feat: finish register receiving and authority routing

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

docs/evidence/RMGR-WP-0005-orphan-disposition-2026-08-21.md

@@ -35,8 +35,18 @@ confirmed live hub-first workplans in this snapshot.
 
 The 217 closed rows remain cheap historical provenance. They need not be
 reconstructed as files, but the cache-rebuild procedure must export or retain
-them before replacing the local database. Repairing the seven live bindings is
-the remaining prerequisite for T07.
+them before replacing the local database.
+
+## Repair result
+
+All seven bindings were submitted together to the preferred
+`PUT /workplans/index/bindings` route and the hub acknowledged
+`{"updated":7,"received":7}`. A fresh query now finds exactly 217 unbound rows:
+201 `finished`, 16 `archived`, and **zero live**. No repository file or
+lifecycle status was changed. The broad `fix-consistency --all` path was not
+used for the repair because it aborts while refreshing the brief for stale
+registered path `/home/worsch/inter-hub`; the targeted binding route avoided
+coupling this data repair to that unrelated registry defect.
 
 ## Reproduction
 

docs/evidence/RMGR-WP-0008-sbom-cutover-2026-08-21.md

@@ -0,0 +1,40 @@
+# RMGR-WP-0008 SBOM receiving and cutover evidence — 2026-08-21
+
+Repo Manager now derives an SBOM snapshot from repository-owned lockfiles and
+the reviewed `sbom-tools.yaml` escape hatch. The snapshot includes source path
+and SHA-256 provenance, Git revision, canonical UTC generation time, ecosystem,
+direct/development flags, licence grouping, and direct production copyleft
+findings.
+
+## Live projection reconciliation
+
+The workstation State Hub held 22 historical snapshots for 18 repositories.
+For migration planning, only the newest snapshot per repository was compared
+with a fresh Repo Manager scan of its registered local path:
+
+- 18 repositories scanned; 0 parse failures;
+- 9 entry counts matched exactly;
+- newest State Hub projections totalled 2,659 entries;
+- current authoritative lockfiles produce 1,565 entries.
+
+The differing counts are expected evidence of source drift, not rows to copy:
+the stored snapshots date from March through July 2026, while the rescan reads
+the current checked-out lockfiles. Copying the 2,659 cached rows into repository
+records would reverse the authority boundary. Cutover therefore rebuilds each
+repository snapshot from its current lockfiles and retains the old State Hub
+snapshot ids/timestamps as historical provenance until the retirement retention
+gate permits deletion.
+
+## Compatibility contract
+
+State Hub's retirement adapter calls `rmgr sbom scan --path <repo> --slug
+<slug>` and receives `repo-manager.sbom-snapshot.v1` JSON. Route-level tests
+pin that invocation and response shape. The adapter is read/derive-only: it
+does not commit, push, or mutate a register file.
+
+## Verification
+
+- `uv run ruff check src tests`
+- focused SBOM and compatibility-adapter tests
+- live `repo-manager` scan: 39 entries, no parse errors, canonical `Z`
+  timestamp, Git revision present, and no direct production copyleft finding