**Related issue:** Resolves#50285
## Summary
- Restore the `All Hosts` and Apple platform built-in label memberships
in the same transaction that clears stale host state during Automated
Device Enrollment (ADE).
- Backfill missing built-in memberships for existing macOS, iOS, and
iPadOS hosts.
- Add regression coverage confirming that an iPadOS update declaration
remains targeted and reaches verified status after the enrollment reset.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one host's records do not affect another)
- [ ] QA'd all new/changed functionality manually
Automated verification:
```sh
MYSQL_TEST=1 go test -run 'TestMDMApple/MDMAppleResetOnReenrollment' ./server/datastore/mysql
MYSQL_TEST=1 go test -run TestUp_20260731100711 ./server/datastore/mysql/migrations/tables
MYSQL_TEST=1 go test -run 'TestIntegrationsMDM/TestIPadOSUpdateDeclarationAfterMDMReset' ./server/service
go test -run TestMDMTokenUpdateResetOnReenrollment ./server/service
go vet ./server/datastore/mysql ./server/service
go build ./server/datastore/mysql/migrations/...
make test-schema
```
## Database migrations
- [x] Checked schema for all modified tables for columns that
auto-update timestamps during migration.
- [x] Confirmed that timestamp behavior is acceptable and will not cause
unwanted side effects. The migration inserts only missing memberships
and leaves existing membership timestamps unchanged.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Apple devices now retain their built-in label memberships after
Automated Device Enrollment or MDM reset.
* Label-scoped profiles, software, and operating system updates can now
continue to be delivered after a reset.
* Platform-specific memberships are restored for macOS, iOS, and iPadOS
devices, including applicable hosts with unspecified platforms.
* iPadOS update declarations now reconcile successfully after an MDM
reset.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Bas Bleijerveld
60e6827071