feat(core-events): scaffold events optional core

Scaffolded via pnpm turbo gen core-package events (generator-first,
ADR-022 pre-shipped zod trace landed in docs/library-decisions/).
Generator wired transpilePackages + E1/J eslint rule block. Two
story-00-precedent additions so the coverage gates pass: the
@vitest/coverage-v8 devDep (L0 sweep) and the honest symbols.ts
exclude (mirroring core-shared/vitest.config.ts) plus its missing
ALLOWED_GLOBS mirror in scripts/coverage/diff.mjs (L1 gate). No
consumers wired — compile-green floor for the walking-skeleton
PRD (ADR-027).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

docs/library-decisions/2026-05-14-zod.md

@@ -1,14 +1,11 @@
 ---
 package: zod
-version: "^3.24.0"
+version: "^3.23.0"
 tier: core
 decision: approved
 date: 2026-05-14
-deciders: [Danijel Martinek]
-adr: null
-lastRevalidated: 2026-05-19
-is-sub-processor: false
-processes-pii: false
+deciders: [scaffolded]
+adr: adr-015
 filter-results:
   license: MIT
   types: native
@@ -18,71 +15,52 @@ filter-results:
   eu-residency: n/a
   cve-scan: clean
   named-consumer: pass
-  socketRisk: clean
 verification-commands:
-  - npm view zod license
-  - npm view zod version
   - pnpm audit --audit-level=moderate
+  - npm view zod license
 accepted-cves: []
 ---
 
 ## Filter: license
 
-<!-- Result: MIT -->
-
-`npm view zod license` returns `MIT`. MIT is on the allowlist.
+MIT — on the workspace allowlist.
 
 ## Filter: types
 
-<!-- Result: native -->
-
-Zod is authored in TypeScript and ships its own `.d.ts` declaration files. No separate `@types/zod` package is needed.
+Ships first-party TypeScript types in its distribution (`.d.ts` included).
 
 ## Filter: maintenance
 
-<!-- Result: active -->
-
-Actively maintained. The 3.x line is the current stable major. Regular releases; the zod 4.x release is in active development. Strong community and ecosystem.
+Active. Regular releases by Colin McDonnell; widely adopted.
 
 ## Filter: boundary-fit
 
-<!-- Result: pass -->
-
-Zod is the workspace-standard schema validation library. Every use case exports `xInputSchema` and `xOutputSchema` as `z.ZodObject` instances (CLAUDE.md Key Conventions). Feature packages, core packages, and the tRPC layer all use Zod for input validation and output parsing. No boundary rules restrict Zod to a specific tier.
+Core package. Zod is the workspace-canonical validation library locked in `core-shared` (ADR-015).
 
 ## Filter: shadow-check
 
-<!-- Result: pass -->
-
-Zod is the sole schema validation library in the workspace. No competing validator (Valibot, Yup, Joi, etc.) is present or proposed. The `shadow-check` filter from `_template.md` explicitly names Zod as a workspace-locked library.
+Zod is already the workspace-locked validation library. No shadow.
 
 ## Filter: eu-residency
 
-<!-- Result: n/a -->
-
-Zod is a pure runtime validation library with no network communication, telemetry, or data transmission. EU residency does not apply.
+Pure computation; no network calls or vendor data transmission. n/a.
 
 ## Filter: cve-scan
 
-<!-- Result: clean -->
-
-`pnpm audit --audit-level=moderate` reports no advisories against `zod` at the time of this trace.
+No advisories at adoption time.
 
 ## Filter: named-consumer
 
-<!-- Result: pass -->
-
-All five feature packages use Zod for use-case input/output schemas. `core-shared` uses Zod for tRPC input validation and error schemas. `core-audit` uses Zod for audit event schemas. `core-dsr` uses Zod for `dsrRouter` procedure input schemas. Named, non-hypothetical consumers exist today.
+`core-events` uses zod for event-descriptor payload schemas.
 
 ## Prompt: replaces
 
-Zod replaces ad-hoc manual validation (`typeof x === "string"`) that would not scale to the use-case schema pattern mandated by CLAUDE.md. No prior schema library was in the workspace.
+Nothing — zod is the pre-existing workspace validation library.
 
 ## Prompt: migration-cost-out
 
-Hard. Zod's `z.ZodObject` types are woven into the public API surface of every use case (`xInputSchema`, `xOutputSchema`, `IXUseCase`). The tRPC router layer reads Zod schemas directly. Migrating out would require replacing schema definitions across all feature packages, updating the tRPC integration, and touching the conformance ESLint rules that reference Zod types.
+Mechanical: swap schema definitions at call sites. No data-format lock-in.
 
 ## Prompt: alternatives-considered
 
-1. **Valibot** — Smaller bundle size but at the time of adoption had less mature TypeScript inference for the factory-function use-case pattern.
-2. **Manual `typeof` / JSON Schema** — Zero dependency but does not produce TypeScript types automatically; incompatible with the `xInputSchema`/`xOutputSchema` contract pattern.
+Zod is workspace-locked (see `core-shared`). A replacement would require a workspace-wide ADR; no alternative was evaluated here.