STATE-WP-0072: remediate remaining workstream HTTP callers

Research sweep captured in research/20260709-workstream-caller-sweep.md.
Migrate dashboard detail tasks query, custodian_cli POST bodies, and
onboarding curl to workplan-first paths; re-capture 8h legacy-meter evidence.

docs/evidence/legacy-meter-weekly-review-20260709.json

@@ -1,12 +1,12 @@
 {
-  "captured_at": "2026-07-08T23:35:18.486286+00:00",
+  "captured_at": "2026-07-08T23:48:41.675130+00:00",
   "api_base": "http://127.0.0.1:8000",
   "workplan": "STATE-WP-0070",
   "retired_interfaces": [],
   "weekly_review": {
-    "generated_at": "2026-07-08T23:35:18.459774Z",
-    "window_start": "2026-07-08T15:35:18.219148Z",
-    "window_end": "2026-07-08T23:35:18.219148Z",
+    "generated_at": "2026-07-08T23:48:41.652056Z",
+    "window_start": "2026-07-08T15:48:41.473474Z",
+    "window_end": "2026-07-08T23:48:41.473474Z",
     "cadence": "weekly",
     "activity_core_handoff": {
       "activity_id": "statehub-legacy-interface-review",

docs/evidence/workstream-caller-inventory-20260709.md

@@ -0,0 +1,78 @@
+# Workstream caller inventory — 2026-07-09 (second sweep)
+
+Follow-up after `STATE-WP-0071` railiance01 deploy. Eight-hour legacy-meter window
+(2026-07-09) still shows heavy `GET /workstreams/*` traffic (~1.7k in 8h for
+`GET /workstreams/` alone); attribution remains mostly `unknown`.
+
+## Newly found — actionable HTTP callers
+
+| Caller | Repo | Legacy usage | Fix |
+| --- | --- | --- | --- |
+| `dashboard/src/workstreams/[id].md` | state-hub | `GET /tasks/?workstream_id=` | → `?workplan_id=` |
+| `custodian_cli.py` | state-hub | `POST /tasks/` body `workstream_id` (onboarding, add-task) | → `workplan_id` |
+| `runtime/prompts/daily_statehub_wsgi_triage.md` | the-custodian | Instructs `GET /workstreams/workplan-index` (**410**) and `?workstream_id=` enrichment | → `/workplans/index`, `?workplan_id=` |
+| `k8s/railiance/21-custodian-runtime.yaml` | activity-core | Same stale prompt text projected to cluster | Roll after prompt fix |
+| `wise-validator/reporter.py` | wise-validator | `POST /progress/` body `workstream_id` | → `workplan_id` |
+| `session_memory/curate/decisions.py` | agentic-resources | Dual-write `workplan_id` + `workstream_id` on decisions | Drop `workstream_id` key |
+
+## Newly found — response / field aliases (no extra REST path)
+
+| Caller | Repo | Notes |
+| --- | --- | --- |
+| `context_resolvers/state_hub.py` `_safe_next_step` | activity-core | Dual-keys `workplan_*` + `workstream_*` in digest JSON (downstream prose only) |
+| `k8s/railiance/20-runtime.yaml` sink configs | activity-core | `workstream_id:` in YAML sink scope — read bridge in `state_hub_write.py` |
+| `schedule_health.py` | activity-core | Accepts legacy param; prefers `workplan_id` |
+| `dashboard/src/components/field-help.js` | state-hub | Nav links `/workstreams/{id}` (UI route compat, not API) |
+| `api/routers/state.py` | state-hub | Response fields `workstream_id`, `open_workstreams` in `/state/summary` |
+| `runtime/context.py` | the-custodian | Reads `open_workstreams` from summary (response field, not REST caller) |
+
+## Confirmed migrated (no change since 2026-07-08 inventory)
+
+- `scripts/consistency_check.py`, `cleanup_stale_tasks.py`, `validate_repo_adr.py` → `/workplans/`
+- `custodian_cli.py` list/CRUD paths → `/workplans/` (body fields still legacy — see above)
+- Dashboard list pages (`workstreams.md`, `extensions.md`, `tasks.md`, …) → `apiFetch("/workplans/")`
+- Dashboard data loaders → `GET /workplans`
+- `mcp_server/server.py` REST calls → `/workplans` (tool/param aliases remain by design)
+- `activity-core/context_resolvers` index/detail/tasks fetches → `/workplans/*`
+- `can-you-assist/shell_session.py` orientation → `GET /workplans/?`
+
+## Intentional legacy (meter-gated — STATE-WP-0070)
+
+| Surface | Notes |
+| --- | --- |
+| `api/routers/workstreams.py` | Compat router; `workplan-index` + `DELETE` already **410** |
+| `api/routers/workstream_dependencies.py` | Legacy dependency aliases |
+| `api/routers/execution.py` | `PATCH /execution/workstreams/{id}/intent` |
+| Query/body aliases on `/tasks/`, `/progress/`, `/decisions/` | Metered per-key |
+| MCP tools `create_workstream`, `list_workstreams`, … | Aliases; internal REST uses `/workplans/` |
+| `state://workstreams/{topic_slug}` resource | Deprecated wrapper |
+| DB columns / JSON response fields `workstream_id` | STATE-WP-0070 T04 |
+| Frontmatter `state_hub_workstream_id` | Fleet bridge — separate migration |
+| `tests/test_legacy_meter.py`, `test_routers_core.py` | Regression coverage |
+
+## Likely sources of remaining `GET /workstreams/*` volume
+
+1. **Remote fix-consistency hosts** not yet on `state-hub` ≥ `14b7d84` (coulombcore runners, cron sweep nodes).
+2. **Dashboard detail page** task poll via `?workstream_id=` (every workplan detail view).
+3. **Agent prompts** still telling models to call retired `workplan-index` legacy path (410 but metered).
+4. **External REST clients** (bookmarks, old scripts, Claude settings curl examples in `activity-core/.claude/settings.local.json`).
+5. **Legacy query aliases** elsewhere in dashboard/docs (`docs/onboarding.md` curl example).
+
+## Remediation (STATE-WP-0072 — 2026-07-09)
+
+- [x] `dashboard/src/workstreams/[id].md` → `?workplan_id=`
+- [x] `custodian_cli.py` POST bodies → `workplan_id`
+- [x] `docs/onboarding.md` curl → `/workplans/`
+- [x] `the-custodian/runtime/prompts/daily_statehub_wsgi_triage.md`
+- [x] `activity-core/k8s/railiance/21-custodian-runtime.yaml`
+- [x] `wise-validator/reporter.py`, `agentic-resources/curate/decisions.py`
+- [x] 8h meter re-capture (`legacy-meter-weekly-review-20260709.json`)
+
+Outstanding: remote fix-consistency hosts; activity-core k8s rollout of prompt projection; meter decline over subsequent 8h windows.
+
+## Verification
+
+```bash
+python scripts/capture_legacy_meter_evidence.py   # 8h window
+rg '/workstreams|workstream_id' --glob '!**/workplans/**' --glob '!**/tests/**' <repo>
+```

docs/onboarding.md

@@ -103,7 +103,7 @@ Restart Claude Code after MCP registration.
 
    ```bash
    cat .custodian-brief.md
-   curl -s "http://127.0.0.1:8000/workstreams/?status=active" | python3 -m json.tool
+   curl -s "http://127.0.0.1:8000/workplans/?status=active" | python3 -m json.tool
    ```
 
 ## Domain Collaborator: New Person