fix: bound task identity ambiguity

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

workplans/STATE-WP-0083-forge-derived-projection-reset.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: infotech
 created: "2026-08-25"
-updated: "2026-08-25"
+updated: "2026-08-31"
 related:
   - CUST-ADR-012
   - CUST-WP-0068
@@ -376,6 +376,27 @@ The primary-only HTTP surface has explicit plan-hash confirmation and a reverse
 operation for a failed file phase. This does not resolve the 35 duplicate
 canonical task identities, so T02 remains `progress`.
 
+**Duplicate identity disposition (2026-08-31).** A fresh primary audit found
+131 duplicate task `record_id` groups across 274 rows. The global count is not
+the reset safety boundary: 104 groups have exactly one current projection
+claimant plus retired history, and 15 exist only under retired workplans. Those
+rows are retained as history and do not compete with the matched current
+workplan.
+
+The remaining 12 groups are two duplicated finished workplan projections:
+`CUST-WP-0010b-T01..T02` and `SECRETS-WP-0002-T01..T10`. They must be resolved
+by retiring the displaced workplan projection, not by deleting or re-keying its
+tasks. Evidence:
+`docs/evidence/STATE-WP-0083-task-identity-audit-2026-08-31.json`.
+
+The diff now reports an explicit `ambiguous` class instead of silently choosing
+the last row in a dictionary. Reset refuses duplicate identities declared by
+the forge, duplicate identified rows inside the matched current workplan, and
+any task creation whose canonical id or derived UUID is held by another current
+workplan. These checks are batched; retired/displaced workplan tasks are outside
+the current matching set and remain preserved. Live deployment and a clean
+repository diff remain before T02 can close.
+
 
 ## Restore a migration mechanism for central