prj-forgejo-org-refactor/inventory/owner-followups.md

Owner follow-up register

This register links evidence and existing owner work by stable ID. It does not copy tasks, reopen completed workplans or assert that an owner has accepted new work. No messages have been sent. accepted_remediation_record stays empty until an actual owning-repo record is identified and accepted.

Gap	Existing owner context	Acceptance needed here
Forge credential policy denial	WARDEN-WP-0031 739bad25-2345-5f4f-aaa3-cc4cd8c71f6c; WARDEN-WP-0025 70c11222-d8e7-5936-99f7-7d626a4a5deb	Authorized metadata export or caller-binding repair evidence, then successful scoped metadata read; no policy bypass
Complete repo/package/access census	railiance-forge; project decision 5f3680fc-0cd5-4d27-ba39-59fbdd13313c	Owner evidence contract; the original lane work is not an export task
Universal coverage contract and collector omissions	RMASTER-WP-0021 37667c23-1fa9-430e-8d80-d67d98f90e38; RMASTER-WP-0025 09d6dfc6-0bde-5516-acaa-a6a4f0551805	Owner resolution of excluded managed Jobs/DaemonSets/substrate workloads; exactly-one-rapp check over an accepted complete census
Current unclaimed workload names	52-row follow-up table	Owner acceptance of the correct declaration/name mapping and green fresh coverage receipt
Runtime image and rollback protection	RPF-WP-0028 622d1208-b085-5ec2-9fb7-5e41f23e1843; RPF-WP-0048-T03 6c2650a2-5da8-5999-a6e7-b22eb7c655f4	Join package ownership and actual retained digests across old/new namespaces; image retention is not workload ownership or transfer rollback
GitOps/legacy consumers	RPF-WP-0044 98140775-3b9a-5cf9-9af6-722502d487dc	Current and frozen-cluster source/access export and explicit external-consumer coverage
Core Hub name drift	RPF-WP-0030 f7a13cc2-7b1f-5644-89a8-b4e9a934b018	Reconcile live candidate/publisher names with rapp-core-hub declarations; do not invent another rapp from a name mismatch
Notice-page workload coverage	RPF-WP-0047 6ab44339-66d3-522b-9d34-fc9ff6f20d1b	Owner ruling on bao-notice's managed-workload declaration; deployment completion alone does not satisfy the family check

The follow-up CSV is a diagnostic routing proposal based on known repo purpose and workload names. It is not a namespace-to-rapp or repo-to-org ownership mapping. Neither the contacts nor the context workplans count as accepted new remediation tasks. New owner records must be linked rather than invented here.

Exclusions requiring disposition

exclusion-review.csv enumerates all 326 excluded files or gitlinks in the retained local/archive snapshot. Every row is unreviewed. Binary formats generally need an owner attestation rather than text extraction; encrypted sources need sanitized reference projections; symlink targets and submodule revisions must be reconciled explicitly.

The four markitect-main submodules expose a concrete gap beyond sibling scans:

Path	Gitlink revision	Current declared remote identity
_issue-tracking/issue-facade	70d7ec0cdcbdff1a41cc420e2c939f855fe7787b	coulomb/issue-facade
capabilities/kaizen-agentic	afc038d98b1efc5098f473e55fdddd2999f798ba	coulomb/kaizen-agentic
capabilities/testdrive-jsui	b8f13b4ae5e80e76a162187613b67cbdc3a65171	coulomb/testdrive-jsui
wiki	8818df03d3d7be241c144fd839d90c4d7c0ba20a	coulomb/markitect-main.wiki

Source: markitect-main .gitmodules and git ls-files --stage, September 28. All four still name the old http://92.205.130.254:32166 endpoint. This review did not contact that endpoint or fetch submodules. The wiki and issue-facade identities are not represented as standalone subjects in the 153-row candidate matrix; they need owner reconciliation (wiki attachment, alias/retirement, or additional repo). Do not invent server IDs or assume a sibling HEAD equals the pinned gitlink.