apiVersion: helixforge.repo-manager/v1
kind: OwnerTaskInterface
metadata:
  id: helixforge.identifiers.state-hub-sealed-projection-repair.v1
  title: Repair an absent pre-derivation projection from a sealed migration unit
source:
  repo: repo-manager
  workplan_task: RMGR-WP-0005-T04
target:
  repo: state-hub
  owner_agent: state-hub
  suggested_work_record: STATE-WP-0079 follow-up task or owner-selected workplan task
approval:
  dispositions: [approved, amended, rejected]
  record_in: State Hub file-backed workplan task or decision
task:
  title: Add sealed repair for absent pre-derivation projection rows
  priority: high
  objective: >-
    Allow an authoritative random UUID that predates deterministic derivation to
    be restored into one partial projection only when a sealed Repo Manager
    migration unit proves the exact repository, record identity, old UUID, and
    derived target, so both projections can enter the existing transactional
    cutover with matching source rows.
  inputs:
    - ref: repo-manager/docs/work-record-uuid-derivation_v1.md
      authority: repo-manager
    - ref: repo-manager/src/repo_manager/commands/registrar_reconcile.py
      authority: repo-manager
    - ref: state-hub/api/services/work_record_identifier_migration.py
      authority: state-hub
  deliverables:
    - >-
      Add an explicit registrar-only repair mode scoped to one canonical
      workplan and one sealed repository migration unit; never widen ordinary
      consistency repair for arbitrary random stale UUIDs.
    - >-
      Reconstruct the absent workplan and its mapped tasks with their exact old
      UUIDs from the clean, synchronized authoritative file and existing
      repository/topic projection, then verify exact API visibility.
    - >-
      Emit a non-secret receipt containing repository, canonical ids, old UUIDs,
      plan seal, source Git revision, projection identity, and canonical UTC
      observation time.
    - Make retry idempotent and reject partial presence, target presence, source drift, or UUID conflict.
  constraints:
    - The normal C-03 random stale-reference refusal remains unchanged.
    - Repair requires explicit primary confirmation and an exact sealed plan hash.
    - Do not infer a repository, topic, canonical id, or UUID from path strings alone.
    - Do not mutate the authoritative workplan file during projection repair.
    - A failed repair must leave no partially created workplan or task rows.
  acceptance:
    - >-
      A fixture with the old row present on one hub and absent on another repairs
      only the absent projection and then passes current UUID=200 and derived UUID=404 preflight.
    - A random stale UUID outside the sealed unit remains non-fixable C-03.
    - Repeating the same repair returns a verified no-op receipt.
    - A dirty or unsynchronized source, mismatched plan hash, or partially present unit is rejected.
    - Existing empty-projection bootstrap and derived-row repair behavior remain unchanged.
  verification:
    - uv run pytest -q tests/test_consistency_check.py tests/test_work_record_identifier_migration.py
    - make test