[aitrawog]

Summary

plugin-fleet is the compiled-in command:deploy plugin: it decodes a
PrepareVenue reply's opaque state patch into its OWN pinned
spec.SaveDeployStateInput before handing it to sdk's SaveDeployState.
opencharly/spec#292 added the authored engine: selector to that struct, and
opencharly/sdk#487 made applyDeployState write it; an older pin here would
silently drop the field between the pod plugin and the per-host entry.

This PR adopts spec v0.2026309.1917 and sdk v0.2026309.1926, and adds an
end-to-end test (TestSaveDeployState_PersistsEngine) that drives the real
save path — this module's marshal/load callbacks + sdk's apply — and asserts
engine: containerd lands on the entry alongside resolved_image. It fails on
the pre-bump pins (measured below), so it is not a vacuous pass.

This is the consumer leg of opencharly/charly#1109; the live pod: /
engine: containerd bed is run in the plugin-deploy-pod and charly PRs that
follow the producer-first order.

How tested

All commands ran on this head in
/home/atrawog/Sync/Atrapub/mo/claude/opencharly/.worktrees/containerd-crabbox-program/engine/plugin-fleet/candy/plugin-fleet
with GOWORK=off (the real adopted pins).

$ git rev-parse HEAD
449e0f87ab571610996cdd4b57010f0fa31e7655

The module gate:

$ GOTOOLCHAIN=go1.26.8 GOWORK=off go build ./...
fleet build rc=0
$ GOTOOLCHAIN=go1.26.8 GOWORK=off go test ./...
fleet test rc=0
ok  	github.com/opencharly/plugin-fleet/candy/plugin-fleet	2.863s
$ gofmt -l .

The new witness:

$ GOTOOLCHAIN=go1.26.8 GOWORK=off go test ./... -run 'TestSaveDeployState_PersistsEngine' -count=1
ok  	github.com/opencharly/plugin-fleet/candy/plugin-fleet	0.024s

Negative control — the SAME test against origin/main's sdk with the new spec
pin fails exactly on the new assertion:

$ GOTOOLCHAIN=go1.26.8 GOWORK=<spec-worktree + base-sdk + this worktree> go test ./... -run 'TestSaveDeployState_PersistsEngine' -count=1
--- FAIL: TestSaveDeployState_PersistsEngine (0.00s)
    deploy_state_writer_test.go:344: Engine = "", want containerd — the state decode or the sdk apply dropped the authored selector
FAIL

The test fixture's thin node-form decoder gained engine and
resolved_image parsing (it decodes only the scalar fields this suite uses),
which is what lets the assertion read the persisted entry.

golangci-lint run ./... reports two PRE-EXISTING findings in files this PR
does not touch (from_box_vm.go errcheck, schema_splice_test.go
staticcheck). They reproduce unchanged on origin/main; they are filed with
their RCA as #40 and do not grow here.

Authoring runtime evidence — the footer's model string is the runtime's own
value, read from the process environment:

$ env | grep -E '^(AI_AGENT|CLAUDE_CODE_SUBAGENT_MODEL|ANTHROPIC_BASE_URL)=' | sort
AI_AGENT=claude-code_2-1-308_agent
ANTHROPIC_BASE_URL=http://127.0.0.1:11434
CLAUDE_CODE_SUBAGENT_MODEL=deepseek-v4.1-flash:cloud

Rulebook compliance

• R0 — loaded /charly-internals:go, /charly-internals:plugin,
  /charly-internals:go-quality, /charly-internals:git-workflow and this
  repo's AGENTS.md before any edit.
• R1 — the pre-existing lint findings were classified non-blocking,
  RCA'd, and filed as chore(lint): two pre-existing golangci-lint findings (from_box_vm.go errcheck, schema_splice_test.go staticcheck) #40; the selector loss is fixed here.
• R2 — the typed wire decode is the one contract; no second parser.
• R3 — no workaround: the field is adopted through the producer's released
  tags.
• R4 — no documented command is routed around; the product path is fixed.
• R5 — no alias or dual path; the field is the authored engine spelling.
• R6 — git status was read first; the session worktree is
  .worktrees/containerd-crabbox-program/engine/plugin-fleet off fresh
  origin/main; no unrelated file was touched.
• R7 — the new test fails on the pre-bump pins (negative control above) and
  passes on this tree.
• R8 — no live service is mocked; the containerd boundary is the consumer
  bed.
• R9 — the gate ran on the worktree-local toolchain.
• R10 — the module gate is green; the live consumer bed is carried by the
  following producer-first PRs.

Change classification

Dependency adoption plus test coverage. No command grammar or schema changes
here; the behavior change is the adopted field flowing through the existing
typed path. Rollback: revert this PR; the fleet then drops the field again
(the pre-fix state), and the pod/charly PRs must be reverted first.

Breaking change + rollback: none — the adopted field is optional and the
existing decode path is unchanged.

Filed issues

• chore(lint): two pre-existing golangci-lint findings (from_box_vm.go errcheck, schema_splice_test.go staticcheck) #40 — the two pre-existing golangci-lint findings
  (from_box_vm.go errcheck, schema_splice_test.go staticcheck) reproduce on
  origin/main and are unrelated to this dependency bump.

Agent: containerd-crabbox-program/engine
Assisted-by: Claude Code ollama-cloud/deepseek-v4.1-flash:cloud (fully tested and validated)

[github-actions]

Review — PASS

Head SHA: 449e0f87ab571610996cdd4b57010f0fa31e7655 (branch: feat/pod-engine-selector)

Change class: dependency adoption (spec/sdk pin bump) + test coverage — module-level.
Comment thread: empty (0 comments) — nothing to disposition.

Security screen: PASS — no secrets/egress, no guardrail weakening, no injection directives; version bumps only.
Checklist: All applicable rules PASS or NA. The new TestSaveDeployState_PersistsEngine exercises the real save path (bed marshal/load + sdk apply) and carries a credible negative control (fails on old sdk), so R7/R10 test-coverage is satisfied; the live end-to-end pod:/engine: containerd bed is legitimately carried by the downstream producer-first PRs (plugin-deploy-pod, charly) since plugin-fleet compiles into charly, so it is not a deferral of this repo's own scope. Pre-existing lint findings are in untouched files and filed as #40.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run