# F-098 — Implementer evidence

## Root cause

`store_settings.updated_by` references `identity_users(id)`, while admin authentication returns IDs from `backoffice_users`. Saving settings therefore raised a PostgreSQL foreign-key error and surfaced as HTTP 500.

## Fix

`settings.routes.ts` now checks whether the authenticated ID exists in `identity_users`; it writes the audit ID only when valid, otherwise writes `NULL`, preserving the FK and allowing backoffice settings saves.

## Smoke test

- Authenticated `PATCH /api/admin/settings` with AI provider, base URL, model, and prompts: HTTP 200.
- Response includes saved AI configuration fields without exposing API key.
- Test rows removed after the smoke test.
- Services restarted successfully on ports 3000/3003/3004/3005.