docs: close inbox snapshot pilot and hand off freshness cutover

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102

workplans/HUB-WP-0010-statehub-inbox-read-pilot.md

@@ -4,13 +4,17 @@ type: workplan
 title: "State Hub inbox read projection pilot"
 domain: infotech
 repo: hub-core
-status: active
+status: finished
 owner: codex
 topic_slug: infotech
 created: "2026-09-05"
 updated: "2026-09-05"
 related:
   - STATE-WP-0079
+quality_dod: DoD-Ok
+quality_dod_at: "2026-09-05"
+quality_dod_by: codex
+quality_dod_note: "Frozen snapshot parity, auth, rollback and live verification passed; residual HUB-WP-0011 owns production cutover."
 quality_dor: DoR-Ok
 quality_dor_at: "2026-09-05"
 quality_dor_by: codex
@@ -24,7 +28,7 @@ quality_dor_note: >-
 
 ```task
 id: HUB-WP-0010-T01
-status: progress
+status: done
 priority: high
 ```
 
@@ -37,7 +41,7 @@ State Hub remains the writer. Existing `/ports/messaging/messages` is unchanged.
 
 ```task
 id: HUB-WP-0010-T02
-status: todo
+status: done
 priority: high
 ```
 
@@ -47,3 +51,9 @@ rows refuse overwrite. Verify parity over a fixed source snapshot with read-only
 queries, auth failures and rollback by disabling the pilot. Packaging/deployment
 belongs to rapp-core-hub. Do not claim continuous freshness or switch clients
 from the sole production message writer based on a one-time snapshot.
+
+## Completion evidence and residual handoff
+
+See `docs/evidence/statehub-inbox-pilot-20260905.md` and its JSON receipt.
+HUB-WP-0011 was created before closure and owns freshness, caller identity and
+production reader cutover; STATE-WP-0079-T09 tracks that gate.

workplans/HUB-WP-0011-statehub-inbox-freshness-and-cutover.md

@@ -0,0 +1,62 @@
+---
+id: HUB-WP-0011
+type: workplan
+title: "State Hub inbox freshness and reader cutover"
+domain: infotech
+repo: hub-core
+status: proposed
+owner: codex
+topic_slug: infotech
+created: "2026-09-05"
+updated: "2026-09-05"
+origin: residual
+origin_ref: HUB-WP-0010
+related:
+  - STATE-WP-0079
+  - RAPPCOREHUB-WP-0004
+---
+
+## Establish ongoing inbox freshness
+
+```task
+id: HUB-WP-0011-T01
+status: todo
+priority: high
+```
+
+The deployed inbox reader is an explicitly labeled one-time snapshot pilot.
+Define and implement monotonic source revision/cursor semantics, atomic refresh,
+read/archive updates, deletes/retention treatment and stale-source signaling.
+The initial importer deliberately refuses different existing rows; do not turn
+it into an unconditional overwrite loop. Prove recovery and idempotency without
+creating a second message writer. Decide the source/destination ownership
+boundary before live client traffic moves.
+
+## Admit the actual reader identity and full scope semantics
+
+```task
+id: HUB-WP-0011-T02
+status: wait
+priority: high
+```
+
+Replace pilot operator authentication with the reviewed caller-specific access
+contract and delivered workload credential. Preserve recipient authorization,
+broadcast behavior, repository canonical/alias resolution, source timestamps
+and thread/read/archive semantics for the selected reader. The existing pilot
+supports only one literal agent and exact sender filters. Never distribute the
+operator token as an application credential.
+
+## Execute one reviewed client switch
+
+```task
+id: HUB-WP-0011-T03
+status: wait
+priority: high
+```
+
+After T01/T02 pass, produce live freshness and parity receipts for one State Hub
+inbox reader; verify rollback to the current State Hub endpoint. Then execute
+that bounded reader switch with the concrete deployment authorization. Retire
+its compatibility dependency only after metered acceptance. Message-writer
+cutover and all other route families remain separate STATE-WP-0079 work.