amadan
Managed boxes: operator orphan-sweep for abandoned failed provisions Feature Request open
Migrated from github.com/carlosframework/platform issue #202, opened 2026-08-15. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: Operator orphan-sweep for abandoned failed provisions; blocked on the unmerged private-instances work.
---
Found by the private-instances whole-branch review (trust-placement).
The retention reap's pre-delete compute.ListBoxes sweep DETECTS a running instance the store doesn't know about (e.g. a CreateRentedBox that failed after a successful EnsureBox and was then abandoned rather than re-run) — and correctly REFUSES to reap, logging the orphan ids. But nothing terminates such an orphan; it keeps billing the operator with no automatic cleanup path.
Mitigations already in place: the provision walk is re-runnable (a re-run repairs the record via idempotent EnsureBox), and the reap logs the orphan. So this only bites when a member abandons after the record-write error.
Proposal: a carlos boxes operator-only reconcile/orphan-sweep verb (and/or a periodic reconcile) that lists cloud instances carrying carlos:managed-fleet with no live rented_box row and offers to terminate them. Operator-gated (IsOperator), never member-facing (a member can't be trusted to terminate the operator's spend).