docs: complete retirement inbox parity gate and track reader cutover

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102

docs/retirement-cutover-slice-plan.md

@@ -32,8 +32,8 @@ No new permanent receiving authority belongs in State Hub during retirement.
 | A4 work/repo UI / 22 | hub-core projection + UI clients; RMGR-ADR-003 excludes a Repo Manager dashboard | No complete State Hub UI redirect receipt established | First prove backing reads; rollback redirects to the retained UI |
 | A5 topic spine / 8 | Published Repo Manager classification contract, accepted by HUB-WP-0004 | No complete State Hub caller-switch receipt established | Prove deployed consumer contract and parity; retain source-backed classification projection |
 | B1 catalogs / 34 | HUB-WP-0004/0005 receiving architecture and `/api/v2` absorption | Completion covers the Core Hub route groups, not every State Hub capability/registry route | Map each State Hub catalog to a deployed endpoint and migration receipt |
-| B2 messaging/interface log / 22 | Shared `hub_core.routers.messages` exists; State Hub interface log is a separate family | Live Hub Core OpenAPI has **no `/messages` or `/interface-changes`**. `/api/v2/interaction-events` exists but is not asserted equivalent | **Next bounded read slice:** STATE-WP-0079-T08. Owner must expose/identify the message read contract and history projection before a parity run or switch. Retain current reads/writer |
-| B3 telemetry / 32 | Shared `hub_core.routers.progress` exists; token/software catalogs need separate mappings | Live Hub Core OpenAPI has **no `/progress` or `/token-events`** | Owner runtime assembly/mapping plus historical identity/count parity; writer exclusivity and rollback receipts remain necessary |
+| B2 messaging/interface log / 22 | Native `/ports/messaging/messages` uses a distinct envelope; new authenticated `/ports/projections/statehub-inbox` preserves bounded State Hub history | T08 complete: 20-row import, six parity cases, private transport and disable/re-enable proof; no production reader switched | T09 / HUB-WP-0011: freshness, caller credentials and aliases before one reader switch. Interface log and writer cutover remain separate |
+| B3 telemetry / 32 | Native `/ports/events/progress` exists; token/software catalogs need separate mappings | Literal `/progress` and `/token-events` absence does not imply no native receiving contract | Map native semantics and historical identity/count parity; writer exclusivity and rollback receipts remain necessary |
 | B4 projection/policy / 20 | HUB-WP-0004/0005; policy publication belongs to policy-nexus | State Hub still serves its projection routes; no full family receipt established | Map individual projections and policy publication; retain source/runtime boundaries and current reads |
 | B5 hub UI / 17 | Hub Core runtime/console exists | Core Hub absorption does not establish replacement of State Hub dashboard pages | Prove A4/B1–B4 data contracts before redirect; retain UI rollback |
 | C1 execution / 13 | ACTIVITY-WP-0029 finished; Activity Core owns scheduling/ops_run | STATE-WP-0079 records launch-request rejection (410), replacement semantics, and corrected unconsumed requests | Verify every remaining execution caller uses the owner contract. Do not revive the obsolete launch queue for rollback |
@@ -54,11 +54,10 @@ No new permanent receiving authority belongs in State Hub during retirement.
 - Direct Nexus `/sbom/report/licences/` and `/sbom/snapshots/` returned 200 from
   the State Hub pod. Their State Hub meter entries are now retired. This does
   **not** delete the compatibility handlers or historical data.
-- Hub Core candidate runtime OpenAPI, read from its own pod loopback, has 31
-  paths and lacks the four State Hub families identified above. The State Hub
-  pod's probes to both Core Hub service addresses were connection-refused;
-  the deployments reported 1/1 ready. Transport readiness must be resolved as
-  part of any proxy-based pilot; this review did not diagnose its cause.
+- The earlier literal-prefix probe missed existing native messaging, event and
+  projection ports. The bounded inbox projection now has live parity evidence.
+  Scoped NetworkPolicy admission resolved State Hub-to-candidate transport;
+  unauthenticated requests from the source pod now reach the 401 boundary.
 - Session trace identifies ad-hoc legacy task reads in fluid-telegram and
   ops-warden. Their corrected canonical queries return 200 with 8 and 5 tasks.
   No evidence identifies the other historical callers yet.
@@ -71,11 +70,10 @@ Evidence: `docs/evidence/STATE-WP-0079-sbom-retirement-20260905.json` and
 1. T07: observe the remaining legacy readers with component attribution. The
    known caller repositories and bundled State Hub skill now prescribe canonical
    reads. Preserve the quiet clocks; do not exercise legacy URLs to test them.
-2. T08: obtain one **deployed message-read contract** from hub-core, including
-   access/transport and historical projection. Use the State Hub inbox reader as
-   the bounded parity client. Compare message IDs and read/archive flags against
-   one consistent snapshot; do not change message writes during this proof.
-   Only after parity and rollback evidence should a concrete reader switch run.
+2. T09 / HUB-WP-0011: establish monotonic freshness and stale-source behavior,
+   caller-specific credentials and canonical/alias scope before one production
+   inbox reader switch. T08's frozen snapshot parity and rollback are complete;
+   see `docs/evidence/statehub-inbox-pilot-20260905.md` and JSON receipt.
 3. RAIL-FAB-WP-0028-T01 remains the owner decision for runtime, persistent store,
    auth, backup/restore and deployment repository. Its T02–T04 deliver deployment,
    freshness and final direct-consumer receipts; no new Fabric authority here.