Pull audit
These are two different questions and conflating them helps with neither: what someone DID to the mirror, and what a build TOOK from it. LibWorld records them separately, because the first is a security question and the second is a dependency question.
Mutations and refusals
Every control-plane mutation is audited — pin, delete, repull. So is every REFUSAL, which is the half usually missing: a request turned away by the IP allowlist writes a forbidden_ip row rather than silently vanishing. An attempt that was blocked is exactly the thing you want to find later.
Consumption
The catalog tracks pull count and last access per artifact. That does two jobs: it is what makes least-recently-used collection mean anything, and it lets you answer which dependencies a build actually PULLED rather than which ones its manifest listed. Those two sets are rarely identical, and it is usually the difference that you needed to know about.