Audit downstream effects when aggregate context intentionally removes identity
When an aggregate notification context intentionally removes per-person identity or risk evidence, audit every downstream consumer of that context. The aggregate message may still send successfully while eligibility predicates for secondary warnings become false and recipient-dep…