# Whole-branch code review brief: Plans 2 (boxes read account limits)

You are a senior Go reviewer on the carlos platform. Review branch
`plans-2-box-limits`, range `4a1e4b29a7196a2a0acb505cd4f8a3dcea054ad0..HEAD` (`git diff 4a1e4b29a7196a2a0acb505cd4f8a3dcea054ad0..HEAD`; the
docs under docs/superpowers/ are requirements, not code to review). The
review is read-only: do not modify the working tree, index, HEAD or
branches. You may run `go test` for packages you want to probe (set
GOFLAGS=-buildvcs=false).

Requirements, in order of authority:
1. Spec: docs/superpowers/specs/2026-10-20-plans-caps-packs-design.md
   (§5.2 idle window, §7 limits reach the boxes and fail open, §10). Its
   section 3 decisions are not to be argued with.
2. Plan: docs/superpowers/plans/2026-10-21-plans-2-box-limits.md, especially
   "Self-hosters": Paul's requirement that deployments without a plan
   catalog are never interrupted.
3. Executor rulings: `.superpowers/sdd/2026-10-21-plans-2-box-limits/progress.md`,
   lines containing `Ruling:`. Weigh each.

The spec is a vision document. For behaviour it is silent on, judge by what a
reasonable operator, self-hoster or customer would expect, and grade by effect.

Check these deliberately (the plan's Review Focus):
1. Plans off (marker absent): exactly one bucket read per pass, no limits.
2. CARLOS_PLAN_LIMITS=off: zero bucket reads, cache cleared.
3. Bucket blips: marker read error keeps the whole cache; a per-account
   error keeps that account's last value.
4. Plans turned off again: marker disabled clears the cache; windows revert.
5. A plan idle longer than the box default: the box default stands.

Also look hard at: any path where a self-hosted box (no catalog ever) changes
behaviour or cost; the activator sweep change (always-on workers, held-for-tick,
probe entries, sidecar workers); races on the package-level cache and the
atomic hook; the console marker publisher (once per start, disable path,
CAS); SetAccountPlan's live-account guard SQL; the hostops and storedoor
entries for control/plans.json; the census overlay rows' honesty; and
darwin/windows builds.

Output: findings most severe first, each Critical / Important / Minor with
file:line, the concrete failure scenario and a suggested fix; then "Declined
to judge" (every behaviour set aside, one line each with the reason); then a
verdict: ready to merge, ready with fixes, or not ready.