docs: record factory runtime proof and preserve historical identities

docs/assessments/2026-09-09-helixforge-runtime-transfer-and-legacy-ids.md

@@ -0,0 +1,69 @@
+# Factory runtime and legacy identity continuation
+
+The worker's missing sandbox-to-source join is implemented and locally proved.
+It captures a bounded Git bundle through sand-boxer's owner execution after rein
+cleanup, then imports the exact commit only after successful sandbox teardown
+and baseline, lease, ancestry, path-grant and object-bound checks. The real local
+bwrap/Glas/worker exercise passed; a lost terminal-close response replayed without
+rerunning the task. Queue and authoring were fixtures. No paid model request,
+factory delivery attempt or live G1/G2 acceptance is claimed.
+
+Native profile USD and turn limits now reach Claude CLI controls with version
+preflight and strict terminal cost/token/turn accounting. Invalid, missing or
+exhausted accounting refuses success. This removes the configured route's empty
+usage accounting; unconfigured legacy paths retain their existing behavior.
+It does not yet establish the proposed EUR 5/run, EUR 25/day, EUR 150 total
+factory envelope. Durable reservations, unknown-outcome recovery, conservative
+currency treatment and actual provider enforcement semantics remain required.
+
+Validation: rein-aharness 290 tests, Glas 133 tests; worker release-contract gate
+51 checks and recovery gate 13 checks pass. The contract/recovery checks overlap
+the main suite and are not additional delivery attempts. Matching Glas and
+sand-boxer revisions are pinned in rein's runtime lock. The protected runtime
+must be rebuilt/installed and admitted for the actual factory identity and host.
+[Runtime evidence](2026-09-09-runtime-transfer-evidence.json).
+
+The user-authorized low-cost side quest used gpt-5.6-luna for the historical-ID
+audit. Root review tightened the allowlist, retained global collision detection
+for canonical task IDs, replaced nonportable tests, and verified the production
+projection merge. Repo Manager now accepts the exact historical suffix IDs and
+38 parent-local task aliases. All 54 affected historical task UUIDs, parent
+bindings and statuses survived the production merge exercise against a current
+read-only Hub snapshot. Repo Manager's suite passed 169 tests.
+[Identity evidence](2026-09-09-legacy-identity-evidence.json).
+
+Only three missing qualified ad-hoc UUID fields were restored with Repo Manager;
+all three matched the UUID already held by the Hub. Existing IDs/UUIDs were not
+replaced. The machine canon and Repo Manager registry now agree on grandfather
+compatibility. Unknown aliases or missing local historical UUIDs still refuse.
+[Binding restoration](2026-09-09-legacy-binding-restoration.json).
+
+## Efficiency gained and remaining work
+
+The artifact change prevents successful sandbox work from being discarded and
+removes the need for manual commit recovery. Existing repository transactions,
+metrics, grants and close replay are reused. Native control/accounting provides
+a concrete input for the remaining spend admission. Historical compatibility
+removes the ordinary synchronization identity refusal without a renumbering
+campaign. No delivery-time or cost saving is claimed yet: the factory attempt
+ledger is empty and its fourteen-day measurement period has not begun.
+
+HFACT-WP-0001 remains the governing plan; reuse-surface remains the first internal
+capability, Railiance Fabric the later placement capability, and
+vergabe-teilnahme the primary customer service/UI repository. Continue:
+
+1. HFACT T01: durable daily/total spend reservation, unknown-outcome recovery,
+   provider semantics and final operating-owner acceptance of the concrete G0 packet.
+2. HFACT T03/T04: deployed PDP replay adoption, client-side/audit custody,
+   approval/native credential delivery, exact factory identity and Railiance placement.
+3. HFACT T05: install the matching protected runtime, then real model G1 and
+   natural Railiance claim/heartbeat/import/metrics/close G2 with recovery negatives.
+4. HFACT T06–T08: deliver the typed reuse-surface refusal, consume it from
+   vergabe-teilnahme, verify authorized release/recovery and measure fourteen days.
+
+RMGR-WP-0014 closes bounded identifier compatibility. CUST-IN-0017 remains open
+for duplicate/retired/orphan history and CUST/THE instruction-generation policy;
+HFACT T02 retains incomplete task-field projection and request-sensitive
+idempotency keys. Ordinary synchronization does not authorize historical row
+retirement. Exact push/projection receipts and the final session progress record
+supply completion evidence for this continuation.