STATE-WP-0073: meter delta zero, remote audit, k8s prompt rollout evidence

Post-0072 8h capture shows zero legacy REST calls on hot keys. Document remote
sweep, railiance01 ConfigMap rollout, and gitea-remote sync blocker.

docs/evidence/legacy-meter-delta-20260709.md

@@ -0,0 +1,56 @@
+# Legacy-meter delta — post STATE-WP-0072 (2026-07-09)
+
+**Workplan:** `STATE-WP-0073` T01  
+**Baseline:** `legacy-meter-weekly-review-20260709.json` (first capture, window ending 23:48Z)  
+**Follow-up capture:** same file refreshed 07:12Z (window 23:12Z → 07:12Z)
+
+## 8h window comparison (hot REST keys)
+
+| Key | Baseline (23:48Z window) | Post-0072 (07:12Z window) |
+| --- | ---: | ---: |
+| `GET /workstreams/{workstream_id}` | 7,653 | **0** |
+| `GET /workstreams/{id}/dependencies/` | 3,892 | **0** |
+| `GET /workstreams/` | 1,752 | **0** |
+| `GET /tasks/?workstream_id` | 577 | **0** |
+| `POST /tasks/ workstream_id` | 5 | **0** |
+
+All phase-1 REST keys are **retirement candidates** in the 07:12Z capture (10 total).
+
+## Interpretation
+
+The baseline window (15:48–23:48Z on 2026-07-08) predates full caller remediation
+effect; the shifted 8h window (23:12Z–07:12Z) shows zero measured legacy REST
+usage. Continue 2–3 captures per day to accumulate **seven consecutive** zero
+windows before `STATE-WP-0070` T02 410 retirements.
+
+## Remote audit (STATE-WP-0073 T02)
+
+- `bridge status`: railiance01 + coulombcore tunnels **connected**.
+- WSL `POST /consistency/sweep/remote-all`: **exit_code 0**, 10 repos processed
+  (progress `754a5c17`, 2026-07-09T07:23Z).
+- WSL `state-hub@8b6b28f` (post-sweep); hub API healthy.
+
+### Host SHAs (SSH audit)
+
+| Host | state-hub | activity-core | the-custodian | Notes |
+| --- | --- | --- | --- | --- |
+| WSL workstation | `8b6b28f` | `b59bf92` | `6d10190` | canonical post-0072 |
+| railiance01 | — | `1a06368` (host checkout) | `d4b14a3` | pulls `gitea-remote`; behind forgejo |
+| coulombcore | — | `3cc39f3` | — | `gitea-remote` at `34c6492` on fetch |
+
+**Blocker:** `gitea-remote` (coulombcore Forgejo `:30022`) rejects push with
+`Permission denied (publickey)` from WSL. Production host checkouts track
+`gitea-remote`, not `forgejo-remote` where STATE-WP-0072 landed. Operator
+action: mirror/sync coulomb ↔ railiance forge or repoint host remotes.
+
+## K8s prompt rollout (STATE-WP-0073 T03)
+
+- Cluster ConfigMap `activity-core/actcore-custodian-runtime` updated via scp +
+  `kubectl apply -n activity-core` from `b59bf92` manifest.
+- Verified prompt lines: `/workplans/index`, `GET .../workplans/index`.
+- Restarted `actcore-worker`, `actcore-api`, `actcore-event-router`.
+
+## Next meter gate (T04)
+
+First key ready when seven consecutive 8h windows show zero:
+`POST /workstreams/{workstream_id}/dependencies/` (already candidate in both captures).