Harden SBOM retries and align hub evidence

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

docs/state-hub-caller-map.md

@@ -13,7 +13,9 @@ activity-core stays the scheduler even when it is not the engine.
 
 Hub-core port names are from `helixforge.hub-extension` 0.1
 (`prj-state-hub-retirement/architecture/hub-extension-contract_v0.1.yaml`).
-HUB-WP-0004 has not shipped those ports yet.
+HUB-WP-0004 shipped the named ports on 2026-08-21; hub-core became production
+authority the same day. Core Hub remains a no-writer rollback only through the
+stabilization window ending no earlier than 2026-08-28.
 
 | Caller | Current URL | SHR-INV | Target owner | Port (when named) |
 | --- | --- | --- | --- | --- |
@@ -51,11 +53,25 @@ HUB-WP-0004 has not shipped those ports yet.
   (dual-run when `RM_RECONCILE` is on). Override with `CONSISTENCY_SWEEP_URL`
   or `REPO_MANAGER_URL` + optional `CONSISTENCY_SWEEP_PATH`.
 
-## Evidence sink (T03 — wait)
+## Evidence sink (T03 — aligned 2026-08-22)
 
-All `POST /progress/` callers stay on the State Hub beachhead until
-**HUB-WP-0004** publishes `port.events.progress` / `port.events.interaction`.
-Do not add a second permanent progress host.
+Ops-inventory evidence now has a canonical `hub-core-interaction-event` sink:
+
+- `POST /ports/events/interaction` with catalog event
+  `hub.interaction.recorded`;
+- the sanitized domain observation remains in
+  `payload.reported_event_type` (for example `ops_inventory_probe`);
+- append verification reads
+  `GET /ports/projections/interaction_events`; and
+- `HUB_CORE_BASE_URL` points at the surviving hub-core runtime. The Railiance
+  Service retains the compatibility name `core-hub-api` during stabilization,
+  but the process and authority behind it are hub-core.
+
+The legacy `core-hub-interaction-event` `/api/v2` sink remains available only
+for rollback compatibility. It is not the configured Railiance probe sink.
+Unmigrated general progress callers can continue through the State Hub
+beachhead during the retirement strangler; this task does not create a second
+permanent progress authority.
 
 ## Execution (T04)