Request lifecycle

1. client → gateway:8080
       POST /v1/agents/agents/echo/foo
                                      ──────────
                                      parsed as agent=echo,
                                      namespace=agents,
                                      rest=/foo

2. gateway.Activator.Resolve(echo)
       ├── fetch Agent CR from informer cache
       ├── Check Endpoints — has ready addresses ✓
       └── return http://echo.agents.svc:8080/  (hot path, no cold start)

3. gateway.handleInvocation
       └── httputil.ReverseProxy forwards
             ├── path rewritten to /foo
             ├── traceparent header preserved
             └── FlushInterval = -1 (immediate flush, streaming-safe)

4. kube-proxy → Endpoint IP → krypton-proxy:8888

5. krypton-proxy
       ├── shuttingDown? no
       ├── acquire concurrency slot (non-blocking)
       │     ├── if cap reached → 503 + Retry-After (back to client)
       │     └── otherwise → in-flight++ , inflight gauge++
       └── reverse-proxy to 127.0.0.1:<spec.port>

6. user container handles the request
       └── response streams back through:
             user → proxy → kube-proxy → gateway → client

7. gateway.handleInvocation completes
       └── go RecordInvocation(...)
             └── patches Agent.Status.LastInvocationAt = now
                  (decoupled from request ctx so it survives disconnect)

T+0:     burst arrives. Sidecars start refusing past spec.concurrency
         with 503 + Retry-After.
T+1s:    scaler tick. inflight = N (sum of sidecar reports).
         desired = ceil(N / concurrency), clamped to [minReplicas, maxReplicas].
         If higher than current, scaler patches Status.DesiredReplicas.

T+1s+ε:  Manager reconciler observes change
         → patches Deployment.Spec.Replicas to the new desired
         → K8s creates additional pods
         → new sidecars take traffic

T+0:    load drops. inflight returns to baseline.
T+1s+:  scaler tick — desired computed below current.
        If within scaler-stable-window-ms (default 60s) of the last
        scale-up, hold. Otherwise patch Status.DesiredReplicas down.
        Always-on never goes below max(minReplicas, 1).