feat(workplan): collision refusal verified live on net-kingdom

Returns refused naming ADHOC-2026-08-23 and its holder, instead of
IntegrityError. Records that a first check against the cache returned refused
via the retirement path and was nearly reported as proof — the output looked
like success while testing nothing of the sort.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

workplans/STATE-WP-0083-forge-derived-projection-reset.md

@@ -518,3 +518,17 @@ created the same daily identifier on the same day.
 The reset must detect that a derived identifier belongs to another repository and
 refuse with that stated, rather than failing on a database constraint. A refusal
 is a decision the caller can act on; a constraint violation is a stack trace.
+
+**Fixed and verified live (2026-08-26, `main-5e4d0be`).** `net-kingdom` now
+returns `refused` with reason *"derived identifier already belongs to another
+repository"*, naming `ADHOC-2026-08-23` and the holder.
+
+Acknowledging retirements deliberately does not authorise a collision: those are
+different decisions — one says the work is gone, the other says take an
+identifier another repository owns — and conflating them would let a routine
+acknowledgement carry an identity change through. Covered by test.
+
+Worth recording how nearly this was mis-reported. A first check run against the
+*cache* returned `refused` and was almost reported as proof; it had exercised the
+retirement path instead, because the cache does not hold the colliding record.
+The output looked like success while testing nothing of the sort.