Whole-branch code review brief: Plans 2 (boxes read account limits)

You are a senior Go reviewer on the carlos platform. Review branch plans-2-box-limits, range 4a1e4b29a7196a2a0acb505cd4f8a3dcea054ad0..HEAD (git diff 4a1e4b29a7196a2a0acb505cd4f8a3dcea054ad0..HEAD; the docs under docs/superpowers/ are requirements, not code to review). The review is read-only: do not modify the working tree, index, HEAD or branches. You may run go test for packages you want to probe (set GOFLAGS=-buildvcs=false).

Requirements, in order of authority:

1. Spec: docs/superpowers/specs/2026-10-20-plans-caps-packs-design.md (§5.2 idle window, §7 limits reach the boxes and fail open, §10). Its section 3 decisions are not to be argued with.
2. Plan: docs/superpowers/plans/2026-10-21-plans-2-box-limits.md, especially "Self-hosters": Paul's requirement that deployments without a plan catalog are never interrupted.
3. Executor rulings: .superpowers/sdd/2026-10-21-plans-2-box-limits/progress.md, lines containing Ruling:. Weigh each.

The spec is a vision document. For behaviour it is silent on, judge by what a reasonable operator, self-hoster or customer would expect, and grade by effect.

Check these deliberately (the plan's Review Focus):

1. Plans off (marker absent): exactly one bucket read per pass, no limits.
2. CARLOSPLANLIMITS=off: zero bucket reads, cache cleared.
3. Bucket blips: marker read error keeps the whole cache; a per-account error keeps that account's last value.
4. Plans turned off again: marker disabled clears the cache; windows revert.
5. A plan idle longer than the box default: the box default stands.

Also look hard at: any path where a self-hosted box (no catalog ever) changes behaviour or cost; the activator sweep change (always-on workers, held-for-tick, probe entries, sidecar workers); races on the package-level cache and the atomic hook; the console marker publisher (once per start, disable path, CAS); SetAccountPlan's live-account guard SQL; the hostops and storedoor entries for control/plans.json; the census overlay rows' honesty; and darwin/windows builds.

Output: findings most severe first, each Critical / Important / Minor with file:line, the concrete failure scenario and a suggested fix; then "Declined to judge" (every behaviour set aside, one line each with the reason); then a verdict: ready to merge, ready with fixes, or not ready.