_is_planned() decides a coordinate's fate by prefix-matching a prose field

[Polichinel]

Why this exists separately from #327

#327 proposes deleting _is_planned() entirely. If that lands, this closes with it. Filed standalone because the predicate is defective on its own terms, and if #327 settles the other way — reservations stay skippable — this bug survives the ruling and nobody is tracking it.

What

tools/credentials/registry_to_env.py:31-38:

def _is_planned(entry: dict) -> bool:
    return str(entry.get("status", "")).strip().lower().startswith("planned")

A coordinate is silently withheld from the emitted environment if a human wrote seven particular characters at the start of a free-text field.

status value	Intended	Actual
"planned — views-productionapi"	reserve	reserved ✓
"planned-for-deletion"	being retired, still live	silently withheld
"planning to remove after Q4"	a note	silently withheld
"plannedX"	typo	silently withheld

The failure is invisible: the name simply does not appear in the reader's output, and platform_env_validate() cannot catch it (see #330 — it derives its checklist from that same output).

The deeper issue

A value-less entry with status = "planned" carries no more information than one without. It is the same absence with an excuse attached. Treating the excuse as authoritative is how this reader lost the ability to distinguish "legitimately reserved" from "the registry is malformed and I could not tell" — and it answers anyway, with a partial coordinate set.

That is the platform's own named defect class (views-appwrite calls it Cluster J: "a system that cannot distinguish 'no' from 'I could not tell', and answers anyway"), in the reader on the UN FAO external-delivery path.

Fixes, in preference order

1. Delete the predicate — reservations belong in [planned], which no reader scans. This is Registry readers have diverged: views-models skips a reserved slot where faoapi and crafdapi raise #327's proposal and the cleanest outcome.
2. If reservations must remain honourable in [target]: match a structured field, not prose. reserved = true is a boolean; status is documentation.
3. At minimum: exact-match a defined token set rather than startswith.

Option 1 makes options 2 and 3 unnecessary. Options 2 and 3 are only relevant if #327 is rejected.

Tracked in views-appwrite's register as C-61. Related: #327 (the ruling), #330 (the validator that cannot catch this).

[Polichinel]

Closed by the D-05 ruling — see #327.

The operator ruled 2026-08-10 that reservations live in [planned] and every reader raises on a value-less entry in a scanned table. That deletes _is_planned() entirely, which removes the prefix-matching defect this issue is about rather than fixing it.

Filing this separately was still right: if D-05 had settled the other way, the startswith("planned") matching would have survived the ruling and been tracked nowhere. It didn't, so this closes with the deletion.