docs(identifier): seal helixforge cutover plan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

docs/evidence/RMGR-WP-0005-helixforge-cutover-readiness-2026-08-22.md

@@ -0,0 +1,68 @@
+# RMGR-WP-0005 HelixForge cutover readiness — 2026-08-22
+
+## Outcome
+
+The deterministic identifier cutover is implemented and rehearsed on both
+sides of the repository/projection boundary. No live UUID migration has run.
+
+## Sealed fleet plan
+
+- File: `RMGR-WP-0005-helixforge-uuid-migration-plan-2026-08-22.json`
+- Namespace: `helixforge`
+- Plan SHA-256: `5a2e0d1d4e6e121780a0e66a83e07a718f3050e8f1c6b94328b86b92de290a0c`
+- Repositories: 43/43 eligible; 0 skipped
+- Live mappings: 245 total; 212 replacements; 33 assignments
+- Collision preflight: zero live collisions
+- Apply policy: all-or-nothing per repository
+
+The prior 2026-08-21 plan correctly became invalid after authoritative
+workplan content changed. Regeneration after Repo Manager commit `1d5b603`
+produced this seal. A dry-run for repository `repo-manager` passed and prepared
+one file containing six replacements without changing it.
+
+## Central projection gate
+
+State Hub commit `cb1b028` provides:
+
+- Alembic revision `b8d4f0a2c6e1`;
+- `ON UPDATE CASCADE` for all 20 foreign keys into workplan/task primary keys,
+  retaining each existing delete policy;
+- durable old-to-new alias provenance;
+- sealed-plan, namespace, derivation, membership, source, target and alias
+  checks;
+- repository-atomic forward migration and task-first/workplan-second reverse.
+
+Isolated PostgreSQL upgrade created 20/20 cascade constraints and the alias
+table. Downgrade restored 20/20 prior update policies and removed the alias
+table. Service evidence covers task parentage, progress events, token events,
+dependency edges, durable alias state, reverse, and transaction abort. Full
+State Hub regression: 622 passed.
+
+## Authoritative file gate
+
+Repo Manager commit `1d5b603` provides `rmgr identifier migration-files`:
+
+- dry-run by default;
+- exact `--confirm-plan-sha256` required;
+- explicit `--execute` required to write;
+- all mappings and all resulting bytes prepared before replacement begins;
+- atomic per-file replacement with restoration of already-written originals if
+  a later write fails;
+- reverse restores replaced values and removes newly assigned fields.
+
+Full Repo Manager regression: 70 passed. Ruff: clean.
+
+## Remaining production gate
+
+Run one operator-approved repository pilot. Required order:
+
+1. Re-verify the sealed repository source and central projection preconditions.
+2. Apply the State Hub repository transaction.
+3. Execute the Repo Manager file transaction using the same plan seal.
+4. Commit the authoritative workplan file changes.
+5. Run `statehub fix-consistency` and verify zero identifier divergence.
+6. If steps 3–5 fail, reverse the file transaction if needed, then reverse the
+   State Hub transaction using the durable aliases.
+
+Do not expand beyond the pilot until old/new lookup evidence, progress/task
+references, and a second consistency pass are clean.