Why: Explicit low IDs bypassed the implicit sequence allocator and could commit after a higher audit page cutoff.
Evidence: Isolated PostgreSQL RED receipt for cross-page omission; local GREEN for explicit and default writes, trigger drift, isolation, mutation denial, offline copy rollback, retry, and sequence non-rewind. Fixed-HEAD receipts follow.
Impact: Add v34 all-writer and append-only guards; reject unsafe strong reads; make command audit storage migration exclusive and atomic with guard restoration and a forward-only sequence.
Refs: Approved W9 all-writers cutoff adjustment r1; W9 Backend task card.
Why: PostgreSQL sequence IDs could commit out of order and make fixed project audit cursors permanently skip a late row.
Evidence: SELF PG cross-page RED, CACHE 10 counterexample, configuration drift RED/GREEN, and pre-commit Go, PG migration, and race receipts are recorded in the W9 task card. Fixed-HEAD checks follow this commit.
Impact: Guard implicit command audit ID allocation with a transaction advisory lock; reject unsafe sequence/default drift; preserve explicit-ID storage migration; report committed-prefix only for verified project pages.
Refs: Approved W9 PostgreSQL cutoff adjustment r1; W9 Backend task card.
Why: Clock-derived IDs could collide and string-scoped hosts could impersonate a registered audit publisher.
Evidence: Fixed-clock concurrent, ambiguous private offset, forged scoped-host, and registered publisher RED-to-GREEN tests; go test ./... -count=1 and targeted race test passed locally as SELF.
Impact: Generate 192-bit host IDs, reject ambiguous explicit offsets, and issue a publication-only capability at verifier registration.
Refs: Stage 5 W9; approved Stage 6 audit-link design adjustment r1; review of a8fa2fe
Why: A domain outbox could not correlate its committed event with the host receipt because the bus generated the operation ID after the handler returned.
Evidence: RED-to-GREEN bus and compiled-handler tests; local go test ./... -count=1 and isolated PostgreSQL operation/link checks passed as SELF.
Impact: Expose a host-generated operation ID to handlers and resolve a unique committed audit offset after dispatch; missing receipts remain retryable and ambiguous rows fail closed.
Refs: Stage 5 W9; approved Stage 6 audit-link design adjustment r1
Why: Owner-only command audit cannot prove shared business commits, and button dispatch omitted its authenticated actor.
Evidence: Local go test ./... passed; isolated PostgreSQL cutoff, link, and SQLite-to-PostgreSQL migration receipts are recorded as SELF in the task card.
Impact: Add an optional domain-verified metadata link, exact authorized cross-member read, idempotent storage, actor propagation, and honest PostgreSQL cutoff coverage. Broad audit pagination and other sources remain pending.
Refs: Stage 5 W9; approved Stage 6 audit-link design adjustment r1
Why: Project audit cannot use owner-wide logs or current conversation project state to establish trusted attribution.
Evidence: RED cases were observed locally; go test ./pkg/extension ./internal/store ./internal/app -count=1 passed on this tree (SELF).
Impact: Add optional X2 read and audit.read callback, immutable project/name snapshots, safe owner-only projection, and explicit unsupported coverage. Cross-member publication remains pending.
Refs: Stage 5 W9; Stage 6 X2 public extension request
agent-exec-transport