CUST-WP-0051: T04/T05 done; end-of-day checkpoint refresh (9 workplans finished)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/infrastructure-stabilization-pickup-checkpoint.md

@@ -3,17 +3,52 @@
 Updated: 2026-07-02
 Coordinator workplan: `CUST-WP-0051`
 
-## Operator Pickups Ready Now (updated 2026-07-02 afternoon)
+## End-of-Day Checkpoint (2026-07-02 evening)
 
-All five morning gates are closed (deploy, CCRs, audit evidence, applier
-proof, unseal-wiring review). The issue-core REST emission lane is live
-end-to-end (Gitea issue `176`), the llm-connect OpenRouter lane is active,
-and the credential lifecycle runbook exists. The single open operator item is
-the **Core Hub staging deployment decision set** (CUST-WP-0025-T16 /
-CORE-WP-0004): target cluster (recommended CoulombCore), staging secret
-posture (recommended generated K8s Secrets), and image path (recommended
-Gitea registry — needs explicit approval because `coulomb` org packages are
-public). Image `core-hub:ba32597` is pre-built locally; registry auth exists.
+Nine workplans finished today and the Core Hub replacement lane was driven
+from no deployed evidence to real data migrated with cutover blockers named.
+
+**Finished this session:** ARTIFACT-STORE-WP-0007, RAIL-BS-WP-0008,
+RAIL-BS-WP-0009, ACTIVITY-WP-0016, RAILIANCE-WP-0008, ISSUE-WP-0003,
+CORE-WP-0004 (+ CUST-WP-0053 earlier). RAILIANCE-WP-0009/0010 are done bar
+ops-warden catalog confirmation; NET-WP-0020-T02 is wired (needs a greenfield
+slate for live proof).
+
+**Live infrastructure now running (was blocked at session start):**
+
+- Daily-triage robustness deployed on railiance01; bounded top-7 proven
+  (State Hub event `24d2d321`). Three scheduled runs (Jul 3–5) close
+  ACTIVITY-WP-0006 calibration by themselves.
+- Credential lanes active: issue-core (`CCR-2026-0002`) and llm-connect
+  OpenRouter (`CCR-2026-0003`), applied via the constrained prod-applier,
+  both ExternalSecrets syncing. Lifecycle runbook at
+  `railiance-platform/docs/credential-lane-lifecycle-runbook.md`.
+- issue-core REST emission live end-to-end (Gitea issue `176`) over a new
+  cross-machine ops-bridge lane (`remote_host` feature added to ops-bridge).
+- Core Hub staging deployed on CoulombCore (`core-hub-staging`, image
+  `gitea.coulomb.social/coulomb/core-hub:3ed8531`): deployed API smoke +
+  activity-core sink smoke both green; full Inter-Hub data (28 records)
+  migrated idempotently.
+
+**Open items requiring a decision (not agent-executable):**
+
+1. **Core Hub cutover prerequisites (core-hub owner).** T03 dual-run found (a)
+   a blocking catalog gap — migrated widgets reference 7 `ops-*` widget types
+   absent from Core Hub's seeded registries because the migration bundle
+   omits the type registries; design choice: extend the bundle schema vs.
+   seed the vocabularies; (b) `/api/v2/hubs` auth-posture break (public →
+   protected). Both on `CORE-WP-0005-T04`; flagged via hub message `4b859f9b`.
+2. **Core Hub production cutover** (`CORE-WP-0005-T04`): operator approval +
+   rollback plan, after prerequisite 1. Then `CORE-WP-0007` Haskell
+   retirement unblocks.
+3. **State Hub pragmatic cutover** (`CUST-WP-0011-T07`): still the standing
+   operator freeze/restore/redirect approval (unchanged from prior board).
+4. **ops-warden confirmations** close `RAILIANCE-WP-0009-T06` /
+   `RAILIANCE-WP-0010-T06` (no custodian action).
+5. **NET-WP-0020-T02** greenfield live proof needs a rebuild slate.
+
+Prior morning decision set (Core Hub staging cluster/secrets/image) is
+resolved: CoulombCore + generated Secrets + Gitea registry, all executed.
 
 ## Original morning list (2026-07-02, all closed)