Validate pending-prefill cancellation and worker replacement on live RNGD to ATOM #244

Problem

Post-first-token cancellation and CPU subprocess fault tests do not prove lifecycle recovery while a real RNGD prefill is executing and ATOM owns the decode lane.

Evidence

#234 passes four-model normal HTTP and post-token cancellation. #238/#239 fixes terminal subprocess failures on CPU. No live hardware test yet combines pending prefill cancellation, worker termination, queued request failure and an explicit healthy replacement.

Hypothesis and scope

Use the existing owned RNGD+ATOM allocation, Qwen3-0.6B medium inputs and existing artifacts. Mark native prefill-call entry/completion in a trusted test-only factory; require the call to be pending at fault injection. Cancel one pending HTTP request and verify reuse; terminate only the test's child worker with queued requests, verify bounded failures, close/unlink its slab, explicitly construct a new worker and verify native-output equality. Do not reset other devices/workloads or claim automatic service restart.

Done when

Real hardware outcomes, failure evidence, exact setup and limits are recorded; discovered scheduler/health/lifecycle defects are fixed or tracked explicitly.

Owner

Codex implementation and experiment; maintainer review/merge.