docs: record policy router import seam

docs/hub-core-extraction-boundary.md

@@ -94,6 +94,9 @@ Current implementation status:
 - 2026-06-07: T08 router imports started. State Hub now mounts the hub-core
   messages router factory with State Hub's own `AgentMessage` model injected,
   proving the router seam can avoid cross-metadata SQLAlchemy model imports.
+- 2026-06-07: T08 policy router import completed. State Hub now mounts the
+  hub-core policy router factory with local path validation plus read/write
+  callbacks, proving non-DB routers can move behind callback seams.
 
 ## Extract Now
 
@@ -201,7 +204,7 @@ to import it:
 
 ## Next Step
 
-Continue T08 by applying the host-model injection pattern to the next
+Continue T08 by applying host-model injection or callback seams to the next
 lowest-risk generic routers. Repos, domains, TPSC, progress, and capability
 requests each need a small dependency-injection review before replacement. Do
 not rename State Hub to dev-hub until T05-T08 prove the shared package

workplans/CUST-WP-0025-fos-hub-bootstrap.md

@@ -286,6 +286,14 @@ that avoids importing hub-core SQLAlchemy metadata into State Hub. Verification:
 hub-core `pytest` passed with 16 tests; State Hub import/core-router/MCP smoke
 focused tests passed with 70 tests.
 
+Implementation slice 5 (2026-06-07): extended
+`hub_core.routers.policy.create_policy_router` with an optional update callback,
+then replaced State Hub's local `api.routers.policy` implementation with the
+hub-core factory while keeping State Hub's policy path validation/read/write
+callbacks local. Verification: hub-core `pytest` passed with 17 tests; State
+Hub policy/import/MCP/core-router focused tests passed when split to avoid live
+API test-DB contention.
+
 ### T09 — Rename MCP server state-hub to dev-hub
 
 ```task