# Use Opt-In Essential V2 Activation

Essential v2 shared-pool activation is not part of the default Premium
`dev-full` startup graph. A session opts in with
`essential_v2.enabled: true`; then `cp9 up` waits for the Premium/NextGen
baseline and runs the Essential v2 activation branch before returning. When the
field is false or omitted, Premium starts without creating or waiting for the
Essential v2 pool.

An already-running Premium session can activate the same capability with
`cp9 essential-v2 activate`. Eager and day-2 activation call the same script.
The script finds the session-named pool through tidb-management-service,
creates it through `CreateResourcePool` only when absent, sets the organization
default through the management API, and waits for `GetResourcePool` to report
`ACTIVE`. CP9 reaches the internal gRPC service on port 10001 through the
existing Kubernetes port-forward and resolves its live protobuf descriptor
through the service's registered reflection endpoint; no HTTP gateway or
copied private API module is involved. NextGen owns the generated pool id,
regional create, dataplane mapping, lifecycle, and workflow. A single-host lock
prevents concurrent creates. Immediately before sending the create RPC,
activation writes a durable attempt fence beside the controller's runtime
status, after the loopback connection, reflection lookup, and request decoding
succeed. It clears the fence only after discovering the exact owner record. An
ambiguous response is resolved by discovery and the create RPC is never
retried, including across command restarts. The
deterministic pool name is the collision-checked CP9 session name; discovery
also requires the exact session/owner tags and `createdBy` identity, and fails
on any missing, mismatched, or duplicate match. Before either activation path
creates the pool, CP9 idempotently enables the Essential v2 plan-selection flag
and region plan in the session databases. The region-tenant and quota rows
remain local seed prerequisites. `cp9 essential-v2 status` is read-only and
reports the live pool id, dataplane, phase, version, and readiness. Activation
stops before any customer TiDB create, backup, restore, or delete operation.

Normal `cp9 destroy` keeps the existing cleanup boundary. Resource-pool,
password, workflow, and event records live in the session's local MySQL and
eventbus volumes and disappear with the session k3d/host. The regional create
request includes the `cp9-owner`/`cp9-session`/`cp9-managed`/`cp9-ttl` cloud
tags, and activation verifies that the NextGen owner profile retained all four.
That does not prove the remaining propagation from NextGen through regional
`CreateSharedPool` onto AWS resources; it remains a code-derived premise until
live proof. The resumed task #210 must inspect resources created through this
path for all four tags, then prove the accepted reaper handoff covers that
exact inventory. A generic zero-survivor receipt alone does not prove the cloud
tag path. This refactor does not run a separate cloud proof before merge.

An Essential v2 OpenAPI train requires status `ready`. Customer public endpoint
readiness is a separate cloud gate: the API must return a customer hostname,
NextGen's external DNS probe must report it reachable, and SQL must succeed
through that exact hostname. A backing NLB is diagnostic evidence only and is
not a substitute for customer-DNS closure.

Dataplane-manager deliberately retains staging's `resourceNamePrefix: tidbcloud`
instead of applying cp9's session prefix. Staging subnet
lookup/adoption depends on that value. Concurrent-session isolation is provided
by the actual creation chain: cluster-ng `genDataplaneName` emits a unique
`dp-<UUID>`, dataplane-manager derives each VPC/Internet/AppBox CR identity as
`MD5(logicalRegionName + "-" + DataPlane.Name)`, and cloud controllers include
that CR identity in external resource names. The pool id is generated by
NextGen and propagated through the regional SharedPool/DataPlane objects;
dataplane-manager carries no fixed pool label. CP9 owner/session tags remain the
cleanup boundary.