feat: add fast forge work-record reconciliation

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

workplans/ADHOC-2026-08-30.md

@@ -0,0 +1,34 @@
+---
+id: STATE-WP-ADHOC-2026-08-30
+type: workplan
+title: "Ad hoc fixes — 2026-08-30"
+domain: infotech
+repo: state-hub
+status: finished
+owner: codex
+topic_slug: state-hub
+created: "2026-08-30"
+updated: "2026-08-30"
+state_hub_workstream_id: "0b6218b2-8dce-5c11-aa5a-196c0521f3fe"
+---
+
+## Align UI startup with the production State Hub
+
+```task
+id: STATE-WP-ADHOC-2026-08-30-T01
+status: done
+priority: high
+state_hub_task_id: "82e36947-3ca3-522d-b5ae-78c2e00e16d8"
+```
+
+Make the railiance01 production tunnel plus workstation dashboard the normal
+documented startup path. Clearly separate local fallback commands and prevent
+the normal dashboard/tunnel targets from silently using an empty local API.
+
+Completed 2026-08-30. The README and Makefile now present `make bridges`
+followed by `make dashboard` as the normal production UI path. The bridge guard
+rejects a non-primary listener on port 8000; the dashboard and `make check`
+require `primary/railiance01`; `make dashboard-local` remains available for
+intentional fallback development. `make dashboard-check` built all 71 pages
+successfully (with the pre-existing `/docs/intakes` → `/suggestions` broken-link
+warning).

workplans/STATE-WP-0086-fast-forge-projection-reconcile.md

@@ -0,0 +1,69 @@
+---
+id: STATE-WP-0086
+type: workplan
+title: "Fast single-repository forge projection reconciliation"
+domain: infotech
+repo: state-hub
+status: active
+owner: codex
+topic_slug: infotech
+created: "2026-08-30"
+updated: "2026-08-30"
+related:
+  - STATE-WP-0083
+  - RMGR-WP-0005
+  - RMGR-WP-0012
+state_hub_workstream_id: "c43b1b2c-2f84-540a-9b93-03a13ed148f1"
+---
+
+# Fast single-repository forge projection reconciliation
+
+## Goal
+
+Expose the existing forge-derived repository reset as a guarded, idempotent,
+single-request compatibility API. The central hub reads the exact pushed forge
+commit itself and applies workplan/task changes in one database transaction.
+
+## Guarded exact-commit API
+
+```task
+id: STATE-WP-0086-T01
+status: done
+priority: high
+state_hub_task_id: "1b72b4e2-419a-5b55-91a7-3f56afba7480"
+```
+
+Add a primary-only endpoint that derives one repository from Forgejo, compares
+the derived commit with the caller's expected commit, and commits or rolls back
+the complete repository reconciliation atomically.
+
+## Complete task and workplan field projection
+
+```task
+id: STATE-WP-0086-T02
+status: done
+priority: high
+state_hub_task_id: "25e1a146-47b2-5704-af45-b314c5a5a353"
+```
+
+Carry owner, priority, description, blocking, and human-intervention fields
+through the existing forge derivation and update path without weakening its
+collision, unreadable-source, or retirement safeguards.
+
+## Idempotency, regression, and performance proof
+
+```task
+id: STATE-WP-0086-T03
+status: progress
+priority: high
+state_hub_task_id: "88723069-59d4-5b7e-85a4-36c3575382af"
+```
+
+Test wrong-instance rejection, commit mismatch, replay, transactional rollback,
+ad-hoc creation, task updates, and bounded request count. Document the endpoint
+as the fast path while retaining the full consistency checker for deep audits.
+
+Focused projection tests are green, including idempotent replay and exact-commit
+refusal, and the complete State Hub suite is the implementation gate. This task
+remains in progress until the endpoint is deployed and a live primary receipt
+records the production latency and counts.