Returns one keyset page of the crypto, admin and authentication audit events for a tenant, ordered server-side by (event_timestamp DESC, event_source, log_id DESC). Replaces client-side merge of independent streams. The stream is narrowed to the event sources the caller's scopes admit, and the set it was narrowed to is returned in admittedSources: audit.*.crypto.read admits crypto, audit.*.admin.read admits admin, audit.*.auth.read admits auth, and audit.*.all.read admits all three. A caller admitted to no source receives 403, never an empty page. The stream can be narrowed further, WITHIN what the scopes admit: source selects one trail, operationType narrows the crypto branch and entityType / action narrow the admin branch. A filter never widens the admitted set — a source the caller may not read is answered 403, exactly as an empty admitted set is. A dimension no admitted branch carries yields an EMPTY page rather than an error or an unfiltered one, and a value outside the projected vocabulary is answered 400 rather than silently ignored. Pagination is by opaque cursor: pass back nextCursor to continue, and read hasMore to learn whether more rows exist. There is no offset ceiling and no sort parameter — a cursor is valid only for the ordering it encodes. A cursor replayed against a different window or filter set is rejected with 400. The applied window and the maximum this feed accepts are stated in appliedRange. Crypto rows carry the key's materialVersion (generation) and resolve the actor as COALESCE(user_id, actor_id) so actor-driven operations surface their identity; admin and auth rows have a null materialVersion.