fix(deploy): render new authority paths in plan

infra/deploy-runner/nodedc-deploy

@@ -5457,6 +5457,53 @@ def preflight_engine_depttrans_zone_authority_v1_predecessor():
     }
 
 
+def print_engine_depttrans_zone_authority_v1_plan(preflight):
+    print("engine_provider_authority_transition=platform-service-v1")
+    print("engine_provider_package=moscow-department-of-transport.pmd-slow-zones.v1")
+    print("engine_provider_id=moscow-department-of-transport")
+    print("engine_provider_authority_boundary=platform-service")
+    print("engine_provider_platform_service=nodedc-map-gateway")
+    print("engine_provider_platform_network=engine")
+    print("engine_data_product=map.zones.current.v2")
+    print("provider_credential_values=preserved")
+    predecessor_sha256 = preflight["predecessor_sha256"]
+    target_sha256 = preflight["target_sha256"]
+    for changed_path in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES:
+        print(f"engine_depttrans_zone_authority_changed_path={changed_path}")
+        if changed_path in predecessor_sha256:
+            print(
+                f"engine_depttrans_zone_authority_predecessor_sha256[{changed_path}]="
+                f"{predecessor_sha256[changed_path]}"
+            )
+        elif changed_path in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_NEW_PATHS:
+            print(
+                f"engine_depttrans_zone_authority_predecessor_state[{changed_path}]="
+                "absent"
+            )
+        else:
+            die(
+                "Engine Depttrans zone authority v1 plan has no predecessor state: "
+                f"{changed_path}"
+            )
+        if changed_path not in target_sha256:
+            die(
+                "Engine Depttrans zone authority v1 plan has no target sha256: "
+                f"{changed_path}"
+            )
+        print(
+            f"engine_depttrans_zone_authority_target_sha256[{changed_path}]="
+            f"{target_sha256[changed_path]}"
+        )
+    print(f"backend_current_barrier={preflight['backend_mode']}")
+    print("backend_force_recreate=yes")
+    print("backend_pull=never")
+    print("l2_graph=untouched")
+    print("n8n_l1=untouched")
+    print("engine_ui=untouched")
+    print("engine_databases=untouched")
+    print("mcp_nginx=untouched")
+
+
 def preflight_engine_provider_target_host_policy_predecessor():
     root = component_root("engine")
     actual = {}
@@ -7984,32 +8031,9 @@ def plan_artifact(artifact):
         print("engine_ui=untouched")
         print("engine_databases=untouched")
     if depttrans_zone_authority_v1_preflight:
-        print("engine_provider_authority_transition=platform-service-v1")
+        print_engine_depttrans_zone_authority_v1_plan(
-        print("engine_provider_package=moscow-department-of-transport.pmd-slow-zones.v1")
+            depttrans_zone_authority_v1_preflight
-        print("engine_provider_id=moscow-department-of-transport")
-        print("engine_provider_authority_boundary=platform-service")
-        print("engine_provider_platform_service=nodedc-map-gateway")
-        print("engine_provider_platform_network=engine")
-        print("engine_data_product=map.zones.current.v2")
-        print("provider_credential_values=preserved")
-        for changed_path in ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES:
-            print(f"engine_depttrans_zone_authority_changed_path={changed_path}")
-            print(
-                f"engine_depttrans_zone_authority_predecessor_sha256[{changed_path}]="
-                f"{depttrans_zone_authority_v1_preflight['predecessor_sha256'][changed_path]}"
         )
-            print(
-                f"engine_depttrans_zone_authority_target_sha256[{changed_path}]="
-                f"{depttrans_zone_authority_v1_preflight['target_sha256'][changed_path]}"
-            )
-        print(f"backend_current_barrier={depttrans_zone_authority_v1_preflight['backend_mode']}")
-        print("backend_force_recreate=yes")
-        print("backend_pull=never")
-        print("l2_graph=untouched")
-        print("n8n_l1=untouched")
-        print("engine_ui=untouched")
-        print("engine_databases=untouched")
-        print("mcp_nginx=untouched")
     if provider_target_host_policy_preflight:
         print("engine_provider_transport_transition=exact-literal-target-host")
         print("engine_provider_package=gelios.provider.v4")

infra/deploy-runner/test_engine_depttrans_zone_authority_v1.py

@@ -1,6 +1,7 @@
 import hashlib
 import importlib.machinery
 import importlib.util
+import io
 import json
 import os
 from pathlib import Path
@@ -8,6 +9,7 @@ import subprocess
 import tarfile
 import tempfile
 import unittest
+from contextlib import redirect_stdout
 from unittest import mock
 
 
@@ -111,6 +113,37 @@ class EngineDepttransZoneAuthorityV1Test(unittest.TestCase):
                 with self.assertRaises(RUNNER.DeployError):
                     RUNNER.preflight_engine_depttrans_zone_authority_v1_predecessor()
 
+    def test_plan_renders_new_path_as_absent_predecessor(self):
+        preflight = {
+            "predecessor_sha256": dict(
+                RUNNER.ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_PREDECESSOR_SHA256
+            ),
+            "target_sha256": dict(
+                RUNNER.ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_TARGET_SHA256
+            ),
+            "backend_mode": "verified-derived-retry",
+        }
+        output = io.StringIO()
+        with redirect_stdout(output):
+            RUNNER.print_engine_depttrans_zone_authority_v1_plan(preflight)
+        rendered = output.getvalue()
+        new_path = RUNNER.ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_NEW_PATHS[0]
+        self.assertIn(
+            f"engine_depttrans_zone_authority_predecessor_state[{new_path}]=absent",
+            rendered,
+        )
+        self.assertNotIn(
+            f"engine_depttrans_zone_authority_predecessor_sha256[{new_path}]",
+            rendered,
+        )
+        for changed_path in RUNNER.ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES:
+            self.assertIn(
+                f"engine_depttrans_zone_authority_target_sha256[{changed_path}]="
+                f"{RUNNER.ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_TARGET_SHA256[changed_path]}",
+                rendered,
+            )
+        self.assertIn("mcp_nginx=untouched", rendered)
+
     def test_healthchecks_dispatch_exact_live_acceptance(self):
         entries = RUNNER.ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES
         root = Path("/engine")