finish deterministic identifier migration

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

decisions/RMGR-DEC-2026-006-fleet-completion-identifier-batch.md

@@ -70,3 +70,13 @@ state, plan seal, or batch seal drift before a repository executes voids that
 repository's execution and stops the sequence. Each successfully completed
 repository is independently durable, pushed, and verified before the next one
 begins.
+
+## Result
+
+Applied successfully on 2026-08-31. All 85 replacements completed across the
+ten approved repositories, zero assignments were made, all authoritative
+commits were pushed, and every mapped old/new endpoint verified as 404/200 with
+the canonical record identity retained. No rollback was required. The fresh
+fleet scan reports 306/306 live identifiers deterministic and no remaining
+action. Evidence:
+`docs/evidence/RMGR-WP-0005-batch-0007-fleet-completion-cutover-2026-08-31.md`.

docs/evidence/RMGR-WP-0005-batch-0007-fleet-completion-cutover-2026-08-31.md

@@ -0,0 +1,75 @@
+# RMGR-WP-0005 batch 0007 fleet-completion cutover
+
+Date: 2026-08-31  
+Decision: `RMGR-DEC-2026-006`  
+Source plan SHA-256: `ab8ae2e55470553f105c6209d6aa4c7b828085bd6c71cec7b16173b8a19bef7b`  
+Approved batch SHA-256: `c0cc496a06d9535a40840a0c7488cf365d8e47c5c58cc29aca72fb6d98273700`
+
+## Outcome
+
+Bernd Worsch approved the decision as written. Batch 0007 completed all 85
+identifier replacements across its ten named repositories, with zero
+assignments and no rollback. Each repository passed source, Git, primary
+identity, and projection preconditions immediately before execution. The
+railiance01 projection transaction completed before the atomic file rewrite;
+each repository was then committed, pushed, reconciled from the exact Forgejo
+commit, and checked for legacy=404, deterministic=200, and matching canonical
+record identity.
+
+| Repository | Replaced | Commit | Reconcile |
+| --- | ---: | --- | --- |
+| `fin-hub` | 13 | `bbfa2d6` | applied, zero refused |
+| `net-kingdom` | 16 | `ce198fc` | applied, zero refused |
+| `prj-canon-federation` | 13 | `921f007` | applied, zero refused |
+| `prj-forgejo-org-refactor` | 6 | `b9e9b73` | applied, zero refused |
+| `prj-state-hub-retirement` | 8 | `354e13d` | applied, zero refused |
+| `prj-unattended-progress-company` | 13 | `2901cc9` | applied, zero refused |
+| `railiance-master` | 3 | `51747ca` | applied, zero refused |
+| `railiance-telemetry` | 4 | `aa59e80` | applied, zero refused |
+| `rapp-qonto` | 4 | `1a6fa41` | applied, zero refused |
+| `soul-frame` | 5 | `7e4ed86` | applied, zero refused |
+
+`rapp-qonto` exercised the guarded duplicate-convergence path deployed in State
+Hub commit `a7c91a6`: one legacy workplan migrated normally and three exact,
+unreferenced task duplicates were coalesced transactionally. All four legacy
+endpoints now return 404 and all four deterministic endpoints retain the
+canonical record identity.
+
+## Bounded sync-wrapper finding
+
+After `net-kingdom` was pushed, the high-level `rmgr sync` wrapper refused its
+pre-projection identity scan because archived historical id
+`NK-WP-0003-T08a` is noncanonical. This was not source drift, a migrated record,
+or a projection failure. The underlying guarded forge-derived reconcile accepted
+the exact pushed commit, updated the projection with zero refusals, and direct
+verification passed all 16 mapped records. The checkout is clean and
+synchronized. Residual `RMGR-IN-0003` tracks scoping normal sync validation so
+unrelated historical conformance findings do not block canonical work.
+
+## Fleet closure proof
+
+The fresh post-cutover plan is
+`docs/evidence/RMGR-WP-0005-fleet-postcutover-2026-08-31.json`, sealed as
+`9dbe8b9dd43997fc80617d18070e7359394b6473c06b54b03ace5288a321b263`.
+It reports:
+
+- 42 repositories eligible, zero skipped;
+- 306 live work records;
+- 306 unchanged deterministic identifiers;
+- zero replacements and zero assignments.
+
+## Interim-rule retirement
+
+State Hub commit `5dd04dc` removes the C-06/C-11/C-32 single-writer registrar
+guard. Its convergence test runs two independent hub stores against identical
+repository sources with `STATEHUB_REGISTRAR=0`, proves byte-identical UUID
+writeback, verifies each store contains exactly one workplan and one task, and
+proves a second pass creates no duplicate or byte change. The complete State Hub
+suite passes (828 tests) and the dashboard production build succeeds.
+
+The exact image `main-5dd04dc` is live on railiance01 as Helm revision 55. The
+deployment rollout succeeded; live health reports `primary/railiance01` with
+schema `a4d5e6f7b8c9` current. State Hub commit `d8e1810` pins the chart and
+values declaration to the deployed image.
+
+No migration rollback was required.

docs/repository-standards_v0.1.md

@@ -34,23 +34,13 @@ Registry: [`config/workplan-prefix-registry.yaml`](../config/workplan-prefix-reg
 
 Work: `RMGR-WP-0004-T01`, `RMGR-WP-0004-T08`.
 
-## Identifier registrar (interim)
+## Identifier derivation and legacy repair
 
-Until UUIDv5 derivation lands (`RMGR-WP-0005-T03`), only the registrar
+UUIDv5 derivation is live fleet-wide (`RMGR-WP-0005`). Any State Hub instance
-instance may mint `state_hub_workstream_id` / `state_hub_task_id` into
+may reconcile canonical workplans, tasks, intakes, and decisions: the fleet
-files (`ADR-007` decision 2). Other hubs may read and project; they must
+namespace plus canonical record id produces the same identifier and
-not write new hub primary keys into git.
+byte-identical writeback on every instance. `STATEHUB_REGISTRAR` no longer gates
-
+the State Hub C-06/C-11/C-32 paths. The normal path is:
-| Signal | Registrar? |
-| --- | --- |
-| `STATEHUB_REGISTRAR=1` / `true` / `yes` / `on` | yes |
-| `STATEHUB_REGISTRAR=0` / `false` / `no` / `off` | no |
-| env unset, hostname starts with `railiance` | yes |
-| env unset, any other hostname | no |
-
-The interim registrar rule is superseded for new canonical workplans and tasks.
-Any host may derive the same missing UUIDv5 value; existing UUIDs are preserved
-and replacement remains a separately sealed migration. The normal path is:
 
 ```bash
 rmgr sync --path . --push
@@ -61,8 +51,10 @@ verifies the State Hub identity, and requests one central reconciliation of the
 exact pushed commit. Disconnected work remains valid in files and receives an
 explicit pending receipt rather than being written to a local cache database.
 
-The production fleet sweep remains disabled. The bounded on-demand registrar
+The production fleet sweep remains disabled. The compatibility command below
-below is retained only for sealed legacy identifier migration and repair:
+is retained only for sealed legacy identifier migration and repair; its name and
+scoped environment preserve compatibility with older State Hub releases and do
+not impose a single-writer rule on ordinary reconciliation:
 
 ```bash
 uv run --project ~/repo-manager rmgr registrar-reconcile \
@@ -74,10 +66,9 @@ uv run --project ~/repo-manager rmgr registrar-reconcile \
 
 The command verifies the authoritative State Hub health endpoint, refuses dirty
 or ahead/behind branches and retired Gitea origins, serializes local registrar
-runs, and grants `STATEHUB_REGISTRAR=1` only to its scoped child process. Agents
+runs, and scopes its compatibility environment to the child process. Agents do
-must not export that variable themselves. If the command is unavailable, send
+not need to export `STATEHUB_REGISTRAR`; ordinary `fix-consistency` runs derive
-one deduplicated request to `repo-manager`; repeated `fix-consistency` runs cannot
+canonical identifiers without it.
-resolve the gate and waste execution time.
 
 `--confirm-primary` is an operator assertion, not endpoint discovery. Always
 pass the central API explicitly; under ADR-010 the workstation service at

intakes/intakes.md

@@ -38,3 +38,24 @@ created: '2026-08-21T20:34:42.177493+00:00'
 updated: '2026-08-21T20:34:42.177493+00:00'
 state_hub_intake_id: "01a02611-a663-7712-bd4b-e39c13e7bf20"
 ```
+
+## RMGR-IN-0003 — Scope normal sync identity validation to actionable records
+
+```yaml
+id: RMGR-IN-0003
+kind: intake
+title: Scope normal sync identity validation to actionable records
+status: open
+origin: residual
+origin_ref: RMGR-WP-0005
+priority: low
+owner: repo-manager
+description: Normal rmgr sync currently refuses net-kingdom because the archived
+  historical task id NK-WP-0003-T08a is noncanonical, even though that record
+  already has an identifier and no assignment is requested. Align normal sync
+  with the scoped legacy-repair behavior: unrelated historical invalid ids stay
+  visible as conformance evidence but do not block deterministic assignment or
+  forge-derived reconciliation of unrelated canonical records.
+created: '2026-08-31T17:30:00+00:00'
+updated: '2026-08-31T17:30:00+00:00'
+```

workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md

@@ -4,11 +4,18 @@ type: workplan
 title: "Registrar consolidation and deterministic hub identifiers"
 domain: infotech
 repo: repo-manager
-status: active
+status: finished
 owner: codex
 topic_slug: infotech
 created: "2026-08-17"
 updated: "2026-08-31"
+quality_dod: DoD-Ok
+quality_dod_at: "2026-08-31"
+quality_dod_by: codex
+quality_dod_note: >-
+  All deterministic-identifier migrations are complete, a zero-residual fleet
+  scan is retained, two-instance convergence is tested, the registrar guard is
+  removed and deployed, and the bounded sync-wrapper residual is RMGR-IN-0003.
 parent_project: prj-state-hub-retirement
 parent_workplan: SHR-WP-0001
 related:
@@ -419,7 +426,7 @@ retry registered `ACTIVITY-WP-ADHOC-2026-08-23` and its task under correlation
 
 ```task
 id: RMGR-WP-0005-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "3fd25c8f-25ea-566e-91c7-ac5ccba83009"
 ```
@@ -694,11 +701,21 @@ seal: `c0cc496a06d9535a40840a0c7488cf365d8e47c5c58cc29aca72fb6d98273700`.
 Evidence:
 `docs/evidence/RMGR-WP-0005-batch-0007-fleet-completion-readiness-2026-08-31.md`.
 
+**Completed (2026-08-31):** the approved batch migrated all 85 remaining
+identifiers across ten repositories with zero assignments and no rollback. Each
+repository is pushed, clean, and verified against the railiance01 primary. A
+fresh fleet plan reports 42/42 repositories eligible and all 306 live records
+unchanged at their deterministic UUIDs, with zero remaining replacements or
+assignments. `RMGR-IN-0003` carries the one bounded residual: normal `rmgr sync`
+should not let an unrelated archived noncanonical task id block canonical
+reconciliation. Evidence:
+`docs/evidence/RMGR-WP-0005-batch-0007-fleet-completion-cutover-2026-08-31.md`.
+
 ## Retire the interim rule
 
 ```task
 id: RMGR-WP-0005-T05
-status: wait
+status: done
 priority: low
 state_hub_task_id: "f2634e3a-b32e-5862-85bf-78437fc976dc"
 ```
@@ -710,6 +727,14 @@ correctness constraint, and disconnected registration works again.
 Confirm before removal: two instances reconciling the same repository produce
 byte-identical writeback, and neither creates a duplicate record.
 
+**Completed (2026-08-31):** State Hub commit `5dd04dc` removes the interim
+C-06/C-11/C-32 registrar guard. The regression proof runs two independent hubs
+against identical repository sources with `STATEHUB_REGISTRAR=0`: both derive
+the same workplan/task UUIDs, produce byte-identical files, retain exactly one
+record of each kind, and create nothing on a second pass. The full State Hub
+suite passes (828 tests), and image `main-5dd04dc` is healthy on railiance01 at
+Helm revision 55. Deployment declarations are pinned in commit `d8e1810`.
+
 ## Rebuild local instances as caches
 
 ```task