carlos / platform Public

Migrated from github.com/carlosframework/platform issue #201, opened 2026-08-15. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".

Still outstanding: Fleet-box edge egress rows trust a self-declared account field instead of the fleet's owning account.

---

Found by the private-instances whole-branch review (trust-placement).

In sweepUsage (internal/console/economicspass.go ~line 526), the edge egress/requests loop attributes each EdgeDay row by its self-declared row.Account. The metrics loop was fixed (PR for #73/Task 3) to force fleet-scoped box telemetry to the fleet's OWNING account (b.account from registry.Fleet.Account), bypassing the box's claim — but the edge loop was not made symmetric. A fleet box can therefore name any account sqid in its egress rows and misattribute egress/requests to it.

No live money impact today: egress is not priced to fleet customers (box_hours is the only customer-facing rental meter, and it comes from the authoritative RentedBox record, not telemetry). But it's an attribution-integrity gap on a metered path, and it becomes a real misbilling vector the moment egress is priced for fleets.

Fix: in the edge loop, when b.root != "" (fleet scope), force acct = b.account exactly as the metrics loop does, instead of reading row.Account. Root-scope boxes keep today's row.Account behavior. Add a test mirroring the metrics-path attribution test.

Also flagged nearby (same review): no release.ValidAccount guard on Fleet.Account writers; a blank account silently falls to OpsAccount with no log.