fix(retirement): close projection and launch contract gaps

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b7c-1c49-76a0-955a-49e7b3ddfc0d

docs/sealed-prederivation-projection-repair.md

@@ -0,0 +1,45 @@
+# Sealed pre-derivation projection repair
+
+This temporary compatibility surface supports the deterministic-identifier
+cutover in `STATE-WP-0079-T04`. It restores one exact random-UUID workplan unit
+into a partial State Hub projection so the existing transactional migration can
+replace the old UUIDs with their deterministic UUIDv5 targets.
+
+Ordinary `statehub fix-consistency` behavior is unchanged: a missing random UUID
+remains a non-fixable C-03 stale reference.
+
+## Endpoint
+
+`POST /identifier-migrations/sealed-projection-repairs`
+
+The request must contain:
+
+- the complete sealed Repo Manager migration plan;
+- the exact plan SHA-256, repository slug, pinned 40-character Git revision,
+  and source fingerprint recorded in that plan;
+- `source_clean`, `source_synchronized`, and `primary_confirmed` set to true;
+- one explicit authoritative workplan projection and every `replace` task
+  mapped to the same sealed workplan file; and
+- a non-secret projection identity for the receipt.
+
+The workplan projection supplies its canonical `record_id`, exact old UUID,
+topic UUID, projection slug, title, status, and optional projection fields.
+Each task supplies its canonical `record_id`, exact old UUID, title, state, and
+optional projection fields. Parentage uses `parent_record_id`, never a path- or
+position-derived identity.
+
+The server rejects source drift, plan-seal drift, repository/topic mismatch,
+partial old-row presence, any derived-target presence, alias conflicts, slug
+conflicts, incomplete task units, and non-identical retries. The workplan and
+tasks are created in one database transaction. An exact retry returns a
+`verified_noop` receipt.
+
+The receipt contains no source content or secrets: repository/projection
+identity, canonical IDs and old UUIDs, plan/source seals, outcome, and a UTC
+observation timestamp.
+
+## Removal condition
+
+Remove this endpoint with the identifier-migration executor after every sealed
+pre-derivation unit has either completed deterministic cutover or been rejected
+and residual-owned. It is not a general projection-import API.