fix: bound task identity ambiguity

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

docs/evidence/STATE-WP-0083-task-identity-audit-2026-08-31.json

@@ -0,0 +1,48 @@
+{
+  "schema": "state-hub.task-identity-audit.v1",
+  "observed_at": "2026-08-31",
+  "source": "primary State Hub task and workplan APIs",
+  "counts": {
+    "tasks": 6613,
+    "identified_tasks": 5831,
+    "duplicate_record_id_groups": 131,
+    "rows_in_duplicate_groups": 274,
+    "cross_workplan_groups": 131,
+    "same_workplan_groups": 0,
+    "cross_repository_groups": 31
+  },
+  "projection_classification": {
+    "one_current_claimant_with_retired_history": 104,
+    "retired_history_only": 15,
+    "multiple_non_retired_claimants": 12
+  },
+  "multiple_non_retired_claimants": [
+    {
+      "record_id_prefix": "CUST-WP-0010b-T",
+      "task_identity_groups": 2,
+      "workplan_slugs": [
+        "cust-wp-0010b",
+        "cust-wp-0010"
+      ],
+      "workplan_status": "finished",
+      "cause": "duplicate workplan projection over one backing file"
+    },
+    {
+      "record_id_prefix": "SECRETS-WP-0002-T",
+      "task_identity_groups": 10,
+      "workplan_slugs": [
+        "secrets-wp-0001",
+        "secrets-wp-0002"
+      ],
+      "workplan_status": "finished",
+      "cause": "duplicate workplan projection over one backing file"
+    }
+  ],
+  "decision": {
+    "retired_rows": "preserve as historical evidence; exclude from current projection ambiguity",
+    "duplicate_inside_matched_workplan": "refuse reset and report every claimant UUID",
+    "duplicate_inside_forge_projection": "refuse reset; require file-level disposition",
+    "new_task_identity_held_by_other_current_workplan": "refuse before insert",
+    "duplicate_across_retired_or_displaced_workplans": "does not block current projection reset"
+  }
+}