Module planner 

Pure planner (RFC-0006 §4.1).

Emits OpenRollout actions for channels with a verified manifest but no rollout row for the current target_ref yet, and walks each active rollout’s Pending hosts through the gate stack to produce QueueDispatch (gates pass) or DeferDispatch (gates block) actions.

Properties enforced by the signature:

• Pure. No chrono::Utc::now(), no DB reads, no HTTP. now is a parameter so tests advance time deterministically.
• Verified-only inputs. SignedManifestSet carries Verified<T>; the planner cannot accidentally consume an unverified manifest.

Functions

active_rollout_for_host

Lookup helper: given a host_id, find its active rollout id (if any).

compute_soak_due_at

Compute soak_due_at for a freshly-dispatched host. Pure: takes dispatched_at + the policy’s wave soak duration; returns the time at which the soak window elapses.

plan_next

Pure reducer: given the trust-verified manifests, the current per-host state aggregate, and the active quarantine table, produce a list of PlanActions for the applier to execute.