[G01h] Observe in-flight idle drain without deleting owned work

[jjangg96]

Goal

Add an experiment-only idle-drain observation path that records real in-flight poll ordering across capacity withdrawal without deleting or replaying owned work.

Parent and execution

Bounded implementation under #1, not a replacement for its Goal or live evidence. Use the single parent G01 goal aligned to the current #1 Goal; do not create a second active goal. Primary route: gpt-luna-max (gpt-5.6-luna / max); explicit user override may select grok-high. Independent review uses gpt-luna-max. One dedicated branch/worktree and focused PR. Parent Agent/status remain untouched.

Dependencies

#60 (closed, merged PR #62). Start from reviewed main cf67d4a or its verified descendant. Native blockedBy must agree before implementation.

Scope and acceptance

• Use the pinned actions/scaleset v0.4.0 high-level listener with initial capacity one and supported SetMaxRunners(0); preserve ACK-before-acquisition ordering.
• Establish an observable real request-in-flight boundary for one poll, withdraw capacity while response delivery is held, then observe old-poll ACK/acquisition and the next poll's zero capacity. A pre-call marker or post-response hold alone must never claim server-side in-flight proof; timing misses remain inconclusive. Do not fabricate or rewrite service responses.
• Emit bounded, secret-free drain observations: ordering, fixed categories, seven nonnegative counters, exact owned set/runner identity when present. Inspect before/after; stale zero, absent runner, matching set or idle callback never authorizes deletion or releases uncertain reservations.
• Integrate the phase through existing experiment approval/broker/ledger boundaries without silently expanding old authority; retain finite one-shot limits and fail-closed storage/identity/cancellation handling.
• Identify the narrow approved prerequisite for one already-idle owned canary runner. If an experiment-only pre-provision seam is necessary, propose it for independent review before adding it. No production provider or second worker.
• Meaningful behavioral failing test precedes minimal implementation, then refactor and relevant boundary/failure tests. Use the actual pinned listener with offline synthetic transport; distinguish offline evidence from live qualification.
• Focused PR records exact commands/results, red evidence, remaining gaps and rollback. Independent contract/security review and clean exact-current-head Codex review plus CI are required before conditional merge.

Exclusions and live gate

Offline implementation only. No credential access/minting, App/key changes, runner registration, live ScaleSet/session/JIT, workflow creation/dispatch/replay/cancellation, Docker/Lima/context/Keychain/launchd changes or cleanup. No RemoveRunner, busy cancellation, production recovery/store/session rehydration, replacement identity or automatic retry. The existing canary group is preparation, not execution authorization. A future live experiment needs a reviewed immutable SHA, exact selected private repository/workflow/resources and explicit maintainer permission. G01 remains open until its full live evidence is independently verified; this PR cannot close #1.

References

docs/HANDOFF.md, docs/EXECUTION.md, docs/decisions/0002-scaleset-integration.md, docs/SECURITY-DESIGN.md, docs/TEST-STRATEGY.md; parent #1 and PR #62.

[jjangg96]

Independent Luna/max design review of immutable cf67d4a confirms the bounded experimental scope. Clarification: a successful request-written marker before local capacity withdrawal and before first response bytes is client-observed wire overlap, NOT proof of server receipt or an atomic server drain barrier. Response-before-withdrawal, missing/ambiguous markers, unknown response/identity/statistics or missing next-zero poll remain inconclusive. The implementation must preserve this distinction and cannot close G01 on local or synthetic evidence. The reviewed worker helper supplies create/start mechanics, but the existing paired/broker path has no pre-acquisition JIT handoff; one already-idle runner is a real remaining live prerequisite, not an existing turnkey capability. Current hook work records that gap; a separate independently reviewed experiment-only handoff or approved helper is required before live drain, including explicit run-ID/offer ordering and one-worker authority. No credentials or live operations were used in this review. Parent goal and Agent/status are unchanged.

[jjangg96]

Local technical review passes, but publication is blocked: maintainer permission is needed to consolidate unpublished local commit history containing a personal path, and the historical initial behavioral-TDD gap requires explicit disposition. No path or private log is published here. Current remote PR #72 remains unreviewed for the local corrections; exact-head Codex and CI follow only after authorized clean publication. Agent remains Luna max; parent #1 and its active goal are not completed. No live actions were taken.

[jjangg96]

Maintainer decision recorded from this coordinator conversation: approval granted for (1) consolidating the unpublished local commits to exclude a personal path from published history and (2) an explicit historical process exception for the original missing meaningful pre-implementation behavioral-red record. The exception does not turn the initial compile failure or retrospective reproductions into TDD evidence. Current/future meaningful red-before-fix requirements, independent review, exact-head Codex, CI, and live-operation authorization gates remain unchanged. Consolidation preserves the 241-file independently reviewed archive exactly; no remote history was rewritten. Clean correction commit: 5d715c4, parent 6e1b214. No approval for live execution is inferred.