feat(legacy-meter): scale retirement quiet period to call volume

A clean review window only proves an interface was silent for that window.
For a heavily used interface that is weak evidence -- an infrequent caller
can fall outside the window entirely, so the interface reads as retirable
while still having consumers.

_retirement_state now also requires silence since last_seen_at, scaled by
all-time volume (RETIREMENT_QUIET_LADDER): 7d under 100 calls, 30d under
10k, 60d above. Existing guards (retired / manual hold / replacement ref /
replacement verified / in-window traffic) still take precedence.

On the 2026-08-20 capture this makes 15 of 19 legacy interfaces retirable
and holds 4: the three six-figure /workstreams/ read paths, and
GET /tasks/?workstream_id which still has live traffic.

Unblocks the bulk of Wave E2 in the cutover slice plan. 7 new tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/retirement-cutover-slice-plan.md

@@ -213,21 +213,43 @@ retirement evidence. Corrected capture:
 `docs/evidence/legacy-meter-weekly-review-20260820.json` — 18 candidates of 20
 interfaces, `GET /tasks/?workstream_id` correctly excluded.
 
-**Still open — E2 remains gated.** A 7-day window is not sufficient for
-high-volume interfaces, and two false positives survive it:
+**Candidate rule tightened (2026-08-20).** `_retirement_state` now requires a
+quiet period scaled to all-time call volume, because a clean window only proves
+silence for that window — for a heavily used interface an infrequent caller can
+fall outside it entirely. `RETIREMENT_QUIET_LADDER` in
+`api/services/legacy_meter.py`:
 
-- `GET /progress/?workstream_id` — last seen 2026-08-12T08:55Z, roughly 14 hours
-  before the window opened
-- `GET /workstreams/` — last seen 2026-08-10, 9 days quiet, 144 086 all-time calls
+| All-time calls | Days since `last_seen_at` required |
+| --- | --- |
+| 0 | none — never used |
+| 1 – 99 | 7 |
+| 100 – 9 999 | 30 |
+| 10 000+ | 60 |
 
-`last_seen_at` is unbounded by the window and is the stronger signal; the
-candidate rule currently ignores it. Before E2 proceeds, the rule should require
-a minimum quiet period scaled to call volume — an interface with six figures of
-traffic needs materially more than seven silent days. That is a service-side
-change in `api/services/legacy_meter.py` and belongs to T05, not here.
+Applied to the 2026-08-20 capture this splits the 19 legacy interfaces cleanly:
 
-Everything else on the list was last seen 2026-07-31 or earlier, most in early
-July, so the bulk of E2 is well-evidenced once the rule is tightened.
+**15 retirable** — all four `workstream` MCP tools, the `state://` resource, and
+the low-volume REST aliases, plus `PATCH /workstreams/{id}` (571 calls, quiet
+42d), `POST /workstreams/` (824, quiet 42d) and
+`POST /workstreams/{id}/dependencies/` (4 971, quiet 49d).
+
+**4 held:**
+
+| Interface | All-time calls | Reason |
+| --- | --- | --- |
+| `GET /tasks/?workstream_id` | 595 | traffic inside the window |
+| `GET /workstreams/` | 144 086 | quiet 9d of 60d |
+| `GET /workstreams/{id}` | 511 406 | quiet 19d of 60d |
+| `GET /workstreams/{id}/dependencies/` | 255 865 | quiet 42d of 60d |
+
+E2 can therefore proceed for the 15, which is the bulk of the slice. The four
+held are the three six-figure read paths and the one with live traffic — exactly
+the set where a false retirement would hurt most. They clear on their own as the
+quiet counter runs, provided no new traffic arrives; the earliest,
+`GET /workstreams/{id}/dependencies/`, needs 18 more silent days.
+
+Re-check before executing E2: the ladder is evaluated at review time, so a
+capture older than the retirement decision is not evidence for it.
 
 ## Keep — 43 items