carlos / platform Public

New instances can remain asleep with an empty version when their channel's binary is already staged: the sandboxed agent cannot write the live symlink, but previously requested the privileged staging pass only for artifact staging failures. Relay EROFS/EPERM/EACCES from the symlink swap through that same opt-in, throttled path. Failed adoption preserves the previous link and recorded version and does not restart the instance.

The regression failed before the fix and passes afterward. Current main d1cfc65 was integrated without conflicts; the difference against main remains only this fix and its regression. Tip 02544dfaa63859286da01669c83fe9345f095f53 passed forge CI: full build/vet/format/tests, all five cross-compilation targets, and MinIO contract. Independent production-path review approved both the original fix and the current-main integration with no blocking findings. Local build, vet, formatting, and release-package tests pass; unrelated macOS full-suite failures were reproduced on unchanged main, and the Linux forge gate is green.

The root staging pass has whole-box scope: this trigger can bring pending release adoption, config, capability and restart work forward. Existing scoped restart selectors remain enforced. The patch does not widen the sandbox or change tenant databases. Platform deployment is separate from merging and must replace the running root agent; the legacy script restarts the named box's edge and has no automatic rollback. Ireland's deployed 66587fa rollback binary has been captured locally and verified against the live binary. No infrastructure deployment is part of this branch.