Running list: what testers try that Khala can't do yet (unsupported-request capture -> triage)

[AtlantisPleb]

Owner-directed. Roadmap: docs/khala/2026-06-26-khala-open-issues-master-roadmap.md.

Why

External testers will attempt things Khala can't do yet. We need a running, triaged list so gaps become roadmap items instead of silent failures.

Scope

Capture unsupported/failed/rejected requests (from the trace-review loop, Forum reports, and direct tester feedback) into a maintained running list — Forum-first per the product-promise intake model, plus a tracking issue/doc. Triage each into bug / missing-capability / won't-do; convert real ones into issues and thread them into the roadmap.

Acceptance

A maintained unsupported-request list + a triage cadence; capability gaps reliably become issues. Tied to the trace-review loop.

[AtlantisPleb]

Implemented and deployed the Khala unsupported-request ledger.

What landed:

• Pylon auth lane fix: same OpenAuth owner can reclaim/heartbeat after local token rotation (18fc4264e0).
• No-spend Codex dispatch gate fix: unpaid/local Codex assignments no longer require wallet readiness (69c6264ca2).
• Unsupported-request ledger API/docs/migration: GET/POST /api/operator/khala/unsupported-requests, D1 migration 0244_khala_unsupported_requests, focused tests, route coverage, and docs (95d77a36b8).

Khala/Pylon/Codex proof:

• Delegated via pylon khala burndown --execute.
• Assignment: assignment.public.khala_coding.chatcmpl_0010fdb2452a4d9c843b874105769d88.
• Exact token proof row: 12,269,803 tokens; public counter delta observed: 12,313,073.

Verification:

• Pre-push check:deploy passed on main.
• bun run --cwd apps/openagents.com/workers/api deploy:safe passed.
• Migration applied on remote D1 and pending-migrations check is clean.
• Deployed Worker version: f637e49f-c541-43d8-be27-5c175882a4a7.
• Remote D1 smoke confirmed khala_unsupported_requests exists.

Note: a live API POST smoke requires the owner-held production OPENAGENTS_ADMIN_API_TOKEN; the local staging token correctly returns 401 on production, so I did not fake that path.