docs: describe the write-ahead audit model and bring the contract files up to date

docs/troubleshooting.md

@@ -1,7 +1,7 @@
 # Troubleshooting
 
 Start with the result of the failing call: errors carry `error.status`, `error.kind` and
-Gitea's sanitized message, and the audit log has one event per call (see
+Gitea's sanitized message, and the audit log has a result entry (`tool_invocation`) per call, preceded by a `tool_call_started` entry (see
 [audit-logging.md](audit-logging.md)).
 
 ## The server does not start