carlos / platform Public

Merge origin/main into customer fleets

Brings PR #63 up to date with main (934414c), which has since landed the
console redesign (#68), the app pages rework (#89), release versioning,
`carlos deploy`, the instances API go-live, exec-instance metrics (#121)
and the #69/#70 db-path fixes.

Seven files conflicted; every one resolves to BOTH sides composed, never
either side picked:

- main.go — main's three-role usage rewrite kept, with the branch's
  `fleets` verb added under "Your deployment" and `apps` regaining its
  place/-place lines. The dispatch table auto-merged with `fleets` intact.
- apps.go — apps create keeps the branch's `place2` argument and adopts
  main's `printUsing` helper.
- internal/console/server.go — fleets routes sit beside the new app
  Settings routes; the fleet page struct fields sit beside Overview /
  InstanceRows / Confirm / Settings; both `provision` and `registry`
  imported. main's new `claimReserved` return updated for the branch's
  two-value claimApp signature.
- internal/console/apiinstances.go — instance create now runs main's
  sibling-apex refusal FIRST (cheap, refuses a bad host before any store
  read), then the branch's fleet-placement lookup, which still overrides
  the request body's region.
- internal/registry/registry.go — the route table gains BOTH new columns
  (`unit` from main, `fleet_box` from the branch): 33 in routeCols,
  scanRoute, the placeholder row and the Upsert argument list, with both
  keep-existing-on-zero CASE arms and the doc comment updated to seven
  such columns.
- internal/host/agent.go — main's adoptLoop(reg, svc) / fastConvergeLoop
  (canaryAdoptLoop's new name) with the branch's startup
  publishResidentFleetBindings pass kept ahead of them.
- internal/host/metrics_loop.go — metricsLoop takes main's activator
  service for the exec-children probe while resolving its box label
  through the branch's metricsBoxLabel.

Fingerprint is the one place both sides rewrote the same function, so it
is composed rather than merged: main's content-accurate sha256 over the
actual column VALUES (which subsumes the branch's rev-counter trick — a
rotated 64-char token hash is visible because its bytes changed, not
because a counter moved) now also hashes `db_path` (#69), `region` and
`fleet_box`, and folds the fleets and fleet_boxes tables in under their
own section markers. Every invariant both sides bought survives: a
same-length version bump, a token rotation, a detach and an unattended
failover restamp all move the fingerprint, and the poll's payload is
fixed-size no matter how many routes are fleet-placed.

TestFingerprintStableWithoutFleetRoutes asserted the OLD aggregate's
string shape (a trailing ':' proving the placement projection was scoped).
There is no projection to scope now, so the assertion is ported to what
still carries its intent: the digest is "<count>:<64 hex>" regardless of
table size, which closes the unbounded-payload hole structurally.

templates/fleetdetail.html auto-merged silently but was written against
the pre-#68 layout, so it is ported by hand to current conventions: flash
banners first, a .pagehead block (eyebrow / h1 / lede) in place of the
bare h1, the placed-app link moved from {{.Base}} to {{.Nav}} like every
other app link on main, and Detach given the `linkish danger` class the
redesign uses for destructive row actions. Form actions stay on
{{.Base}}, which is already the convention. No other fleets template
exists; the handler already builds its page through main's accountPage
helper. Existing fleet-page render tests cover the result.

go build / go vet / go test ./... -count=1: all 21 packages green.

Co-Authored-By: Claude <noreply@anthropic.com>