carlos / platform Public

PLATFORM_EDGE_IPS on carlos-tito-ie lists 3 of the 6 armed edges, so the custom-domain DNS check flaps between pointing and elsewhere. GitHub carlosframework/platform#388 described this and was closed 2026-09-05, but the box still carries the short list.

Evidence (2026-09-25, carlos-tito-ie over SSM)

• /etc/carlos/*.env: PLATFORM_EDGE_IPS=54.228.234.85,35.177.77.51,16.16.113.244
• carlos domains attach guidance for the same host hands out six: 54.228.234.85, 35.177.77.51, 16.16.113.244, 13.233.36.247, 3.92.98.101, 63.181.123.82. 13.233.36.247, 3.92.98.101 and 63.181.123.82 are missing from the list.
• tickets.heinekengreenlight.ie → greenlight.tito.page → edge.platform.tito.io (CNAME, TTL 60, public resolvers agree since 06:08 UTC). carlos domains list has moved misdirected → issuing-cert/pointing → misdirected → issuing-cert/pointing over the last 90 minutes.
• carlos-edge journal, repeatedly after the DNS settled: edges: alias tickets.heinekengreenlight.ie not published — dns_status "elsewhere", want "pointing" (does PLATFORM_EDGE_IPS list every armed edge?). The last one was at 07:28 UTC, 80 minutes after the flip and well past every TTL involved.
• The same flap delayed events.coolvectormedia.com yesterday (19:52 elsewhere, live at 20:47).

Effect

A correctly pointed custom domain is refused publication (and so a certificate) whenever the check resolves the steering name to one of the three unlisted edges. It eventually lands by chance. Today it is holding a customer cutover: Heineken Greenlight's ticket domain moving from Tito Pro to Tito Go.

Ask

1. Bring PLATFORM_EDGE_IPS on carlos-tito-ie up to the six armed edges, and whatever writes it too, so it doesn't drift again.
2. Better: derive the "pointing" set from the armed-edge registry (the same source the attach guidance uses) rather than from a hand-set env var, so arming a region can't silently break the check.

We haven't edited the box's env ourselves, because it is platform config.