Scope: gitea namespace on kubernetes-admin@kubernetes, existing worker drg-k8s-worker-01.auth.home.lan. No added capacity, storage, secret, or promotion permission.
PR #6676 passed branch, native, and WASM checks (Gitea run #3663) and merged to dev at 2642d0a487778c149c572dfd36c834f396759d8a. The checked-in manifest changes runners 1 and 2 to advertise rust-validation plus rust-delivery, and runner 3 to advertise only rust-candidate. The candidate workflow is still disabled by repository variable; this lane change does not enable test or production rollout.
Before mutation: cluster and worker Ready; three Rust runner pods 3/3 on worker-01; Gitea runner registrations 23–25 online; worker NVMe /dev/nvme0n1p1 had 761,770,295,296 bytes available, above the 350 GiB restore threshold. Both ConfigMaps were updated from the reviewed manifest. Runner 1 reported busy=false before its exact Deployment was applied. Recreate rollout started; old runner logs show graceful 20-minute shutdown wait. Do not restart runners 2 or 3 until runner 1 is online with both labels. Record final status and capacity-check evidence here after the migration.
Runner 1 and runner 2 each completed a guarded Recreate rollout after Gitea reported busy=false; runner 3 was rotated only after both shared runners were back online. No pod was force-deleted. All three Deployments and all three runner pods reached Ready 1/1 and 3/3 respectively on worker-01. Gitea registrations 23 and 24 are online with rust-validation,rust-delivery; registration 25 is online with only rust-candidate. The merged dev branch-validation run #3664 reached terminal success before runner 3 changed label.
Manual runner-capacity workflow run #3666 on exact dev revision 2642d0a487778c149c572dfd36c834f396759d8a reached terminal success. All seven matrix jobs passed; task-to-runner records show the rust-candidate job on runner 3, rust-delivery on runner 2, and rust-validation on runners 1/2. The three general-runner jobs also passed. After the check, /dev/nvme0n1p1 had 717.1 GiB available, above the 350 GiB restore threshold. AUTOCODER_TEST_CANDIDATES_ENABLED=false and AUTOCODER_CANDIDATE_SHADOW_ENABLED=false were read back; no normal candidate was registered or deployed by this change. Test remains unhealthy for the separately documented private-registry permission blocker. The 180-second p95 SLA remains unproved and prior shadow validation still exceeds it.