@7ots/cli 0.1.6 → 0.1.8

package/server/platform/vm.mjs

@@ -1,15 +1,36 @@
 /**
  * The machine where an ot's assistant worker runs, and the desktop → VM offload channel (docs/VM-PLAN.md).
  *
- * Phase 0: the owner brings their own Linux box (provider 'byo'): the dashboard hands out a one-time
+ * Provider 'byo': the owner brings their own Linux box: the dashboard hands out a one-time
  * `7ve_` code and the exact command; `7ots vm enroll` trades it for a `7vm_` token bound to that one
- * ot and `7ots vm worker` connects outbound only (no SSH keys ever reach 7ots). VMs paid by 7ots
- * (provider 'orquesta', created through Orquesta) come in Phase 1 and are what accounts.vm_enabled gates.
+ * ot and `7ots vm worker` connects outbound only (no SSH keys ever reach 7ots).
+ * Provider 'orquesta' ("7ots server, operated by Orquesta"): gated by accounts.vm_enabled and
+ * ORQUESTA_VM_TOKEN (7ots' partner oak_ key: orgs:write + projects:write + vms:write, never shown to
+ * anyone). Each 7ots account gets its own Orquesta child org (POST /api/v1/partner/orgs, external_ref
+ * `<prefix>acct:<accountId>`, kept in accounts.orq_org_id) and every project/VM call for it carries
+ * `X-Orquesta-Org: <child>`. Orquesta bills the child through its own Stripe Checkout: until the child's
+ * billing is active, POST /vm answers { needsPayment, checkoutUrl } (back to /app/?vm_ots=<id>).
+ * Provider 'orquesta_user': the owner connected their own Orquesta account (orquesta.mjs) with an oak_
+ * key that has projects:write + vms:write; the VM is created in THEIR org, with their key (which never
+ * leaves orquesta.mjs) and billed to them by Orquesta. No child org, no 7ots checkout.
+ * Both create project `ot-<id>` + its VM with a bootstrap that enrolls it the same way (code valid
+ * VM_ORQ_ENROLL_MIN, default 60, to cover the boot). Quotas VM_PER_ACCOUNT (default 1, both providers)
+ * and VM_MAX_TOTAL (default 10, 'orquesta' only). Deleting the VM, the ot or the account tears down VM
+ * and project with the credential that made them; releasing the account also deletes its child org
+ * (which cancels its Orquesta subscription). A reconciliation every VM_RECONCILE_MIN (30) compares
+ * GET /api/v1/vms of each child org with ots_vms, refreshes 'orquesta_user' VMs one by one, retries
+ * failed teardowns and org deletions and logs orphans (VM_REAP_ORPHANS=1 deletes them).
+ * Env: ORQUESTA_URL, ORQUESTA_VM_SIZE (default: cheapest), ORQUESTA_VM_SIZES ('slug[:usd],…'), ORQUESTA_VM_REGION,
+ * ORQUESTA_VM_REF_PREFIX ('7ots:', distinct per 7ots install sharing one org), SEVENOTS_VM_CLI (pinned, 0.1.6).
  *
  * Dashboard (session + X-7ots-Admin, via routes.mjs):
- *   GET    /api/platform/ots/:id/vm          { vm|null, online, jobs, kinds, daily, paidVms }
+ *   GET    /api/platform/ots/:id/vm          { vm|null, jobs, kinds, daily, paidVms, hosted: { available, canCreate, reason, sizes, billing, user, defaultOption, … } }
+ *   POST   /api/platform/ots/:id/vm          { provider: 'orquesta'|'orquesta_user', size? } → 202 { vm } (provisioning in the background)
+ *                                             · 'orquesta' unpaid → 200 { needsPayment: true, checkoutUrl, monthlyPrice }
+ *   GET    /api/platform/ots/:id/vm/billing  { status, active } of the account's child org (polled after the checkout)
+ *   DELETE /api/platform/ots/:id/vm/subscription   no 7ots server left → deletes the child org (ends the subscription)
  *   POST   /api/platform/ots/:id/vm/enroll   { provider?: 'byo' } → { code, expiresIn, command }
- *   DELETE /api/platform/ots/:id/vm          revokes the worker, marks it terminated
+ *   DELETE /api/platform/ots/:id/vm          revokes the worker; byo → terminated, orquesta → 202 terminating → terminated
  *
  * Worker on the VM (Authorization: Bearer 7vm_…):
  *   POST /api/vm/enroll { code } → { token, ots }          (no auth, rate-limited, code used once)
@@ -37,7 +58,8 @@ import { identityPrompt } from '../identity.mjs';
 import { errorText, reqT } from '../i18n.mjs';
 import { getDb, tx } from './db.mjs';
 import { newId, sha256, token } from './crypto.mjs';
-import { getOts, getOwnOts } from './store.mjs';
+import { getOts, getOwnOts, getPlatformState, setPlatformState } from './store.mjs';
+import { orquestaInfra, orquestaVmAccess } from './orquesta.mjs';
 import { otsStep } from './runtime.mjs';
 
 const penv = process.env;
@@ -113,6 +135,7 @@ function vmView(vm) {
     enrollExpiresAt: vm.enroll_hash ? vm.enroll_exp : null,
     error: vm.error || null,
     since: vm.created_at,
+    ...(HOSTED.includes(vm.provider) ? { orqStatus: vm.orq_status || null, ip: vm.ip || null, monthlyPrice: vm.price_cents ? vm.price_cents / 100 : null, checkedAt: vm.orq_checked_at || null } : {}),
   };
 }
 
@@ -180,6 +203,491 @@ function workerJob(j, ots) {
   return { id: j.id, kind: j.kind, input: j.input, context: j.context, prompt, createdAt: j.created_at };
 }
 
+// ───────────── VMs paid by 7ots, created through Orquesta (provider 'orquesta') ─────────────
+//
+// One Orquesta project `ot-<otsId>` per VM (Orquesta allows one VM per project), created with the
+// org-wide ORQUESTA_VM_TOKEN; the VM boots with a bootstrap that enrolls it with a one-time 7ve_
+// code, exactly as an owner's own server would. ots_vms.status: creating (Orquesta calls in flight)
+// → pending (VM booting, waiting for the worker) → enrolled · error · terminating → terminated.
+// orq_status mirrors Orquesta's own VM status (checked at most every 15 s).
+
+const ORQ = () => (penv.ORQUESTA_URL || 'https://getorquesta.com').replace(/\/+$/, '');
+const orqToken = () => String(penv.ORQUESTA_VM_TOKEN || '').trim();
+export const hostedConfigured = () => !!orqToken();
+const REF_PREFIX = () => penv.ORQUESTA_VM_REF_PREFIX || '7ots:';
+const ORQ_ENROLL_TTL = () => Math.max(10, Number(penv.VM_ORQ_ENROLL_MIN || 60)) * 60_000; // covers the boot
+const ORQ_CACHE_MS = 15_000;
+const MAX_TOTAL = () => Math.max(0, Number(penv.VM_MAX_TOTAL ?? 10));
+const PER_ACCOUNT = () => Math.max(0, Number(penv.VM_PER_ACCOUNT ?? 1));
+const RECONCILE_MS = () => Math.max(0.01, Number(penv.VM_RECONCILE_MIN || 30)) * 60_000;
+const PROJECT_RETRY_MS = () => Number(penv.VM_ORQ_RETRY_MS || 10_000);
+const HOSTED = ['orquesta', 'orquesta_user'];
+const LIVE_ORQ = "provider IN ('orquesta', 'orquesta_user') AND status <> 'terminated'"; // per-account quota
+const LIVE_PARTNER = "provider = 'orquesta' AND status <> 'terminated'"; // 7ots' own fleet (VM_MAX_TOTAL)
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** The CLI the VM installs, pinned (SEVENOTS_VM_CLI: '0.1.6' or '@7ots/cli@0.1.6'). */
+function cliSpec() {
+  const v = String(penv.SEVENOTS_VM_CLI || '0.1.7').trim();
+  const s = v.startsWith('@7ots/cli@') ? v : `@7ots/cli@${v}`;
+  if (!/^@7ots\/cli@\d+\.\d+\.\d+(-[0-9A-Za-z.]+)?$/.test(s)) throw new Error('SEVENOTS_VM_CLI must be an exact version');
+  return s;
+}
+
+/** Sizes known (ORQUESTA_VM_SIZES 'slug[:usd/month],…'; prices from Orquesta's AWS catalogue). */
+function hostedSizes() {
+  const list = String(penv.ORQUESTA_VM_SIZES || 't3.micro:17,t3.small:28,t3.medium:49')
+    .split(/[\s,]+/)
+    .map((x) => x.split(':'))
+    .filter(([id]) => /^[a-z0-9][a-z0-9.-]{1,40}$/.test(id))
+    .map(([id, p]) => ({ id, monthlyPrice: Number(p) > 0 ? Number(p) : null }));
+  return list.length ? list : [{ id: 't3.small', monthlyPrice: null }];
+}
+/** Always the cheapest size (ORQUESTA_VM_SIZE overrides only if listed). */
+function defaultSize() {
+  const all = hostedSizes();
+  const forced = all.find((s) => s.id === penv.ORQUESTA_VM_SIZE);
+  if (forced) return forced.id;
+  return all.reduce((a, b) => ((b.monthlyPrice ?? Infinity) < (a.monthlyPrice ?? Infinity) ? b : a)).id;
+}
+
+/** Monthly price in cents from whatever Orquesta returns (its catalogue counts cents). */
+function priceCents(v) {
+  const c = v?.priceMonthly ?? v?.price_monthly ?? v?.size?.priceMonthly ?? v?.size?.price_monthly;
+  if (Number(c) > 0) return Math.round(Number(c));
+  const usd = v?.monthly_price_usd ?? v?.monthlyPriceUsd ?? v?.monthly_price ?? v?.monthlyPrice;
+  return Number(usd) > 0 ? Math.round(Number(usd) * 100) : null;
+}
+
+class OrqError extends Error {}
+
+const orqFail = (method, path, status, data) => {
+  const msg = typeof data.error === 'string' ? data.error : data.error?.message || data.message || '';
+  return Object.assign(new OrqError(`Orquesta ${method} ${path.replace(/\/[^/]{20,}/g, '/…')}: HTTP ${status}${msg ? ` ${clean(msg, 200)}` : ''}`), { status, code: data.error?.code || data.code });
+};
+
+/**
+ * Orquesta's /api/v1 with a credential:
+ *   { kind: 'partner', org } → ORQUESTA_VM_TOKEN, plus X-Orquesta-Org when org is a child ('' = 7ots' own org);
+ *   { kind: 'user', accountId } → the owner's own key, through orquesta.mjs (it never reaches this module).
+ * Without cred: the partner key on its own org (the /partner/orgs routes refuse X-Orquesta-Org).
+ */
+async function orq(method, path, body, timeoutMs = 20_000, cred = null) {
+  if (cred?.kind === 'user') {
+    let r;
+    try {
+      r = await orquestaInfra(cred.accountId, method, `/api/v1${path}`, body, timeoutMs);
+    } catch (e) {
+      // Not connected / reconnect / unreachable: never a 404 or 409 of the resource itself.
+      throw Object.assign(new OrqError(`Orquesta (owner's account): ${clean(e.message, 200)}`), { status: 0, code: 'credentials', i18n: e.i18n });
+    }
+    if (!r.ok) throw orqFail(method, path, r.status, r.data || {});
+    return r.status === 204 ? {} : r.data || {};
+  }
+  let res;
+  try {
+    res = await fetch(`${ORQ()}/api/v1${path}`, {
+      method,
+      headers: {
+        Accept: 'application/json',
+        Authorization: `Bearer ${orqToken()}`,
+        ...(cred?.org ? { 'X-Orquesta-Org': cred.org } : {}),
+        ...(body ? { 'Content-Type': 'application/json' } : {}),
+      },
+      body: body ? JSON.stringify(body) : undefined,
+      redirect: 'manual',
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (e) {
+    throw Object.assign(new OrqError(`Orquesta unreachable (${e.name === 'TimeoutError' ? 'timeout' : e.code || e.name})`), { status: 0 });
+  }
+  const data = res.status === 204 ? {} : await res.json().catch(() => ({}));
+  if (!res.ok) throw orqFail(method, path, res.status, data);
+  return data;
+}
+
+/** The credential that made (and unmakes) a row's VM. */
+const credOf = (row) => (row.provider === 'orquesta_user' ? { kind: 'user', accountId: row.account_id } : { kind: 'partner', org: row.orq_org_id || '' });
+const credOfItem = (x) => (x.user ? { kind: 'user', accountId: x.accountId } : { kind: 'partner', org: x.org || '' });
+
+// ── the account's child org (provider 'orquesta') ──
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const accountOrg = (accountId) => getDb().prepare('SELECT orq_org_id FROM accounts WHERE id = ?').get(accountId)?.orq_org_id || '';
+const accountRef = (accountId) => `${REF_PREFIX()}acct:${accountId}`;
+const ensuring = new Map(); // account id → Promise<org id>
+
+/** The account's Orquesta child org, created the first time (idempotent on Orquesta's side by external_ref). */
+function ensureChildOrg(accountId) {
+  const have = accountOrg(accountId);
+  if (have) return Promise.resolve(have);
+  if (!ensuring.has(accountId)) {
+    const p = (async () => {
+      const r = await orq('POST', '/partner/orgs', { external_ref: accountRef(accountId), name: `7ots account ${accountId}`.slice(0, 100) });
+      const id = String(r.org?.id || '');
+      if (!UUID_RE.test(id)) throw new OrqError('Orquesta returned no organization id');
+      getDb().prepare("UPDATE accounts SET orq_org_id = ? WHERE id = ? AND orq_org_id = ''").run(id, accountId);
+      return accountOrg(accountId) || id;
+    })().finally(() => ensuring.delete(accountId));
+    ensuring.set(accountId, p);
+  }
+  return ensuring.get(accountId);
+}
+
+const billingSeen = new Map(); // account id → { status, at } (last answer from Orquesta, for the card)
+
+/** Billing status of the account's child org: 'active' | 'past_due' | 'canceled' | null (never paid). */
+async function childBilling(accountId, org) {
+  const r = await orq('GET', `/partner/orgs/${encodeURIComponent(org)}/billing`, null, 10_000);
+  const status = r.status ? clean(r.status, 20) : null;
+  billingSeen.set(accountId, { status, at: now() });
+  return status;
+}
+
+function orgDeletes() {
+  try {
+    const q = JSON.parse(getPlatformState('vm_org_deletes') || '[]');
+    return Array.isArray(q) ? q : [];
+  } catch {
+    return [];
+  }
+}
+const setOrgDeletes = (q) => setPlatformState('vm_org_deletes', JSON.stringify(q.slice(-500)));
+
+/** Deletes a child org (Orquesta cancels its subscription first). 409 while a VM is still going away → queued. */
+async function dropChildOrg(accountId, org) {
+  if (!org) return true;
+  try {
+    await orq('DELETE', `/partner/orgs/${encodeURIComponent(org)}`, null, 30_000);
+  } catch (e) {
+    if (e.status !== 404) {
+      console.warn(`[7ots] vm org delete ${org}:`, e.message);
+      setOrgDeletes([...orgDeletes().filter((x) => x.org !== org), { org, accountId, at: now() }]);
+      return false;
+    }
+  }
+  setOrgDeletes(orgDeletes().filter((x) => x.org !== org));
+  getDb().prepare("UPDATE accounts SET orq_org_id = '' WHERE id = ? AND orq_org_id = ?").run(accountId, org);
+  billingSeen.delete(accountId);
+  return true;
+}
+
+/** Bash run as root at the end of the VM's user-data (≤ 8 KB). Every value is validated, never free text. */
+export function bootstrapScript({ server, code, cli = cliSpec() }) {
+  if (!/^https?:\/\/[A-Za-z0-9.:[\]-]+(\/[A-Za-z0-9._~/-]*)?$/.test(server)) throw new Error('bad server url');
+  if (!/^7ve_[A-Za-z0-9_-]{20,100}$/.test(code)) throw new Error('bad code');
+  return `#!/bin/bash
+# 7ots cloud worker: user "ot" runs \`7ots vm worker\` (outbound HTTPS only).
+set -euo pipefail
+exec >>/var/log/7ots-bootstrap.log 2>&1
+echo "[7ots] bootstrap $(date -u +%FT%TZ)"
+CLI='${cli}'
+SERVER='${server}'
+CODE='${code}'
+if ! command -v node >/dev/null 2>&1 || ! node -e 'process.exit(+process.versions.node.split(".")[0] < 20 ? 1 : 0)'; then
+  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+  DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
+fi
+id ot >/dev/null 2>&1 || useradd --create-home --shell /bin/bash ot
+# Pinned and installed once: the service never fetches code at restart.
+npm install -g --no-fund --no-audit "$CLI"
+BIN="$(command -v 7ots)"
+sudo -u ot -H "$BIN" vm enroll --server "$SERVER" --code "$CODE"
+# System unit (a --user unit would need a login session/linger for "ot").
+cat >/etc/systemd/system/7ots-vm.service <<UNIT
+[Unit]
+Description=7ots cloud worker (7ots vm worker)
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+User=ot
+Group=ot
+WorkingDirectory=/home/ot
+Environment=HOME=/home/ot
+ExecStart=$BIN vm worker
+Restart=always
+RestartSec=10
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+systemctl daemon-reload
+systemctl enable --now 7ots-vm
+echo "[7ots] worker started"
+`;
+}
+
+function setRow(otsId, fields, where = '') {
+  const keys = Object.keys(fields);
+  return getDb()
+    .prepare(`UPDATE ots_vms SET ${keys.map((k) => `${k} = ?`).join(', ')}, updated_at = ? WHERE ots_id = ?${where ? ` AND ${where}` : ''}`)
+    .run(...keys.map((k) => fields[k]), now(), otsId).changes;
+}
+
+const inflight = new Map(); // ots id → provisioning promise
+const checking = new Map(); // ots id → status refresh promise
+
+function teardownQueue() {
+  try {
+    const q = JSON.parse(getPlatformState('vm_teardowns') || '[]');
+    return Array.isArray(q) ? q : [];
+  } catch {
+    return [];
+  }
+}
+/** item: { pid, otsId, accountId, org, user } — enough to rebuild the credential that made the project. */
+function queueTeardown(item) {
+  const q = teardownQueue().filter((x) => x.pid !== item.pid);
+  setPlatformState('vm_teardowns', JSON.stringify([...q, { ...item, at: now() }].slice(-500)));
+}
+function dequeueTeardown(pid) {
+  setPlatformState('vm_teardowns', JSON.stringify(teardownQueue().filter((x) => x.pid !== pid)));
+}
+const teardownItem = (row, pid = row.orq_project_id) => ({ pid, otsId: row.ots_id, accountId: row.account_id, org: row.orq_org_id || '', user: row.provider === 'orquesta_user' });
+
+/** Terminates the project's VM, then the project. 404 = already gone. 409 on the project = VM still going away. */
+async function destroy(pid, { retries = 6, cred = null } = {}) {
+  if (!pid) return;
+  const p = `/projects/${encodeURIComponent(pid)}`;
+  try {
+    await orq('DELETE', `${p}/vm`, null, 60_000, cred);
+  } catch (e) {
+    if (e.status !== 404) throw e;
+  }
+  for (let i = 0; ; i++) {
+    try {
+      return void (await orq('DELETE', p, null, 20_000, cred));
+    } catch (e) {
+      if (e.status === 404) return;
+      if (e.status !== 409 || i >= retries) throw e;
+      await sleep(PROJECT_RETRY_MS());
+    }
+  }
+}
+
+/** Runs after DELETE (and after a provisioning in flight ends): row 'terminating' → 'terminated'. */
+async function finishTeardown(otsId) {
+  await inflight.get(otsId)?.catch(() => {});
+  const row = vmRow(otsId);
+  if (!row || row.status !== 'terminating') return;
+  try {
+    await destroy(row.orq_project_id, { cred: credOf(row) });
+    setRow(otsId, { status: 'terminated', orq_status: 'terminated', ip: '', error: '' }, "status = 'terminating'");
+    dequeueTeardown(row.orq_project_id);
+  } catch (e) {
+    console.warn(`[7ots] vm teardown ${otsId}:`, e.message);
+    setRow(otsId, { error: clean(e.message, 500) }, "status = 'terminating'"); // reconciliation retries
+  }
+}
+
+/** What the owner reads when a create fails (in the language of the request that started it). */
+function createError(e, cred, t) {
+  if (cred.kind === 'partner' && e.status === 402) return t('platform.vm.needsPayment');
+  if (cred.kind === 'user' && e.code === 'credentials') return e.i18n ? t(e.i18n.key, e.i18n.vars) : e.message;
+  if (cred.kind === 'user' && (e.status === 401 || e.status === 403)) return `${t('platform.vm.userScopes')} (${e.message})`;
+  return e.message;
+}
+
+/** Creates project + VM. The row may be deleted (ot gone) or set 'terminating' meanwhile: then it undoes its own work. */
+async function provision(ots, { server, code, size, region, cred, t }) {
+  let pid = '';
+  const gone = () => !vmRow(ots.id);
+  const item = () => ({ pid, otsId: ots.id, accountId: ots.accountId, org: cred.org || '', user: cred.kind === 'user' });
+  const undo = (retries) => destroy(pid, { retries, cred }).catch(() => queueTeardown(item()));
+  try {
+    const p = await orq('POST', '/projects', { name: `ot-${ots.id}`, description: clean(`7ots cloud worker for "${ots.name}" (ot ${ots.id}, account ${ots.accountId})`, 300) }, 20_000, cred);
+    pid = String(p.project?.id || '');
+    if (!pid) throw new OrqError('Orquesta returned no project id');
+    setRow(ots.id, { orq_project_id: pid });
+    if (gone()) return void (await undo(0));
+    if (vmRow(ots.id).status !== 'creating') return; // DELETE came first: finishTeardown takes it from here
+    const r = await orq('POST', `/projects/${encodeURIComponent(pid)}/vm`, { size, ...(region ? { region } : {}), external_ref: `${REF_PREFIX()}${ots.id}`, bootstrap: bootstrapScript({ server, code }) }, 6 * 60_000, cred);
+    const v = r.vm || {};
+    if (gone()) return void (await undo());
+    setRow(ots.id, { orq_vm_id: String(v.id || ''), orq_status: clean(v.status, 40), ip: clean(v.ip, 60), price_cents: priceCents(v) ?? vmRow(ots.id).price_cents, orq_checked_at: now() }, "status <> 'terminated'");
+    setRow(ots.id, { status: 'pending' }, "status = 'creating'");
+  } catch (e) {
+    console.warn(`[7ots] vm create ${ots.id}:`, e.message);
+    if (e.status === 402) billingSeen.delete(ots.accountId); // the card asks for the payment again
+    if (gone()) return void (pid && (await undo()));
+    if (vmRow(ots.id).status !== 'creating') return;
+    // Undo what exists (a timed-out create may still have made the VM): ids cleared only once it is gone.
+    let undone = !pid;
+    if (pid) undone = await destroy(pid, { cred }).then(() => true, () => false);
+    setRow(ots.id, { status: 'error', error: clean(createError(e, cred, t), 500), enroll_hash: null, enroll_exp: null, ...(undone ? { orq_project_id: '', orq_vm_id: '', orq_status: '' } : {}) }, "status = 'creating'");
+  }
+}
+
+/** Orquesta's view of the VM, at most every 15 s per ot (shared by concurrent readers). */
+async function refreshHosted(otsId, { force = false } = {}) {
+  const row = vmRow(otsId);
+  if (!row || !HOSTED.includes(row.provider) || !row.orq_project_id) return row;
+  if (row.provider === 'orquesta' && !hostedConfigured()) return row;
+  if (!['pending', 'enrolled', 'error'].includes(row.status) || inflight.has(otsId)) return row;
+  if (!force && row.orq_checked_at && now() - row.orq_checked_at < ORQ_CACHE_MS) return row;
+  if (!checking.has(otsId)) {
+    const p = (async () => {
+      try {
+        const v = (await orq('GET', `/projects/${encodeURIComponent(row.orq_project_id)}/vm`, null, 8000, credOf(row))).vm;
+        if (!v) throw Object.assign(new OrqError('no vm'), { status: 404 });
+        const st = clean(v.status, 40);
+        const fields = { orq_status: st, ip: clean(v.ip, 60), orq_checked_at: now(), ...(v.id ? { orq_vm_id: String(v.id) } : {}) };
+        const pc = priceCents(v);
+        if (pc) fields.price_cents = pc;
+        setRow(otsId, fields);
+        if (/^(error|failed)$/i.test(st)) setRow(otsId, { status: 'error', error: clean(v.error || `Orquesta reports the VM as ${st}`, 500) }, "status = 'pending'");
+        else if (/^(terminated|deleted|destroyed)$/i.test(st)) setRow(otsId, { status: 'error', error: 'The VM was terminated outside 7ots' }, "status IN ('pending', 'enrolled')");
+        else if (/^(running|active)$/i.test(st)) {
+          const cur = vmRow(otsId);
+          if (cur.status === 'pending' && cur.enroll_exp && cur.enroll_exp < now()) setRow(otsId, { status: 'error', error: 'The server did not connect before its enrollment code expired; delete it and create it again', enroll_hash: null, enroll_exp: null }, "status = 'pending'");
+        }
+      } catch (e) {
+        if (e.status === 404) {
+          setRow(otsId, { orq_status: 'gone', orq_checked_at: now() });
+          setRow(otsId, { status: 'error', error: 'The VM no longer exists in Orquesta' }, "status IN ('pending', 'enrolled')");
+        } else {
+          setRow(otsId, { orq_checked_at: now() }); // keep the cache window on errors too
+          console.warn(`[7ots] vm status ${otsId}:`, e.message);
+        }
+      } finally {
+        checking.delete(otsId);
+      }
+    })();
+    checking.set(otsId, p);
+  }
+  await checking.get(otsId);
+  return vmRow(otsId);
+}
+
+/**
+ * Compares Orquesta with ots_vms. 'orquesta' VMs: GET /api/v1/vms of 7ots' own org and of every child
+ * org; refreshes them, retries teardowns, adopts or flags lost creates and logs orphans.
+ * 'orquesta_user' VMs: refreshed one by one with each owner's own credential (never listed: their org
+ * is theirs). Then queued teardowns and child-org deletions are retried.
+ */
+export async function reconcileVms() {
+  const rows = getDb().prepare(`SELECT * FROM ots_vms WHERE ${LIVE_ORQ}`).all();
+  const report = { checked: rows.length, orquesta: 0, orgs: 0, user: 0, orphans: [], missing: [], retried: 0 };
+  const prefix = REF_PREFIX();
+  const orgOf = (r) => r.orq_org_id || '';
+  if (hostedConfigured()) {
+    const partnerRows = rows.filter((r) => r.provider === 'orquesta');
+    // '' = 7ots' own org (VMs made before child orgs existed).
+    const orgs = new Set(['', ...partnerRows.map(orgOf), ...getDb().prepare("SELECT orq_org_id FROM accounts WHERE orq_org_id <> ''").all().map((a) => a.orq_org_id)]);
+    const ours = [];
+    const failed = new Set();
+    for (const org of orgs) {
+      try {
+        const { vms = [] } = await orq('GET', '/vms', null, 30_000, { kind: 'partner', org });
+        for (const v of vms) if (String(v.external_ref || '').startsWith(prefix)) ours.push({ v, org, otsId: String(v.external_ref).slice(prefix.length) });
+        report.orgs++;
+      } catch (e) {
+        failed.add(org);
+        console.warn(`[7ots] vm reconcile: GET /vms${org ? ` (org ${org})` : ''}:`, e.message);
+      }
+    }
+    if (failed.size === orgs.size) throw new OrqError('Orquesta did not list any VMs');
+    report.orquesta = ours.length;
+    for (const row of partnerRows) {
+      if (inflight.has(row.ots_id) || failed.has(orgOf(row))) continue;
+      const hit = ours.find((x) => x.org === orgOf(row) && (x.otsId === row.ots_id || (row.orq_project_id && String(x.v.project_id) === row.orq_project_id)));
+      const v = hit?.v;
+      if (row.status === 'terminating') {
+        report.retried++;
+        await finishTeardown(row.ots_id);
+        continue;
+      }
+      if (row.status === 'creating') {
+        // The server stopped mid-create: adopt what Orquesta made, or give up on it.
+        if (v) setRow(row.ots_id, { orq_project_id: String(v.project_id || row.orq_project_id), orq_vm_id: String(v.id || ''), orq_status: clean(v.status, 40), ip: clean(v.ip, 60), status: 'pending' }, "status = 'creating'");
+        else if (now() - row.updated_at > 15 * 60_000) setRow(row.ots_id, { status: 'error', error: 'Creation was interrupted' }, "status = 'creating'");
+        continue;
+      }
+      if (!v && row.orq_project_id) {
+        report.missing.push(row.ots_id);
+        setRow(row.ots_id, { orq_status: 'gone', orq_checked_at: now() });
+        if (!online(row)) setRow(row.ots_id, { status: 'error', error: 'The VM no longer exists in Orquesta' }, "status IN ('pending', 'enrolled')");
+        console.warn(`[7ots] vm reconcile: ${row.ots_id} has no VM in Orquesta`);
+      } else if (v) setRow(row.ots_id, { orq_status: clean(v.status, 40), ip: clean(v.ip, 60), orq_checked_at: now(), ...(v.id ? { orq_vm_id: String(v.id) } : {}) });
+    }
+    const live = new Set(partnerRows.map((r) => `${orgOf(r)}|${r.ots_id}`));
+    const queued = new Set(teardownQueue().map((x) => x.pid));
+    for (const { v, org, otsId } of ours) {
+      if (live.has(`${org}|${otsId}`) || queued.has(String(v.project_id))) continue;
+      if (/^(terminated|terminating|deleted|destroyed)$/i.test(String(v.status))) continue;
+      report.orphans.push({ otsId, vmId: v.id, projectId: v.project_id, status: v.status, ...(org ? { org } : {}) });
+      console.warn(`[7ots] vm reconcile: orphan VM ${v.id} (project ${v.project_id}, ref ${v.external_ref}${org ? `, org ${org}` : ''}) has no live ot`);
+      if (penv.VM_REAP_ORPHANS === '1') await destroy(String(v.project_id), { cred: { kind: 'partner', org } }).catch((e) => console.warn('[7ots] vm orphan teardown:', e.message));
+    }
+  }
+  // Owners' own VMs, each with its owner's credential.
+  for (const row of rows.filter((r) => r.provider === 'orquesta_user')) {
+    if (inflight.has(row.ots_id)) continue;
+    report.user++;
+    if (row.status === 'terminating') {
+      report.retried++;
+      await finishTeardown(row.ots_id);
+    } else if (row.status === 'creating') {
+      if (now() - row.updated_at > 15 * 60_000) setRow(row.ots_id, { status: 'error', error: 'Creation was interrupted' }, "status = 'creating'");
+    } else await refreshHosted(row.ots_id, { force: true });
+  }
+  // Teardowns that failed when an ot was deleted.
+  for (const item of teardownQueue()) {
+    if (item.user && !getDb().prepare('SELECT 1 FROM accounts WHERE id = ?').get(item.accountId)) {
+      // The owner's account (and with it their credential) is gone: the project stays in THEIR org.
+      console.warn(`[7ots] vm teardown ${item.pid}: the owner's account is gone; it must be removed in Orquesta`);
+      dequeueTeardown(item.pid);
+      continue;
+    }
+    if (!item.user && !hostedConfigured()) continue;
+    report.retried++;
+    await destroy(item.pid, { cred: credOfItem(item) }).then(() => dequeueTeardown(item.pid), (e) => console.warn(`[7ots] vm teardown retry ${item.pid}:`, e.message));
+  }
+  // Child orgs let go of (account released) while a VM was still going away.
+  if (hostedConfigured()) {
+    for (const x of orgDeletes()) {
+      if (getDb().prepare(`SELECT 1 FROM ots_vms WHERE ${LIVE_PARTNER} AND orq_org_id = ?`).get(x.org)) continue;
+      report.retried++;
+      await dropChildOrg(x.accountId, x.org);
+    }
+  }
+  setPlatformState('vm_orphans', JSON.stringify({ at: now(), orphans: report.orphans, missing: report.missing }));
+  return report;
+}
+
+/** Before an ot (or its account) is deleted: revoke its worker and tear its Orquesta VM down (queued if Orquesta fails). */
+export async function releaseOtsVm(otsId) {
+  const row = vmRow(otsId);
+  if (!row) return;
+  getDb().prepare('UPDATE ots_vms SET agent_hash = NULL, enroll_hash = NULL, enroll_exp = NULL, updated_at = ? WHERE ots_id = ?').run(now(), otsId);
+  if (!HOSTED.includes(row.provider) || row.status === 'terminated') return;
+  setRow(otsId, { status: 'terminating' });
+  if (inflight.has(otsId)) return; // provision() sees the row gone and undoes its own work
+  if (!row.orq_project_id) return;
+  try {
+    await destroy(row.orq_project_id, { retries: 0, cred: credOf(row) });
+  } catch (e) {
+    console.warn(`[7ots] vm teardown on delete ${otsId}:`, e.message);
+    queueTeardown(teardownItem(row));
+  }
+}
+
+/**
+ * Before an account is deleted: every VM of it goes, then its Orquesta child org (Orquesta cancels the
+ * subscription first). While a VM is still going away Orquesta answers 409 and the deletion is queued
+ * for the reconciliation.
+ */
+export async function releaseAccountVms(accountId) {
+  for (const { ots_id } of getDb().prepare('SELECT ots_id FROM ots_vms WHERE account_id = ?').all(accountId)) await releaseOtsVm(ots_id);
+  await Promise.all(getDb().prepare('SELECT ots_id FROM ots_vms WHERE account_id = ?').all(accountId).map(({ ots_id }) => inflight.get(ots_id)?.catch(() => {})));
+  const org = accountOrg(accountId);
+  if (org && hostedConfigured()) await dropChildOrg(accountId, org);
+}
+
 /**
  * @param {{ send: Function, readJson: Function, rateLimit: (req) => boolean, base: (req) => string }} deps
  */
@@ -353,34 +861,197 @@ export function createVm({ send, readJson, rateLimit, base }) {
 
   // ───────────── dashboard (/api/platform/ots/:id/vm…) ─────────────
 
+  /** What the dashboard needs to offer a hosted server: 7ots' (via the account's child org) and/or one in the owner's own Orquesta org. */
+  function hostedInfo(account) {
+    const enabled = account.vm_enabled === 1;
+    const configured = hostedConfigured();
+    const used = getDb().prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ} AND account_id = ?`).get(account.id).n;
+    const total = getDb().prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_PARTNER}`).get().n;
+    const reason = !enabled ? 'notEnabled' : !configured ? 'notConfigured' : used >= PER_ACCOUNT() ? 'accountLimit' : total >= MAX_TOTAL() ? 'full' : null;
+    const size = defaultSize();
+    const access = orquestaVmAccess(account.id);
+    const userReason = !access.usable ? access.reason : used >= PER_ACCOUNT() ? 'accountLimit' : null;
+    const org = accountOrg(account.id);
+    return {
+      enabled,
+      configured,
+      available: enabled && configured,
+      canCreate: !reason,
+      reason,
+      sizes: hostedSizes().filter((z) => z.id === size),
+      defaultSize: size,
+      monthlyPrice: hostedSizes().find((z) => z.id === size)?.monthlyPrice ?? null,
+      region: penv.ORQUESTA_VM_REGION || null,
+      used,
+      max: PER_ACCOUNT(),
+      operator: 'Orquesta',
+      // 7ots server: Orquesta bills the account's child org; null = never paid (or not known yet).
+      billing: org ? (billingSeen.get(account.id)?.status ?? null) : null,
+      // The owner's own Orquesta account (path A): needs an oak_ key with projects:write + vms:write.
+      user: { connected: access.connected, canCreate: !userReason, reason: userReason },
+      defaultOption: access.connected ? 'user' : '7ots',
+    };
+  }
+
+  /** Same quotas for both providers, checked inside the reserving transaction (and once before any Orquesta call). */
+  function quotaError(d, t, account, ots, partner) {
+    const cur = d.prepare('SELECT * FROM ots_vms WHERE ots_id = ?').get(ots.id);
+    if (cur && cur.status !== 'terminated' && (HOSTED.includes(cur.provider) || cur.status === 'enrolled')) return [409, t('platform.vm.exists')];
+    if (inflight.has(ots.id)) return [409, t('platform.vm.exists')];
+    if (d.prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ} AND account_id = ?`).get(account.id).n >= PER_ACCOUNT()) return [403, t('platform.vm.accountLimit', { max: PER_ACCOUNT() })];
+    if (partner && d.prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_PARTNER}`).get().n >= MAX_TOTAL()) return [503, t('platform.vm.full')];
+    return null;
+  }
+
+  /** Billing of the account's child org; an org deleted on Orquesta's side is forgotten and made again. */
+  async function billingOf(account) {
+    let org = await ensureChildOrg(account.id);
+    try {
+      return { org, status: await childBilling(account.id, org) };
+    } catch (e) {
+      if (e.status !== 404) throw e;
+      getDb().prepare("UPDATE accounts SET orq_org_id = '' WHERE id = ? AND orq_org_id = ?").run(account.id, org);
+      org = await ensureChildOrg(account.id);
+      return { org, status: await childBilling(account.id, org) };
+    }
+  }
+
+  /**
+   * POST /vm {provider:'orquesta'|'orquesta_user'}: reserves the slot (quotas, atomically) and provisions in the background.
+   * 'orquesta' first makes sure the account's child org exists and is paid: if not, { needsPayment, checkoutUrl }.
+   */
+  async function createHosted(req, res, account, ots, provider) {
+    const t = reqT(req);
+    const user = provider === 'orquesta_user';
+    if (user) {
+      const a = orquestaVmAccess(account.id);
+      if (!a.usable) {
+        const key = { needsKey: 'platform.vm.userNeedsKey', reconnect: 'platform.orquesta.reconnect' }[a.reason] || 'platform.orquesta.notConnected';
+        return send(res, 409, { error: t(key), code: `orquesta_${a.reason}` });
+      }
+    } else {
+      if (account.vm_enabled !== 1) return send(res, 403, { error: t('platform.vm.paidOff') });
+      if (!hostedConfigured()) return send(res, 503, { error: t('platform.vm.paidUnavailable') });
+    }
+    const size = defaultSize();
+    let server;
+    try {
+      server = base(req);
+      bootstrapScript({ server, code: `7ve_${'x'.repeat(30)}` }); // validates the URL and SEVENOTS_VM_CLI before spending anything
+    } catch (e) {
+      console.warn('[7ots] vm create:', e.message);
+      return send(res, 503, { error: t('platform.vm.paidUnavailable') });
+    }
+    const pre = quotaError(getDb(), t, account, ots, !user);
+    if (pre) return send(res, pre[0], { error: pre[1] });
+    const price = hostedSizes().find((s) => s.id === size).monthlyPrice;
+    let cred = { kind: 'user', accountId: account.id };
+    if (!user) {
+      try {
+        const { org, status } = await billingOf(account);
+        if (status !== 'active') {
+          let ck = null;
+          try {
+            // No #fragment: Orquesta appends ?orq_checkout=success|cancel; the dashboard opens the ot from vm_ots.
+            ck = await orq('POST', `/partner/orgs/${encodeURIComponent(org)}/checkout`, { return_url: `${server}/app/?vm_ots=${encodeURIComponent(ots.id)}`, size });
+          } catch (e) {
+            if (e.status !== 409) throw e; // ALREADY_ACTIVE (paid meanwhile) / PARTNER_BILLED: nothing to pay
+          }
+          if (ck) {
+            if (!/^https:\/\//.test(String(ck.url || ''))) throw new OrqError('Orquesta returned no checkout URL');
+            return send(res, 200, { needsPayment: true, checkoutUrl: ck.url, size, monthlyPrice: price, operator: 'Orquesta', hosted: hostedInfo(account) });
+          }
+        }
+        cred = { kind: 'partner', org };
+      } catch (e) {
+        console.warn('[7ots] vm billing:', e.message);
+        return send(res, 503, { error: t('platform.vm.paidUnavailable') });
+      }
+    }
+    const region = penv.ORQUESTA_VM_REGION || '';
+    const code = `7ve_${token()}`;
+    const tm = now();
+    const err = tx((d) => {
+      const q = quotaError(d, t, account, ots, !user);
+      if (q) return q;
+      d.prepare(`INSERT INTO ots_vms (ots_id, account_id, provider, orq_org_id, status, size, region, enroll_hash, enroll_exp, price_cents, created_at, updated_at) VALUES (?, ?, ?, ?, 'creating', ?, ?, ?, ?, ?, ?, ?)
+                 ON CONFLICT(ots_id) DO UPDATE SET account_id = excluded.account_id, provider = excluded.provider, orq_org_id = excluded.orq_org_id, status = 'creating', orq_project_id = '', orq_vm_id = '', orq_status = '', orq_checked_at = NULL, size = excluded.size, region = excluded.region,
+                   ip = '', error = '', enroll_hash = excluded.enroll_hash, enroll_exp = excluded.enroll_exp, agent_hash = NULL, agent_seen_at = NULL, worker_version = '', worker_info = '{}', price_cents = excluded.price_cents, created_at = excluded.created_at, updated_at = excluded.updated_at`)
+        .run(ots.id, account.id, user ? 'orquesta_user' : 'orquesta', cred.org || '', size, region, sha256(code), tm + ORQ_ENROLL_TTL(), price ? Math.round(price * 100) : null, tm, tm);
+      return null;
+    });
+    if (err) return send(res, err[0], { error: err[1] });
+    const job = provision(ots, { server, code, size, region, cred, t }).finally(() => inflight.delete(ots.id));
+    inflight.set(ots.id, job);
+    return send(res, 202, { vm: vmView(vmRow(ots.id)), hosted: hostedInfo(account) });
+  }
+
   /** @returns {Promise<boolean>} true if it served the route */
   async function dashboard(req, res, account, ots, sub) {
     if (sub !== '/vm' && !sub.startsWith('/vm/')) return false;
     const t = reqT(req);
-    const vm = vmRow(ots.id);
+    let vm = vmRow(ots.id);
     if (sub === '/vm' && req.method === 'GET') {
       reap(ots.id);
-      return send(res, 200, { vm: vmView(vm), jobs: recentJobs(ots.id), kinds: otsVmKinds(ots), allKinds: VM_KINDS, daily: { used: jobsLastDay(ots.id), max: DAILY() }, paidVms: account.vm_enabled === 1 }), true;
+      if (HOSTED.includes(vm?.provider)) vm = await refreshHosted(ots.id);
+      // What the card says about payment: asked to Orquesta at most every 5 min per account.
+      const org = accountOrg(account.id);
+      const seenAt = billingSeen.get(account.id)?.at || 0;
+      if (org && hostedConfigured() && now() - seenAt > 5 * 60_000) await childBilling(account.id, org).catch((e) => console.warn('[7ots] vm billing:', e.message));
+      return send(res, 200, { vm: vmView(vm), jobs: recentJobs(ots.id), kinds: otsVmKinds(ots), allKinds: VM_KINDS, daily: { used: jobsLastDay(ots.id), max: DAILY() }, paidVms: account.vm_enabled === 1, hosted: hostedInfo(account) }), true;
+    }
+    if (sub === '/vm/billing' && req.method === 'GET') {
+      // Polled by the dashboard after Orquesta's checkout, until the webhook marks the subscription active.
+      const org = accountOrg(account.id);
+      if (!org || !hostedConfigured()) return send(res, 200, { status: null, active: false }), true;
+      try {
+        const status = await childBilling(account.id, org);
+        return send(res, 200, { status, active: status === 'active' }), true;
+      } catch (e) {
+        console.warn('[7ots] vm billing:', e.message);
+        return send(res, 503, { error: t('platform.vm.paidUnavailable') }), true;
+      }
+    }
+    if (sub === '/vm/subscription' && req.method === 'DELETE') {
+      // Ends what the account pays for 7ots servers: only with none left (deleting the org cancels the subscription).
+      if (getDb().prepare(`SELECT 1 FROM ots_vms WHERE ${LIVE_PARTNER} AND account_id = ?`).get(account.id)) return send(res, 409, { error: t('platform.vm.subscriptionInUse') }), true;
+      const org = accountOrg(account.id);
+      if (!org) return send(res, 200, { ok: true }), true;
+      const done = await dropChildOrg(account.id, org);
+      return send(res, done ? 200 : 202, { ok: true, queued: !done, hosted: hostedInfo(account) }), true;
     }
-    if (sub === '/vm/enroll' && req.method === 'POST') {
-      const { provider = 'byo' } = await readJson(req, 4096);
-      // VMs paid by 7ots are created through Orquesta (Phase 1): not yet.
-      if (provider === 'orquesta') return send(res, account.vm_enabled === 1 ? 501 : 403, { error: t('platform.vm.paidSoon') }), true;
-      if (provider !== 'byo') return send(res, 400, { error: t('server.http.badRequest') }), true;
+    if ((sub === '/vm' || sub === '/vm/enroll') && req.method === 'POST') {
+      const body = await readJson(req, 4096);
+      const provider = body.provider || (sub === '/vm' ? 'orquesta' : 'byo');
+      if (HOSTED.includes(provider) && sub === '/vm') return await createHosted(req, res, account, ots, provider), true;
+      if (provider !== 'byo' || sub !== '/vm/enroll') return send(res, 400, { error: t('server.http.badRequest') }), true;
+      // A hosted server must be deleted first: re-enrolling would leave its VM running unattached.
+      if (HOSTED.includes(vm?.provider) && vm.status !== 'terminated') return send(res, 409, { error: t('platform.vm.exists') }), true;
       const code = `7ve_${token()}`;
       const tm = now();
-      if (vm) getDb().prepare("UPDATE ots_vms SET enroll_hash = ?, enroll_exp = ?, provider = 'byo', status = CASE WHEN status = 'terminated' THEN 'pending' ELSE status END, updated_at = ? WHERE ots_id = ?").run(sha256(code), tm + ENROLL_TTL, tm, ots.id);
+      if (vm) getDb().prepare("UPDATE ots_vms SET enroll_hash = ?, enroll_exp = ?, provider = 'byo', orq_org_id = '', status = CASE WHEN status = 'terminated' THEN 'pending' ELSE status END, updated_at = ? WHERE ots_id = ?").run(sha256(code), tm + ENROLL_TTL, tm, ots.id);
       else getDb().prepare("INSERT INTO ots_vms (ots_id, account_id, provider, status, enroll_hash, enroll_exp, created_at, updated_at) VALUES (?, ?, 'byo', 'pending', ?, ?, ?, ?)").run(ots.id, account.id, sha256(code), tm + ENROLL_TTL, tm, tm);
       return send(res, 200, { code, expiresIn: ENROLL_TTL / 1000, command: `npx -y @7ots/cli vm enroll --server ${base(req)} --code ${code} --systemd` }), true;
     }
     if (sub === '/vm' && req.method === 'DELETE') {
       if (!vm) return send(res, 200, { ok: true }), true;
-      getDb().prepare("UPDATE ots_vms SET agent_hash = NULL, enroll_hash = NULL, enroll_exp = NULL, status = 'terminated', updated_at = ? WHERE ots_id = ?").run(now(), ots.id);
+      const hosted = HOSTED.includes(vm.provider) && vm.status !== 'terminated';
+      getDb().prepare(`UPDATE ots_vms SET agent_hash = NULL, enroll_hash = NULL, enroll_exp = NULL, status = '${hosted ? 'terminating' : 'terminated'}', updated_at = ? WHERE ots_id = ?`).run(now(), ots.id);
       for (const j of getDb().prepare("SELECT * FROM vm_jobs WHERE ots_id = ? AND status NOT IN ('completed', 'failed', 'cancelled')").all(ots.id)) setStatus(j, 'cancelled', { error: 'worker revoked' });
-      return send(res, 200, { ok: true }), true;
+      if (!hosted) return send(res, 200, { ok: true }), true;
+      finishTeardown(ots.id); // background: VM, then project; reconciliation retries if Orquesta fails
+      return send(res, 202, { ok: true, vm: vmView(vmRow(ots.id)) }), true;
     }
     return send(res, 404, { error: t('server.http.unknownRoute') }), true;
   }
 
-  return { worker, device, dashboard };
+  // Reconciliation with Orquesta (every VM_RECONCILE_MIN, default 30): 7ots' VMs when ORQUESTA_VM_TOKEN is set, owners' own VMs always.
+  if (!createVm.timer) {
+    const run = () => reconcileVms().catch((e) => console.warn('[7ots] vm reconcile:', e.message));
+    createVm.timer = setInterval(run, RECONCILE_MS());
+    createVm.timer.unref?.();
+    setTimeout(run, Math.min(60_000, RECONCILE_MS())).unref?.();
+  }
+
+  return { worker, device, dashboard, releaseOts: releaseOtsVm, releaseAccount: releaseAccountVms, reconcile: reconcileVms };
 }