The log is complete because the gate can't fail open

The customer's auditor asks the question every logging system dreads: how do you know every request was logged?

Your app's audit logger is a proxy hook: a catch-all rule on the service, match: { method: "*", path: "*" }, pointing at a script in your own hoody-exec. Every matching request reaches that script before the upstream does. The script writes its line and calls metadata.hook.forward(). Hooks fail closed: an exception, a timeout, a missing script returns an error to the client. There is no fail-open fallback.

So the question inverts. A request the logger never saw is a request the app never served. The proxy also writes a best-effort hook-dispatch audit row with the same auditId your line carries. WebSocket upgrades skip hooks, so those routes live on another service; the container firewall closes the direct-IP side door.

Completeness isn't a property of the logger. It's a property of the gate.