• [new] Auth lock lifecycle events: auth lock: attempting acquire (timeout=<n>ms) (path, timeout_ms) and auth lock: acquired (pid=<n>) (path, pid)
• [new] Auth update completion events: auth update disk written (elapsed_ms, key_prefix, rt_prefix) and auth update enrichment done (lock_wait_ms, total_ms, user_ms, write_ms)
• [new] auth.refresh.success with expires_at, key_changed, new/old key prefixes
• [new] Model catalog auth-refresh watcher: triggered (had_real_catalog, model_count_before) and updated catalog (model_count_before/after, was_recovery)
• [new] Model catalog fetch path: model catalog: fetching (fetch_auth, has_auth) and model catalog: fetch succeeded (model_count)
• [new] OIDC refresh surface: oidc refresh enter (has_current, is_expired, reason), oidc refresh attempting idp (client_id, expires_at, has_rt, issuer), oidc try_refresh_pure enter (client_id, issuer), oidc try_refresh_pure succeeded (expires_at, mono_ms, suspected_suspend, suspended_ms, wall_ms)
• [new] On-disk auth.json.lock alongside auth state