fix(bootstrap): reuse the installed root domain instead of re-deriving it

	// rebuilds the image and rolls the deployment from the SAME binary -- a run that looks

	// like a successful update and leaves the version unchanged.

	//

	// The installer is the only thing that moves felis-api, but it is NOT an updater and

	// must not be recommended as one without this warning. detect_node_ip re-derives

	// FELIS_ROOT_DOMAIN on every run and defaults it to <node-ip>.nip.io -- nothing reads

	// the domain back out of the felis.toml a previous run wrote. A bare re-run therefore

	// rewrites root-domain/panel-hostname/admin-hostname to nip.io names while

	// ensure_panel_tls_cert, which is write-once, keeps serving the old ones: the console

	// stops matching its own certificate. There is no re-domain flow to recover with.

	// The installer is the only thing that moves felis-api. It is safe to point at now

	// that detect_node_ip reuses the installed root domain, so what is left to warn about

	// is the channel: FELIS_VERSION_BOOTSTRAP is not persisted anywhere and defaults to

	// release, so a bare re-run on a host tracking main quietly moves it onto releases.

	// That is a channel change, not a broken install, which is why it is one clause and

	// not a paragraph.

	if offeredFelisAPI {

		b.WriteString("\nfelis-api (panel, plugins) is the exception: setup re-images it from the felis binary\nalready on this host, so it cannot install a NEWER felis-api. Only re-running the\nbootstrap installer does that, and it is a full install run, not an update: give it the\nSAME environment as the original install, FELIS_ROOT_DOMAIN above all. It defaults to\n<node-ip>.nip.io, and a bare re-run re-domains this install while the write-once panel\ncertificate keeps the old hostnames.\n")

		b.WriteString("\nfelis-api (panel, plugins) is the exception: setup re-images it from the felis binary\nalready on this host, so it cannot install a NEWER felis-api. Re-run the bootstrap\ninstaller for that -- it keeps this install's root domain. It does default to the\nrelease channel, so pass FELIS_VERSION_BOOTSTRAP=dev if this host tracks main.\n")

	}

	return b.String()

}

	if !strings.Contains(api, caveat) {

		t.Fatalf("--panel resolves to felis-api and must carry the caveat:\n%s", api)

	}

	// Naming the installer without naming this is worse than saying nothing: the README

	// invocation carries no environment, detect_node_ip then defaults FELIS_ROOT_DOMAIN

	// to <node-ip>.nip.io, and the operator re-domains a live install by following our

	// own advice. Nothing reads the previous domain back, and the write-once panel cert

	// keeps the old hostnames, so there is no recovery path either.

	if !strings.Contains(api, "FELIS_ROOT_DOMAIN") {

		t.Fatalf("pointing at the installer without the re-domain warning is a footgun:\n%s", api)

	// Naming the installer obliges us to name what a bare re-run still changes. The domain

	// is handled -- detect_node_ip reuses the installed one -- but the channel is not

	// persisted at all and defaults to release, so a host tracking main gets moved onto

	// releases by following this advice.

	if !strings.Contains(api, "FELIS_VERSION_BOOTSTRAP=dev") {

		t.Fatalf("pointing at the installer without the channel caveat misleads a dev host:\n%s", api)

	}

	vel := renderApplyGuidance(

  log "host: ${PRETTY_NAME:-$OS_ID $OS_VERSION}  (package manager: ${PKG})"

}

# persisted_root_domain echoes the root_domain an earlier run wrote, or nothing. The

# generated toml is the only durable record of it: nothing else on the host stores the

# domain, and it is written on every successful install.

persisted_root_domain() {

  local f="${STATE_DIR}/felis.host.toml"

  [ -r "$f" ] || return 0

  awk -F'"' '/^[[:space:]]*root_domain[[:space:]]*=/ { print $2; exit }' "$f"

}

detect_node_ip() {

  NODE_IP="$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="src"){print $(i+1); exit}}')"

  [ -n "${NODE_IP:-}" ] || NODE_IP="$(hostname -I 2>/dev/null | awk '{print $1}')"

  [ -n "${NODE_IP:-}" ] || die "could not determine this host's primary IPv4 address"

  FELIS_ROOT_DOMAIN="${FELIS_ROOT_DOMAIN:-${NODE_IP}.nip.io}"

  # Precedence: an explicit FELIS_ROOT_DOMAIN, then whatever the last run persisted, then

  # the nip.io default. The middle step is what makes a re-run idempotent. Without it this

  # installer re-derived the domain from scratch every time and defaulted to nip.io, so

  # re-running it on a live install -- the only way to move felis-api to a newer release,

  # and what `felis update` points operators at -- rewrote root_domain, panel_hostname and

  # admin_hostname to nip.io names. ensure_panel_tls_cert is write-once and kept serving a

  # certificate for the OLD hostnames, so the console stopped matching its own cert, with

  # no re-domain flow to recover through. Secrets never had this problem:

  # load_or_make_secrets has always sourced secrets.env before generating anything.

  local persisted

  persisted="$(persisted_root_domain)"

  if [ -n "${FELIS_ROOT_DOMAIN:-}" ] && [ -n "$persisted" ] && [ "$FELIS_ROOT_DOMAIN" != "$persisted" ]; then

    # Deliberate re-domain. Allowed -- there is no other route to it -- but it is not a

    # thing this script finishes: the panel certificate, the two secrets, the velocity

    # config and the login CR all still carry the old name.

    warn "FELIS_ROOT_DOMAIN (${FELIS_ROOT_DOMAIN}) differs from the installed ${persisted}."

    warn "This re-domains the install. The write-once panel certificate is NOT reissued and"

    warn "will keep the old hostnames; the proxy and login config need the same treatment."

  fi

  FELIS_ROOT_DOMAIN="${FELIS_ROOT_DOMAIN:-${persisted:-${NODE_IP}.nip.io}}"

  if [ -n "$persisted" ] && [ "$FELIS_ROOT_DOMAIN" = "$persisted" ]; then

    log "node IP: ${NODE_IP}   root domain: ${FELIS_ROOT_DOMAIN} (reusing the installed domain)"

  else

    log "node IP: ${NODE_IP}   root domain: ${FELIS_ROOT_DOMAIN}"

  fi

}

pkg_install() {