docs(workplans): prepare identifier batch and SBOM client follow-up

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

decisions/RMGR-DEC-2026-003-railiance-cluster-identifier-batch.md

@@ -0,0 +1,48 @@
+# RMGR-DEC-2026-003 — Railiance Cluster identifier cutover batch
+
+```yaml
+id: RMGR-DEC-2026-003
+kind: decision
+title: Approve deterministic identifier batch 0004 for railiance-cluster
+status: open
+decision_type: pending
+owner: Bernd Worsch
+repo: repo-manager
+workplan: RMGR-WP-0005
+workplan_task: RMGR-WP-0005-T04
+requested_dispositions:
+  - approved
+  - revised
+  - rejected
+source_plan: docs/evidence/RMGR-WP-0005-helixforge-uuid-migration-plan-2026-08-22-v3.json
+source_plan_sha256: b155d8f193ae3496765b1964e51f9918a3a55b1993793cc7fd3ceb3b18d12ad0
+batch_manifest: docs/evidence/RMGR-WP-0005-batch-0004-railiance-cluster.json
+batch_sha256: 554c6cbe119e13738efc6e2836254ddae00ea870f1cb99f2b5603336160e308d
+scope:
+  repositories: [railiance-cluster]
+  replacements: 6
+  assignments: 0
+apply_authorized: false
+approval_effect: >-
+  Approved authorizes one repository-atomic forward cutover of exactly the
+  pinned batch in both current projections and the authoritative repository
+  file, subject to repeated no-drift and restore-point checks. Revised or
+  rejected authorizes no mutation.
+rollback: >-
+  Reverse the file transaction if written, then reverse production and
+  workstation projection transactions using their durable aliases.
+evidence: docs/evidence/RMGR-WP-0005-batch-0004-railiance-cluster-readiness-2026-08-22.md
+created: "2026-08-22"
+updated: "2026-08-22"
+```
+
+## Decision requested
+
+Approve, revise, or reject the exact batch manifest named above. Approval is
+limited to `railiance-cluster`, `RCLUSTER-WP-0007`, and its five live mapped
+tasks; it does not authorize the two cancelled task identifiers or any later or
+broader batch.
+
+The manifest remains fail-closed: any Git, source-fingerprint, projection, or
+plan-seal drift before execution voids the approval and requires a new batch
+hash.