adopt the tracing log facade, engine crates only (review 004 item 7's family-level decision, ADR-025): the family precedent checked and unanimous (alkcall/alktunnels/alksocks/alktty all on tracing = "0.1" facade-only, tracing-subscriber env-filter a dev-dep where present, silent by default); user sign-off taken in-session (2026-10-11, adopt-tracing option chosen) and recorded in the ADR's status; core stays dep- and emit-free (the explicit core-dep answer — the payload serde deps remain the sole core deps, the ADR states the ADR-020-§4 reading explicitly); all 19 library-path eprintln! sites migrated to tracing::warn!/error! with message text + the alkstore: prefix + the secret-free discipline unchanged (17 at review time, +2 from the review's own inline tick/lease restructures — re-grepped, sqlite 10 / pg 9, zero remainder, tests' harness-skip prints untouched); levels: warn = retried/degraded ops, error = unrecoverable loss (watcher death, discarded pooled clients, panic-path rollback failures); the four substrate-lineage files ride PROVENANCE delta D-41 (message-identical macro swap); deployment.md gains the diagnostics-posture section (operator recipe RUST_LOG=warn/error at the consuming binary; listener application_name diagnosability joins it), ADR index + design-decisions table carry the 025 row, CHANGELOG's 0.1.0 body states the facade; pg-fix-forwarder-diagnosability's output form now pinned (warn on failed reconnect connects with attempt/backoff context, error on the loop-exit poll error); gates green: build, workspace tests server-less, clippy -D warnings, fmt, doc gate zero warnings, fuzz corpus replay 6/6; task -> completed

CHANGELOG.md

@@ -34,6 +34,15 @@ Three engines ship the same contract v1 surface:
   no durability, never fleet-valid; the wasm32-compile-clean family
   member.
 
+Engine diagnostics route through the `tracing` facade
+([ADR-025]) — silent by default: the engine crates carry no
+subscriber, and a consuming binary opts into diagnostics by wiring a
+`tracing-subscriber` env-filter (e.g. `RUST_LOG=warn` for
+degraded-operation events, `RUST_LOG=error` for unrecoverable-loss
+events). Core never emits; the contract's failure reporting stays the
+typed error taxonomy. All engine events are secret-free by the
+standing rule — no DSN, password, or credential material.
+
 All three engines run the same contract-suite rows
 (`alkstore-contract-suite`) against their own factory — three engines,
 one pinned contract. The contract version is the core crate's semver
@@ -43,4 +52,5 @@ window, and ADR-017 §2's class-1 amendment events terminate at it.
 [0.1.0]: https://git.alk.dev/alkdev/alkstore/releases/tag/v0.1.0
 
 [ADR-016]: docs/architecture/decisions/016-deployment-honesty.md
-[ADR-017]: docs/architecture/decisions/017-contract-versioning.md
+[ADR-017]: docs/architecture/decisions/017-contract-versioning.md
+[ADR-025]: docs/architecture/decisions/025-log-facade.md