📝 docs(domain-error-http-mapping): fill the verified-by column

Every AC now names the command that proves it. Only the fills the drift check
judged honest: AC-8 cites both specs, because the booted app proves the status
and body while the unit spec proves the ERROR-level log; AC-11 cites the unit
spec alone, since log level is not an HTTP-observable property.

D-020 records why the non-domain path delegates rather than reproduces.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: MaloPromyze

.claude/features/domain-error-http-mapping/charter.md

@@ -103,17 +103,17 @@ correctly and still never be selected by Nest, and no unit test would notice.
 
 | id | criterion | user-visible | verified by |
 |----|-----------|--------------|-------------|
-| AC-1 | An authenticated request whose user record no longer exists is answered `404`, not `500` | yes | |
-| AC-2 | A request from a user who is not a member of the target organization is answered `403` | yes | |
-| AC-3 | A request on an organization-admin-only route from a non-admin is answered `403` | yes | |
-| AC-4 | A request scoped to a space the caller is not a member of is answered `404`, and is byte-identical to the answer for a space that does not exist | yes | |
-| AC-5 | A request on a space-admin-only route from a space member who is not a space admin is answered `403` | yes | |
-| AC-6 | The response body for AC-1..AC-5 carries a stable snake_case `reason` a client can branch on without parsing prose | yes | |
+| AC-1 | An authenticated request whose user record no longer exists is answered `404`, not `500` | yes |  `nx test api --testNamePattern='the domain exception filter over HTTP'` |
+| AC-2 | A request from a user who is not a member of the target organization is answered `403` | yes |  `nx test api --testNamePattern='the domain exception filter over HTTP'` |
+| AC-3 | A request on an organization-admin-only route from a non-admin is answered `403` | yes |  `nx test api --testNamePattern='the domain exception filter over HTTP'` |
+| AC-4 | A request scoped to a space the caller is not a member of is answered `404`, and is byte-identical to the answer for a space that does not exist | yes |  `nx test api --testNamePattern='the domain exception filter over HTTP'` |
+| AC-5 | A request on a space-admin-only route from a space member who is not a space admin is answered `403` | yes |  `nx test api --testNamePattern='the domain exception filter over HTTP'` |
+| AC-6 | The response body for AC-1..AC-5 carries a stable snake_case `reason` a client can branch on without parsing prose | yes |  `nx test api --testNamePattern='the domain exception filter over HTTP'` |
 | AC-7 | None of the five reworded access-error messages that reach a client contains a UUID or any other identifier | yes | `nx test node-utils --testNamePattern='access error messages'` |
-| AC-8 | An error class that has not declared a kind is still answered `500` with today's body and today's ERROR-level log | no | |
-| AC-9 | An `HttpException` thrown by a controller reaches the client with its own status and its own body, untouched by the filter | no | |
+| AC-8 | An error class that has not declared a kind is still answered `500` with today's body and today's ERROR-level log | no |  `nx test api --testNamePattern='the domain exception filter over HTTP'` + `nx test node-utils --testNamePattern='DomainExceptionFilter'` |
+| AC-9 | An `HttpException` thrown by a controller reaches the client with its own status and its own body, untouched by the filter | no |  `nx test api --testNamePattern='the domain exception filter over HTTP'` |
 | AC-10 | A domain error passing through `withSpan` does not set the span status to ERROR; a non-domain error still does, and both are still recorded as exceptions | no | `nx test node-utils --testNamePattern='withSpan'` |
-| AC-11 | An access denial is logged at `warn` without a stack trace, as `ExpectedAuthError`'s docstring has always asked | no | |
+| AC-11 | An access denial is logged at `warn` without a stack trace, as `ExpectedAuthError`'s docstring has always asked | no |  `nx test node-utils --testNamePattern='DomainExceptionFilter'` |
 
 ## Known unknowns