docs(CUST-WP-0054): record Phase 3 access rewire to railiance01

state-hub-primary tunnel, activity-core in-cluster URL, fleet-state-hub
coulombcore retired. Production :8000 now serves railiance01 hub.

docs/state-hub-railiance01-cutover-phase3-2026-07-06.md

@@ -0,0 +1,77 @@
+# T05 Phase 3 Evidence — Access Path Rewire (2026-07-06)
+
+Workplan: `CUST-WP-0054-T05`  
+Parent runbook: `docs/state-hub-railiance01-cutover-plan.md`  
+`no_secret_material_recorded: true`
+
+## Checklist
+
+| Step | Action | Result | Evidence |
+| --- | --- | --- | --- |
+| 3.1 | activity-core in-cluster URL | **pass** | `STATE_HUB_URL=http://state-hub.state-hub.svc.cluster.local:8000` |
+| 3.2 | Retire `fleet-state-hub-coulombcore` | **pass** | systemd stopped + disabled on railiance01 |
+| 3.3 | Workstation `state-hub-primary` | **pass** | `92.205.62.239` → `10.43.68.154:8000` |
+| 3.4 | Agents `127.0.0.1:8000` | **pass** | `/state/health` ok via tunnel |
+| 3.5 | Smoke write | **pass** | progress event `659fabf6` via `:8000` |
+
+**Phase 3 status: complete.**
+
+## Changes applied
+
+### activity-core (railiance01-k3s)
+
+- ConfigMap `actcore-runtime-config`: `STATE_HUB_URL` → in-cluster service
+- `actcore-state-hub-bridge` Deployment scaled to **0**
+- Rollout restart: `actcore-worker`, `actcore-api`, `actcore-event-router`
+- Source: `activity-core/k8s/railiance/20-runtime.yaml`
+
+Verified from `actcore-api` pod:
+
+```text
+url http://state-hub.state-hub.svc.cluster.local:8000
+{"status":"ok","db":"connected"}
+```
+
+### railiance01 host
+
+```bash
+systemctl --user stop fleet-state-hub-coulombcore
+systemctl --user disable fleet-state-hub-coulombcore
+```
+
+`:18000` no longer serves State Hub (expected).
+
+### Workstation ops-bridge
+
+`~/.config/bridge/tunnels.yaml` — `state-hub-primary`:
+
+| Field | Before | After |
+| --- | --- | --- |
+| `host` | `92.205.130.254` (coulombcore) | `92.205.62.239` (railiance01) |
+| `remote_host` | `10.43.170.94` | `10.43.68.154` |
+| `actor` | `agt-claude-coulombcore` | `agt-claude-railiance01` |
+
+Stale `state-hub-coulombcore` tunnel on `:8000` cleared before primary restart.
+
+## Verification
+
+```bash
+curl -s http://127.0.0.1:8000/state/health
+# {"status":"ok","db":"connected"}
+
+curl -s http://127.0.0.1:8000/state/summary
+# workstreams 640, tasks 4002
+```
+
+## Production topology after Phase 3
+
+```
+workstation :8000 ──state-hub-primary──► railiance01 SSH ──► 10.43.68.154:8000 (state-hub)
+activity-core pods ──in-cluster DNS──► state-hub.state-hub.svc.cluster.local:8000
+coulombcore state-hub Deployment: scaled 0 (rollback only)
+```
+
+## Next: Phase 4–5
+
+- Phase 4: sweep checkout migration to `/home/tegwick/<slug>`
+- Phase 5: 48–72h stabilization before coulombcore teardown