docs(CUST-WP-0054-T05): Phase 4 sweep checkout migration evidence

Record railiance01 clone tree, host_paths registration, and tooling for
bulk clone and path registration. Update T05 workplan with Phase 4 completion.

docs/state-hub-railiance01-cutover-phase4-2026-07-06.md

@@ -0,0 +1,83 @@
+# T05 Phase 4 Evidence — Sweep Checkout Migration (2026-07-06)
+
+Workplan: `CUST-WP-0054-T05`  
+Parent runbook: `docs/state-hub-railiance01-cutover-plan.md`  
+`no_secret_material_recorded: true`
+
+## Checklist
+
+| Step | Action | Result | Evidence |
+| --- | --- | --- | --- |
+| 4.1 | Clone root `/home/tegwick/<slug>` | **pass** | 74 host_paths registered; 73 new clones + 4 retried |
+| 4.2 | Bulk clone from git remotes | **pass** | `railiance01-bulk-clone-repos.sh` on railiance01 |
+| 4.3 | Register `host_paths` | **pass** | host=`239.62.205.92.host.secureserver.net` × 74 |
+| 4.4 | Sweep on railiance01 | **pass** | `POST /consistency/sweep/remote-all` exit_code=0 |
+| 4.5 | Writeback on railiance01 | **pass** | `the-custodian` fix: `push: pushed` from `/home/tegwick/` |
+
+**Phase 4 status: complete.**
+
+## Infrastructure changes
+
+### state-hub image (`main-phase4-sweep`)
+
+Imported to railiance01 k3s (local build; promote via Forgejo CI next):
+
+- Dockerfile: `git`, `openssh-client`
+- `STATE_HUB_SWEEP_HOSTNAME` env (Kubernetes pod hostname cannot contain dots)
+- `api/classification.py`: railiance01 path fallback for allowed-values YAML
+- `scripts/consistency_check.py`: `_sweep_hostname()` for `host_paths` resolution
+
+### Helm (`deploy/railiance/apps/helm/state-hub-values.yaml`)
+
+```yaml
+sweep:
+  enabled: true
+  hostname: 239.62.205.92.host.secureserver.net
+  hostPath: /home/tegwick
+  sshHostPath: /home/tegwick/.ssh
+```
+
+Deployment mounts host clone tree + SSH config; `postStart` sets
+`git config --global safe.directory '*'` (root in pod, tegwick-owned repos).
+
+### railiance01 host
+
+- SSH: `~/.ssh/config` with `forgejo-remote` + `gitea-remote` (workstation `id_gitea` copied)
+- Clone tree: `/home/tegwick/<slug>` (77 entries incl. tooling dirs)
+- Failed-then-fixed slugs: `ihp-railiance-probe`, `llm-connect`, `markitect-project` (from `markitect_project`), `vergabe_teilnahme` (from `vergabe-teilnahme`)
+
+## Tooling added (the-custodian)
+
+- `tools/railiance01-bulk-clone-repos.sh`
+- `tools/railiance01-register-host-paths.sh`
+
+## Verification
+
+```bash
+# Single-repo fix inside pod — railiance01 path, push succeeds
+kubectl -n state-hub exec deploy/state-hub -- \
+  python3 /app/scripts/consistency_check.py --repo the-custodian --fix \
+  --api-base http://127.0.0.1:8000
+# → repo_path: /home/tegwick/the-custodian, push: pushed
+
+# Full sweep canary
+curl -s -X POST http://127.0.0.1:8000/consistency/sweep/remote-all \
+  -H "Content-Type: application/json" \
+  -d '{"max_seconds":300,"source":"phase4-canary"}'
+# → exit_code: 0, 8 repos processed (budget-limited first pass), skipped_missing: 0
+```
+
+`.custodian-brief.md` on railiance01 (`17:08 UTC`) is newer than workstation (`15:27 UTC`).
+
+Workstation `host_paths[bnt-lap001]` retained for dev; production sweep resolves
+`host_paths[239.62.205.92.host.secureserver.net]`.
+
+## Follow-ups (Phase 5)
+
+- Promote `main-phase4-sweep` image via Forgejo CI (replace hand-imported tag)
+- Allow longer first-pass sweep budget or multiple cron cycles to reconcile all 74 repos
+- activity-core scheduled sweeps should recover (were failing with exit_code=1 pre-Phase-4)
+
+## Next: Phase 5
+
+48–72h stabilization before coulombcore hub teardown.