feat: advance conformance and deterministic ID migration

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md

@@ -313,8 +313,9 @@ derivation scope this task needs:
   checked against the live namespace and renumbered if it clashes. Build this
   check alongside derivation, not after.
 
-Remaining prerequisite is the live-collision remediation below, tracked on
-`RMGR-WP-0004-T09`. 11 files, 5 identifiers.
+The live-collision remediation tracked on `RMGR-WP-0004-T09` completed
+2026-08-21. All 11 affected files are terminal history, and a fresh fleet
+preflight found 263 live identifiers with zero collisions.
 
 Progress (2026-08-21): the versioned derivation function and collision guard are
 implemented in Repo Manager and published as
@@ -322,15 +323,18 @@ implemented in Repo Manager and published as
 `a4058507-5c4a-5a00-ab06-fffa4fb46009` and exact name bytes
 `<fleet-namespace>\n<canonical-id>`. `rmgr identifier derive|preflight` provides
 independent reproduction and a hard live-collision refusal, including the
-unarchive hazard. Activation remains correctly gated on T09's 11-file
-remediation and declaration of the current N1 fleet namespace name; no existing
-minted identifier was rewritten implicitly.
+unarchive hazard. `rmgr identifier migration-plan` now emits the versioned,
+non-mutating old-to-derived mapping needed by T04 and refuses a whole repository
+when any live record is unsafe. Activation is gated only on declaration of the
+current fleet namespace boundary/name: ADR-011 intentionally leaves that an
+open governance question, so Repo Manager does not infer it from a hostname.
+No existing minted identifier was rewritten implicitly.
 
 ## Migrate the fleet
 
 ```task
 id: RMGR-WP-0005-T04
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "503a23a9-ede1-4cf1-bd32-e9669b84ce58"
 ```
@@ -346,6 +350,14 @@ value, update the database to match, and write the file.
 - Repositories with unresolved identifier collisions cannot migrate until
   `ADR-007` § Migration is ruled on; skip and report them rather than guessing.
 
+**Progress (2026-08-21):** `rmgr identifier migration-plan --root ...
+--namespace ... --output ...` implements the non-mutating first phase. Its
+versioned JSON retains every current-to-derived UUID, labels the repository as
+the atomic unit, and skips an entire affected repository on a collision or
+malformed live identifier. Applying those plans remains gated on the namespace
+declaration and a compatibility write path that updates file and central
+projection together.
+
 ## Retire the interim rule
 
 ```task
@@ -388,7 +400,7 @@ portion of the divergence is redundant and needs no merge — only a rebuild.
 
 ```task
 id: RMGR-WP-0005-T08
-status: wait
+status: done
 priority: high
 state_hub_task_id: "241cf058-2f3e-4d49-8cc9-5c714be4a1cf"
 ```
@@ -411,11 +423,22 @@ this split most of what it buffers does not need buffering, and only the
 append-only stream does. Re-examine before building further on it — this likely
 reduces its scope.
 
+**Result (2026-08-21):** `config/hub-record-authority.yaml` classifies all 42
+tables imported by the current State Hub model package; a regression test keeps
+the inventory explicit. `docs/hub-record-authority_v1.md` defines truth source,
+offline behaviour, write rule, and target owner. The audit adapted the original
+binary wording: hub-native origin contains both append-only events and mutable
+control records. Only `progress_events` and `token_events` enter the generic
+append/replay path; mutable message, launch, domain/topic, interface, and catalog
+state requires an owner-specific ordered command or stays online-only. Decisions
+and intakes are file-derived under the ratified work-record standard, superseding
+ADR-010's older example list.
+
 ## Disposition the orphaned hub-first records
 
 ```task
 id: RMGR-WP-0005-T09
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "d40cc4a8-4280-4940-ac1d-dc1049f1b678"
 ```
@@ -442,6 +465,16 @@ Note: one of these records is already labelled `SPURIOUS bootstrap (statehub
 register collision)` in `repo-manager`, independent corroboration of the
 `STATE-WP-0080` defect.
 
+**Rebaselined 2026-08-21:** the local cache now has 224 rows without a backing
+filename, not 28: 217 are closed (`finished`/`archived`) provenance and seven are
+live. All seven live rows have matching files across `net-kingdom`, `state-hub`,
+`railiance-platform`, `railiance-enablement`, `railiance-infra`, and `ops-hub`;
+there are zero confirmed live hub-first rows in this snapshot. Exact ids and
+paths are captured in
+`docs/evidence/RMGR-WP-0005-orphan-disposition-2026-08-21.md`. Remaining work is
+to repair those seven bindings and retain/export the 217 closed rows before T07
+replaces the cache.
+
 ## Assign one authoritative hub per record
 
 ```task