@7ots/cli 0.1.7 → 0.1.9

package/server/platform/vm.mjs

@@ -4,18 +4,31 @@
  * Provider 'byo': the owner brings their own Linux box: the dashboard hands out a one-time
  * `7ve_` code and the exact command; `7ots vm enroll` trades it for a `7vm_` token bound to that one
  * ot and `7ots vm worker` connects outbound only (no SSH keys ever reach 7ots).
- * Provider 'orquesta': a VM paid by 7ots, gated by accounts.vm_enabled and ORQUESTA_VM_TOKEN (an
- * org-wide Orquesta key, never shown to anyone). 7ots creates project `ot-<id>` + its VM with a
- * bootstrap that enrolls it the same way (code valid VM_ORQ_ENROLL_MIN, default 60, to cover the boot).
- * Quotas VM_PER_ACCOUNT (default 1) and VM_MAX_TOTAL (default 10). Deleting the VM, the ot or the
- * account tears down VM and project; a reconciliation every VM_RECONCILE_MIN (30) compares
- * GET /api/v1/vms with ots_vms, retries failed teardowns and logs orphans (VM_REAP_ORPHANS=1 deletes them).
+ * Provider 'orquesta' ("7ots server, operated by Orquesta"): gated by accounts.vm_enabled and
+ * ORQUESTA_VM_TOKEN (7ots' partner oak_ key: orgs:write + projects:write + vms:write, never shown to
+ * anyone). Each 7ots account gets its own Orquesta child org (POST /api/v1/partner/orgs, external_ref
+ * `<prefix>acct:<accountId>`, kept in accounts.orq_org_id) and every project/VM call for it carries
+ * `X-Orquesta-Org: <child>`. Orquesta bills the child through its own Stripe Checkout: until the child's
+ * billing is active, POST /vm answers { needsPayment, checkoutUrl } (back to /app/?vm_ots=<id>).
+ * Provider 'orquesta_user': the owner connected their own Orquesta account (orquesta.mjs) with an oak_
+ * key that has projects:write + vms:write; the VM is created in THEIR org, with their key (which never
+ * leaves orquesta.mjs) and billed to them by Orquesta. No child org, no 7ots checkout.
+ * Both create project `ot-<id>` + its VM with a bootstrap that enrolls it the same way (code valid
+ * VM_ORQ_ENROLL_MIN, default 60, to cover the boot). Quotas VM_PER_ACCOUNT (default 1, both providers)
+ * and VM_MAX_TOTAL (default 10, 'orquesta' only). Deleting the VM, the ot or the account tears down VM
+ * and project with the credential that made them; releasing the account also deletes its child org
+ * (which cancels its Orquesta subscription). A reconciliation every VM_RECONCILE_MIN (30) compares
+ * GET /api/v1/vms of each child org with ots_vms, refreshes 'orquesta_user' VMs one by one, retries
+ * failed teardowns and org deletions and logs orphans (VM_REAP_ORPHANS=1 deletes them).
  * Env: ORQUESTA_URL, ORQUESTA_VM_SIZE (default: cheapest), ORQUESTA_VM_SIZES ('slug[:usd],…'), ORQUESTA_VM_REGION,
  * ORQUESTA_VM_REF_PREFIX ('7ots:', distinct per 7ots install sharing one org), SEVENOTS_VM_CLI (pinned, 0.1.6).
  *
  * Dashboard (session + X-7ots-Admin, via routes.mjs):
- *   GET    /api/platform/ots/:id/vm          { vm|null, jobs, kinds, daily, paidVms, hosted: { available, canCreate, reason, sizes, … } }
- *   POST   /api/platform/ots/:id/vm          { provider: 'orquesta', size? } → 202 { vm } (provisioning in the background)
+ *   GET    /api/platform/ots/:id/vm          { vm|null, jobs, kinds, daily, paidVms, hosted: { available, canCreate, reason, sizes, billing, user, defaultOption, … } }
+ *   POST   /api/platform/ots/:id/vm          { provider: 'orquesta'|'orquesta_user', size? } → 202 { vm } (provisioning in the background)
+ *                                             · 'orquesta' unpaid → 200 { needsPayment: true, checkoutUrl, monthlyPrice }
+ *   GET    /api/platform/ots/:id/vm/billing  { status, active } of the account's child org (polled after the checkout)
+ *   DELETE /api/platform/ots/:id/vm/subscription   no 7ots server left → deletes the child org (ends the subscription)
  *   POST   /api/platform/ots/:id/vm/enroll   { provider?: 'byo' } → { code, expiresIn, command }
  *   DELETE /api/platform/ots/:id/vm          revokes the worker; byo → terminated, orquesta → 202 terminating → terminated
  *
@@ -46,6 +59,7 @@ import { errorText, reqT } from '../i18n.mjs';
 import { getDb, tx } from './db.mjs';
 import { newId, sha256, token } from './crypto.mjs';
 import { getOts, getOwnOts, getPlatformState, setPlatformState } from './store.mjs';
+import { orquestaInfra, orquestaVmAccess } from './orquesta.mjs';
 import { otsStep } from './runtime.mjs';
 
 const penv = process.env;
@@ -121,7 +135,7 @@ function vmView(vm) {
     enrollExpiresAt: vm.enroll_hash ? vm.enroll_exp : null,
     error: vm.error || null,
     since: vm.created_at,
-    ...(vm.provider === 'orquesta' ? { orqStatus: vm.orq_status || null, ip: vm.ip || null, monthlyPrice: vm.price_cents ? vm.price_cents / 100 : null, checkedAt: vm.orq_checked_at || null } : {}),
+    ...(HOSTED.includes(vm.provider) ? { orqStatus: vm.orq_status || null, ip: vm.ip || null, monthlyPrice: vm.price_cents ? vm.price_cents / 100 : null, checkedAt: vm.orq_checked_at || null } : {}),
   };
 }
 
@@ -207,12 +221,14 @@ const MAX_TOTAL = () => Math.max(0, Number(penv.VM_MAX_TOTAL ?? 10));
 const PER_ACCOUNT = () => Math.max(0, Number(penv.VM_PER_ACCOUNT ?? 1));
 const RECONCILE_MS = () => Math.max(0.01, Number(penv.VM_RECONCILE_MIN || 30)) * 60_000;
 const PROJECT_RETRY_MS = () => Number(penv.VM_ORQ_RETRY_MS || 10_000);
-const LIVE_ORQ = "provider = 'orquesta' AND status <> 'terminated'";
+const HOSTED = ['orquesta', 'orquesta_user'];
+const LIVE_ORQ = "provider IN ('orquesta', 'orquesta_user') AND status <> 'terminated'"; // per-account quota
+const LIVE_PARTNER = "provider = 'orquesta' AND status <> 'terminated'"; // 7ots' own fleet (VM_MAX_TOTAL)
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
 /** The CLI the VM installs, pinned (SEVENOTS_VM_CLI: '0.1.6' or '@7ots/cli@0.1.6'). */
 function cliSpec() {
-  const v = String(penv.SEVENOTS_VM_CLI || '0.1.6').trim();
+  const v = String(penv.SEVENOTS_VM_CLI || '0.1.7').trim();
   const s = v.startsWith('@7ots/cli@') ? v : `@7ots/cli@${v}`;
   if (!/^@7ots\/cli@\d+\.\d+\.\d+(-[0-9A-Za-z.]+)?$/.test(s)) throw new Error('SEVENOTS_VM_CLI must be an exact version');
   return s;
@@ -245,12 +261,39 @@ function priceCents(v) {
 
 class OrqError extends Error {}
 
-async function orq(method, path, body, timeoutMs = 20_000) {
+const orqFail = (method, path, status, data) => {
+  const msg = typeof data.error === 'string' ? data.error : data.error?.message || data.message || '';
+  return Object.assign(new OrqError(`Orquesta ${method} ${path.replace(/\/[^/]{20,}/g, '/…')}: HTTP ${status}${msg ? ` ${clean(msg, 200)}` : ''}`), { status, code: data.error?.code || data.code });
+};
+
+/**
+ * Orquesta's /api/v1 with a credential:
+ *   { kind: 'partner', org } → ORQUESTA_VM_TOKEN, plus X-Orquesta-Org when org is a child ('' = 7ots' own org);
+ *   { kind: 'user', accountId } → the owner's own key, through orquesta.mjs (it never reaches this module).
+ * Without cred: the partner key on its own org (the /partner/orgs routes refuse X-Orquesta-Org).
+ */
+async function orq(method, path, body, timeoutMs = 20_000, cred = null) {
+  if (cred?.kind === 'user') {
+    let r;
+    try {
+      r = await orquestaInfra(cred.accountId, method, `/api/v1${path}`, body, timeoutMs);
+    } catch (e) {
+      // Not connected / reconnect / unreachable: never a 404 or 409 of the resource itself.
+      throw Object.assign(new OrqError(`Orquesta (owner's account): ${clean(e.message, 200)}`), { status: 0, code: 'credentials', i18n: e.i18n });
+    }
+    if (!r.ok) throw orqFail(method, path, r.status, r.data || {});
+    return r.status === 204 ? {} : r.data || {};
+  }
   let res;
   try {
     res = await fetch(`${ORQ()}/api/v1${path}`, {
       method,
-      headers: { Accept: 'application/json', Authorization: `Bearer ${orqToken()}`, ...(body ? { 'Content-Type': 'application/json' } : {}) },
+      headers: {
+        Accept: 'application/json',
+        Authorization: `Bearer ${orqToken()}`,
+        ...(cred?.org ? { 'X-Orquesta-Org': cred.org } : {}),
+        ...(body ? { 'Content-Type': 'application/json' } : {}),
+      },
       body: body ? JSON.stringify(body) : undefined,
       redirect: 'manual',
       signal: AbortSignal.timeout(timeoutMs),
@@ -259,13 +302,76 @@ async function orq(method, path, body, timeoutMs = 20_000) {
     throw Object.assign(new OrqError(`Orquesta unreachable (${e.name === 'TimeoutError' ? 'timeout' : e.code || e.name})`), { status: 0 });
   }
   const data = res.status === 204 ? {} : await res.json().catch(() => ({}));
-  if (!res.ok) {
-    const msg = typeof data.error === 'string' ? data.error : data.error?.message || data.message || '';
-    throw Object.assign(new OrqError(`Orquesta ${method} ${path.replace(/\/[^/]{20,}/g, '/…')}: HTTP ${res.status}${msg ? ` ${clean(msg, 200)}` : ''}`), { status: res.status, code: data.error?.code || data.code });
-  }
+  if (!res.ok) throw orqFail(method, path, res.status, data);
   return data;
 }
 
+/** The credential that made (and unmakes) a row's VM. */
+const credOf = (row) => (row.provider === 'orquesta_user' ? { kind: 'user', accountId: row.account_id } : { kind: 'partner', org: row.orq_org_id || '' });
+const credOfItem = (x) => (x.user ? { kind: 'user', accountId: x.accountId } : { kind: 'partner', org: x.org || '' });
+
+// ── the account's child org (provider 'orquesta') ──
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const accountOrg = (accountId) => getDb().prepare('SELECT orq_org_id FROM accounts WHERE id = ?').get(accountId)?.orq_org_id || '';
+const accountRef = (accountId) => `${REF_PREFIX()}acct:${accountId}`;
+const ensuring = new Map(); // account id → Promise<org id>
+
+/** The account's Orquesta child org, created the first time (idempotent on Orquesta's side by external_ref). */
+function ensureChildOrg(accountId) {
+  const have = accountOrg(accountId);
+  if (have) return Promise.resolve(have);
+  if (!ensuring.has(accountId)) {
+    const p = (async () => {
+      const r = await orq('POST', '/partner/orgs', { external_ref: accountRef(accountId), name: `7ots account ${accountId}`.slice(0, 100) });
+      const id = String(r.org?.id || '');
+      if (!UUID_RE.test(id)) throw new OrqError('Orquesta returned no organization id');
+      getDb().prepare("UPDATE accounts SET orq_org_id = ? WHERE id = ? AND orq_org_id = ''").run(id, accountId);
+      return accountOrg(accountId) || id;
+    })().finally(() => ensuring.delete(accountId));
+    ensuring.set(accountId, p);
+  }
+  return ensuring.get(accountId);
+}
+
+const billingSeen = new Map(); // account id → { status, at } (last answer from Orquesta, for the card)
+
+/** Billing status of the account's child org: 'active' | 'past_due' | 'canceled' | null (never paid). */
+async function childBilling(accountId, org) {
+  const r = await orq('GET', `/partner/orgs/${encodeURIComponent(org)}/billing`, null, 10_000);
+  const status = r.status ? clean(r.status, 20) : null;
+  billingSeen.set(accountId, { status, at: now() });
+  return status;
+}
+
+function orgDeletes() {
+  try {
+    const q = JSON.parse(getPlatformState('vm_org_deletes') || '[]');
+    return Array.isArray(q) ? q : [];
+  } catch {
+    return [];
+  }
+}
+const setOrgDeletes = (q) => setPlatformState('vm_org_deletes', JSON.stringify(q.slice(-500)));
+
+/** Deletes a child org (Orquesta cancels its subscription first). 409 while a VM is still going away → queued. */
+async function dropChildOrg(accountId, org) {
+  if (!org) return true;
+  try {
+    await orq('DELETE', `/partner/orgs/${encodeURIComponent(org)}`, null, 30_000);
+  } catch (e) {
+    if (e.status !== 404) {
+      console.warn(`[7ots] vm org delete ${org}:`, e.message);
+      setOrgDeletes([...orgDeletes().filter((x) => x.org !== org), { org, accountId, at: now() }]);
+      return false;
+    }
+  }
+  setOrgDeletes(orgDeletes().filter((x) => x.org !== org));
+  getDb().prepare("UPDATE accounts SET orq_org_id = '' WHERE id = ? AND orq_org_id = ?").run(accountId, org);
+  billingSeen.delete(accountId);
+  return true;
+}
+
 /** Bash run as root at the end of the VM's user-data (≤ 8 KB). Every value is validated, never free text. */
 export function bootstrapScript({ server, code, cli = cliSpec() }) {
   if (!/^https?:\/\/[A-Za-z0-9.:[\]-]+(\/[A-Za-z0-9._~/-]*)?$/.test(server)) throw new Error('bad server url');
@@ -333,6 +439,7 @@ function teardownQueue() {
     return [];
   }
 }
+/** item: { pid, otsId, accountId, org, user } — enough to rebuild the credential that made the project. */
 function queueTeardown(item) {
   const q = teardownQueue().filter((x) => x.pid !== item.pid);
   setPlatformState('vm_teardowns', JSON.stringify([...q, { ...item, at: now() }].slice(-500)));
@@ -340,19 +447,20 @@ function queueTeardown(item) {
 function dequeueTeardown(pid) {
   setPlatformState('vm_teardowns', JSON.stringify(teardownQueue().filter((x) => x.pid !== pid)));
 }
+const teardownItem = (row, pid = row.orq_project_id) => ({ pid, otsId: row.ots_id, accountId: row.account_id, org: row.orq_org_id || '', user: row.provider === 'orquesta_user' });
 
 /** Terminates the project's VM, then the project. 404 = already gone. 409 on the project = VM still going away. */
-async function destroy(pid, { retries = 6 } = {}) {
+async function destroy(pid, { retries = 6, cred = null } = {}) {
   if (!pid) return;
   const p = `/projects/${encodeURIComponent(pid)}`;
   try {
-    await orq('DELETE', `${p}/vm`, null, 60_000);
+    await orq('DELETE', `${p}/vm`, null, 60_000, cred);
   } catch (e) {
     if (e.status !== 404) throw e;
   }
   for (let i = 0; ; i++) {
     try {
-      return void (await orq('DELETE', p));
+      return void (await orq('DELETE', p, null, 20_000, cred));
     } catch (e) {
       if (e.status === 404) return;
       if (e.status !== 409 || i >= retries) throw e;
@@ -367,7 +475,7 @@ async function finishTeardown(otsId) {
   const row = vmRow(otsId);
   if (!row || row.status !== 'terminating') return;
   try {
-    await destroy(row.orq_project_id);
+    await destroy(row.orq_project_id, { cred: credOf(row) });
     setRow(otsId, { status: 'terminated', orq_status: 'terminated', ip: '', error: '' }, "status = 'terminating'");
     dequeueTeardown(row.orq_project_id);
   } catch (e) {
@@ -376,43 +484,55 @@ async function finishTeardown(otsId) {
   }
 }
 
+/** What the owner reads when a create fails (in the language of the request that started it). */
+function createError(e, cred, t) {
+  if (cred.kind === 'partner' && e.status === 402) return t('platform.vm.needsPayment');
+  if (cred.kind === 'user' && e.code === 'credentials') return e.i18n ? t(e.i18n.key, e.i18n.vars) : e.message;
+  if (cred.kind === 'user' && (e.status === 401 || e.status === 403)) return `${t('platform.vm.userScopes')} (${e.message})`;
+  return e.message;
+}
+
 /** Creates project + VM. The row may be deleted (ot gone) or set 'terminating' meanwhile: then it undoes its own work. */
-async function provision(ots, { server, code, size, region }) {
+async function provision(ots, { server, code, size, region, cred, t }) {
   let pid = '';
   const gone = () => !vmRow(ots.id);
+  const item = () => ({ pid, otsId: ots.id, accountId: ots.accountId, org: cred.org || '', user: cred.kind === 'user' });
+  const undo = (retries) => destroy(pid, { retries, cred }).catch(() => queueTeardown(item()));
   try {
-    const p = await orq('POST', '/projects', { name: `ot-${ots.id}`, description: clean(`7ots cloud worker for "${ots.name}" (ot ${ots.id}, account ${ots.accountId})`, 300) });
+    const p = await orq('POST', '/projects', { name: `ot-${ots.id}`, description: clean(`7ots cloud worker for "${ots.name}" (ot ${ots.id}, account ${ots.accountId})`, 300) }, 20_000, cred);
     pid = String(p.project?.id || '');
     if (!pid) throw new OrqError('Orquesta returned no project id');
     setRow(ots.id, { orq_project_id: pid });
-    if (gone()) return void (await destroy(pid, { retries: 0 }).catch(() => queueTeardown({ pid, otsId: ots.id })));
+    if (gone()) return void (await undo(0));
     if (vmRow(ots.id).status !== 'creating') return; // DELETE came first: finishTeardown takes it from here
-    const r = await orq('POST', `/projects/${encodeURIComponent(pid)}/vm`, { size, ...(region ? { region } : {}), external_ref: `${REF_PREFIX()}${ots.id}`, bootstrap: bootstrapScript({ server, code }) }, 6 * 60_000);
+    const r = await orq('POST', `/projects/${encodeURIComponent(pid)}/vm`, { size, ...(region ? { region } : {}), external_ref: `${REF_PREFIX()}${ots.id}`, bootstrap: bootstrapScript({ server, code }) }, 6 * 60_000, cred);
     const v = r.vm || {};
-    if (gone()) return void (await destroy(pid).catch(() => queueTeardown({ pid, otsId: ots.id })));
+    if (gone()) return void (await undo());
     setRow(ots.id, { orq_vm_id: String(v.id || ''), orq_status: clean(v.status, 40), ip: clean(v.ip, 60), price_cents: priceCents(v) ?? vmRow(ots.id).price_cents, orq_checked_at: now() }, "status <> 'terminated'");
     setRow(ots.id, { status: 'pending' }, "status = 'creating'");
   } catch (e) {
     console.warn(`[7ots] vm create ${ots.id}:`, e.message);
-    if (gone()) return void (pid && (await destroy(pid).catch(() => queueTeardown({ pid, otsId: ots.id }))));
+    if (e.status === 402) billingSeen.delete(ots.accountId); // the card asks for the payment again
+    if (gone()) return void (pid && (await undo()));
     if (vmRow(ots.id).status !== 'creating') return;
     // Undo what exists (a timed-out create may still have made the VM): ids cleared only once it is gone.
     let undone = !pid;
-    if (pid) undone = await destroy(pid).then(() => true, () => false);
-    setRow(ots.id, { status: 'error', error: clean(e.message, 500), enroll_hash: null, enroll_exp: null, ...(undone ? { orq_project_id: '', orq_vm_id: '', orq_status: '' } : {}) }, "status = 'creating'");
+    if (pid) undone = await destroy(pid, { cred }).then(() => true, () => false);
+    setRow(ots.id, { status: 'error', error: clean(createError(e, cred, t), 500), enroll_hash: null, enroll_exp: null, ...(undone ? { orq_project_id: '', orq_vm_id: '', orq_status: '' } : {}) }, "status = 'creating'");
   }
 }
 
 /** Orquesta's view of the VM, at most every 15 s per ot (shared by concurrent readers). */
 async function refreshHosted(otsId, { force = false } = {}) {
   const row = vmRow(otsId);
-  if (!row || row.provider !== 'orquesta' || !row.orq_project_id || !hostedConfigured()) return row;
+  if (!row || !HOSTED.includes(row.provider) || !row.orq_project_id) return row;
+  if (row.provider === 'orquesta' && !hostedConfigured()) return row;
   if (!['pending', 'enrolled', 'error'].includes(row.status) || inflight.has(otsId)) return row;
   if (!force && row.orq_checked_at && now() - row.orq_checked_at < ORQ_CACHE_MS) return row;
   if (!checking.has(otsId)) {
     const p = (async () => {
       try {
-        const v = (await orq('GET', `/projects/${encodeURIComponent(row.orq_project_id)}/vm`, null, 8000)).vm;
+        const v = (await orq('GET', `/projects/${encodeURIComponent(row.orq_project_id)}/vm`, null, 8000, credOf(row))).vm;
         if (!v) throw Object.assign(new OrqError('no vm'), { status: 404 });
         const st = clean(v.status, 40);
         const fields = { orq_status: st, ip: clean(v.ip, 60), orq_checked_at: now(), ...(v.id ? { orq_vm_id: String(v.id) } : {}) };
@@ -443,49 +563,97 @@ async function refreshHosted(otsId, { force = false } = {}) {
   return vmRow(otsId);
 }
 
-/** Compares Orquesta's VMs with ots_vms: refreshes them, retries teardowns, adopts or flags lost creates and logs orphans. */
+/**
+ * Compares Orquesta with ots_vms. 'orquesta' VMs: GET /api/v1/vms of 7ots' own org and of every child
+ * org; refreshes them, retries teardowns, adopts or flags lost creates and logs orphans.
+ * 'orquesta_user' VMs: refreshed one by one with each owner's own credential (never listed: their org
+ * is theirs). Then queued teardowns and child-org deletions are retried.
+ */
 export async function reconcileVms() {
-  if (!hostedConfigured()) return null;
-  const { vms = [] } = await orq('GET', '/vms', null, 30_000);
-  const prefix = REF_PREFIX();
-  const ours = vms.filter((v) => String(v.external_ref || '').startsWith(prefix));
-  const byRef = new Map(ours.map((v) => [String(v.external_ref).slice(prefix.length), v]));
   const rows = getDb().prepare(`SELECT * FROM ots_vms WHERE ${LIVE_ORQ}`).all();
-  const report = { checked: rows.length, orquesta: ours.length, orphans: [], missing: [], retried: 0 };
-  for (const row of rows) {
+  const report = { checked: rows.length, orquesta: 0, orgs: 0, user: 0, orphans: [], missing: [], retried: 0 };
+  const prefix = REF_PREFIX();
+  const orgOf = (r) => r.orq_org_id || '';
+  if (hostedConfigured()) {
+    const partnerRows = rows.filter((r) => r.provider === 'orquesta');
+    // '' = 7ots' own org (VMs made before child orgs existed).
+    const orgs = new Set(['', ...partnerRows.map(orgOf), ...getDb().prepare("SELECT orq_org_id FROM accounts WHERE orq_org_id <> ''").all().map((a) => a.orq_org_id)]);
+    const ours = [];
+    const failed = new Set();
+    for (const org of orgs) {
+      try {
+        const { vms = [] } = await orq('GET', '/vms', null, 30_000, { kind: 'partner', org });
+        for (const v of vms) if (String(v.external_ref || '').startsWith(prefix)) ours.push({ v, org, otsId: String(v.external_ref).slice(prefix.length) });
+        report.orgs++;
+      } catch (e) {
+        failed.add(org);
+        console.warn(`[7ots] vm reconcile: GET /vms${org ? ` (org ${org})` : ''}:`, e.message);
+      }
+    }
+    if (failed.size === orgs.size) throw new OrqError('Orquesta did not list any VMs');
+    report.orquesta = ours.length;
+    for (const row of partnerRows) {
+      if (inflight.has(row.ots_id) || failed.has(orgOf(row))) continue;
+      const hit = ours.find((x) => x.org === orgOf(row) && (x.otsId === row.ots_id || (row.orq_project_id && String(x.v.project_id) === row.orq_project_id)));
+      const v = hit?.v;
+      if (row.status === 'terminating') {
+        report.retried++;
+        await finishTeardown(row.ots_id);
+        continue;
+      }
+      if (row.status === 'creating') {
+        // The server stopped mid-create: adopt what Orquesta made, or give up on it.
+        if (v) setRow(row.ots_id, { orq_project_id: String(v.project_id || row.orq_project_id), orq_vm_id: String(v.id || ''), orq_status: clean(v.status, 40), ip: clean(v.ip, 60), status: 'pending' }, "status = 'creating'");
+        else if (now() - row.updated_at > 15 * 60_000) setRow(row.ots_id, { status: 'error', error: 'Creation was interrupted' }, "status = 'creating'");
+        continue;
+      }
+      if (!v && row.orq_project_id) {
+        report.missing.push(row.ots_id);
+        setRow(row.ots_id, { orq_status: 'gone', orq_checked_at: now() });
+        if (!online(row)) setRow(row.ots_id, { status: 'error', error: 'The VM no longer exists in Orquesta' }, "status IN ('pending', 'enrolled')");
+        console.warn(`[7ots] vm reconcile: ${row.ots_id} has no VM in Orquesta`);
+      } else if (v) setRow(row.ots_id, { orq_status: clean(v.status, 40), ip: clean(v.ip, 60), orq_checked_at: now(), ...(v.id ? { orq_vm_id: String(v.id) } : {}) });
+    }
+    const live = new Set(partnerRows.map((r) => `${orgOf(r)}|${r.ots_id}`));
+    const queued = new Set(teardownQueue().map((x) => x.pid));
+    for (const { v, org, otsId } of ours) {
+      if (live.has(`${org}|${otsId}`) || queued.has(String(v.project_id))) continue;
+      if (/^(terminated|terminating|deleted|destroyed)$/i.test(String(v.status))) continue;
+      report.orphans.push({ otsId, vmId: v.id, projectId: v.project_id, status: v.status, ...(org ? { org } : {}) });
+      console.warn(`[7ots] vm reconcile: orphan VM ${v.id} (project ${v.project_id}, ref ${v.external_ref}${org ? `, org ${org}` : ''}) has no live ot`);
+      if (penv.VM_REAP_ORPHANS === '1') await destroy(String(v.project_id), { cred: { kind: 'partner', org } }).catch((e) => console.warn('[7ots] vm orphan teardown:', e.message));
+    }
+  }
+  // Owners' own VMs, each with its owner's credential.
+  for (const row of rows.filter((r) => r.provider === 'orquesta_user')) {
     if (inflight.has(row.ots_id)) continue;
-    const v = byRef.get(row.ots_id) || ours.find((x) => row.orq_project_id && String(x.project_id) === row.orq_project_id);
+    report.user++;
     if (row.status === 'terminating') {
       report.retried++;
       await finishTeardown(row.ots_id);
-      continue;
-    }
-    if (row.status === 'creating') {
-      // The server stopped mid-create: adopt what Orquesta made, or give up on it.
-      if (v) setRow(row.ots_id, { orq_project_id: String(v.project_id || row.orq_project_id), orq_vm_id: String(v.id || ''), orq_status: clean(v.status, 40), ip: clean(v.ip, 60), status: 'pending' }, "status = 'creating'");
-      else if (now() - row.updated_at > 15 * 60_000) setRow(row.ots_id, { status: 'error', error: 'Creation was interrupted' }, "status = 'creating'");
-      continue;
-    }
-    if (!v && row.orq_project_id) {
-      report.missing.push(row.ots_id);
-      setRow(row.ots_id, { orq_status: 'gone', orq_checked_at: now() });
-      if (!online(row)) setRow(row.ots_id, { status: 'error', error: 'The VM no longer exists in Orquesta' }, "status IN ('pending', 'enrolled')");
-      console.warn(`[7ots] vm reconcile: ${row.ots_id} has no VM in Orquesta`);
-    } else if (v) setRow(row.ots_id, { orq_status: clean(v.status, 40), ip: clean(v.ip, 60), orq_checked_at: now(), ...(v.id ? { orq_vm_id: String(v.id) } : {}) });
+    } else if (row.status === 'creating') {
+      if (now() - row.updated_at > 15 * 60_000) setRow(row.ots_id, { status: 'error', error: 'Creation was interrupted' }, "status = 'creating'");
+    } else await refreshHosted(row.ots_id, { force: true });
   }
   // Teardowns that failed when an ot was deleted.
   for (const item of teardownQueue()) {
+    if (item.user && !getDb().prepare('SELECT 1 FROM accounts WHERE id = ?').get(item.accountId)) {
+      // The owner's account (and with it their credential) is gone: the project stays in THEIR org.
+      console.warn(`[7ots] vm teardown ${item.pid}: the owner's account is gone; it must be removed in Orquesta`);
+      dequeueTeardown(item.pid);
+      continue;
+    }
+    if (!item.user && !hostedConfigured()) continue;
     report.retried++;
-    await destroy(item.pid).then(() => dequeueTeardown(item.pid), (e) => console.warn(`[7ots] vm teardown retry ${item.pid}:`, e.message));
+    await destroy(item.pid, { cred: credOfItem(item) }).then(() => dequeueTeardown(item.pid), (e) => console.warn(`[7ots] vm teardown retry ${item.pid}:`, e.message));
   }
-  const live = new Set(rows.map((r) => r.ots_id));
-  const queued = new Set(teardownQueue().map((x) => x.pid));
-  for (const [otsId, v] of byRef) {
-    if (live.has(otsId) || queued.has(String(v.project_id))) continue;
-    if (/^(terminated|deleted|destroyed)$/i.test(String(v.status))) continue;
-    report.orphans.push({ otsId, vmId: v.id, projectId: v.project_id, status: v.status });
-    console.warn(`[7ots] vm reconcile: orphan VM ${v.id} (project ${v.project_id}, ref ${v.external_ref}) has no live ot`);
-    if (penv.VM_REAP_ORPHANS === '1') await destroy(String(v.project_id)).catch((e) => console.warn('[7ots] vm orphan teardown:', e.message));
+  // Child orgs let go of (account released) while a VM was still going away.
+  if (hostedConfigured()) {
+    for (const x of orgDeletes()) {
+      if (getDb().prepare(`SELECT 1 FROM ots_vms WHERE ${LIVE_PARTNER} AND orq_org_id = ?`).get(x.org)) continue;
+      report.retried++;
+      await dropChildOrg(x.accountId, x.org);
+    }
   }
   setPlatformState('vm_orphans', JSON.stringify({ at: now(), orphans: report.orphans, missing: report.missing }));
   return report;
@@ -496,20 +664,28 @@ export async function releaseOtsVm(otsId) {
   const row = vmRow(otsId);
   if (!row) return;
   getDb().prepare('UPDATE ots_vms SET agent_hash = NULL, enroll_hash = NULL, enroll_exp = NULL, updated_at = ? WHERE ots_id = ?').run(now(), otsId);
-  if (row.provider !== 'orquesta' || row.status === 'terminated') return;
+  if (!HOSTED.includes(row.provider) || row.status === 'terminated') return;
   setRow(otsId, { status: 'terminating' });
   if (inflight.has(otsId)) return; // provision() sees the row gone and undoes its own work
   if (!row.orq_project_id) return;
   try {
-    await destroy(row.orq_project_id, { retries: 0 });
+    await destroy(row.orq_project_id, { retries: 0, cred: credOf(row) });
   } catch (e) {
     console.warn(`[7ots] vm teardown on delete ${otsId}:`, e.message);
-    queueTeardown({ pid: row.orq_project_id, otsId });
+    queueTeardown(teardownItem(row));
   }
 }
 
+/**
+ * Before an account is deleted: every VM of it goes, then its Orquesta child org (Orquesta cancels the
+ * subscription first). While a VM is still going away Orquesta answers 409 and the deletion is queued
+ * for the reconciliation.
+ */
 export async function releaseAccountVms(accountId) {
   for (const { ots_id } of getDb().prepare('SELECT ots_id FROM ots_vms WHERE account_id = ?').all(accountId)) await releaseOtsVm(ots_id);
+  await Promise.all(getDb().prepare('SELECT ots_id FROM ots_vms WHERE account_id = ?').all(accountId).map(({ ots_id }) => inflight.get(ots_id)?.catch(() => {})));
+  const org = accountOrg(accountId);
+  if (org && hostedConfigured()) await dropChildOrg(accountId, org);
 }
 
 /**
@@ -685,21 +861,78 @@ export function createVm({ send, readJson, rateLimit, base }) {
 
   // ───────────── dashboard (/api/platform/ots/:id/vm…) ─────────────
 
-  /** What the dashboard needs to offer a 7ots server (and why not, when it can't). */
+  /** What the dashboard needs to offer a hosted server: 7ots' (via the account's child org) and/or one in the owner's own Orquesta org. */
   function hostedInfo(account) {
     const enabled = account.vm_enabled === 1;
     const configured = hostedConfigured();
     const used = getDb().prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ} AND account_id = ?`).get(account.id).n;
-    const total = getDb().prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ}`).get().n;
+    const total = getDb().prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_PARTNER}`).get().n;
     const reason = !enabled ? 'notEnabled' : !configured ? 'notConfigured' : used >= PER_ACCOUNT() ? 'accountLimit' : total >= MAX_TOTAL() ? 'full' : null;
-    return { enabled, configured, available: enabled && configured, canCreate: !reason, reason, sizes: hostedSizes().filter((z) => z.id === defaultSize()), defaultSize: defaultSize(), region: penv.ORQUESTA_VM_REGION || null, used, max: PER_ACCOUNT() };
+    const size = defaultSize();
+    const access = orquestaVmAccess(account.id);
+    const userReason = !access.usable ? access.reason : used >= PER_ACCOUNT() ? 'accountLimit' : null;
+    const org = accountOrg(account.id);
+    return {
+      enabled,
+      configured,
+      available: enabled && configured,
+      canCreate: !reason,
+      reason,
+      sizes: hostedSizes().filter((z) => z.id === size),
+      defaultSize: size,
+      monthlyPrice: hostedSizes().find((z) => z.id === size)?.monthlyPrice ?? null,
+      region: penv.ORQUESTA_VM_REGION || null,
+      used,
+      max: PER_ACCOUNT(),
+      operator: 'Orquesta',
+      // 7ots server: Orquesta bills the account's child org; null = never paid (or not known yet).
+      billing: org ? (billingSeen.get(account.id)?.status ?? null) : null,
+      // The owner's own Orquesta account (path A): needs an oak_ key with projects:write + vms:write.
+      user: { connected: access.connected, canCreate: !userReason, reason: userReason },
+      defaultOption: access.connected ? 'user' : '7ots',
+    };
+  }
+
+  /** Same quotas for both providers, checked inside the reserving transaction (and once before any Orquesta call). */
+  function quotaError(d, t, account, ots, partner) {
+    const cur = d.prepare('SELECT * FROM ots_vms WHERE ots_id = ?').get(ots.id);
+    if (cur && cur.status !== 'terminated' && (HOSTED.includes(cur.provider) || cur.status === 'enrolled')) return [409, t('platform.vm.exists')];
+    if (inflight.has(ots.id)) return [409, t('platform.vm.exists')];
+    if (d.prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ} AND account_id = ?`).get(account.id).n >= PER_ACCOUNT()) return [403, t('platform.vm.accountLimit', { max: PER_ACCOUNT() })];
+    if (partner && d.prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_PARTNER}`).get().n >= MAX_TOTAL()) return [503, t('platform.vm.full')];
+    return null;
+  }
+
+  /** Billing of the account's child org; an org deleted on Orquesta's side is forgotten and made again. */
+  async function billingOf(account) {
+    let org = await ensureChildOrg(account.id);
+    try {
+      return { org, status: await childBilling(account.id, org) };
+    } catch (e) {
+      if (e.status !== 404) throw e;
+      getDb().prepare("UPDATE accounts SET orq_org_id = '' WHERE id = ? AND orq_org_id = ?").run(account.id, org);
+      org = await ensureChildOrg(account.id);
+      return { org, status: await childBilling(account.id, org) };
+    }
   }
 
-  /** POST /vm {provider:'orquesta', size?}: reserves the slot (quotas, atomically) and provisions in the background. */
-  async function createHosted(req, res, account, ots, body) {
+  /**
+   * POST /vm {provider:'orquesta'|'orquesta_user'}: reserves the slot (quotas, atomically) and provisions in the background.
+   * 'orquesta' first makes sure the account's child org exists and is paid: if not, { needsPayment, checkoutUrl }.
+   */
+  async function createHosted(req, res, account, ots, provider) {
     const t = reqT(req);
-    if (account.vm_enabled !== 1) return send(res, 403, { error: t('platform.vm.paidOff') });
-    if (!hostedConfigured()) return send(res, 503, { error: t('platform.vm.paidUnavailable') });
+    const user = provider === 'orquesta_user';
+    if (user) {
+      const a = orquestaVmAccess(account.id);
+      if (!a.usable) {
+        const key = { needsKey: 'platform.vm.userNeedsKey', reconnect: 'platform.orquesta.reconnect' }[a.reason] || 'platform.orquesta.notConnected';
+        return send(res, 409, { error: t(key), code: `orquesta_${a.reason}` });
+      }
+    } else {
+      if (account.vm_enabled !== 1) return send(res, 403, { error: t('platform.vm.paidOff') });
+      if (!hostedConfigured()) return send(res, 503, { error: t('platform.vm.paidUnavailable') });
+    }
     const size = defaultSize();
     let server;
     try {
@@ -709,24 +942,46 @@ export function createVm({ send, readJson, rateLimit, base }) {
       console.warn('[7ots] vm create:', e.message);
       return send(res, 503, { error: t('platform.vm.paidUnavailable') });
     }
+    const pre = quotaError(getDb(), t, account, ots, !user);
+    if (pre) return send(res, pre[0], { error: pre[1] });
+    const price = hostedSizes().find((s) => s.id === size).monthlyPrice;
+    let cred = { kind: 'user', accountId: account.id };
+    if (!user) {
+      try {
+        const { org, status } = await billingOf(account);
+        if (status !== 'active') {
+          let ck = null;
+          try {
+            // No #fragment: Orquesta appends ?orq_checkout=success|cancel; the dashboard opens the ot from vm_ots.
+            ck = await orq('POST', `/partner/orgs/${encodeURIComponent(org)}/checkout`, { return_url: `${server}/app/?vm_ots=${encodeURIComponent(ots.id)}`, size });
+          } catch (e) {
+            if (e.status !== 409) throw e; // ALREADY_ACTIVE (paid meanwhile) / PARTNER_BILLED: nothing to pay
+          }
+          if (ck) {
+            if (!/^https:\/\//.test(String(ck.url || ''))) throw new OrqError('Orquesta returned no checkout URL');
+            return send(res, 200, { needsPayment: true, checkoutUrl: ck.url, size, monthlyPrice: price, operator: 'Orquesta', hosted: hostedInfo(account) });
+          }
+        }
+        cred = { kind: 'partner', org };
+      } catch (e) {
+        console.warn('[7ots] vm billing:', e.message);
+        return send(res, 503, { error: t('platform.vm.paidUnavailable') });
+      }
+    }
     const region = penv.ORQUESTA_VM_REGION || '';
     const code = `7ve_${token()}`;
     const tm = now();
-    const price = hostedSizes().find((s) => s.id === size).monthlyPrice;
     const err = tx((d) => {
-      const cur = d.prepare('SELECT * FROM ots_vms WHERE ots_id = ?').get(ots.id);
-      if (cur && cur.status !== 'terminated' && (cur.provider === 'orquesta' || cur.status === 'enrolled')) return [409, t('platform.vm.exists')];
-      if (inflight.has(ots.id)) return [409, t('platform.vm.exists')];
-      if (d.prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ} AND account_id = ?`).get(account.id).n >= PER_ACCOUNT()) return [403, t('platform.vm.accountLimit', { max: PER_ACCOUNT() })];
-      if (d.prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ}`).get().n >= MAX_TOTAL()) return [503, t('platform.vm.full')];
-      d.prepare(`INSERT INTO ots_vms (ots_id, account_id, provider, status, size, region, enroll_hash, enroll_exp, price_cents, created_at, updated_at) VALUES (?, ?, 'orquesta', 'creating', ?, ?, ?, ?, ?, ?, ?)
-                 ON CONFLICT(ots_id) DO UPDATE SET account_id = excluded.account_id, provider = 'orquesta', status = 'creating', orq_project_id = '', orq_vm_id = '', orq_status = '', orq_checked_at = NULL, size = excluded.size, region = excluded.region,
+      const q = quotaError(d, t, account, ots, !user);
+      if (q) return q;
+      d.prepare(`INSERT INTO ots_vms (ots_id, account_id, provider, orq_org_id, status, size, region, enroll_hash, enroll_exp, price_cents, created_at, updated_at) VALUES (?, ?, ?, ?, 'creating', ?, ?, ?, ?, ?, ?, ?)
+                 ON CONFLICT(ots_id) DO UPDATE SET account_id = excluded.account_id, provider = excluded.provider, orq_org_id = excluded.orq_org_id, status = 'creating', orq_project_id = '', orq_vm_id = '', orq_status = '', orq_checked_at = NULL, size = excluded.size, region = excluded.region,
                    ip = '', error = '', enroll_hash = excluded.enroll_hash, enroll_exp = excluded.enroll_exp, agent_hash = NULL, agent_seen_at = NULL, worker_version = '', worker_info = '{}', price_cents = excluded.price_cents, created_at = excluded.created_at, updated_at = excluded.updated_at`)
-        .run(ots.id, account.id, size, region, sha256(code), tm + ORQ_ENROLL_TTL(), price ? Math.round(price * 100) : null, tm, tm);
+        .run(ots.id, account.id, user ? 'orquesta_user' : 'orquesta', cred.org || '', size, region, sha256(code), tm + ORQ_ENROLL_TTL(), price ? Math.round(price * 100) : null, tm, tm);
       return null;
     });
     if (err) return send(res, err[0], { error: err[1] });
-    const job = provision(ots, { server, code, size, region }).finally(() => inflight.delete(ots.id));
+    const job = provision(ots, { server, code, size, region, cred, t }).finally(() => inflight.delete(ots.id));
     inflight.set(ots.id, job);
     return send(res, 202, { vm: vmView(vmRow(ots.id)), hosted: hostedInfo(account) });
   }
@@ -738,25 +993,49 @@ export function createVm({ send, readJson, rateLimit, base }) {
     let vm = vmRow(ots.id);
     if (sub === '/vm' && req.method === 'GET') {
       reap(ots.id);
-      if (vm?.provider === 'orquesta') vm = await refreshHosted(ots.id);
+      if (HOSTED.includes(vm?.provider)) vm = await refreshHosted(ots.id);
+      // What the card says about payment: asked to Orquesta at most every 5 min per account.
+      const org = accountOrg(account.id);
+      const seenAt = billingSeen.get(account.id)?.at || 0;
+      if (org && hostedConfigured() && now() - seenAt > 5 * 60_000) await childBilling(account.id, org).catch((e) => console.warn('[7ots] vm billing:', e.message));
       return send(res, 200, { vm: vmView(vm), jobs: recentJobs(ots.id), kinds: otsVmKinds(ots), allKinds: VM_KINDS, daily: { used: jobsLastDay(ots.id), max: DAILY() }, paidVms: account.vm_enabled === 1, hosted: hostedInfo(account) }), true;
     }
+    if (sub === '/vm/billing' && req.method === 'GET') {
+      // Polled by the dashboard after Orquesta's checkout, until the webhook marks the subscription active.
+      const org = accountOrg(account.id);
+      if (!org || !hostedConfigured()) return send(res, 200, { status: null, active: false }), true;
+      try {
+        const status = await childBilling(account.id, org);
+        return send(res, 200, { status, active: status === 'active' }), true;
+      } catch (e) {
+        console.warn('[7ots] vm billing:', e.message);
+        return send(res, 503, { error: t('platform.vm.paidUnavailable') }), true;
+      }
+    }
+    if (sub === '/vm/subscription' && req.method === 'DELETE') {
+      // Ends what the account pays for 7ots servers: only with none left (deleting the org cancels the subscription).
+      if (getDb().prepare(`SELECT 1 FROM ots_vms WHERE ${LIVE_PARTNER} AND account_id = ?`).get(account.id)) return send(res, 409, { error: t('platform.vm.subscriptionInUse') }), true;
+      const org = accountOrg(account.id);
+      if (!org) return send(res, 200, { ok: true }), true;
+      const done = await dropChildOrg(account.id, org);
+      return send(res, done ? 200 : 202, { ok: true, queued: !done, hosted: hostedInfo(account) }), true;
+    }
     if ((sub === '/vm' || sub === '/vm/enroll') && req.method === 'POST') {
       const body = await readJson(req, 4096);
       const provider = body.provider || (sub === '/vm' ? 'orquesta' : 'byo');
-      if (provider === 'orquesta') return await createHosted(req, res, account, ots, body), true;
+      if (HOSTED.includes(provider) && sub === '/vm') return await createHosted(req, res, account, ots, provider), true;
       if (provider !== 'byo' || sub !== '/vm/enroll') return send(res, 400, { error: t('server.http.badRequest') }), true;
-      // A 7ots server must be deleted first: re-enrolling would leave its VM running unattached.
-      if (vm?.provider === 'orquesta' && vm.status !== 'terminated') return send(res, 409, { error: t('platform.vm.exists') }), true;
+      // A hosted server must be deleted first: re-enrolling would leave its VM running unattached.
+      if (HOSTED.includes(vm?.provider) && vm.status !== 'terminated') return send(res, 409, { error: t('platform.vm.exists') }), true;
       const code = `7ve_${token()}`;
       const tm = now();
-      if (vm) getDb().prepare("UPDATE ots_vms SET enroll_hash = ?, enroll_exp = ?, provider = 'byo', status = CASE WHEN status = 'terminated' THEN 'pending' ELSE status END, updated_at = ? WHERE ots_id = ?").run(sha256(code), tm + ENROLL_TTL, tm, ots.id);
+      if (vm) getDb().prepare("UPDATE ots_vms SET enroll_hash = ?, enroll_exp = ?, provider = 'byo', orq_org_id = '', status = CASE WHEN status = 'terminated' THEN 'pending' ELSE status END, updated_at = ? WHERE ots_id = ?").run(sha256(code), tm + ENROLL_TTL, tm, ots.id);
       else getDb().prepare("INSERT INTO ots_vms (ots_id, account_id, provider, status, enroll_hash, enroll_exp, created_at, updated_at) VALUES (?, ?, 'byo', 'pending', ?, ?, ?, ?)").run(ots.id, account.id, sha256(code), tm + ENROLL_TTL, tm, tm);
       return send(res, 200, { code, expiresIn: ENROLL_TTL / 1000, command: `npx -y @7ots/cli vm enroll --server ${base(req)} --code ${code} --systemd` }), true;
     }
     if (sub === '/vm' && req.method === 'DELETE') {
       if (!vm) return send(res, 200, { ok: true }), true;
-      const hosted = vm.provider === 'orquesta' && vm.status !== 'terminated';
+      const hosted = HOSTED.includes(vm.provider) && vm.status !== 'terminated';
       getDb().prepare(`UPDATE ots_vms SET agent_hash = NULL, enroll_hash = NULL, enroll_exp = NULL, status = '${hosted ? 'terminating' : 'terminated'}', updated_at = ? WHERE ots_id = ?`).run(now(), ots.id);
       for (const j of getDb().prepare("SELECT * FROM vm_jobs WHERE ots_id = ? AND status NOT IN ('completed', 'failed', 'cancelled')").all(ots.id)) setStatus(j, 'cancelled', { error: 'worker revoked' });
       if (!hosted) return send(res, 200, { ok: true }), true;
@@ -766,8 +1045,8 @@ export function createVm({ send, readJson, rateLimit, base }) {
     return send(res, 404, { error: t('server.http.unknownRoute') }), true;
   }
 
-  // Reconciliation with Orquesta (every VM_RECONCILE_MIN, default 30), only when hosted VMs are configured.
-  if (hostedConfigured() && !createVm.timer) {
+  // Reconciliation with Orquesta (every VM_RECONCILE_MIN, default 30): 7ots' VMs when ORQUESTA_VM_TOKEN is set, owners' own VMs always.
+  if (!createVm.timer) {
     const run = () => reconcileVms().catch((e) => console.warn('[7ots] vm reconcile:', e.message));
     createVm.timer = setInterval(run, RECONCILE_MS());
     createVm.timer.unref?.();