fix registrar writebacks and own the State Hub access map

Ignore generated WORK-RECORDS.md/.custodian-brief.md in the registrar git
precondition, commit identifier writebacks even when registration is
incomplete, and name the remaining records in the error. Add
config/state-hub-access.yaml as the single source for the AGENTS.md port
map, rendered by rmgr scaffold and refreshed with --refresh-hub-access.

Assistant: grok
Assistant-Session: 01a04996-76e8-7f53-b971-1885cfbed436

tests/test_registrar_reconcile.py

@@ -177,6 +177,101 @@ def test_rejects_dirty_or_unsynced_repository(tmp_path: Path, monkeypatch) -> No
     dirty = rr.registrar_reconcile(repo, confirm_primary=True)
     assert dirty.status == "rejected"
     assert dirty.error and dirty.error["code"] == "git_precondition_failed"
+    assert "note.txt" in (dirty.error.get("message") or "")
+
+
+def test_generated_index_alone_does_not_fail_git_precondition(tmp_path: Path, monkeypatch) -> None:
+    repo = _fixture(tmp_path)
+    (repo / "WORK-RECORDS.md").write_text("# generated\n", encoding="utf-8")
+    monkeypatch.setattr(
+        rr,
+        "_check_primary",
+        lambda _api, **_: ({"status": "ok", "db": "connected", "instance_role": "primary"}, None),
+    )
+
+    def fake_run(command, *, env):
+        workplan = repo / "workplans" / "DEMO-WP-0001.md"
+        text = workplan.read_text(encoding="utf-8")
+        text = text.replace(
+            "status: active\n---",
+            'status: active\nstate_hub_workstream_id: "11111111-1111-4111-8111-111111111111"\n---',
+        )
+        text = text.replace(
+            "priority: high\n```",
+            'priority: high\nstate_hub_task_id: "22222222-2222-4222-8222-222222222222"\n```',
+        )
+        workplan.write_text(text, encoding="utf-8")
+        return subprocess.CompletedProcess(command, 0, "ok", "")
+
+    monkeypatch.setattr(rr, "_run_statehub", fake_run)
+    result = rr.registrar_reconcile(repo, statehub_bin="statehub", confirm_primary=True)
+    assert result.status == "applied"
+    assert "WORK-RECORDS.md" in result.evidence.get("committed_paths", [])
+
+
+def test_incomplete_run_commits_writebacks_and_names_the_record(
+    tmp_path: Path, monkeypatch
+) -> None:
+    repo = _fixture(tmp_path)
+    monkeypatch.setattr(
+        rr,
+        "_check_primary",
+        lambda _api, **_: ({"status": "ok", "db": "connected", "instance_role": "primary"}, None),
+    )
+
+    def fake_run(command, *, env):
+        workplan = repo / "workplans" / "DEMO-WP-0001.md"
+        text = workplan.read_text(encoding="utf-8")
+        text = text.replace(
+            "status: active\n---",
+            'status: active\nstate_hub_workstream_id: "11111111-1111-4111-8111-111111111111"\n---',
+        )
+        workplan.write_text(text, encoding="utf-8")
+        (repo / "WORK-RECORDS.md").write_text("# generated after mint\n", encoding="utf-8")
+        return subprocess.CompletedProcess(
+            command,
+            1,
+            "! task DEMO-WP-0001-T01 not created: 500 Internal Server Error: Internal Server Error",
+            "",
+        )
+
+    monkeypatch.setattr(rr, "_run_statehub", fake_run)
+    result = rr.registrar_reconcile(repo, statehub_bin="statehub", confirm_primary=True)
+    assert result.status == "failed"
+    assert result.error and result.error["code"] == "registration_incomplete"
+    assert "DEMO-WP-0001-T01" in (result.error.get("message") or "")
+    assert result.error.get("records") == ["DEMO-WP-0001-T01"]
+    assert "not created:" in (result.error.get("message") or "")
+    subject = subprocess.run(
+        ["git", "log", "-1", "--format=%s"], cwd=repo, capture_output=True, text=True, check=True
+    ).stdout.strip()
+    assert subject == "chore(registrar): assign State Hub identifiers"
+    workplan = (repo / "workplans" / "DEMO-WP-0001.md").read_text(encoding="utf-8")
+    assert "11111111-1111-4111-8111-111111111111" in workplan
+
+
+def test_bootstrap_source_invalid_names_the_record(tmp_path: Path, monkeypatch) -> None:
+    repo = _fixture(tmp_path)
+    monkeypatch.setattr(
+        rr,
+        "_check_primary",
+        lambda _api, **_: ({"status": "ok", "db": "connected", "instance_role": "primary"}, None),
+    )
+    monkeypatch.setattr(
+        rr,
+        "_check_empty_repo_projection",
+        lambda _api, _slug: ({"repo_id": "repo-1", "workplan_count": 0}, None),
+    )
+    result = rr.registrar_reconcile(
+        repo,
+        statehub_bin="statehub",
+        confirm_primary=True,
+        bootstrap_empty_projection=True,
+    )
+    assert result.status == "rejected"
+    assert result.error and result.error["code"] == "bootstrap_source_invalid"
+    assert "DEMO-WP-0001" in (result.error.get("message") or "")
+    assert result.error.get("record") == "DEMO-WP-0001"
 
 
 def test_missing_scan_includes_intakes_and_decisions(tmp_path: Path) -> None: