docs: close stale repo manager work

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md

@@ -236,7 +236,7 @@ credential path that does not mount an operator home or private-key directory.
 
 ```task
 id: RMGR-WP-0005-T12
-status: wait
+status: cancel
 priority: high
 state_hub_task_id: "0d69713d-0596-5415-b40c-8f5035641541"
 ```
@@ -251,11 +251,17 @@ Coordinate credential custody with the platform owner and keep the schedule
 disabled until positive allowed-repository and negative unrelated-repository
 push evidence exist without exposing credential values.
 
+**Cancelled 2026-08-31.** The host-wide sweep is retired, not awaiting
+re-enablement. Production continues with `sweep.enabled: false`, no checkout
+hostPath, and no operator SSH mount. A future scoped sweep would be a new
+capability with its own workplan and credential route; keeping a conditional
+task open here incorrectly implies the retired design is on the critical path.
+
 ## Re-register identifiers minted outside the registrar
 
 ```task
 id: RMGR-WP-0005-T02
-status: wait
+status: cancel
 priority: medium
 state_hub_task_id: "7892ca86-bd89-537e-9361-d648dff8e4b2"
 ```
@@ -329,6 +335,13 @@ and pushed Custodian revision `d792318`. The full historical identity report
 remained in evidence while `blocking_invalid_identifiers` and
 `blocking_identity_collisions` were both empty, proving the intended boundary.
 
+**Superseded 2026-08-31.** T03 and T04 replaced hand re-registration as the
+governed convergence path. The fresh fleet plan covers every eligible live
+record as `replace`, `assign`, or `unchanged`; closed pre-derivation UUIDs stay
+frozen historical evidence. No remaining record should be repaired through the
+old registrar-minting procedure, so this task is cancelled rather than left in
+permanent conditional wait.
+
 ## Derive identifiers deterministically
 
 ```task
@@ -669,7 +682,7 @@ byte-identical writeback, and neither creates a duplicate record.
 
 ```task
 id: RMGR-WP-0005-T07
-status: progress
+status: done
 priority: high
 state_hub_task_id: "e3c2a791-f632-59f3-9929-b179e45c77d0"
 ```
@@ -732,6 +745,17 @@ repeat comparison passes. Evidence and the non-destructive procedure are in
 `docs/evidence/RMGR-WP-0005-isolated-rebuild-2026-08-22.md` and
 `docs/cache-rebuild_v1.md`.
 
+**Done with explicit disposition 2026-08-31.** The workstation State Hub API is
+gone; its loopback address is now a relay to the sole `railliance01` primary.
+Repo Manager's advisory cache rebuilt 96 current records at commit `e8e2747`
+and immediately reported fresh with matching source fingerprints. The old
+local-only hub-native rows were not migrated before the local database was
+replaced: the current local PostgreSQL database contains zero matching progress
+events or messages. They are therefore dispositioned as discarded cache
+history, not claimed as reconstructed. Central now exclusively owns new
+hub-native writes. Exact counts and the limitation are retained in
+`docs/evidence/RMGR-WP-0005-cache-centralization-2026-08-31.md`.
+
 ## Separate file-derived from hub-native data
 
 ```task

workplans/RMGR-WP-0011-sbom-nexus-production-client.md

@@ -4,12 +4,19 @@ type: workplan
 title: "SBOM Nexus production client and explicit preview semantics"
 domain: infotech
 repo: repo-manager
-status: active
+status: finished
 owner: codex
 topic_slug: infotech
 quality_dor: DoR-Ok
 created: "2026-08-22"
-updated: "2026-08-22"
+updated: "2026-08-31"
+quality_dod: DoD-Ok
+quality_dod_at: "2026-08-31"
+quality_dod_by: codex
+quality_dod_note: >-
+  Contract, failure semantics, explicit preview mode, controlled source
+  projection, and live authoritative Nexus reads are evidenced; durable SBOM
+  ownership remains solely with SBOM Nexus.
 parent_workplan: SBOM-WP-0002
 related:
   - CUST-WP-0062
@@ -109,7 +116,7 @@ contract tests carry the same semantics.
 
 ```task
 id: RMGR-WP-0011-T04
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "81fed060-3431-5d9b-819b-fcc7d629c364"
 ```
@@ -143,13 +150,23 @@ pre-contract service cannot silently discard it. Live read-only proof resolved
 `refs/heads/main`. Remaining T04 work is the Nexus/package/Activity Core
 implementation and attended production proof owned through `CUST-WP-0064`.
 
+**Done 2026-08-31.** `CUST-WP-0064` is finished and production Nexus is
+healthy on the controlled-source implementation. Repo Manager's own
+`source-ref --project --confirm-authoritative` command resolved the exact
+Forgejo `main` revision, projected it with `checkout_path: null`, and received
+the identical source reference from Nexus. Its production client also consumed
+the latest-snapshot and licence-report routes with explicit
+`authoritative-service` context. Source inspection confirms Repo Manager holds
+no scanner, snapshot store, freshness/catch-up policy, or licence classifier.
+Evidence: `docs/evidence/RMGR-WP-0011-production-client-proof-2026-08-31.md`.
+
 ## Acceptance
 
-- Authoritative mode talks to SBOM Nexus and returns its pinned snapshot
+- [x] Authoritative mode talks to SBOM Nexus and returns its pinned snapshot
   contract without local persistence.
-- Preview mode is visibly non-authoritative and cannot be mistaken for an
+- [x] Preview mode is visibly non-authoritative and cannot be mistaken for an
   ingest receipt.
-- Existing `rmgr sbom scan|licence-report` users receive a documented migration
+- [x] Existing `rmgr sbom scan|licence-report` users receive a documented migration
   path and deterministic errors.
-- Repo Manager remains authoritative only for repository identity and paths;
+- [x] Repo Manager remains authoritative only for repository identity and paths;
   SBOM Nexus remains the sole durable SBOM owner.