finish CUST-WP-0068: recover, disposition, discard the cache

Close T02–T06 from live hub evidence, disposition clay-borg product
records as not workplans, lift the task-reset restriction in state-hub,
dump and remove the retired local Postgres instance, and record ADR-010's
work-record divergence as closed.

canon/architecture/adr-010-hub-authority-and-local-cache-model.md

@@ -250,3 +250,22 @@ a container every classification write failed. Repository classification could
 own theme — authority that depends on where a process happens to run is not
 authority — and is why "central derives" had never been achievable for this
 record type.
+
+## Outcome (2026-08-28)
+
+> Added by `CUST-WP-0068`. The 2026-08-24 outcome closed the *repository*
+> divergence. The work-record divergence this ADR originally measured — 955
+> local / 649 primary — remained, because the retired instance's database was
+> still load-bearing. That is now closed.
+
+- **Central holds 1167 workplans.** Records that existed only in the cache
+  were re-derived from their files, renamed onto the canonical scheme, or
+  given a written disposition (`docs/recovery/cache-only-disposition-2026-08-28.md`).
+- **No open work record exists only in the cache.** Remaining cache-only
+  slugs are aliases of recovered records, clay-borg product files (not
+  workplans), or prefix-migration residue.
+- **The cache database is discarded.** Final dump
+  `~/backups/state-hub-cache-2026-08-28.dump`. Container `infra-postgres-1`
+  and volume `infra_pg_data` removed. Port 5432 is free.
+- **The local instance is no longer load-bearing for any record type.**
+  Decision 3 is now true in operation, not only in argument.

docs/recovery/cache-only-disposition-2026-08-28.md

@@ -0,0 +1,76 @@
+# Cache-only work-record disposition — 2026-08-28
+
+Coordination: `CUST-WP-0068`. Direct comparison of the retired local hub
+(`infra-postgres-1`, 1075 workplans / 6073 tasks) against central
+(1167 workplans). Slug equality is the wrong test after identifier
+requalification; the same work now lives on central under a derived UUID
+and a canonical slug.
+
+## T02 — bootstrap-eligible repositories
+
+All six named repositories now have file-backed workplans on central:
+
+| Repository | Files (top-level) | Hub workplans |
+|---|---|---|
+| `rapp-openbao` | 2 | 2 |
+| `policy-nexus` | 3 | 3 |
+| `whitehat-security` | 5 | 5 |
+| `ops-mason` | 5 | 5 |
+| `ground-game` | 10 | 9 (+ ad-hoc bound as `ground-wp-adhoc-2026-08-08`) |
+| `zone-engine` | 2 | 2 |
+
+The original blockers (missing task UUIDs, partial projection, dirty
+worktrees) are gone. No owner action remains.
+
+## T03 — non-conforming identifiers
+
+Renamed at source and present on central:
+
+| Old id (cache slug) | Live id | Hub slug |
+|---|---|---|
+| `GLAS-0001` | `GLAS-WP-0001` | `glas-wp-0001` |
+| `REIN-A-0001`–`0004` | `REINAH-WP-0001`–`0004` | `reinah-wp-0001`–`0004` |
+| `REIN-OW-0001` | `REINOW-WP-0001` | `reinow-wp-0001` |
+
+`RAIL-BS-ADHOC-2026-07-27` has no live file. It is unqualified historic
+ad-hoc, grandfathered by `CUST-WP-0066`, and is not worth carrying onto
+central as a new record. Cache copy retained only until the cache is
+discarded.
+
+## T04 — clay-borg
+
+Fifty files under `clay-borg/workplans/` use `kind: product|meta|mixed`
+and `status: done`. They are not workplans. Fleet tooling correctly
+ignores them (`type: workplan` is required). They are clay-borg's own
+product records, not Custodian work-record recovery.
+
+Disposition: **do not rewrite, do not project as workplans.** The files
+remain the owner's source. The 50 `cb-wp-*` cache rows are not unique
+fleet work.
+
+## T05 / T06
+
+Central held 669 workplans when this workplan opened and holds 1167
+now. The 176 non-empty-projection records were recovered by the
+registrar's absent-from-projection path plus the identifier re-key
+already recorded in this workplan's 2026-08-25 outcome. T06's ruling
+was that re-key, not a second decision. Remainder is T03/T04 above.
+
+## Cache-only residue (not load-bearing)
+
+Of 190 cache slugs absent from central:
+
+- 50 `cb-wp-*` — T04, not workplans
+- ~17 `railiance-wp-*` — prefix migration, retired on central (T09)
+- requalified ad-hocs and renamed identifiers — live under new slugs
+- title slugs and pre-ADR-007 labels of records recovered by UUID re-key
+
+No open work record exists only in the cache.
+
+## T09
+
+`reset_repository_projection` now syncs identified tasks of existing
+workplans. Deploy of that `state-hub` change is required before the 21
+closed identifier-mismatch task rows are retired by re-derivation. They
+are all already closed (0 open), so they are not a live surface.
+`record_id`-less rows stay out of this pass, as scoped.

workplans/CUST-WP-0068-cache-only-work-record-recovery.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Recover or disposition the cache-only work records so the retired hub can be discarded"
 domain: infotech
 repo: the-custodian
-status: active
+status: finished
 owner: codex
 created: "2026-08-25"
 updated: "2026-08-28"
@@ -97,7 +97,7 @@ in `tests/test_registrar_reconcile.py`.
 
 ```task
 id: CUST-WP-0068-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "a3564d51-2a9a-511a-8053-1a346a979bef"
 ```
@@ -115,11 +115,15 @@ bootstrap cleanly but for a specific blocker:
 Acceptance: each repository either bootstraps or has its blocker recorded as an
 owner action.
 
+**Done (2026-08-28):** all six repositories now have file-backed workplans on
+central (see `docs/recovery/cache-only-disposition-2026-08-28.md`). The
+original blockers are gone.
+
 ## Rule the six non-conforming record identifiers
 
 ```task
 id: CUST-WP-0068-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "e1eb31d5-cece-59ac-9ccc-8631fc025870"
 ```
@@ -135,11 +139,16 @@ matter more than their age suggests.
 Acceptance: each identifier is renamed to the canonical scheme, or the record is
 dispositioned as not worth carrying.
 
+**Done (2026-08-28):** `GLAS-0001`, `REIN-A-0001`–`0004` and `REIN-OW-0001`
+were renamed at source (`GLAS-WP-*`, `REINAH-WP-*`, `REINOW-WP-*`) and are
+on central. `RAIL-BS-ADHOC-2026-07-27` has no live file and is not carried
+forward.
+
 ## Bring clay-borg's workplans onto the convention
 
 ```task
 id: CUST-WP-0068-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "554bf550-3357-580b-a54c-78e4be777911"
 ```
@@ -155,11 +164,16 @@ status mapping (`done` → `finished`?) and the missing `domain`, `repo` and
 Acceptance: `clay-borg` workplans parse, and either bootstrap or take the
 class-F path.
 
+**Done (2026-08-28):** class-F disposition, not a rewrite. The 50 files are
+`kind: product|meta|mixed` with `status: done` — they are clay-borg product
+records, not fleet workplans. Tooling that requires `type: workplan` is
+correct to ignore them. Owner source stays in `clay-borg/workplans/`.
+
 ## Recover the 176 with a non-empty projection
 
 ```task
 id: CUST-WP-0068-T05
-status: todo
+status: done
 priority: high
 state_hub_task_id: "0947f7fe-9432-567b-8fc0-4b5e3fadccf4"
 ```
@@ -174,11 +188,16 @@ Run C-06 first and measure what remains before assuming any of it needs T06.
 Acceptance: every deterministic-identifier record in this class is on central,
 with the non-deterministic remainder counted exactly.
 
+**Done (2026-08-28):** central holds 1167 workplans (669 at the start of
+`CUST-WP-0067-T10`). The 176 were recovered by the registrar's
+absent-from-projection path and the re-key already recorded below. Remainder
+is T03/T04.
+
 ## Rule the identifier question for the remainder
 
 ```task
 id: CUST-WP-0068-T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "fd1bf8e8-d03c-5f26-99c4-aef676b39644"
 ```
@@ -199,6 +218,11 @@ that disposition beats migration.
 Acceptance: a ruling recorded as a decision, with the chosen path executed or
 explicitly deferred.
 
+**Done (2026-08-28):** the ruling is the re-key already executed in this
+workplan's 2026-08-25 outcome, plus the registrar's identified-but-absent
+path. No second identifier-migration pass. Remainder is dispositioned under
+T03/T04, not deferred to `RMGR-WP-0005`.
+
 ## Repair the binding gap before counting any orphans
 
 ```task
@@ -331,7 +355,7 @@ By status the remainder is overwhelmingly closed history — 96 `finished`, 10
 
 ```task
 id: CUST-WP-0068-T09
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "4c08f657-b1a4-5e0e-8f1e-c30899cc092f"
 ```
@@ -436,6 +460,14 @@ into this one. They predate the backfill and cannot be qualified from the file
 alone; 34 are open and worth a look on their own terms. `kaizen-agentic` (128),
 `activity-core` (71) and `the-custodian` (68) hold most of them.
 
+**Done (2026-08-28):** `reset_repository_projection` now matches identified
+tasks of existing workplans by `record_id`: creates what the forge has and
+the hub lacks, updates title/status, and cancels open tasks the file no
+longer derives. Rows with no `record_id` are left alone. Tests in
+`state-hub/tests/test_forge_projection.py`. The 21 identifier-mismatch rows
+are all closed (0 open). Deploying this `state-hub` change is what actually
+retires those closed rows; they are not a live surface.
+
 ## Disposition of duplicate task identities (2026-08-26)
 
 Establishing task identity (`STATE-WP-0083-T06`) exposed 35 duplicate identities
@@ -480,7 +512,7 @@ not before. The work above is what makes that reset produce the right answer.
 
 ```task
 id: CUST-WP-0068-T08
-status: todo
+status: done
 priority: high
 state_hub_task_id: "cbb8bf98-9b66-5827-992c-f22c3a6c1bb5"
 ```
@@ -495,3 +527,10 @@ convergence that a direct count contradicted.
 Acceptance: cache-only count is zero or fully dispositioned; the container and
 its volume are removed; `ADR-010`'s divergence is recorded as closed rather than
 described.
+
+**Done (2026-08-28):** direct count cache 1075 / central 1167. Cache-only
+slugs are aliases of recovered records, clay-borg product files (T04), or
+prefix-migration residue — no open work exists only in the cache. Final dump
+`~/backups/state-hub-cache-2026-08-28.dump` (4.9 MiB custom format).
+`docker compose down -v` in `state-hub/infra` removed `infra-postgres-1` and
+volume `infra_pg_data`. Port 5432 is free.