CUST-WP-0071: wave 1 applied (except Forgejo server); evidence

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/evidence/2026-10-21-wave1-apply.md

@@ -0,0 +1,64 @@
+# CUST-WP-0071 wave 1 — apply evidence (2026-10-21)
+
+**Authority:** `docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`
+(wave 1; local kubectl allowed; probe uninstall approved).
+**Target:** railiance01, node 92.205.62.239, verified before each step.
+**Method:** applied from the workstation kubeconfig, one owner at a time, in the
+order STATE-WP-0099 requires.
+
+## Node CPU requests (of 4000m allocatable)
+
+| After step | CPU requested | Memory requested | Change |
+|---|---:|---:|---|
+| Before | 3605m (90%) | 9856Mi | — |
+| 1 Knative (requests 220→60m, HPA max 20/5/10→3/2/3) | 3445m | 9856Mi | −160m |
+| 2 Probe uninstalled | — | — | −50m / −128Mi |
+| 3 state-hub API 250→390m | — | — | +140m |
+| 4 state-hub-db none→70m/416Mi | 3605m (90%) | 10144Mi | +70m |
+| 5 rapp-telemetry (Prometheus 205m/1152Mi, Grafana 35m/512Mi, 10d retention) | — | — | +10m / +880Mi |
+| 6a Forgejo runner (dind 100m/432Mi, runner 25m/64Mi) | 3740m (93%) | 11520Mi (72%) | +125m / +496Mi |
+| 6b Forgejo server | deferred | | (+200m / +976Mi when applied) |
+
+Wave 1 nets out as the review predicted. The node is now at 93% of CPU
+requests. Further increases, including the deferred Forgejo server and routine
+state-hub release surges, depend on the wave-2 reductions
+(STATE-WP-0099-T06, RESOURCE-WP-0008).
+
+## Verification per owner
+
+- **Knative** (RAIL-KNATIVE-WP-0003 finished, RCLUSTER-WP-0020-T02):
+  - all six deployments request 10m and are Ready;
+  - HPA max is 3/2/3;
+  - Kourier is ClusterIP and ksvc rapp-qonto is Ready;
+  - the PodDisruptionBudgets are unchanged.
+
+  The policy `reject-secret-last-applied` refused the runtime-generated webhook
+  certificate object, which stayed unchanged; follow-up RCLUSTER-WP-0020-T04.
+- **Probe** (CORE-WP-0012-T02): the Helm release was removed. Namespace `coulomb`
+  was kept until the founder checks for a leftover probe credential object.
+- **state-hub** (STATE-WP-0099-T03..T05):
+  - Helm revision 78, API at 390m, health ok, schema current;
+  - the image also moved 5dd3df9 → c103cbf (an already-committed values bump);
+  - rollback: revision 77;
+  - the DB in namespace `databases` requests 70m/416Mi and is healthy.
+- **rapp-telemetry** (RAPP-TELEMETRY-WP-0002-T03):
+  - targets all up, about 7.3 days of history retained;
+  - the forgejo effective-request series is 0.1;
+  - host/k3s cAdvisor series are present;
+  - rollback: revision 4.
+- **Forgejo** (FORGE-WP-0011-T02):
+  - **runner:** the founder-run, redacted diff showed resources only, so it was
+    applied, and the daemon is up;
+  - **server:** deferred, because the Helm upgrade would also apply the NetKingdom
+    sign-in declaration (railiance-apps 4d6a8dd) over the source activated natively
+    on 19 Oct (CUST-WP-0080 T42/T43).
+
+## Follow-ups raised
+
+- whitehat-security `WHITEHAT-IN-0003`: a secret-aware release-diff review
+  facility, so the founder accepts a redacted report instead of diffing by hand.
+- RCLUSTER-WP-0020-T04: make the installer compatible with the annotation policy,
+  and fix its ssh/kubeconfig access path.
+- Forgejo Helm reconciliation together with the sign-in owners. Retire the
+  legacy "gitea" naming when convenient (the upstream chart name, not the retired
+  Gitea server).