feat(OMN-13011): LANE CENSUS RECONCILIATION ratchet — declared desired-state per lane, drift = auto-ticket

[jonahgabriel]

OMN-13011 — LANE CENSUS RECONCILIATION ratchet

The class fix for the recurring lane-drift regression. Nothing reconciled the declared desired state of a runtime lane against what is actually running, so the same failure kept recurring with zero signal:

• volume config drift (OMN-12945 family)
• WORKER_REPLICAS silent zero — worker scaled to 0, no alert (OMN-12988 / OMN-12990)
• 2026-06-11: prod runtime containers + the broker network silently absent for hours during demo prep, zero alert.

Operator demand: "how do we keep having this regression over and over." Answer: there was no reconciler. This ships one.

What this does

(a) DECLARED — deploy/lane-census/lane-manifest.yaml is the versioned desired state per lane (stability-test, prod, judge, dev): container set, network, replicas, image-tag pattern. Names/networks are derived from the canonical compose lane files; nothing is hardcoded in the scripts. A parity ratchet (test_lane_census_manifest_parity.py) keeps the manifest locked in step with the compose files and forbids any service declaring replicas: 0 (the silent-drop surface). This also closes the OMN-12988 runtime-worker.yaml container_name: null census gap by sourcing concrete names from the compose lane files.

(b) RECONCILED — scripts/lane_census_plan.py (pure planner, no I/O) diffs desired vs the live docker ps / docker network ls inventory and emits typed drift findings. scripts/lane-census-check.sh drives it on .201. Coordinated with the OMN-13008 AutoGC timer (PR #1952): instead of a second timer, a systemd drop-in (deploy/lane-census/onex-disk-gc.service.d/20-lane-census.conf) appends a 4th ExecStart to the shared onex-disk-gc.service. On-demand path: bash scripts/lane-census-check.sh --json (the runtime_sweep invocation surface).

(c) DRIFT = AUTO-TICKET — on drift, scripts/lane_census_event.py builds a typed bus event (onex.evt.infra.lane-census-drift.v1) with a dedupe alert_key and a ticket title/body naming exactly what is missing/extra: container_absent, network_detached, replicas_zero, unexpected_container, oneshot_failed, oneshot_stuck, image_tag_mismatch. The sweep auto-ticket path consumes it (single ticket-creation authority, same pattern as the OMN-13008 disk-watermark event).

Fail-fast, no warn-only mode (gates-block policy): drift exits 30; the bus publish is fail-fast on KAFKA_BOOTSTRAP_SERVERS (no localhost/default broker).

Red fixture (tonight's case)

test_tonight_prod_red_fixture_runtime_absent_and_network_detached reproduces 2026-06-11: prod runtime containers absent + broker network detached. The planner must emit network_detached + container_absent for every missing runtime service, all critical — the ticket that should have fired hours before a human noticed.

Builds on (no duplication)

• OMN-12988 (fix(OMN-12988): pin stability runtime-worker to replicas 1 + silent-drop census ratchet #1942 merged): deploy-agent RUNTIME-scope census + verify_containers_up — the deploy-time census. This is the complementary steady-state reconciler.
• OMN-13008 (feat(OMN-13008): automated .201 disk maintenance — worktree GC + docker GC + watermark alert ratchet #1952 open): shares its systemd timer + reuses its typed-event/auto-ticket shape.

Evidence (dod_evidence — contracts/OMN-13011.yaml)

uv run pytest tests/unit/scripts/test_lane_census_plan.py \
  tests/unit/scripts/test_lane_census_event.py \
  tests/unit/scripts/test_lane_census_manifest_parity.py \
  tests/unit/scripts/test_lane_census_dry_run.py \
  tests/unit/scripts/test_lane_census_timer_dropin.py -q   # 37 passed
uv run ruff check scripts/lane_census_plan.py scripts/lane_census_event.py   # clean
uv run mypy scripts/lane_census_plan.py scripts/lane_census_event.py --strict # clean
pre-commit run --files <all> # passed (arch, topic-naming, no-hardcoded-broker, SPDX)

Evidence-Ticket: OMN-13011
Evidence-Source: OCC#2536
Config-drift family: OMN-12945
Relates-to: OMN-13009, OMN-12988, OMN-13008

[coderabbitai]

Warning

Review limit reached

@jonahgabriel, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 1 hour, 14 minutes, and 24 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c92a26a0-bd9d-4f3b-8b94-6ef4f3e52f6a

📥 Commits

Reviewing files that changed from the base of the PR and between ada95a5 and 11b6126.

📒 Files selected for processing (12)

• contracts/OMN-13011.yaml
• deploy/lane-census/install-lane-census.sh
• deploy/lane-census/lane-manifest.yaml
• deploy/lane-census/onex-disk-gc.service.d/20-lane-census.conf
• scripts/lane-census-check.sh
• scripts/lane_census_event.py
• scripts/lane_census_plan.py
• tests/unit/scripts/test_lane_census_dry_run.py
• tests/unit/scripts/test_lane_census_event.py
• tests/unit/scripts/test_lane_census_manifest_parity.py
• tests/unit/scripts/test_lane_census_plan.py
• tests/unit/scripts/test_lane_census_timer_dropin.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-lane-census-reconciliation

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}