Observe Email runtime inputs without restarting the service #5417

🤖 Generated by the Agentic Engineer

Description

Email is unavailable, and its serving process exposes no diagnostic log. The existing logging repair requires initializer publication and deployment. Add a separate, bounded read-only observation path to distinguish runtime identity, mounted configuration, required input access, datastore opening, local listener and health behavior while that repair remains in flight.

Expected Behavior

A confirmed dispatch of a reviewed main revision observes the existing serving container without restarting it or changing any service, data, credential or access policy. It returns one sanitized phase classification and treats failed, incomplete or changing observations as inconclusive.

Actual Behavior

Available evidence confirms failed readiness and repeated restarts, but cannot establish the failing phase. Native synthetic startup succeeds, including constrained-network controls; it does not explain the production failure.

Acceptance Criteria

• Implement a main-only, first-attempt, typed-confirmation workflow using the existing production identity and serialized production operation lane; reject invalid dispatches before checkout or credentials.
• Bind the observation to the reviewed deployed image and stable pod/container identity before and after one fixed, bounded read. Do not add arbitrary commands, destinations, resource inputs or agent-side exec access.
• Read only process/listener and fixed input metadata, the public startup ConfigMap fingerprint and unauthenticated local health status. Never read Secret contents, private key contents, mail data or process environment values.
• Emit only a canned phase classification; keep raw responses, error text, operational identifiers and file metadata out of public output. Failed access and partial or changed reads remain inconclusive.
• Prove behavior and privacy with positive, negative and identity-change controls; pass current-head validation, substantive review and protected merge.
• Dispatch the merged workflow on main and retain the observed phase. Preserve the full outage and recovery criteria on Restore Email availability after repeated startup failures #5412.

Additional Context

This is a separate read-only diagnostic leaf under #5412, complementary to #5416's initializer logging changes. It does not repair or close the outage, alter probes, widen network policy or migrate credentials. Size: Medium.