Function reconcile_builtin_cluster_replicas 

fn reconcile_builtin_cluster_replicas(
    txn: &mut Transaction<'_>,
    builtin_cluster_config_map: &BuiltinBootstrapClusterConfigMap,
    boot_ts: Timestamp,
) -> Result<(), AdapterError>

Converges each builtin cluster’s replica set on the cluster’s own managed config.

A builtin cluster is normally managed, and a managed cluster’s replicas are derived state: exactly replication_factor replicas, named by managed_cluster_replica_name. One can be altered to unmanaged, which leaves no factor to derive from, and then its replica set is the operator’s.

Replicas this creates are shaped from the cluster’s config. An existing replica is matched by name alone and left untouched, so this converges cardinality and names rather than shape. An internal replica is never derived state and is left alone entirely.

The bootstrap flags seed replication_factor and size when a cluster is first created (see add_new_remove_old_builtin_clusters_migration) and are deliberately not consulted here, so an ALTER CLUSTER against a builtin cluster survives a restart.

This runs at catalog open so the replicas a cluster’s config calls for exist as early as possible. The coordinator’s bootstrap brings up only replicas already recorded durably and runs before the cluster controller is spawned, and the controller does not run at all while a deployment is read-only.

The controller derives its target from the same cluster config, so it converges on the same replica set rather than competing for it. It excludes system clusters today, but nothing here depends on that staying true.