carlos / platform Public

Merge origin/main into console-as-an-app (40 commits, domains fold + bake ratchet)

One conflict, in internal/host/agent.go, and both sides were wanted.

main (ec3767c, c567b1d) made the domains work fleet-aware: the edge set is
folded per pass from every live box's published edges file rather than read
once from PLATFORM_EDGE_IPS at boot, and ReconcileAliases now takes a
DeploymentRoutes set so a claim cannot capture a hostname another box already
serves as a route. Both call sites in the fast-converge full pass and
instancesLoop grew an edgesfile fold.

This branch had rewritten the same function's tail: fastDeps is built in two
phases (empty struct first, so observeRestart can wrap the restart dispatch
around a `d` that exists), which turned main's single fastDeps{...} struct
literal into a run of field assignments. That is the whole of the conflict —
the two changes are textually adjacent and semantically independent.

Resolved by keeping this branch's two-phase construction and lifting main's
per-pass fold into it: d.fullPass now folds edgesfile.DeploymentRoutes and
hands it to ReconcileAliases, with main's comment on why it is uncached. The
domainsLoop and instancesLoop halves of main's change auto-merged untouched.

All five pieces of the restart-recovery work verified intact after the merge:
makeStartRoute's two refusals (no Unit, and the structural Hibernate guard),
systemctlStartUnit's start-not-try-restart, observeRestart never suppressing
a restart, the restartHold backoff with fullPass deliberately ungated, and
fastPassOpts' fourth parameter. internal/release/adopt.go carries both sides
too: our rolledBack gating and startUnit call, and main's bake ratchet and
pipeline-evidence changes (bake.go is byte-identical to main).

Gate: go vet clean, gofmt -l . clean, 34 ok. The three failing packages
(root, internal/edge, internal/activator) fail identically on clean
origin/main in a throwaway worktree — issue #326's walkConfig cwd-climb plus
a unix-socket sun_path length limit that trips the long-named activator
tests. All five cross-compile targets build.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>