feat(identifiers): prepare verified cutover batches

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

docs/evidence/RMGR-WP-0005-batch-0002-readiness-2026-08-22.md

@@ -0,0 +1,77 @@
+# RMGR-WP-0005 batch 0002 readiness
+
+**Observed at:** `2026-08-22T12:48:35Z`
+
+**Scope:** `whynot-design` only
+
+**Decision:** `RMGR-DEC-2026-001`
+
+## Outcome
+
+The next deterministic-identifier batch is fully specified and ready for an
+explicit approval decision. No database or repository identifier was changed.
+
+The earlier fleet seal correctly rejects 15 repositories whose authoritative
+sources changed after it was generated. A refreshed plan now covers 41 eligible
+repositories and 230 records with zero collisions:
+
+- 180 replacements;
+- 32 assignments;
+- 18 already deterministic;
+- 0 skipped repositories.
+
+Source plan:
+`RMGR-WP-0005-helixforge-uuid-migration-plan-2026-08-22-v2.json`, SHA-256 seal
+`ac97f6e4f0b35db63a0dc1b4a439f0a39738d13c1407f18419f706d780d4eea0`.
+
+## Batch 0002
+
+The proposed batch deliberately stays at one repository and one replacement:
+
+| Repository | Record | Current UUID | Derived UUID |
+| --- | --- | --- | --- |
+| `whynot-design` | `WHYNOT-WP-0003` | `41fed928-f44a-48f4-9870-120310fbf071` | `d3a6ec16-ac40-5ffb-99e7-07f997e59a4a` |
+
+Batch manifest:
+`RMGR-WP-0005-batch-0002-whynot-design.json`, SHA-256 seal
+`4039224352c6590fdc6b41e739539f1f9c92d098b43ed6e30b3cd9a87b53da65`.
+
+The manifest reports `ready_for_approval: true`, `apply_authorized: false`.
+`whynot-design` is clean, exactly synchronized with `origin/main`, and its
+origin is the Forgejo lineage. The plan pins HEAD
+`4b62cffc86496d587ac8d48a8e199624bc4a5c1f` and source fingerprint
+`55ea5e6884be2c5a0a7b8e9e19326f381c2b86afecbc28adc00252ce56793a7f`.
+
+## Projection preflight
+
+Read-only checks against the workstation and production projections agree:
+
+| Check | Workstation | Production |
+| --- | ---: | ---: |
+| Current workplan UUID lookup | 200 | 200 |
+| Derived workplan UUID lookup | 404 | 404 |
+| Tasks linked to current workplan | 9 | 9 |
+| Progress events linked to current workplan | 11 | 11 |
+| Decisions linked to current workplan | 1 | 1 |
+
+This is a useful second pilot: unlike the Repo Manager pilot, the same old row
+exists in both projections and has matching dependent-record counts. The
+database cascade must preserve those links while the task UUIDs remain
+unchanged.
+
+## Approved execution interface
+
+If `RMGR-DEC-2026-001` is approved against the exact batch hash:
+
+1. Re-run batch/source/Git preflight and stop on any drift.
+2. Retain fresh per-database restore points and hashes.
+3. Apply the repository transaction to workstation and production projections.
+4. Apply the sealed authoritative file transaction for `whynot-design`.
+5. Commit and push only the mapped workplan file.
+6. Run consistency twice and require the derived lookup to return 200, the old
+   lookup to return 404, and all dependent counts to remain 9/11/1.
+7. On any failure after database apply, reverse written files if necessary and
+   then reverse both database transactions from durable aliases.
+
+The decision does not authorize any other repository or restoration of the
+disabled production sweep.

docs/evidence/RMGR-WP-0005-batch-0002-whynot-design.json

@@ -0,0 +1,47 @@
+{
+  "schema": "repo-manager.identifier-migration-batch.v1",
+  "ok": true,
+  "ready_for_approval": true,
+  "apply_authorized": false,
+  "approval_required": true,
+  "namespace": "helixforge",
+  "source_plan_sha256": "ac97f6e4f0b35db63a0dc1b4a439f0a39738d13c1407f18419f706d780d4eea0",
+  "batch_policy": "repository-atomic, sequential, stop on first failure",
+  "rollback_order": "reverse files if written, then reverse central projection",
+  "generated_at": "2026-08-22T12:48:35.222354Z",
+  "totals": {
+    "repositories": 1,
+    "records": 1,
+    "replace": 1,
+    "assign": 0,
+    "unchanged": 0
+  },
+  "repositories": [
+    {
+      "repo": "whynot-design",
+      "path": "/home/worsch/whynot-design",
+      "planned_head_sha": "4b62cffc86496d587ac8d48a8e199624bc4a5c1f",
+      "source_fingerprint": "55ea5e6884be2c5a0a7b8e9e19326f381c2b86afecbc28adc00252ce56793a7f",
+      "source_verified": true,
+      "git_preflight": {
+        "ok": true,
+        "head_sha": "4b62cffc86496d587ac8d48a8e199624bc4a5c1f",
+        "expected_head_sha": "4b62cffc86496d587ac8d48a8e199624bc4a5c1f",
+        "upstream": "origin/main",
+        "behind": 0,
+        "ahead": 0,
+        "origin": "forgejo-remote:coulomb/whynot-design.git",
+        "errors": []
+      },
+      "mapping_counts": {
+        "records": 1,
+        "replace": 1,
+        "assign": 0,
+        "unchanged": 0
+      },
+      "ready": true
+    }
+  ],
+  "errors": [],
+  "batch_sha256": "4039224352c6590fdc6b41e739539f1f9c92d098b43ed6e30b3cd9a87b53da65"
+}

docs/work-record-uuid-derivation_v1.md

@@ -44,6 +44,13 @@ rmgr identifier preflight --root /path/to/fleet
 rmgr identifier migration-plan --root /path/to/fleet --output uuid-migration.json
 rmgr identifier migration-verify --plan uuid-migration.json
 rmgr identifier migration-verify --plan uuid-migration.json --repo repo-manager
+rmgr identifier migration-batch-plan \
+  --plan uuid-migration.json \
+  --repo whynot-design \
+  --output batch.json
+rmgr identifier migration-batch-verify \
+  --plan uuid-migration.json \
+  --batch batch.json
 ```
 
 `migration-plan` is non-mutating. Its versioned JSON output preserves every
@@ -61,6 +68,13 @@ repository. `--repo` verifies one atomic apply unit, so unrelated fleet churn
 does not invalidate a stable repository. A new plan is required for each unit
 whose authoritative source drifts.
 
+`migration-batch-plan` converts selected atomic units into a bounded approval
+package. Each selected repository must still match the planned Git HEAD, have a
+clean worktree, exactly match its configured upstream, and use a non-retired
+origin. The batch records these facts and its own SHA-256 seal, but always emits
+`apply_authorized: false`. An explicit decision must cite that batch hash before
+any database or file mutation.
+
 Activation and applying a bulk migration remain separate governed steps.
 Publishing or planning this function does not retroactively rewrite existing
 identifiers. `--namespace` remains an explicit override for a foreign/forked