DTO: trackerHead @IsString/@MaxLength(20000) + htmlEmbed @IsBoolean accept/reject cases. CASL: a non-admin updating trackerHead/htmlEmbed gets ForbiddenException (update not called); owner/admin proceed. Audit: a no-op trackerHead re-save doesn't enter the audit diff. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>