Why: Owner-only command audit cannot prove shared business commits, and button dispatch omitted its authenticated actor.
Evidence: Local go test ./... passed; isolated PostgreSQL cutoff, link, and SQLite-to-PostgreSQL migration receipts are recorded as SELF in the task card.
Impact: Add an optional domain-verified metadata link, exact authorized cross-member read, idempotent storage, actor propagation, and honest PostgreSQL cutoff coverage. Broad audit pagination and other sources remain pending.
Refs: Stage 5 W9; approved Stage 6 audit-link design adjustment r1
weichen
48fdddee25