fix(projection): recognise a re-key by the slug, not the UUID version

The previous commit tested UUID version as a proxy for "identity is derived".
It covers 19 of the 44 ad-hoc rows; the other 25 are legacy v4, so they kept
path matching and would have been updated in place — slug still
`adhoc-2026-07-02` while the file says `ADAPTIVE-WP-ADHOC-2026-07-02`. The
divergence would have persisted, and silently, for most of the records this
was meant to fix.

The distinction that actually matters is whether the row's slug is a
work-record identifier. A row whose slug is an identifier claims to be that
record, so a different derived identifier for the same file means two records.
A row whose slug is a title — `three-phoenix-ha-cluster` for RCLUSTER-WP-0007 —
never claimed one: those are hub-first rows from before ADR-001 where the
backing path is the only link there has ever been, and path matching is all
that holds them together.

730 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

api/services/forge_projection.py

@@ -32,6 +32,26 @@ _HEADING_RE = re.compile(r"^(#{1,4})\s+(.+?)$", re.MULTILINE)
 DEFAULT_FORGE_BASE = "https://forgejo.coulomb.social/coulomb"
 
 
+_IDENTIFIER_SLUG = re.compile(
+    r"^[a-z0-9-]*-wp-\d{3,}(?:-t\d{2})?$"          # PREFIX-WP-0001, -T01
+    r"|^[a-z0-9-]*adhoc[a-z0-9-]*?-\d{4}-\d{2}-\d{2}(?:-t\d{2})?$"  # daily ad-hoc, qualified either side
+)
+
+
+def _slug_is_identifier(slug: str) -> bool:
+    """Whether a row's slug is a work-record identifier or a title slug.
+
+    This is what separates a re-key from a rename when the path cannot. A row
+    whose slug is an identifier is *claiming* to be that record, so if the forge
+    derives a different identifier for the same file, they are two records and
+    the old one retires. A row whose slug is a title (`three-phoenix-ha-cluster`
+    for `RCLUSTER-WP-0007`) never claimed one: those are hub-first rows from
+    before ADR-001, where the backing path is the only link there has ever been,
+    and path matching is the only thing that can hold them together.
+    """
+    return bool(_IDENTIFIER_SLUG.match((slug or "").strip().lower()))
+
+
 def _identity_is_derived(row: Any) -> bool:
     """Whether this row's UUID was derived from its identifier (ADR-007).
 
@@ -641,7 +661,12 @@ async def reset_repository_projection(
     for row in rows:
         key = (row.slug or "").strip().lower()
         if key not in want:
-            if _identity_is_derived(row):
+            if _identity_is_derived(row) or _slug_is_identifier(row.slug or ""):
+                # ADR-007: a record identified by an identifier *is* that
+                # identifier. Two cases reach here — a derived (v5) row, and a
+                # legacy row whose slug is still a work-record identifier. Both
+                # are re-keys, not renames.
+                #
                 # ADR-007: a derived record's identity *is* a function of its
                 # identifier, so a changed identifier means a different record —
                 # the old one retires and the new one is created. Matching it to