fix(docs): restore zod trace enrichment lost to stale generator template

The core-package generator's pre-shipped zod trace force-overwrote the
curated trace, dropping lastRevalidated/is-sub-processor/processes-pii/
socketRisk fields and the deciders record. Restores the rich version
with the consumer list updated for the post-retrofit package map.
Reviewer-required follow-up from story 05.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

docs/library-decisions/2026-05-14-zod.md

@@ -1,11 +1,14 @@
 ---
 package: zod
-version: "^3.23.0"
+version: "^3.24.0"
 tier: core
 decision: approved
 date: 2026-05-14
-deciders: [scaffolded]
-adr: adr-016
+deciders: [Danijel Martinek]
+adr: null
+lastRevalidated: 2026-05-19
+is-sub-processor: false
+processes-pii: false
 filter-results:
   license: MIT
   types: native
@@ -15,52 +18,71 @@ filter-results:
   eu-residency: n/a
   cve-scan: clean
   named-consumer: pass
+  socketRisk: clean
 verification-commands:
-  - pnpm audit --audit-level=moderate
   - npm view zod license
+  - npm view zod version
+  - pnpm audit --audit-level=moderate
 accepted-cves: []
 ---
 
 ## Filter: license
 
-MIT — on the workspace allowlist.
+<!-- Result: MIT -->
+
+`npm view zod license` returns `MIT`. MIT is on the allowlist.
 
 ## Filter: types
 
-Ships first-party TypeScript types in its distribution (`.d.ts` included).
+<!-- Result: native -->
+
+Zod is authored in TypeScript and ships its own `.d.ts` declaration files. No separate `@types/zod` package is needed.
 
 ## Filter: maintenance
 
-Active. Regular releases by Colin McDonnell; widely adopted.
+<!-- Result: active -->
+
+Actively maintained. The 3.x line is the current stable major. Regular releases; the zod 4.x release is in active development. Strong community and ecosystem.
 
 ## Filter: boundary-fit
 
-Core package. Zod is the workspace-canonical validation library locked in `core-shared` (ADR-016).
+<!-- Result: pass -->
+
+Zod is the workspace-standard schema validation library. Every use case exports `xInputSchema` and `xOutputSchema` as `z.ZodObject` instances (CLAUDE.md Key Conventions). Feature packages, core packages, and the tRPC layer all use Zod for input validation and output parsing. No boundary rules restrict Zod to a specific tier.
 
 ## Filter: shadow-check
 
-Zod is already the workspace-locked validation library. No shadow.
+<!-- Result: pass -->
+
+Zod is the sole schema validation library in the workspace. No competing validator (Valibot, Yup, Joi, etc.) is present or proposed. The `shadow-check` filter from `_template.md` explicitly names Zod as a workspace-locked library.
 
 ## Filter: eu-residency
 
-Pure computation; no network calls or vendor data transmission. n/a.
+<!-- Result: n/a -->
+
+Zod is a pure runtime validation library with no network communication, telemetry, or data transmission. EU residency does not apply.
 
 ## Filter: cve-scan
 
-No advisories at adoption time.
+<!-- Result: clean -->
+
+`pnpm audit --audit-level=moderate` reports no advisories against `zod` at the time of this trace.
 
 ## Filter: named-consumer
 
-`core-realtime` uses zod for channel descriptor and payload schema validation.
+<!-- Result: pass -->
+
+The `auth` feature package uses Zod for use-case input/output schemas. `core-shared` uses Zod for tRPC input validation and error schemas. `core-audit` uses Zod for audit event schemas. `core-dsr` uses Zod for `dsrRouter` procedure input schemas. `core-events` and `core-realtime` use Zod for event/channel payload schemas. Named, non-hypothetical consumers exist today. _(Consumer list updated 2026-07-12 after the platform-retrofit deletions; enrichment fields restored after a stale generator pre-shipped trace overwrote this file — see story 05 review notes.)_
 
 ## Prompt: replaces
 
-Nothing — zod is the pre-existing workspace validation library.
+Zod replaces ad-hoc manual validation (`typeof x === "string"`) that would not scale to the use-case schema pattern mandated by CLAUDE.md. No prior schema library was in the workspace.
 
 ## Prompt: migration-cost-out
 
-Mechanical: swap schema definitions at call sites. No data-format lock-in.
+Hard. Zod's `z.ZodObject` types are woven into the public API surface of every use case (`xInputSchema`, `xOutputSchema`, `IXUseCase`). The tRPC router layer reads Zod schemas directly. Migrating out would require replacing schema definitions across all feature packages, updating the tRPC integration, and touching the conformance ESLint rules that reference Zod types.
 
 ## Prompt: alternatives-considered
 
-Zod is workspace-locked (see `core-shared`). A replacement would require a workspace-wide ADR; no alternative was evaluated here.
+1. **Valibot** — Smaller bundle size but at the time of adoption had less mature TypeScript inference for the factory-function use-case pattern.
+2. **Manual `typeof` / JSON Schema** — Zero dependency but does not produce TypeScript types automatically; incompatible with the `xInputSchema`/`xOutputSchema` contract pattern.