investigate(apple-runner): compare a command-control actor with concrete ownership after the first cleanup wave

First verify the prerequisite issues and record a fresh baseline SHA. Read the listed RunnerTests+Transport.swift, RunnerTests+CommandJournal.swift, RunnerTests+CommandDispatch.swift, RunnerTests+MainThreadWork.swift, RunnerTests+SnapshotCaptureTarget.swift, and RunnerMainOwnedState.swift files, then run the specified XCTest and pnpm validation commands. Done means a reproducible concrete-owner versus Swift-actor prototype, preservation evidence, ownership/line-count comparison, and an adopt, concrete-owner, or retain verdict.

Question and timing

Non-blocking follow-up to #2803: does a Swift command-control actor remove more coordination machinery than an equivalent concrete synchronized owner, while preserving the runner's device-proven behavior?

Blocked by the first cleanup wave: #2963 merged; #2965's accounting decision and fix merged; #2972, #2974 and #2970 completed, or explicitly dispositioned by the maintainer where a deletion case does not justify implementation. Start from a main containing those merged changes and record the exact SHA. Current status at filing: all five are still open. This is a research/prototype task, not approval for a production migration. Keep needs-triage until the prerequisites are resolved.

Do not wait for all of #2803, and do not make this experiment a prerequisite for closing it. Run before reconsidering deferred #2966/#2973 or expanding the target-state redesign; existing bounded correctness work may proceed. Serialize edits to shared runner Swift files and use a separate worktree/device for the experiment.

Source starting points

Research baseline: 8c89891b215c8504d1881eef06031d1d5f223726; recheck after the prerequisites. Under apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/:

• RunnerTests+Transport.swift: inline status/uptime, command queue, duplicate-command waiters, encoding/stamping.
• RunnerTests+CommandJournal.swift: acceptance/start/terminal state and bounded response retention.
• RunnerTests+CommandDispatch.swift: logical execution, watchdog errors and journal completion.
• RunnerTests+MainThreadWork.swift: completion/timeout arbitration and actual native drain.
• RunnerTests+SnapshotCaptureTarget.swift and RunnerMainOwnedState.swift: deferred writes and existing main-actor target isolation.

Transport and journal currently use separate locks. This is an ownership opportunity, not a demonstrated defect. #2965's host-side settlement bug still needs its own fix.

Bounded comparison

Build two replaceable prototypes behind the same small interface and run the same behavioral cases:

1. A concrete synchronized command coordinator.
2. A non-main Swift actor owning the same admission, active-command identity, in-flight duplicate recipients and journal transitions.

Illustrative interface, to validate rather than copy blindly:

actor RunnerControl {
  func receive(_ command: Command,
               reply: @escaping @Sendable (TransportReply) -> Void)
}

Use checked transferable command/reply values. Keep XCTest references behind the existing native execution seam. Neither coordinator executes blocking XCTest/private AX, semaphore waits, or large response encoding. Retain the dedicated native worker, bounded main-thread mechanism and @MainActor target state.

Both alternatives need explicit ordered admission and an active execution slot: Swift actors can interleave at suspension points and do not guarantee FIFO scheduling. Probes bypass ordinary execution. Preserve current in-flight-only coalescing, journal pruning, unstamped journal results, send-time stamps and the point at which the next command starts. No task-per-connection ordering assumption or new permanent idempotency cache.

Do not replace native completion/timeout arbitration with actor-message arrival order. A completed action must still win if its result published before the watchdog's abandonment decision, even if its notification is delayed. Logical command completion, transport cancellation and native drain remain separate facts. Preserve existing cancellation/disconnect policy.

Required evidence and go/no-go

• One native execution for duplicate in-flight command IDs; identical encoded reply for their recipients; unchanged behavior when that ID returns after completion.
• No overlapping ordinary logical commands; status/uptime remain responsive with main deliberately blocked and with response encoding held outside the coordinator.
• Completion just before timeout arbitration returns the actual result. Timeout followed by late completion drains exactly once without another reply or clearing another execution.
• Cancellation, shutdown, stale callbacks and deferred main-state writes preserve current outcomes; no accepted mutation is silently replayed or forgotten.
• Report matched baseline/prototype probe p50/p95/max, deadline misses and conditions. Use identical device/toolchain/load and existing budgets; no invented universal speedup target. Distinguish fake-worker, simulator and physical evidence.
• Report added/deleted/net production lines with rename-aware accounting; tests separately. List deleted locks, duplicated state/decisions and caller obligations alongside added queues, tasks, continuations, adapters and suspension points. Moving code does not count as deletion.
• New actor state is compiler-isolated, with negative isolation checks. No blanket @unchecked Sendable on XCTestCase, native handles or capture models; document any narrowly justified adapter exception.

Go only if all preservation cases pass and the actor demonstrably removes coordination complexity compared with the concrete owner. For adoption under the shrink initiative, target net production reduction; any growth needs an explicit quantified rationale and maintainer decision. Fewer locks alone, or shorter call sites hiding a larger framework, is insufficient. If the concrete owner is simpler, recommend it. If neither improves on the baseline, recommend retaining the existing design.

Deliverable, validation and exclusions

Publish the reproducible prototype diff/commit, test commands/results, size/ownership comparison and a clear adopt/concrete-owner/retain verdict on this issue. A negative result completes the experiment. An adoption verdict produces a separate bounded implementation contract before production migration; the prototype is not automatically merged.

Fresh worktree: pnpm install --frozen-lockfile && pnpm build. Follow docs/agents/testing.md and docs/agents/device-verification.md; run the existing transport/journal/coalescing and main-work regression cases, pnpm check:xctest-selection, unit-enabled iOS/macOS runner builds and selected XCTest lanes, pnpm check:packaged-runner-swift, and pnpm check:affected --run. Report unavailable native evidence as pending. Do not substitute compilation for execution proof.

No async snapshot-acquisition migration, whole-runner actor rewrite, host TypeScript actor framework, wire change, fallback deletion, timeout tuning, actor-per-cache conversion, or new process supervisor. Broader async native-work supervision requires a separate decision and value-transfer inventory.

Language constraints: Swift actors, structured concurrency and cooperative cancellation. A task-group timeout race does not make noncooperative native work cancellable.