[vincentkoc]

What Problem This Solves

Private checkpoint migration errors did not identify which GitHub operation failed, leaving operators unable to inspect a retained draft safely.

User Impact

API failures now report a fixed operation, exit category, and HTTP status when available. The existing manual migration workflow can verify a pinned failed draft and its first part without restoring a database or changing the checkpoint.

Why This Change Was Made

Public admission and private checkpoint requests share one bounded process owner while retaining separate credentials. It drains private output without logging it and verifies that its process group has stopped before consuming results. The diagnostic binds the reviewed current source separately from the original failed migration and rechecks custody after the read.

A successful diagnostic proves only the current read path and selected part. It does not classify an earlier unrecorded failure or establish full recovery.

Evidence

• 38 focused Python tests passed, including stderr flooding, inherited descriptors, unknown cleanup, credential separation, evidence drift, corrupt parts, and first-part-only reads.
• Three native publication/workflow regressions passed.
• Two independent source reviews and fresh P3 autoreview passed on the exact head.
• Hosted production diagnostic remains a separate reviewed operation; no live retry, upload, promotion, or cache deletion has been performed by this change.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.