carlos / platform Public

domains: fold the claim set from the listing's stamps, not a GET per claim (#173)

ListClaims lists domains/ and then reads every object under it. Three
things do that repeatedly: every app Settings render, every
`carlos domains list`, and every box's ReconcileAliases — the last one on
the FAST-CONVERGE leg, which runs on every serial bump, a seconds cadence,
ahead of the adopt leg inside a two-second convergence promise.

At tens of claims that is invisible. At the hundreds titogo's custom
domains are heading for it is a slow page and a steady drip of bucket
reads on every box in the fleet, forever. It is the shape PR #134 already
paid for once on releases.

The fix needs no new object and no new writer, because the listing already
carries the answer. S3 returns LastModified with every ListObjectsV2
entry, DirStore has the file mtime, and release.ModLister already
surfaces both — List simply throws it away. A claim whose stamp has not
moved has not changed, so its body does not need re-reading. Steady state:
one ListMod and zero GETs. The pass after a claim changes reads exactly
the claims that changed.

No TTL and no invalidation call, deliberately. Two exact rules do the
work: an entry is reused only when its stamp is unchanged, and the entry
map is replaced whole each fold — so a detached claim leaves the cache on
the same pass it leaves the listing, with nothing to remember to call.

Three bounds, each of which is a bug without it:

  - modSettle. S3 stamps have one-second granularity, so a claim read and
    then rewritten inside the same second carries an unchanged-looking
    stamp. Caching that read would serve the old body until something
    else moved the stamp — and nothing edits a settled claim, so for that
    hostname "until" means never.

  - A READ failure is never remembered, only a DECODE refusal. The same
    bytes refuse to parse the same way every pass, so remembering that
    saves a pointless GET forever; a network blip remembered would hide a
    perfectly good claim on exactly the same "forever" timescale.

  - A store with no ListMod — the fleet store door's client, every test
    fake — degrades to the plain fold, not to a weaker time-based cache.
    A customer fleet box is the hardest place to notice a stale claim set.

ReconcileAliases takes the cache explicitly; nil means today's behaviour.
internal/host holds one process-lifetime cache shared by both alias legs,
following withheldAliasSaid's precedent in the same file — one agent per
process, both legs asking about the same deployment's claims, so two
caches would double the cold reads for nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>