Protect owner administration authority

docs/DOGFOOD.md

@@ -73,3 +73,9 @@ application concern belongs in the shared module.
   and writes identity plus organization audits. Grant completion installs the
   replacement password, passkey, and recovery-code set atomically and never
   issues a session.
+- Gamertan's distinction between Site Admin and Owner exposed a second
+  composition boundary: permission to manage ordinary staff must not imply
+  permission to create, demote, suspend, or remove an Owner. Preview 19 moves
+  that invariant into the same SQLite transactions as direct-role and
+  membership changes, while leaving the application's role vocabulary and UI
+  policy application-owned.

docs/GETTING_STARTED.md

@@ -26,7 +26,7 @@ The packages are ordinary Go imports. Pin the current preview and verify its
 module checksum:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.18
+go get gamertan.com/web/requestmeta@v0.1.0-preview.19
 go mod verify
 ```
 

docs/MODULES.md

@@ -18,7 +18,7 @@ import "gamertan.com/web/requestmeta"
 and request the containing module at an exact version:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.18
+go get gamertan.com/web/requestmeta@v0.1.0-preview.19
 ```
 
 Only imported packages are compiled and linked. The packages nevertheless