Function reconcile_builtin_cluster_replicas 

fn reconcile_builtin_cluster_replicas(
    txn: &mut Transaction<'_>,
    builtin_cluster_config_map: &BuiltinBootstrapClusterConfigMap,
    boot_ts: Timestamp,
) -> Result<(), AdapterError>

Converges each builtin cluster’s replica set on the cluster’s own managed config.

A builtin cluster is normally managed, and a managed cluster’s replicas are derived state: exactly replication_factor replicas, named by managed_cluster_replica_name. One can be altered to unmanaged, which leaves no factor to derive from, and then its replica set is the operator’s.

Replicas this creates are shaped from the cluster’s config. An existing replica is matched by name alone and left untouched, so this converges cardinality and names rather than shape. An internal replica is never derived state and is left alone entirely.

The bootstrap flags seed replication_factor and size when a cluster is first created (see add_new_remove_old_builtin_clusters_migration) and are deliberately not consulted here, so an ALTER CLUSTER against a builtin cluster survives a restart.

This runs at catalog open so the replicas a cluster’s config calls for exist as early as possible. The coordinator’s bootstrap brings up only replicas already recorded durably and runs before the cluster controller is spawned, and the controller does not run at all while a deployment is read-only.

The cluster controller owns these replica sets at runtime and derives its target from the same cluster config, so the two converge on the same set rather than competing for it. The controller matches replicas by shape and count, never by name, so the r1..rN this creates satisfy it. This converges by name, so a boot after the controller reshaped a cluster renames or re-creates replicas it had materialized under generator names. That is harmless: every replica is a cold process at boot anyway, so the cost is replica-id and audit-log noise.