docs(workplans): RMGR-WP-0005 T07-T10 implement the ADR-008 cache model

T07 rebuild local instances as caches; T08 separate file-derived from
hub-native data and rescope STATE-WP-0068; T09 disposition the 28 orphans
(blocks T07); T10 assign one authoritative hub per record before the hub
split lands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md

@@ -144,6 +144,101 @@ correctness constraint, and disconnected registration works again.
 Confirm before removal: two instances reconciling the same repository produce
 byte-identical writeback, and neither creates a duplicate record.
 
+## Rebuild local instances as caches
+
+```task
+id: RMGR-WP-0005-T07
+status: wait
+priority: high
+```
+
+Implement `ADR-008` decisions 1–3: the central hub on railiance is authoritative
+as a *reading* of the repositories; local instances become rebuildable caches.
+
+- A cache must be discardable and reconstructable from repository files alone,
+  with no work lost.
+- Local work must not require a hub — repository files are self-describing, so
+  reading them is sufficient for working inside a repo.
+- Cache reads are advisory and must carry their staleness (`ADR-008` decision 8).
+
+Measured 2026-08-17: 955 workplans locally against 649 on the primary, 320
+local-only, of which **288 are backed by files that all exist on disk**. That
+portion of the divergence is redundant and needs no merge — only a rebuild.
+
+## Separate file-derived from hub-native data
+
+```task
+id: RMGR-WP-0005-T08
+status: wait
+priority: high
+```
+
+Implement `ADR-008` decision 4. The two kinds need opposite handling:
+
+- **File-derived** (workplans, tasks, statuses, dependencies) — central derives
+  it and must not accept pushes of it (decision 5). Offline, the git commit *is*
+  the write. No conflict model: conflicts are git conflicts.
+- **Hub-native** (progress events, decisions, inbox messages, token events) —
+  central owns it, needs a real write path and a local append-only buffer for
+  replay. No conflict model either: append-only merges regardless of order.
+
+Deliverable is an explicit classification of every record type the hub holds,
+with its truth source and offline behaviour, so neither kind is handled by the
+other's rules.
+
+Feeds a rescope of `STATE-WP-0068` (offline write buffer and edge relay): under
+this split most of what it buffers does not need buffering, and only the
+append-only stream does. Re-examine before building further on it — this likely
+reduces its scope.
+
+## Disposition the orphaned hub-first records
+
+```task
+id: RMGR-WP-0005-T09
+status: wait
+priority: high
+```
+
+28 records exist in the local instance with no backing file. They are the only
+records a cache rebuild would drop, so they must be classified first
+(`ADR-008` § Orphan disposition):
+
+1. **Broken links** — a file exists but `backing_filename` was never recorded.
+   `RMGR-WP-0004` is a confirmed instance. Repair the link; no data at risk.
+   Likely the largest class, so classify before estimating the rest.
+2. **Live hub-first records** — `proposed`/`ready`/`backlog` with no file, in
+   `activity-core`, `core-hub`, `hub-core`, `issue-core`, `ops-hub`,
+   `prj-forgejo-org-refactor`, `railiance-enablement`, `railiance-infra`,
+   `reef-railiance`. Write a repository file or drop explicitly. These are
+   `ADR-001` violations and must not survive as hub-only records.
+3. **Closed hub-first records** — `finished`/`archived` with no file. Retain as
+   provenance where cheap; do not reconstruct completed plans.
+
+**Blocks T07** — rebuilding the cache before this classification would discard
+class 2.
+
+Note: one of these records is already labelled `SPURIOUS bootstrap (statehub
+register collision)` in `repo-manager`, independent corroboration of the
+`STATE-WP-0080` defect.
+
+## Assign one authoritative hub per record
+
+```task
+id: RMGR-WP-0005-T10
+status: wait
+priority: medium
+```
+
+Implement `ADR-008` decision 7. The retirement splits one hub into several, which
+is permitted only if every record has exactly one authoritative hub, determined
+by its repository and domain.
+
+Define and enforce that mapping before the split lands. Without it the
+peer-database divergence this workplan exists to remove recurs at larger scale.
+
+Coordinate with the hub-extension architecture in
+`prj-state-hub-retirement/architecture/`; `hub-core` owns the hub-native side.
+
 ## Protect lifecycle status from automation
 
 ```task