)},
+                    payload={"content_length": len(reply_text), "platform": platform})
+
     # 6. Trigger Dispatch (Mission 6)
     try:
         from app.workers.tasks import dispatch_message_task

backend/app/models/models.py

@@ -406,6 +406,29 @@ class EmailOutbox(BaseIDModel, table=True):
     locked_at: Optional[datetime] = None
     last_error: Optional[str] = None
 
+# --- Runtime Event Trail (Mission 18) ---
+
+class RuntimeEventLog(SQLModel, table=True):
+    id: UUID = Field(default_factory=uuid4, primary_key=True)
+    workspace_id: Optional[UUID] = Field(default=None, index=True)
+    event_type: str = Field(index=True)
+    source: str = Field(index=True)
+    correlation_id: Optional[str] = Field(default=None, index=True)
+    related_ids: Optional[Dict[str, Any]] = Field(default=None, sa_column=Column(JSON))
+    actor_user_id: Optional[UUID] = Field(default=None)
+    payload: Optional[Dict[str, Any]] = Field(default=None, sa_column=Column(JSON))
+    outcome: Optional[str] = Field(default=None)
+    error_message: Optional[str] = Field(default=None)
+    duration_ms: Optional[int] = Field(default=None)
+    created_at: datetime = Field(default_factory=datetime.utcnow, index=True)
+
+    __table_args__ = (
+        Index("idx_rte_ws_created", "workspace_id", "created_at"),
+        Index("idx_rte_correlation", "correlation_id"),
+        Index("idx_rte_type_created", "event_type", "created_at"),
+        Index("idx_rte_source_created", "source", "created_at"),
+    )
+
 # --- Plans & Entitlements (Mission 14) ---
 
 class Plan(BaseIDModel, table=True):

backend/app/services/dispatch_service.py

@@ -13,6 +13,7 @@ from app.models.models import Message, DeliveryStatus, Integration, ChannelIdent
 from app.core.security import decrypt_data
 from app.integrations.whatsapp.adapter import WhatsAppAdapter
 from app.integrations.meta.adapter import MetaAdapter
+from app.services.runtime_event_service import log_event
 
 logger = logging.getLogger(__name__)
 
@@ -89,6 +90,9 @@ class DispatchService:
 
             if not lock_acquired:
                 logger.warning(f"Message {msg.id} is already being dispatched (locked). Skipping.")
+                await log_event(db, event_type="dispatch.lock_skipped", source="dispatch",
+                                workspace_id=msg.workspace_id, outcome="skipped",
+                                related_ids={"message_id": str(msg.id)})
                 continue
             
             try:
@@ -124,6 +128,9 @@ class DispatchService:
             msg.delivery_status = DeliveryStatus.SENT
             msg.sent_at = msg.sent_at or datetime.utcnow()
             db.add(msg)
+            await log_event(db, event_type="dispatch.skipped_already_sent", source="dispatch",
+                            workspace_id=msg.workspace_id, outcome="skipped",
+                            related_ids={"message_id": str(msg.id)})
             await db.commit()
             return
 
@@ -144,6 +151,9 @@ class DispatchService:
                 msg.sent_at = datetime.utcnow()
                 msg.last_error = "Skipped by idempotency guard"
                 db.add(msg)
+                await log_event(db, event_type="dispatch.skipped_idempotency", source="dispatch",
+                                workspace_id=msg.workspace_id, outcome="skipped",
+                                related_ids={"message_id": str(msg.id)})
                 await db.commit()
                 return
 
@@ -152,6 +162,10 @@ class DispatchService:
         msg.last_attempt_at = datetime.utcnow()
         msg.attempt_count += 1
         db.add(msg)
+        await log_event(db, event_type="dispatch.attempt_started", source="dispatch",
+                        workspace_id=msg.workspace_id,
+                        related_ids={"message_id": str(msg.id), "conversation_id": str(msg.conversation_id)},
+                        payload={"platform": msg.platform, "attempt_count": msg.attempt_count})
         await db.commit()
         await db.refresh(msg)
 
@@ -215,20 +229,31 @@ class DispatchService:
             msg.sent_at = datetime.utcnow()
             msg.last_error = None
             logger.info(f"Successfully sent message {msg.id}", extra=log_ctx)
-            
+            await log_event(db, event_type="dispatch.attempt_succeeded", source="dispatch",
+                            workspace_id=msg.workspace_id,
+                            related_ids={"message_id": str(msg.id)},
+                            payload={"provider_message_id": provider_message_id, "platform": msg.platform})
+
         except Exception as e:
             error_str = str(e)
             is_permanent = "PERMANENT_FAILURE" in error_str
-            
+
             logger.error(f"Dispatch error for message {msg.id}: {error_str}", extra=log_ctx)
             msg.last_error = error_str
-            
+
             if is_permanent or msg.attempt_count >= 5:
                 msg.delivery_status = DeliveryStatus.FAILED
             else:
                 # Set back to FAILED for retry polling
-                msg.delivery_status = DeliveryStatus.FAILED 
-            
+                msg.delivery_status = DeliveryStatus.FAILED
+
+            await log_event(db, event_type="dispatch.attempt_failed", source="dispatch",
+                            workspace_id=msg.workspace_id,
+                            outcome="failure" if is_permanent or msg.attempt_count >= 5 else "skipped",
+                            error_message=error_str,
+                            related_ids={"message_id": str(msg.id)},
+                            payload={"platform": msg.platform, "attempt_count": msg.attempt_count})
+
             raise e
         finally:
             db.add(msg)

backend/app/services/runtime_event_service.py

@@ -0,0 +1,115 @@
+import logging
+import copy
+import re
+from typing import Optional, Dict, Any
+from uuid import UUID
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.audit import SENSITIVE_KEYS
+from app.models.models import RuntimeEventLog
+
+logger = logging.getLogger(__name__)
+
+# Regex patterns for additional scrubbing
+_SG_KEY_RE = re.compile(r"SG\.\S+")
+_BEARER_RE = re.compile(r"Bearer\s+\S+")
+
+MAX_STRING_LENGTH = 2048
+MAX_ARRAY_LENGTH = 20
+MAX_DICT_KEYS = 50
+
+
+def redact_payload(payload: Any) -> Any:
+    """
+    Deep-redact a payload dict for safe storage.
+    - Reuses SENSITIVE_KEYS from app.core.audit
+    - Scrubs SG.* SendGrid keys and Bearer tokens
+    - Truncates long strings, arrays, and large dicts
+    """
+    if payload is None:
+        return None
+    if not isinstance(payload, (dict, list)):
+        return payload
+
+    data = copy.deepcopy(payload)
+    return _redact(data)
+
+
+def _redact(data: Any) -> Any:
+    if isinstance(data, dict):
+        # Cap number of keys
+        if len(data) > MAX_DICT_KEYS:
+            keys = list(data.keys())[:MAX_DICT_KEYS]
+            data = {k: data[k] for k in keys}
+            data["_truncated"] = True
+
+        for k in list(data.keys()):
+            if any(sec in str(k).lower() for sec in SENSITIVE_KEYS):
+                data[k] = "***REDACTED***"
+            else:
+                data[k] = _redact(data[k])
+        return data
+    elif isinstance(data, list):
+        truncated = len(data) > MAX_ARRAY_LENGTH
+        items = [_redact(item) for item in data[:MAX_ARRAY_LENGTH]]
+        if truncated:
+            items.append({"_truncated": True})
+        return items
+    elif isinstance(data, str):
+        # Scrub SendGrid API keys
+        val = _SG_KEY_RE.sub("SG.***", data)
+        # Scrub Bearer tokens
+        val = _BEARER_RE.sub("Bearer ***", val)
+        # Truncate long strings
+        if len(val) > MAX_STRING_LENGTH:
+            val = val[:MAX_STRING_LENGTH] + "...[truncated]"
+        return val
+    return data
+
+
+async def log_event(
+    db: AsyncSession,
+    *,
+    event_type: str,
+    source: str,
+    workspace_id: Optional[UUID] = None,
+    correlation_id: Optional[str] = None,
+    related_ids: Optional[Dict[str, Any]] = None,
+    actor_user_id: Optional[UUID] = None,
+    payload: Optional[Dict[str, Any]] = None,
+    outcome: str = "success",
+    error_message: Optional[str] = None,
+    duration_ms: Optional[int] = None,
+):
+    """
+    Non-throwing runtime event logger.
+    Adds to session but does NOT commit — caller commits.
+    """
+    try:
+        safe_payload = redact_payload(payload) if payload else None
+        safe_error = error_message[:MAX_STRING_LENGTH] if error_message and len(error_message) > MAX_STRING_LENGTH else error_message
+
+        # Coerce string UUIDs to UUID objects for SQLAlchemy compatibility
+        ws_id = UUID(str(workspace_id)) if workspace_id and not isinstance(workspace_id, UUID) else workspace_id
+        actor_id = UUID(str(actor_user_id)) if actor_user_id and not isinstance(actor_user_id, UUID) else actor_user_id
+
+        event = RuntimeEventLog(
+            workspace_id=ws_id,
+            event_type=event_type,
+            source=source,
+            correlation_id=str(correlation_id) if correlation_id else None,
+            related_ids=related_ids,
+            actor_user_id=actor_id,
+            payload=safe_payload,
+            outcome=outcome,
+            error_message=safe_error,
+            duration_ms=duration_ms,
+        )
+        db.add(event)
+        await db.flush()
+    except Exception as e:
+        logger.warning(f"Failed to log runtime event ({event_type}): {e}")
+        try:
+            await db.rollback()
+        except Exception:
+            pass

backend/app/workers/email_tasks.py

@@ -244,8 +244,13 @@ def send_email_task_v2(self, outbox_id: str):
             # --- PRE-SEND STATE (Two-Phase Commit) ---
             email_log.status = EmailStatus.SENDING
             email_log.provider_message_id = message_id
+            from app.services.runtime_event_service import log_event as _log_rt_event
+            await _log_rt_event(db, event_type="email.send_started", source="email",
+                                workspace_id=email_log.workspace_id,
+                                related_ids={"email_outbox_id": outbox_id},
+                                payload={"email_type": email_type, "to_email": to_email})
             await db.commit()
-            
+
             # --- DISPATCH ---
             try:
                 success = False
@@ -262,21 +267,32 @@ def send_email_task_v2(self, outbox_id: str):
 
                 if not success:
                     raise Exception("EmailService returned False indicating failure.")
-                
+
                 # --- DB ATOMIC UPDATE ON SUCCESS ---
                 email_log.status = EmailStatus.SENT
                 email_log.sent_at = datetime.utcnow()
                 email_log.attempt_count = outbox.attempt_count + 1
                 email_log.error_message = None
-                
+
                 outbox.status = EmailOutboxStatus.SENT
                 outbox.attempt_count += 1
                 outbox.last_error = None
+                await _log_rt_event(db, event_type="email.send_succeeded", source="email",
+                                    workspace_id=email_log.workspace_id,
+                                    related_ids={"email_outbox_id": outbox_id})
                 await db.commit()
-                
+
             except Exception as exc:
                 await db.rollback() # Rollback anything in transit
                 
+                # Log runtime event for failure
+                async with SessionLocal() as db_rt:
+                    from app.services.runtime_event_service import log_event as _log_rt_event2
+                    await _log_rt_event2(db_rt, event_type="email.send_failed", source="email",
+                                         outcome="failure", error_message=str(exc),
+                                         related_ids={"email_outbox_id": outbox_id})
+                    await db_rt.commit()
+
                 # Safe atomic update for failure status
                 async with SessionLocal() as db_err:
                     import uuid

backend/app/workers/tasks.py

@@ -85,7 +85,8 @@ def process_webhook_event(event_id: str):
         logger.info(f"Processing webhook event: {event_id}")
         from app.core.db import engine
         from sqlalchemy.ext.asyncio import AsyncSession
-        
+        from app.services.runtime_event_service import log_event
+
         async with AsyncSession(engine) as session:
             event = await session.get(WebhookEventLog, UUID(event_id))
             if not event or not event.workspace_id:
@@ -94,6 +95,9 @@ def process_webhook_event(event_id: str):
 
             event.status = WebhookStatus.QUEUED
             session.add(event)
+            await log_event(session, event_type="webhook.processing_started", source="webhook",
+                            workspace_id=event.workspace_id, correlation_id=str(event.correlation_id),
+                            related_ids={"webhook_event_id": event_id})
             await session.commit()
 
             try:
@@ -114,7 +118,7 @@ def process_webhook_event(event_id: str):
                         msg_event = entry["messaging"][0]
                         if msg_event.get("message", {}).get("is_echo"):
                             is_echo = True
-                
+
                 if is_echo:
                     logger.info(f"Ignoring echo event {event_id} to prevent loops")
                     event.status = WebhookStatus.PROCESSED
@@ -133,13 +137,13 @@ def process_webhook_event(event_id: str):
 
                 # 2. Resolve Contact & Store Message
                 contact, identity, conversation = await resolve_or_create_contact(
-                    session, 
-                    event.workspace_id, 
-                    event.provider, 
+                    session,
+                    event.workspace_id,
+                    event.provider,
                     info["provider_user_id"],
                     first_name=info["first_name"]
                 )
-                
+
                 if info["trigger_type"] == "MESSAGE_INBOUND":
                     inbound_msg = Message(
                         workspace_id=event.workspace_id,
@@ -150,22 +154,22 @@ def process_webhook_event(event_id: str):
                         delivery_status="delivered"
                     )
                     session.add(inbound_msg)
-                
+
                 # 3. Find Matching Published Flow
                 flow_query = select(FlowVersion).join(Flow).where(
                     Flow.workspace_id == event.workspace_id,
                     FlowVersion.is_published == True
                 ).order_by(FlowVersion.created_at.desc())
-                
+
                 flow_version = (await session.execute(flow_query)).scalars().first()
-                
+
                 if flow_version:
                     # 4. Create Execution Instance
                     nodes = flow_version.definition_json.get("nodes", [])
                     start_node = next((n for n in nodes if n.get("type") == "TRIGGER"), None)
                     if not start_node and nodes:
                         start_node = nodes[0]
-                    
+
                     instance = ExecutionInstance(
                         workspace_id=event.workspace_id,
                         flow_version_id=flow_version.id,
@@ -174,8 +178,11 @@ def process_webhook_event(event_id: str):
                         current_node_id=UUID(start_node["id"]) if start_node else None
                     )
                     session.add(instance)
+                    await log_event(session, event_type="runtime.execution_created", source="runtime",
+                                    workspace_id=event.workspace_id, correlation_id=str(event.correlation_id),
+                                    related_ids={"webhook_event_id": event_id, "execution_instance_id": str(instance.id)})
                     await session.commit()
-                    
+
                     # 5. Execute Runtime
                     await execute_instance(instance.id)
 
@@ -183,14 +190,21 @@ def process_webhook_event(event_id: str):
                 event.status = WebhookStatus.PROCESSED
                 event.processed_at = datetime.utcnow()
                 session.add(event)
+                await log_event(session, event_type="webhook.processing_completed", source="webhook",
+                                workspace_id=event.workspace_id, correlation_id=str(event.correlation_id),
+                                related_ids={"webhook_event_id": event_id})
                 await session.commit()
-                
+
             except Exception as e:
                 logger.exception(f"Failed to process event {event_id}")
                 event.status = WebhookStatus.FAILED
                 event.last_error = str(e)
                 event.attempts += 1
                 session.add(event)
+                await log_event(session, event_type="webhook.processing_failed", source="webhook",
+                                workspace_id=event.workspace_id, correlation_id=str(event.correlation_id),
+                                outcome="failure", error_message=str(e),
+                                related_ids={"webhook_event_id": event_id})
                 await session.commit()
 
     run_async(_run())
@@ -222,8 +236,40 @@ def dispatch_pending_task(workspace_id: Optional[str] = None):
     async def _run():
         async with AsyncSession(engine) as session:
             await DispatchService.dispatch_pending_messages(
-                session, 
+                session,
                 workspace_id=UUID(workspace_id) if workspace_id else None
             )
-            
+
+    run_async(_run())
+
+
+@celery_app.task(name="app.workers.tasks.purge_runtime_events_task")
+def purge_runtime_events_task():
+    """Daily task to purge old runtime events based on retention policy."""
+    from app.core.config import settings as app_settings
+    from app.core.db import engine
+    from sqlalchemy.ext.asyncio import AsyncSession
+    from app.models.models import RuntimeEventLog
+    from datetime import timedelta
+    from sqlalchemy import delete as sa_delete
+
+    async def _run():
+        cutoff = datetime.utcnow() - timedelta(days=app_settings.RUNTIME_EVENT_RETENTION_DAYS)
+        total_purged = 0
+        async with AsyncSession(engine) as session:
+            while True:
+                query = select(RuntimeEventLog.id).where(
+                    RuntimeEventLog.created_at < cutoff
+                ).limit(1000)
+                result = await session.execute(query)
+                ids = [row[0] for row in result.all()]
+                if not ids:
+                    break
+                await session.execute(
+                    sa_delete(RuntimeEventLog).where(RuntimeEventLog.id.in_(ids))
+                )
+                await session.commit()
+                total_purged += len(ids)
+        logger.info(f"Purged {total_purged} runtime events older than {app_settings.RUNTIME_EVENT_RETENTION_DAYS} days")
+
     run_async(_run())

backend/main.py

@@ -15,6 +15,7 @@ from app.api.v1.diagnostics import router as diagnostics_router
 from app.api.v1.agency import router as agency_router
 from app.api.v1.settings import router as settings_router
 from app.api.v1.audit_logs import router as audit_logs_router
+from app.api.v1.support_timeline import router as support_timeline_router
 from fastapi import HTTPException
 import uuid
 import logging
@@ -152,6 +153,7 @@ app.include_router(diagnostics_router, prefix=f"{settings.API_V1_STR}/diagnostic
 app.include_router(agency_router, prefix=f"{settings.API_V1_STR}/agency", tags=["agency"])
 app.include_router(settings_router, prefix=f"{settings.API_V1_STR}/settings/workspace", tags=["settings"])
 app.include_router(audit_logs_router, prefix=f"{settings.API_V1_STR}/audit-logs", tags=["audit-logs"])
+app.include_router(support_timeline_router, prefix=f"{settings.API_V1_STR}", tags=["support-timeline"])
 
 @app.get("/")
 async def root():

backend/tests/test_runtime_events.py

@@ -0,0 +1,142 @@
+"""
+Mission 18 — Runtime Event Trail Tests
+"""
+import pytest
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlmodel import select, func
+from uuid import uuid4
+
+from app.models.models import RuntimeEventLog
+from app.services.runtime_event_service import log_event, redact_payload
+
+
+# ── Helpers ──────────────────────────────────────────────────────────────────
+
+async def _count_events(db: AsyncSession, **filters) -> int:
+    q = select(func.count(RuntimeEventLog.id))
+    for k, v in filters.items():
+        q = q.where(getattr(RuntimeEventLog, k) == v)
+    result = await db.execute(q)
+    return result.scalar_one()
+
+
+# ── Service Unit Tests ───────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_log_event_stores_fields(db_session: AsyncSession):
+    """log_event() should persist all provided fields."""
+    ws_id = uuid4()
+    corr = str(uuid4())
+    await log_event(
+        db_session,
+        event_type="webhook.received",
+        source="webhook",
+        workspace_id=ws_id,
+        correlation_id=corr,
+        related_ids={"webhook_event_id": "evt-123"},
+        payload={"provider": "whatsapp", "phone_number_id": "12345"},
+        outcome="success",
+        duration_ms=42,
+    )
+    await db_session.commit()
+
+    result = await db_session.execute(
+        select(RuntimeEventLog).where(RuntimeEventLog.correlation_id == corr)
+    )
+    entry = result.scalars().first()
+
+    assert entry is not None
+    assert entry.event_type == "webhook.received"
+    assert entry.source == "webhook"
+    assert entry.workspace_id == ws_id
+    assert entry.outcome == "success"
+    assert entry.duration_ms == 42
+    assert entry.related_ids["webhook_event_id"] == "evt-123"
+    assert entry.payload["provider"] == "whatsapp"
+
+
+@pytest.mark.asyncio
+async def test_log_event_redacts_payload(db_session: AsyncSession):
+    """Sensitive keys and Bearer tokens should be redacted in stored payload."""
+    await log_event(
+        db_session,
+        event_type="test.redact",
+        source="test",
+        payload={
+            "access_token": "secret-token-value",
+            "provider": "meta",
+            "authorization": "Bearer sk-1234",
+        },
+    )
+    await db_session.commit()
+
+    result = await db_session.execute(
+        select(RuntimeEventLog).where(RuntimeEventLog.event_type == "test.redact")
+    )
+    entry = result.scalars().first()
+
+    assert entry is not None
+    assert entry.payload["access_token"] == "***REDACTED***"
+    assert entry.payload["authorization"] == "***REDACTED***"
+    assert entry.payload["provider"] == "meta"
+
+
+@pytest.mark.asyncio
+async def test_log_event_swallows_exceptions(db_session: AsyncSession):
+    """log_event() should not raise even on invalid data."""
+    # Pass a non-UUID for workspace_id to trigger a potential error — but log_event is non-throwing
+    # Actually, let's just ensure it handles gracefully without crashing
+    try:
+        await log_event(
+            db_session,
+            event_type="test.error_handling",
+            source="test",
+        )
+        await db_session.commit()
+    except Exception:
+        pytest.fail("log_event() should not raise exceptions")
+
+
+@pytest.mark.asyncio
+async def test_redact_payload_truncates_long_strings():
+    """Strings longer than 2048 chars should be truncated."""
+    long_string = "x" * 5000
+    result = redact_payload({"data": long_string})
+    assert len(result["data"]) < 5000
+    assert result["data"].endswith("...[truncated]")
+
+
+@pytest.mark.asyncio
+async def test_redact_payload_truncates_arrays():
+    """Arrays with > 20 items should be truncated."""
+    long_array = list(range(50))
+    result = redact_payload({"items": long_array})
+    assert len(result["items"]) == 21  # 20 items + truncation marker
+    assert result["items"][-1] == {"_truncated": True}
+
+
+@pytest.mark.asyncio
+async def test_redact_payload_scrubs_sendgrid_keys():
+    """SG.* patterns should be scrubbed."""
+    result = redact_payload({"api_response": "API key is SG.abc123xyz.foobar"})
+    assert "SG.abc123xyz" not in result["api_response"]
+    assert "SG.***" in result["api_response"]
+
+
+@pytest.mark.asyncio
+async def test_redact_payload_scrubs_bearer_tokens():
+    """Bearer tokens should be scrubbed."""
+    result = redact_payload({"header": "Bearer eyJhbGciOiJIUzI1NiJ9.payload.sig"})
+    assert "eyJhbGciOiJIUzI1NiJ9" not in result["header"]
+    assert "Bearer ***" in result["header"]
+
+
+@pytest.mark.asyncio
+async def test_redact_payload_caps_dict_keys():
+    """Dicts with > 50 keys should be truncated."""
+    big_dict = {f"key_{i}": i for i in range(80)}
+    result = redact_payload(big_dict)
+    assert "_truncated" in result
+    assert result["_truncated"] is True
+    # Should have at most 51 keys (50 original + _truncated)
+    assert len(result) <= 51

frontend/src/app/(admin)/admin/runtime-events/page.tsx

@@ -0,0 +1,306 @@
+"use client";
+
+import { useEffect, useState, useCallback } from "react";
+import { adminApi, RuntimeEventEntry } from "@/lib/admin-api";
+import { Loader2, ChevronLeft, ChevronRight, ChevronDown, ChevronUp, Copy, Check, AlertCircle, CheckCircle, MinusCircle } from "lucide-react";
+
+function formatDate(iso: string) {
+    try {
+        return new Date(iso).toLocaleString(undefined, { dateStyle: "medium", timeStyle: "medium" });
+    } catch {
+        return iso;
+    }
+}
+
+const SOURCE_COLORS: Record<string, string> = {
+    webhook: "bg-blue-500/20 text-blue-300 border-blue-500/30",
+    runtime: "bg-purple-500/20 text-purple-300 border-purple-500/30",
+    dispatch: "bg-emerald-500/20 text-emerald-300 border-emerald-500/30",
+    email: "bg-orange-500/20 text-orange-300 border-orange-500/30",
+    zoho: "bg-cyan-500/20 text-cyan-300 border-cyan-500/30",
+    inbox: "bg-slate-500/20 text-slate-400 border-slate-500/30",
+};
+
+function SourceBadge({ source }: { source: string }) {
+    const cls = SOURCE_COLORS[source] || SOURCE_COLORS.inbox;
+    return (
+        <span className={`inline-flex items-center px-2 py-0.5 rounded text-[10px] font-semibold uppercase tracking-wider border ${cls}`}>
+            {source}
+        </span>
+    );
+}
+
+function OutcomeBadge({ outcome }: { outcome?: string | null }) {
+    if (!outcome) return <span className="text-[10px] text-slate-500">—</span>;
+    switch (outcome) {
+        case "success":
+            return (
+                <span className="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[10px] font-semibold uppercase tracking-wider border bg-emerald-500/20 text-emerald-300 border-emerald-500/30">
+                    <CheckCircle className="w-3 h-3" /> success
+                </span>
+            );
+        case "failure":
+            return (
+                <span className="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[10px] font-semibold uppercase tracking-wider border bg-red-500/20 text-red-300 border-red-500/30">
+                    <AlertCircle className="w-3 h-3" /> failure
+                </span>
+            );
+        case "skipped":
+            return (
+                <span className="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[10px] font-semibold uppercase tracking-wider border bg-amber-500/20 text-amber-300 border-amber-500/30">
+                    <MinusCircle className="w-3 h-3" /> skipped
+                </span>
+            );
+        default:
+            return <span className="text-[10px] text-slate-500">{outcome}</span>;
+    }
+}
+
+function CopyButton({ text }: { text: string }) {
+    const [copied, setCopied] = useState(false);
+    return (
+        <button
+            onClick={() => { navigator.clipboard.writeText(text); setCopied(true); setTimeout(() => setCopied(false), 1500); }}
+            className="p-0.5 hover:bg-white/10 rounded transition-colors"
+            title="Copy"
+        >
+            {copied ? <Check className="w-3 h-3 text-emerald-400" /> : <Copy className="w-3 h-3 text-slate-500" />}
+        </button>
+    );
+}
+
+export default function AdminRuntimeEventsPage() {
+    const [events, setEvents] = useState<RuntimeEventEntry[]>([]);
+    const [total, setTotal] = useState(0);
+    const [loading, setLoading] = useState(true);
+    const [skip, setSkip] = useState(0);
+    const limit = 50;
+    const [expandedId, setExpandedId] = useState<string | null>(null);
+
+    // Filters
+    const [sourceFilter, setSourceFilter] = useState("");
+    const [eventTypeFilter, setEventTypeFilter] = useState("");
+    const [outcomeFilter, setOutcomeFilter] = useState("");
+    const [workspaceIdFilter, setWorkspaceIdFilter] = useState("");
+
+    const fetchEvents = useCallback(async () => {
+        setLoading(true);
+        try {
+            const res = await adminApi.getRuntimeEvents({
+                skip,
+                limit,
+                source: sourceFilter || undefined,
+                event_type: eventTypeFilter || undefined,
+                outcome: outcomeFilter || undefined,
+                workspace_id: workspaceIdFilter || undefined,
+            });
+            setEvents(res.data?.items || []);
+            setTotal(res.data?.total || 0);
+        } catch {
+            setEvents([]);
+        } finally {
+            setLoading(false);
+        }
+    }, [skip, sourceFilter, eventTypeFilter, outcomeFilter, workspaceIdFilter]);
+
+    useEffect(() => { fetchEvents(); }, [fetchEvents]);
+
+    const totalPages = Math.ceil(total / limit);
+    const currentPage = Math.floor(skip / limit) + 1;
+
+    return (
+        <div className="p-6 space-y-6">
+            <div className="flex items-center justify-between">
+                <div>
+                    <h1 className="text-2xl font-bold text-white">Runtime Events</h1>
+                    <p className="text-sm text-slate-400 mt-1">High-volume system event trail across all subsystems</p>
+                </div>
+                <div className="text-sm text-slate-400">{total} total events</div>
+            </div>
+
+            {/* Filters */}
+            <div className="flex flex-wrap gap-3">
+                <select
+                    value={sourceFilter}
+                    onChange={(e) => { setSourceFilter(e.target.value); setSkip(0); }}
+                    className="bg-slate-800 border border-slate-700 rounded-lg text-sm text-white px-3 py-2 focus:ring-2 focus:ring-blue-500/50 focus:border-blue-500"
+                >
+                    <option value="">All Sources</option>
+                    <option value="webhook">Webhook</option>
+                    <option value="runtime">Runtime</option>
+                    <option value="dispatch">Dispatch</option>
+                    <option value="email">Email</option>
+                    <option value="zoho">Zoho</option>
+                    <option value="inbox">Inbox</option>
+                </select>
+                <input
+                    type="text"
+                    placeholder="Event type..."
+                    value={eventTypeFilter}
+                    onChange={(e) => { setEventTypeFilter(e.target.value); setSkip(0); }}
+                    className="bg-slate-800 border border-slate-700 rounded-lg text-sm text-white px-3 py-2 w-48 focus:ring-2 focus:ring-blue-500/50 focus:border-blue-500 placeholder:text-slate-500"
+                />
+                <select
+                    value={outcomeFilter}
+                    onChange={(e) => { setOutcomeFilter(e.target.value); setSkip(0); }}
+                    className="bg-slate-800 border border-slate-700 rounded-lg text-sm text-white px-3 py-2 focus:ring-2 focus:ring-blue-500/50 focus:border-blue-500"
+                >
+                    <option value="">All Outcomes</option>
+                    <option value="success">Success</option>
+                    <option value="failure">Failure</option>
+                    <option value="skipped">Skipped</option>
+                </select>
+                <input
+                    type="text"
+                    placeholder="Workspace ID..."
+                    value={workspaceIdFilter}
+                    onChange={(e) => { setWorkspaceIdFilter(e.target.value); setSkip(0); }}
+                    className="bg-slate-800 border border-slate-700 rounded-lg text-sm text-white px-3 py-2 w-64 focus:ring-2 focus:ring-blue-500/50 focus:border-blue-500 placeholder:text-slate-500"
+                />
+            </div>
+
+            {/* Table */}
+            {loading ? (
+                <div className="flex items-center justify-center py-20">
+                    <Loader2 className="w-6 h-6 animate-spin text-blue-500" />
+                </div>
+            ) : (
+                <div className="bg-slate-800/50 border border-slate-700/50 rounded-xl overflow-hidden">
+                    <table className="w-full text-sm">
+                        <thead>
+                            <tr className="border-b border-slate-700/50 text-left text-xs uppercase tracking-wider text-slate-400">
+                                <th className="px-4 py-3 w-8"></th>
+                                <th className="px-4 py-3">Time</th>
+                                <th className="px-4 py-3">Source</th>
+                                <th className="px-4 py-3">Event Type</th>
+                                <th className="px-4 py-3">Outcome</th>
+                                <th className="px-4 py-3">Duration</th>
+                                <th className="px-4 py-3">Correlation ID</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {events.map((evt) => {
+                                const isExpanded = expandedId === evt.id;
+                                return (
+                                    <>
+                                        <tr
+                                            key={evt.id}
+                                            className="border-b border-slate-700/30 hover:bg-slate-700/20 cursor-pointer transition-colors"
+                                            onClick={() => setExpandedId(isExpanded ? null : evt.id)}
+                                        >
+                                            <td className="px-4 py-3">
+                                                {isExpanded ? (
+                                                    <ChevronUp className="w-3.5 h-3.5 text-slate-500" />
+                                                ) : (
+                                                    <ChevronDown className="w-3.5 h-3.5 text-slate-500" />
+                                                )}
+                                            </td>
+                                            <td className="px-4 py-3 text-slate-300 whitespace-nowrap text-xs">
+                                                {formatDate(evt.created_at)}
+                                            </td>
+                                            <td className="px-4 py-3"><SourceBadge source={evt.source} /></td>
+                                            <td className="px-4 py-3 text-slate-200 font-mono text-xs">{evt.event_type}</td>
+                                            <td className="px-4 py-3"><OutcomeBadge outcome={evt.outcome} /></td>
+                                            <td className="px-4 py-3 text-slate-400 font-mono text-xs">
+                                                {evt.duration_ms !== null && evt.duration_ms !== undefined ? `${evt.duration_ms}ms` : "—"}
+                                            </td>
+                                            <td className="px-4 py-3">
+                                                {evt.correlation_id ? (
+                                                    <div className="flex items-center gap-1">
+                                                        <span className="font-mono text-[10px] text-slate-500 truncate max-w-[120px]">
+                                                            {evt.correlation_id}
+                                                        </span>
+                                                        <CopyButton text={evt.correlation_id} />
+                                                    </div>
+                                                ) : (
+                                                    <span className="text-slate-600">—</span>
+                                                )}
+                                            </td>
+                                        </tr>
+                                        {isExpanded && (
+                                            <tr key={`${evt.id}-detail`} className="bg-slate-900/50">
+                                                <td colSpan={7} className="px-6 py-4">
+                                                    <div className="grid grid-cols-2 gap-4 text-xs">
+                                                        <div>
+                                                            <span className="text-slate-500 font-semibold uppercase tracking-wider text-[10px]">Event ID</span>
+                                                            <div className="text-slate-300 font-mono mt-1 flex items-center gap-1">
+                                                                {evt.id} <CopyButton text={evt.id} />
+                                                            </div>
+                                                        </div>
+                                                        <div>
+                                                            <span className="text-slate-500 font-semibold uppercase tracking-wider text-[10px]">Workspace</span>
+                                                            <div className="text-slate-300 font-mono mt-1">
+                                                                {evt.workspace_id || "—"}
+                                                            </div>
+                                                        </div>
+                                                        {evt.error_message && (
+                                                            <div className="col-span-2">
+                                                                <span className="text-slate-500 font-semibold uppercase tracking-wider text-[10px]">Error</span>
+                                                                <div className="text-red-400 bg-red-900/20 p-2 rounded mt-1 font-mono break-all">
+                                                                    {evt.error_message}
+                                                                </div>
+                                                            </div>
+                                                        )}
+                                                        {evt.related_ids && Object.keys(evt.related_ids).length > 0 && (
+                                                            <div className="col-span-2">
+                                                                <span className="text-slate-500 font-semibold uppercase tracking-wider text-[10px]">Related IDs</span>
+                                                                <div className="mt-1 flex flex-wrap gap-2">
+                                                                    {Object.entries(evt.related_ids).map(([k, v]) => (
+                                                                        <span key={k} className="bg-slate-800 px-2 py-1 rounded text-[10px] font-mono text-slate-300 border border-slate-700">
+                                                                            {k}: {v}
+                                                                        </span>
+                                                                    ))}
+                                                                </div>
+                                                            </div>
+                                                        )}
+                                                        {evt.payload && Object.keys(evt.payload).length > 0 && (
+                                                            <div className="col-span-2">
+                                                                <span className="text-slate-500 font-semibold uppercase tracking-wider text-[10px]">Payload</span>
+                                                                <pre className="bg-slate-800 p-3 rounded mt-1 text-[11px] font-mono text-slate-300 overflow-x-auto max-h-48 border border-slate-700">
+                                                                    {JSON.stringify(evt.payload, null, 2)}
+                                                                </pre>
+                                                            </div>
+                                                        )}
+                                                    </div>
+                                                </td>
+                                            </tr>
+                                        )}
+                                    </>
+                                );
+                            })}
+                        </tbody>
+                    </table>
+
+                    {events.length === 0 && (
+                        <div className="py-12 text-center text-slate-500 text-sm">No runtime events found</div>
+                    )}
+                </div>
+            )}
+
+            {/* Pagination */}
+            {totalPages > 1 && (
+                <div className="flex items-center justify-between">
+                    <span className="text-sm text-slate-400">
+                        Page {currentPage} of {totalPages}
+                    </span>
+                    <div className="flex gap-2">
+                        <button
+                            disabled={skip === 0}
+                            onClick={() => setSkip(Math.max(0, skip - limit))}
+                            className="flex items-center gap-1 px-3 py-1.5 bg-slate-800 border border-slate-700 rounded-lg text-sm text-slate-300 hover:bg-slate-700 disabled:opacity-40 disabled:cursor-not-allowed transition-colors"
+                        >
+                            <ChevronLeft className="w-4 h-4" /> Previous
+                        </button>
+                        <button
+                            disabled={skip + limit >= total}
+                            onClick={() => setSkip(skip + limit)}
+                            className="flex items-center gap-1 px-3 py-1.5 bg-slate-800 border border-slate-700 rounded-lg text-sm text-slate-300 hover:bg-slate-700 disabled:opacity-40 disabled:cursor-not-allowed transition-colors"
+                        >
+                            Next <ChevronRight className="w-4 h-4" />
+                        </button>
+                    </div>
+                </div>
+            )}
+        </div>
+    );
+}

frontend/src/app/(dashboard)/inbox/page.tsx

@@ -15,13 +15,15 @@ import {
     Bot,
     UserCircle,
     Archive,
-    CloudUpload
+    CloudUpload,
+    Clock
 } from "lucide-react";
 import { formatDistanceToNow } from "date-fns";
 import { cn } from "@/lib/utils";
 import { apiClient } from "@/lib/api";
 import { useSearchParams, useRouter } from "next/navigation";
 import { toast } from "sonner";
+import TimelinePanel from "@/components/inbox/TimelinePanel";
 
 // --- Types ---
 
@@ -59,6 +61,7 @@ export default function InboxPage() {
     const [replyContent, setReplyContent] = useState("");
     const [sending, setSending] = useState(false);
     const [syncingZoho, setSyncingZoho] = useState(false);
+    const [showTimeline, setShowTimeline] = useState(false);
 
     // Filters
     const [searchQuery, setSearchQuery] = useState("");
@@ -239,7 +242,7 @@ export default function InboxPage() {
             </div>
 
             {/* Right Panel: Thread & Composer */}
-            <div className="flex-1 flex flex-col bg-white">
+            <div className={cn("flex flex-col bg-white", showTimeline ? "flex-1 min-w-0" : "flex-1")}>
                 {selectedId && thread ? (
                     <>
                         {/* Header */}
@@ -273,6 +276,18 @@ export default function InboxPage() {
                                         Return to AI
                                     </button>
                                 )}
+                                <button
+                                    onClick={() => setShowTimeline(!showTimeline)}
+                                    className={cn(
+                                        "flex items-center gap-2 px-3 py-1.5 rounded-md text-xs font-semibold transition-colors",
+                                        showTimeline
+                                            ? "bg-blue-100 text-blue-700 border border-blue-200"
+                                            : "bg-slate-50 text-slate-600 hover:bg-slate-100"
+                                    )}
+                                >
+                                    <Clock className="w-3.5 h-3.5" />
+                                    Timeline
+                                </button>
                                 <button
                                     onClick={() => handleUpdateStatus(selectedId, thread.status === "closed" ? "bot_active" : "closed")}
                                     className={cn(
@@ -369,6 +384,13 @@ export default function InboxPage() {
                     </div>
                 )}
             </div>
+
+            {/* Timeline Side Panel */}
+            {showTimeline && selectedId && (
+                <div className="w-80 border-l border-slate-200 bg-white overflow-y-auto">
+                    <TimelinePanel conversationId={selectedId} />
+                </div>
+            )}
         </div>
     );
 }

frontend/src/components/AdminSidebar.tsx

@@ -38,6 +38,7 @@ const adminNavItems = [
     { name: "Zoho Health",   href: "/admin/zoho-health",   icon: Database },
     { name: "Monitoring",    href: "/admin/monitoring",    icon: Activity },
     { name: "Audit Log",     href: "/admin/audit-log",     icon: ScrollText },
+    { name: "Runtime Events",href: "/admin/runtime-events",icon: Activity },
 ];
 
 interface AdminSidebarProps {

frontend/src/components/inbox/TimelinePanel.tsx

@@ -0,0 +1,156 @@
+"use client";
+
+import { useState, useEffect } from "react";
+import { apiClient } from "@/lib/api";
+import { ChevronDown, ChevronRight, Clock, AlertCircle, CheckCircle, MinusCircle } from "lucide-react";
+import { cn } from "@/lib/utils";
+
+type RuntimeEvent = {
+    id: string;
+    event_type: string;
+    source: string;
+    correlation_id?: string | null;
+    related_ids?: Record<string, string> | null;
+    payload?: Record<string, unknown> | null;
+    outcome?: string | null;
+    error_message?: string | null;
+    duration_ms?: number | null;
+    created_at: string;
+};
+
+const SOURCE_COLORS: Record<string, string> = {
+    webhook: "bg-blue-100 text-blue-700 border-blue-200",
+    runtime: "bg-purple-100 text-purple-700 border-purple-200",
+    dispatch: "bg-emerald-100 text-emerald-700 border-emerald-200",
+    email: "bg-orange-100 text-orange-700 border-orange-200",
+    zoho: "bg-cyan-100 text-cyan-700 border-cyan-200",
+    inbox: "bg-slate-100 text-slate-600 border-slate-200",
+};
+
+function OutcomeBadge({ outcome }: { outcome?: string | null }) {
+    if (!outcome) return null;
+    switch (outcome) {
+        case "success":
+            return <CheckCircle className="w-3.5 h-3.5 text-emerald-500" />;
+        case "failure":
+            return <AlertCircle className="w-3.5 h-3.5 text-red-500" />;
+        case "skipped":
+            return <MinusCircle className="w-3.5 h-3.5 text-amber-500" />;
+        default:
+            return null;
+    }
+}
+
+export default function TimelinePanel({ conversationId }: { conversationId: string }) {
+    const [events, setEvents] = useState<RuntimeEvent[]>([]);
+    const [loading, setLoading] = useState(true);
+    const [expandedId, setExpandedId] = useState<string | null>(null);
+
+    useEffect(() => {
+        if (!conversationId) return;
+        setLoading(true);
+        apiClient
+            .get<{ items: RuntimeEvent[]; total: number }>(
+                `/support/timeline?conversation_id=${conversationId}&limit=100`
+            )
+            .then((res) => setEvents(res.data?.items || []))
+            .catch(() => setEvents([]))
+            .finally(() => setLoading(false));
+    }, [conversationId]);
+
+    if (loading) {
+        return (
+            <div className="p-4 text-center text-slate-400 text-sm">Loading timeline...</div>
+        );
+    }
+
+    if (events.length === 0) {
+        return (
+            <div className="p-6 text-center text-slate-400 text-sm">
+                <Clock className="w-8 h-8 mx-auto mb-2 opacity-30" />
+                No runtime events for this conversation
+            </div>
+        );
+    }
+
+    return (
+        <div className="space-y-1 p-3">
+            <h3 className="text-xs font-bold uppercase tracking-wider text-slate-500 px-1 mb-3">
+                Event Timeline ({events.length})
+            </h3>
+            {events.map((evt) => {
+                const isExpanded = expandedId === evt.id;
+                const colorClass = SOURCE_COLORS[evt.source] || SOURCE_COLORS.inbox;
+
+                return (
+                    <div key={evt.id} className="border border-slate-100 rounded-lg overflow-hidden">
+                        <button
+                            className="w-full flex items-center gap-2 px-3 py-2 text-left hover:bg-slate-50 transition-colors"
+                            onClick={() => setExpandedId(isExpanded ? null : evt.id)}
+                        >
+                            {isExpanded ? (
+                                <ChevronDown className="w-3.5 h-3.5 text-slate-400 flex-shrink-0" />
+                            ) : (
+                                <ChevronRight className="w-3.5 h-3.5 text-slate-400 flex-shrink-0" />
+                            )}
+                            <span
+                                className={cn(
+                                    "text-[10px] font-bold uppercase px-1.5 py-0.5 rounded border flex-shrink-0",
+                                    colorClass
+                                )}
+                            >
+                                {evt.source}
+                            </span>
+                            <span className="text-xs text-slate-700 truncate flex-1">
+                                {evt.event_type}
+                            </span>
+                            <OutcomeBadge outcome={evt.outcome} />
+                            <span className="text-[10px] text-slate-400 whitespace-nowrap">
+                                {new Date(evt.created_at).toLocaleTimeString([], {
+                                    hour: "2-digit",
+                                    minute: "2-digit",
+                                    second: "2-digit",
+                                })}
+                            </span>
+                        </button>
+
+                        {isExpanded && (
+                            <div className="px-3 pb-3 pt-1 bg-slate-50 text-xs space-y-2 border-t border-slate-100">
+                                {evt.duration_ms !== null && evt.duration_ms !== undefined && (
+                                    <div className="text-slate-500">
+                                        Duration: <span className="font-mono">{evt.duration_ms}ms</span>
+                                    </div>
+                                )}
+                                {evt.correlation_id && (
+                                    <div className="text-slate-500 truncate">
+                                        Correlation: <span className="font-mono">{evt.correlation_id}</span>
+                                    </div>
+                                )}
+                                {evt.error_message && (
+                                    <div className="text-red-600 bg-red-50 p-2 rounded text-[11px] break-all">
+                                        {evt.error_message}
+                                    </div>
+                                )}
+                                {evt.payload && Object.keys(evt.payload).length > 0 && (
+                                    <pre className="bg-white p-2 rounded border border-slate-200 text-[10px] font-mono overflow-x-auto max-h-32">
+                                        {JSON.stringify(evt.payload, null, 2)}
+                                    </pre>
+                                )}
+                                {evt.related_ids && Object.keys(evt.related_ids).length > 0 && (
+                                    <div className="text-slate-500">
+                                        <span className="font-semibold">Related: </span>
+                                        {Object.entries(evt.related_ids).map(([k, v]) => (
+                                            <span key={k} className="font-mono text-[10px] mr-2">
+                                                {k}={v?.slice(0, 8)}...
+                                            </span>
+                                        ))}
+                                    </div>
+                                )}
+                            </div>
+                        )}
+                    </div>
+                );
+            })}
+        </div>
+    );
+}

frontend/src/lib/admin-api.ts

@@ -111,6 +111,21 @@ export interface AuditLogEntry {
     created_at: string;
 }
 
+export interface RuntimeEventEntry {
+    id: string;
+    workspace_id?: string | null;
+    event_type: string;
+    source: string;
+    correlation_id?: string | null;
+    related_ids?: Record<string, string> | null;
+    actor_user_id?: string | null;
+    payload?: Record<string, unknown> | null;
+    outcome?: string | null;
+    error_message?: string | null;
+    duration_ms?: number | null;
+    created_at: string;
+}
+
 // ---- Admin API methods ------------------------------------------------------
 
 export const adminApi = {
@@ -187,6 +202,29 @@ export const adminApi = {
     getAuditLogDetail: (logId: string) =>
         adminClient.get<AuditLogEntry>(`/admin/audit-log/${logId}`),
 
+    // Runtime events (Mission 18)
+    getRuntimeEvents: (params?: {
+        skip?: number; limit?: number; source?: string; event_type?: string;
+        outcome?: string; workspace_id?: string; correlation_id?: string;
+        date_from?: string; date_to?: string;
+    }) => {
+        const qs = new URLSearchParams();
+        if (params?.skip !== undefined) qs.set("skip", String(params.skip));
+        if (params?.limit !== undefined) qs.set("limit", String(params.limit));
+        if (params?.source) qs.set("source", params.source);
+        if (params?.event_type) qs.set("event_type", params.event_type);
+        if (params?.outcome) qs.set("outcome", params.outcome);
+        if (params?.workspace_id) qs.set("workspace_id", params.workspace_id);
+        if (params?.correlation_id) qs.set("correlation_id", params.correlation_id);
+        if (params?.date_from) qs.set("date_from", params.date_from);
+        if (params?.date_to) qs.set("date_to", params.date_to);
+        return adminClient.get<{ items: RuntimeEventEntry[]; total: number; skip: number; limit: number }>(
+            `/admin/runtime-events?${qs.toString()}`
+        );
+    },
+    getRuntimeEventDetail: (eventId: string) =>
+        adminClient.get<RuntimeEventEntry>(`/admin/runtime-events/${eventId}`),
+
     // Email logs + retry
     getEmailLogs: (params?: { status?: string; email_type?: string; skip?: number; limit?: number }) => {
         const qs = new URLSearchParams();