@treeseed/sdk 0.10.27 → 0.11.0

package/dist/reconcile/builtin-adapters.js

@@ -34,10 +34,7 @@ import {
 } from "../operations/services/deploy.js";
 import {
   configuredRailwayServices,
-  deriveRailwayMarketOperationsRunnerVolumeName,
-  ensureRailwayProjectContext,
-  ensureRailwayServiceVolumeWithCliFallback,
-  runRailway,
+  findStaleTreeseedOperationsRunnerResources,
   validateRailwayDeployPrerequisites
 } from "../operations/services/railway-deploy.js";
 import { shouldExposeManagedHostRuntimeSecret } from "../operations/services/managed-host-security.js";
@@ -47,19 +44,24 @@ import {
   ensureRailwayProject,
   ensureRailwayService,
   ensureRailwayServiceInstanceConfiguration,
+  ensureRailwayServiceVolume,
+  ensureRailwayPostgresService,
+  deleteRailwayService,
+  deleteRailwayVolume,
   getRailwayServiceInstance,
   getRailwayProject,
   listRailwayCustomDomains,
   listRailwayEnvironments,
   listRailwayProjects,
+  listRailwayServices,
   listRailwayVolumes,
   listRailwayVariables,
   resolveRailwayWorkspaceContext,
-  updateRailwayServiceName,
   upsertRailwayVariables
 } from "../operations/services/railway-api.js";
 import { loadTreeseedReconcileState } from "./state.js";
 import { createTreeseedReconcileUnitId } from "./units.js";
+import { discoverTreeseedApplications } from "../hosting/apps.js";
 function toDeployTarget(target) {
   return target.kind === "persistent" ? createPersistentDeployTarget(target.scope) : createBranchPreviewDeployTarget(target.branchName);
 }
@@ -103,28 +105,6 @@ function noopDiff() {
     after: {}
   };
 }
-function parseRailwayJsonPayload(output) {
-  const text = typeof output === "string" ? output.trim() : "";
-  if (!text) {
-    return null;
-  }
-  try {
-    return JSON.parse(text);
-  } catch {
-  }
-  const lines = text.split(/\r?\n/u);
-  for (let index = lines.length - 1; index >= 0; index -= 1) {
-    const candidate = lines.slice(index).join("\n").trim();
-    if (!candidate.startsWith("{") && !candidate.startsWith("[")) {
-      continue;
-    }
-    try {
-      return JSON.parse(candidate);
-    } catch {
-    }
-  }
-  return null;
-}
 function buildCompositeAdapter(unitType) {
   return {
     providerId: "treeseed",
@@ -132,10 +112,10 @@ function buildCompositeAdapter(unitType) {
     supports(candidateUnitType, providerId) {
       return candidateUnitType === unitType && providerId === "treeseed";
     },
-    observe(input) {
+    refresh(input) {
       return noopObservedState(input);
     },
-    plan() {
+    diff() {
       return noopDiff();
     },
     requiredPostconditions({ unit }) {
@@ -144,7 +124,7 @@ function buildCompositeAdapter(unitType) {
         description: `Dependency ${dependency} is verified`
       }));
     },
-    reconcile({ unit, observed, diff }) {
+    apply({ unit, observed, diff }) {
       return {
         unit,
         observed,
@@ -329,7 +309,7 @@ function listCloudflareQueuesViaApi(env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function cloudflareObservationSnapshot(input, forceRefresh = false) {
-  const cacheKey = `cloudflare:observe:${input.unit.target.kind === "persistent" ? input.unit.target.scope : input.unit.target.branchName}`;
+  const cacheKey = `cloudflare:refresh:${input.unit.target.kind === "persistent" ? input.unit.target.scope : input.unit.target.branchName}`;
   return providerCache(input, cacheKey, () => {
     const target = toDeployTarget(input.context.target);
     const env = buildCloudflareEnv(input);
@@ -557,58 +537,30 @@ function normalizeRailwayDomainPayload(value) {
   };
 }
 async function ensureRailwayCustomDomain(input, service, domain, env, identifiers) {
-  if (identifiers?.projectId && identifiers?.environmentId && identifiers?.serviceId) {
-    const ensured = await ensureRailwayCustomDomainViaApi({
-      projectId: identifiers.projectId,
-      environmentId: identifiers.environmentId,
-      serviceId: identifiers.serviceId,
-      domain,
-      env
-    });
-    if (ensured.domain) {
-      return ensured.domain;
-    }
+  if (!identifiers?.projectId || !identifiers.environmentId || !identifiers.serviceId) {
+    throw new Error(`Railway custom domain ${domain} cannot be reconciled without project, environment, and service ids.`);
   }
-  ensureRailwayProjectContext(service, { env, capture: true });
-  const result = runRailway(["domain", domain, "--service", service.serviceName ?? service.serviceId, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
+  const existing = await listRailwayCustomDomains({
+    projectId: identifiers.projectId,
+    environmentId: identifiers.environmentId,
+    serviceId: identifiers.serviceId,
     env
   });
-  const output = `${result.stderr ?? ""}
-${result.stdout ?? ""}`;
-  if (identifiers?.projectId && identifiers?.environmentId && identifiers?.serviceId) {
-    const refreshed = await listRailwayCustomDomains({
-      projectId: identifiers.projectId,
-      environmentId: identifiers.environmentId,
-      serviceId: identifiers.serviceId,
-      env
-    });
-    const matched = refreshed.find((entry) => entry.domain === domain) ?? null;
-    if (matched) {
-      return matched;
-    }
-  }
-  if (result.status !== 0 && !/already exists|already assigned|taken|has already been taken|not available/iu.test(output)) {
-    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `railway domain ${domain} failed`);
-  }
-  let parsedJson = {};
-  if (result.stdout?.trim()) {
-    try {
-      parsedJson = JSON.parse(result.stdout);
-    } catch {
-      parsedJson = {};
-    }
-  }
-  const parsed = normalizeRailwayDomainPayload(parsedJson);
-  return parsed ?? {
-    id: null,
+  const matched = existing.find((entry) => entry.domain === domain) ?? null;
+  if (matched) {
+    return matched;
+  }
+  const ensured = await ensureRailwayCustomDomainViaApi({
+    projectId: identifiers.projectId,
+    environmentId: identifiers.environmentId,
+    serviceId: identifiers.serviceId,
     domain,
-    serviceDomain: null,
-    certificateStatus: null,
-    dnsRecords: []
-  };
+    env
+  });
+  if (!ensured.domain) {
+    throw new Error(`Railway API custom domain reconciliation did not return ${domain}.`);
+  }
+  return ensured.domain;
 }
 function collectCloudflareEnvironmentSync(input) {
   const target = toDeployTarget(input.context.target);
@@ -1417,16 +1369,27 @@ function buildCloudflareDiff(input, observed) {
       after: input.unit.spec
     };
   }
+  if (input.unit.unitType === "pages-project") {
+    const verification = verifyCloudflareUnit(input, []);
+    if (verification.supported && !verification.verified) {
+      return {
+        action: "update",
+        reasons: [...verification.missing, ...verification.drifted],
+        before: observed.live,
+        after: input.unit.spec
+      };
+    }
+  }
   const locatorValues = Object.values(observed.locators).filter(Boolean);
   return {
-    action: locatorValues.length > 0 ? "reuse" : "update",
+    action: locatorValues.length > 0 ? "noop" : "update",
     reasons: locatorValues.length > 0 ? ["resource already present"] : ["resource partially configured"],
     before: observed.live,
     after: input.unit.spec
   };
 }
 function reconcileCloudflareUnit(input, diff) {
-  const cacheKey = `cloudflare:reconcile:${input.unit.target.kind === "persistent" ? input.unit.target.scope : input.unit.target.branchName}`;
+  const cacheKey = `cloudflare:apply:${input.unit.target.kind === "persistent" ? input.unit.target.scope : input.unit.target.branchName}`;
   const { state } = providerCache(input, cacheKey, () => {
     let attempt = 0;
     for (; ; ) {
@@ -1449,7 +1412,7 @@ function reconcileCloudflareUnit(input, diff) {
     unit: input.unit,
     observed: refreshed,
     diff,
-    action: diff.action === "create" || diff.action === "update" ? "drift_correct" : diff.action,
+    action: diff.action === "create" || diff.action === "update" ? "update" : diff.action,
     warnings: refreshed.warnings,
     resourceLocators: refreshed.locators,
     state: input.unit.unitType === "edge-worker" ? { workerName: state.workerName, lastDeployedUrl: state.lastDeployedUrl ?? null } : refreshed.live
@@ -1462,7 +1425,7 @@ function buildCloudflareAdapter(unitType) {
     supports(candidateUnitType, providerId) {
       return providerId === "cloudflare" && candidateUnitType === unitType;
     },
-    observe(input) {
+    refresh(input) {
       return observeCloudflareUnit(input);
     },
     requiredPostconditions(input) {
@@ -1507,10 +1470,10 @@ function buildCloudflareAdapter(unitType) {
           return [];
       }
     },
-    plan(input) {
+    diff(input) {
       return buildCloudflareDiff(input, input.observed);
     },
-    reconcile(input) {
+    apply(input) {
       return reconcileCloudflareUnit(input, input.diff);
     },
     verify(input) {
@@ -1523,12 +1486,12 @@ function buildCloudflareAdapter(unitType) {
         unit: input.unit,
         observed: input.observed,
         diff: {
-          action: "destroy",
+          action: "delete",
           reasons: ["target destroyed"],
           before: input.observed.live,
           after: {}
         },
-        action: "destroy",
+        action: "delete",
         warnings: [],
         resourceLocators: {},
         state: {},
@@ -1541,6 +1504,27 @@ function relativeRailwayRootDir(tenantRoot, serviceRoot) {
   const resolved = relative(tenantRoot, serviceRoot).replace(/\\/gu, "/");
   return !resolved || resolved === "" ? "." : resolved;
 }
+function railwayServiceRootDirectory(tenantRoot, service) {
+  return relativeRailwayRootDir(service.application?.root ?? tenantRoot, service.rootDir);
+}
+function configuredMarketDatabaseService(tenantRoot, deployConfig) {
+  if (deployConfig.services?.treeseedDatabase) {
+    return treeseedDatabaseDescriptor(deployConfig.services.treeseedDatabase, deployConfig.slug);
+  }
+  for (const application of discoverTreeseedApplications(tenantRoot)) {
+    const service = application.config.services?.treeseedDatabase;
+    if (service) {
+      return treeseedDatabaseDescriptor(service, application.config.slug);
+    }
+  }
+  return null;
+}
+function treeseedDatabaseDescriptor(service, slug) {
+  return {
+    service,
+    serviceName: typeof service.railway?.serviceName === "string" && service.railway.serviceName.trim() ? service.railway.serviceName.trim() : `${slug ?? "treeseed-api"}-postgres`
+  };
+}
 async function ensureRailwayEnvironmentForService({
   service,
   project,
@@ -1559,16 +1543,6 @@ async function ensureRailwayEnvironmentForService({
       throw error;
     }
   }
-  ensureRailwayProjectContext({
-    ...service,
-    projectId: project.id,
-    projectName: project.name ?? service.projectName,
-    railwayEnvironment: environmentName
-  }, {
-    env,
-    allowFailure: true,
-    capture: true
-  });
   for (let attempt = 0; attempt < 12; attempt += 1) {
     const environments = await listRailwayEnvironments({ projectId: project.id, env });
     const existing = environments.find((environment) => environment.name === environmentName || environment.id === environmentName) ?? null;
@@ -1577,7 +1551,7 @@ async function ensureRailwayEnvironmentForService({
     }
     await new Promise((resolve2) => setTimeout(resolve2, 2500));
   }
-  throw new Error(`Railway environment ${environmentName} was created through the CLI fallback but was not visible through the Railway API.`);
+  throw new Error(`Railway API environment provisioning failed for ${project.name ?? service.projectName ?? project.id}/${environmentName}.`);
 }
 async function resolveRailwayTopologyForScope(input, scope, {
   ensure = false,
@@ -1592,6 +1566,7 @@ async function resolveRailwayTopologyForScope(input, scope, {
     const env = buildRailwayEnv(input, scope);
     const deployState = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target: toDeployTarget(input.context.target) });
     const services = configuredRailwayServices(input.context.tenantRoot, scope).filter((service) => normalizedServiceKeys.includes("__all__") || normalizedServiceKeys.includes(service.key));
+    traceRailwayReconcile(env, "topology:start", `scope=${scope} ensure=${ensure ? "yes" : "no"} services=${services.map((service) => service.key).join(",")}`);
     let workspace = null;
     const knownProjects = [];
     const knownProjectIds = [...new Set(services.map((service) => service.projectId || deployState.services?.[service.key]?.projectId || "").filter((value) => typeof value === "string" && value.trim().length > 0).map((value) => value.trim()))];
@@ -1626,6 +1601,7 @@ async function resolveRailwayTopologyForScope(input, scope, {
     }
     const resolvedServices = /* @__PURE__ */ new Map();
     for (const service of services) {
+      traceRailwayReconcile(env, "topology:service:start", service.key);
       const persistedService = deployState.services?.[service.key] ?? {};
       const resolvedProjectId = service.projectId ?? persistedService.projectId ?? "";
       const resolvedProjectName = service.projectName ?? persistedService.projectName ?? "";
@@ -1634,8 +1610,10 @@ async function resolveRailwayTopologyForScope(input, scope, {
       let project = projectsByKey.get(resolvedProjectId) ?? projectsByKey.get(resolvedProjectName) ?? null;
       if (!project && ensure) {
         if (!workspace) {
+          traceRailwayReconcile(env, "topology:workspace", "resolving workspace");
           workspace = await resolveRailwayWorkspaceContext({ env });
         }
+        traceRailwayReconcile(env, "topology:project:ensure", `${service.key}:${resolvedProjectName || resolvedProjectId}`);
         const ensuredProject = await ensureRailwayProject({
           projectId: resolvedProjectId,
           projectName: resolvedProjectName,
@@ -1649,6 +1627,7 @@ async function resolveRailwayTopologyForScope(input, scope, {
       }
       let environment = project?.environments.find((entry) => entry.name === service.railwayEnvironment || entry.id === service.railwayEnvironment) ?? null;
       if (project && !environment && ensure) {
+        traceRailwayReconcile(env, "topology:environment:ensure", `${service.key}:${service.railwayEnvironment}`);
         environment = await ensureRailwayEnvironmentForService({
           service,
           project,
@@ -1664,6 +1643,7 @@ async function resolveRailwayTopologyForScope(input, scope, {
       }
       let resolvedService = project?.services.find((entry) => entry.id === resolvedServiceId || entry.name === resolvedServiceName) ?? null;
       if (project && !resolvedService && ensure) {
+        traceRailwayReconcile(env, "topology:railway-service:ensure", `${service.key}:${resolvedServiceName || resolvedServiceId}`);
         resolvedService = (await ensureRailwayService({
           projectId: project.id,
           serviceId: resolvedServiceId,
@@ -1680,12 +1660,13 @@ async function resolveRailwayTopologyForScope(input, scope, {
       let instance = null;
       if (includeInstances && resolvedService && environment) {
         if (ensure) {
+          traceRailwayReconcile(env, "topology:instance:ensure", `${service.key}:${resolvedService.name}`);
           instance = (await ensureRailwayServiceInstanceConfiguration({
             serviceId: resolvedService.id,
             environmentId: environment.id,
             buildCommand: service.buildCommand,
             startCommand: service.startCommand,
-            rootDirectory: relativeRailwayRootDir(input.context.tenantRoot, service.rootDir),
+            rootDirectory: railwayServiceRootDirectory(input.context.tenantRoot, service),
             healthcheckPath: service.healthcheckPath,
             healthcheckTimeoutSeconds: service.healthcheckTimeoutSeconds,
             healthcheckIntervalSeconds: service.healthcheckIntervalSeconds,
@@ -1715,7 +1696,9 @@ async function resolveRailwayTopologyForScope(input, scope, {
         instance,
         currentVariables
       });
+      traceRailwayReconcile(env, "topology:service:done", service.key);
     }
+    traceRailwayReconcile(env, "topology:done", `scope=${scope}`);
     return {
       scope,
       env,
@@ -1727,20 +1710,171 @@ async function resolveRailwayTopologyForScope(input, scope, {
     };
   }, refresh);
 }
+function traceRailwayReconcile(env, stage, message) {
+  if (env?.TREESEED_RECONCILE_TRACE === "1" || process.env.TREESEED_RECONCILE_TRACE === "1") {
+    console.error(`[trsd][railway][${stage}] ${message}`);
+  }
+}
+function railwayDriftSessionKey(scope) {
+  return `railway:provider-drift:${scope}`;
+}
+function recordRailwayProviderDrift(input, scope, drift) {
+  const key = railwayDriftSessionKey(scope);
+  const current = input.context.session.get(key);
+  const entries = Array.isArray(current) ? current : [];
+  entries.push(drift);
+  input.context.session.set(key, entries);
+}
+function railwayProviderDrift(input, scope) {
+  const current = input.context.session.get(railwayDriftSessionKey(scope));
+  return Array.isArray(current) ? current : [];
+}
+function activeRailwayVolumeInstances(volume) {
+  const instances = Array.isArray(volume.instances) ? volume.instances : [];
+  return instances.filter((instance) => {
+    const state = String(instance.state ?? "READY").toUpperCase();
+    return state !== "DELETING" && state !== "DELETED";
+  });
+}
+async function waitForRailwayServiceDeleted({
+  projectId,
+  serviceId,
+  env
+}) {
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    const services = await listRailwayServices({ projectId, env }).catch(() => []);
+    if (!services.some((service) => service.id === serviceId)) {
+      return true;
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, 1500));
+  }
+  return false;
+}
+async function waitForRailwayVolumeDeleted({
+  projectId,
+  volumeId,
+  env
+}) {
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    const volumes = await listRailwayVolumes({ projectId, env }).catch(() => []);
+    if (!volumes.some((volume) => volume.id === volumeId)) {
+      return true;
+    }
+    await new Promise((resolve2) => setTimeout(resolve2, 1500));
+  }
+  return false;
+}
+async function reconcileStaleOperationsRunnerResourcesForScope(input, topology) {
+  const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
+  const desiredRunners = configuredRailwayServices(input.context.tenantRoot, scope).filter((service) => service.key === "operationsRunner").filter((service) => service.enabled !== false);
+  const desiredServiceNames = new Set(desiredRunners.map((service) => service.serviceName).filter(Boolean));
+  const desiredVolumeNames = new Set([...desiredServiceNames].map((serviceName) => `${serviceName}-volume`));
+  if (desiredServiceNames.size === 0) {
+    traceRailwayReconcile(topology.env, "sync:runner:cleanup-skip", "no desired operations runner service names");
+    return;
+  }
+  const projectEntries = [...topology.services.values()].filter((entry) => entry.project?.id && entry.environment?.id).map((entry) => ({ project: entry.project, environment: entry.environment }));
+  traceRailwayReconcile(
+    topology.env,
+    "sync:runner:cleanup-projects",
+    projectEntries.map((entry) => `${entry.project.name}:${entry.environment.name}`).join(",") || "(none)"
+  );
+  const projects = new Map(projectEntries.map((entry) => [entry.project.id, entry]));
+  for (const { project, environment } of projects.values()) {
+    await reconcileStaleOperationsRunnerResourcesForProject(input, {
+      scope,
+      env: topology.env,
+      project,
+      environment,
+      desiredServiceNames,
+      desiredVolumeNames
+    });
+  }
+}
+async function reconcileStaleOperationsRunnerResourcesForProject(input, {
+  scope,
+  env,
+  project,
+  environment,
+  desiredServiceNames,
+  desiredVolumeNames
+}) {
+  if (desiredServiceNames.size === 0 || desiredVolumeNames.size === 0) {
+    traceRailwayReconcile(env, "sync:runner:delete-skip", `${project.name}: no desired runner names; refusing to prune operations runner resources`);
+    return;
+  }
+  const services = await listRailwayServices({ projectId: project.id, env });
+  const desiredServiceIds = new Set(services.filter((service) => desiredServiceNames.has(service.name)).map((service) => service.id));
+  const staleServices = findStaleTreeseedOperationsRunnerResources(services, desiredServiceNames);
+  traceRailwayReconcile(
+    env,
+    "sync:runner:observed-services",
+    `${project.name}: desired=${[...desiredServiceNames].join(",") || "(none)"} stale=${staleServices.map((service) => service.name).join(",") || "(none)"}`
+  );
+  for (const service of staleServices) {
+    traceRailwayReconcile(env, "sync:runner:delete-stale-service", `${service.name}:${service.id}`);
+    await deleteRailwayService({ serviceId: service.id, env });
+    const deleted = await waitForRailwayServiceDeleted({ projectId: project.id, serviceId: service.id, env });
+    if (!deleted) {
+      recordRailwayProviderDrift(input, scope, {
+        kind: "railway.stale-operations-runner-service",
+        action: "delete",
+        status: "blocked",
+        projectId: project.id,
+        environmentId: environment.id,
+        serviceId: service.id,
+        serviceName: service.name,
+        reason: "Railway still reports the stale operations runner service after delete reconciliation."
+      });
+    }
+  }
+  const volumes = await listRailwayVolumes({ projectId: project.id, env }).catch(() => []);
+  const staleVolumes = findStaleTreeseedOperationsRunnerResources(volumes, desiredVolumeNames).filter((volume) => {
+    const activeInstances = activeRailwayVolumeInstances(volume);
+    return volume.instances.length === 0 || activeInstances.length > 0;
+  }).filter((volume) => activeRailwayVolumeInstances(volume).every((instance) => !desiredServiceIds.has(instance.serviceId ?? "")));
+  traceRailwayReconcile(
+    env,
+    "sync:runner:observed-volumes",
+    `${project.name}: desired=${[...desiredVolumeNames].join(",") || "(none)"} stale=${staleVolumes.map((volume) => volume.name ?? volume.id).join(",") || "(none)"}`
+  );
+  for (const volume of staleVolumes) {
+    traceRailwayReconcile(env, "sync:runner:delete-stale-volume", `${volume.name ?? volume.id}:${volume.id}`);
+    await deleteRailwayVolume({ volumeId: volume.id, env });
+    const deleted = await waitForRailwayVolumeDeleted({ projectId: project.id, volumeId: volume.id, env });
+    if (!deleted) {
+      recordRailwayProviderDrift(input, scope, {
+        kind: "railway.stale-operations-runner-volume",
+        action: "delete",
+        status: "blocked",
+        projectId: project.id,
+        environmentId: environment.id,
+        volumeId: volume.id,
+        volumeName: volume.name ?? null,
+        reason: "Railway still reports the stale operations runner volume after delete reconciliation."
+      });
+    }
+  }
+}
 async function syncRailwayEnvironmentForScope(input, { dryRun = false } = {}) {
   const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
   const sync = collectRailwayEnvironmentSync(input);
+  traceRailwayReconcile(input.context.env, "sync:start", `scope=${scope} dryRun=${dryRun ? "yes" : "no"}`);
   const topology = await resolveRailwayTopologyForScope(input, scope, {
     ensure: !dryRun,
     includeInstances: !dryRun,
     includeVariables: false
   });
+  traceRailwayReconcile(topology.env, "sync:topology", `services=${[...topology.services.keys()].join(",")}`);
   if (!dryRun) {
+    traceRailwayReconcile(topology.env, "sync:postgres:start", "ensuring Treeseed database");
     await ensureRailwayMarketDatabaseForScope(input, topology);
+    traceRailwayReconcile(topology.env, "sync:postgres:done", "Treeseed database ensured");
     for (const entry of topology.services.values()) {
       if (!entry.project || !entry.environment || !entry.service) {
         continue;
       }
+      traceRailwayReconcile(topology.env, "sync:variables", `${entry.configuredService.key}:${entry.service.name}`);
       const serviceSync = sync.forService(entry.configuredService.key);
       await upsertRailwayVariables({
         projectId: entry.project.id,
@@ -1753,60 +1887,42 @@ async function syncRailwayEnvironmentForScope(input, { dryRun = false } = {}) {
         env: topology.env
       });
       if (entry.configuredService.volumeMountPath) {
-        const volumeName = entry.configuredService.key === "marketOperationsRunner" ? deriveRailwayMarketOperationsRunnerVolumeName(entry.service.name, entry.environment.name) : `${entry.service.name}-volume`;
-        const volume = await ensureRailwayServiceVolumeWithCliFallback({
-          tenantRoot: input.context.tenantRoot,
+        const volumeName = `${entry.service.name}-volume`;
+        traceRailwayReconcile(topology.env, "sync:volume", `${entry.configuredService.key}:${volumeName}:${entry.configuredService.volumeMountPath}`);
+        const volume = await ensureRailwayServiceVolume({
           projectId: entry.project.id,
           environmentId: entry.environment.id,
-          environmentName: entry.environment.name,
           serviceId: entry.service.id,
-          serviceName: entry.service.name,
           name: volumeName,
           mountPath: entry.configuredService.volumeMountPath,
-          preferCli: entry.configuredService.key === "marketOperationsRunner",
           env: topology.env
         });
         if (volume.instance?.serviceId !== entry.service.id || volume.instance?.environmentId !== entry.environment.id || volume.instance?.mountPath !== entry.configuredService.volumeMountPath) {
-          ensureRailwayProjectContext(entry.configuredService, { env: topology.env, capture: true });
-          let attachMessage = "";
-          let attached = false;
-          for (let attempt = 0; attempt < 5; attempt += 1) {
-            const attachResult = runRailway([
-              "volume",
-              "--service",
-              entry.service.id,
-              "attach",
-              "--volume",
-              volume.volume.id,
-              "--yes",
-              "--json"
-            ], {
-              cwd: entry.configuredService.rootDir,
-              capture: true,
-              allowFailure: true,
-              env: topology.env
-            });
-            if ((attachResult.status ?? 1) === 0) {
-              attached = true;
-              break;
-            }
-            attachMessage = attachResult.stderr?.trim() || attachResult.stdout?.trim() || "";
-            if (/already mounted/iu.test(attachMessage)) {
-              attached = true;
-              break;
-            }
-            if (!/volume .*not found|not found|does not exist/iu.test(attachMessage)) {
-              break;
-            }
-            sleepMs(2e3 * (attempt + 1));
-          }
-          if (!attached) {
-            throw new Error(attachMessage || `Railway volume attach failed for ${entry.service.name}.`);
-          }
+          throw new Error(`Railway API volume reconciliation did not mount ${volumeName} on ${entry.service.name} at ${entry.configuredService.volumeMountPath}.`);
+        }
+      }
+      if (entry.configuredService.key === "operationsRunner") {
+        const desiredServiceNames = new Set(configuredRailwayServices(input.context.tenantRoot, scope).filter((service) => service.key === "operationsRunner").filter((service) => service.enabled !== false).map((service) => service.serviceName).filter(Boolean));
+        if (entry.configuredService.serviceName) {
+          desiredServiceNames.add(entry.configuredService.serviceName);
+        }
+        const desiredVolumeNames = new Set([...desiredServiceNames].map((serviceName) => `${serviceName}-volume`));
+        if (desiredServiceNames.size > 0) {
+          await reconcileStaleOperationsRunnerResourcesForProject(input, {
+            scope,
+            env: topology.env,
+            project: entry.project,
+            environment: entry.environment,
+            desiredServiceNames,
+            desiredVolumeNames
+          });
         }
       }
     }
+    traceRailwayReconcile(topology.env, "sync:runner:cleanup-stale", "reconciling old operations runner resources");
+    await reconcileStaleOperationsRunnerResourcesForScope(input, topology);
   }
+  traceRailwayReconcile(topology.env, "sync:done", `scope=${scope}`);
   return {
     scope,
     services: [...topology.services.values()].map((entry) => entry.configuredService),
@@ -1817,38 +1933,101 @@ async function syncRailwayEnvironmentForScope(input, { dryRun = false } = {}) {
   };
 }
 async function ensureRailwayMarketDatabaseForScope(input, topology) {
-  const marketDatabaseService = input.context.deployConfig.services?.marketDatabase;
-  if (!marketDatabaseService || marketDatabaseService.enabled === false || marketDatabaseService.provider !== "railway" || marketDatabaseService.railway?.resourceType !== "postgres") {
+  const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
+  const treeseedDatabase = configuredMarketDatabaseService(input.context.tenantRoot, input.context.deployConfig);
+  const treeseedDatabaseService = treeseedDatabase?.service;
+  if (!treeseedDatabaseService || treeseedDatabaseService.enabled === false || treeseedDatabaseService.provider !== "railway" || treeseedDatabaseService.railway?.resourceType !== "postgres") {
     return;
   }
   const firstService = [...topology.services.values()].find((entry) => entry.project && entry.environment);
   if (!firstService?.project || !firstService.environment) {
     return;
   }
-  const baseName = typeof marketDatabaseService.railway?.serviceName === "string" && marketDatabaseService.railway.serviceName.trim() ? marketDatabaseService.railway.serviceName.trim() : `${input.context.deployConfig.slug ?? "treeseed-market"}-postgres`;
-  const serviceName = `${baseName.replace(/-(staging|prod|production)$/u, "")}-${topology.scope === "prod" ? "prod" : topology.scope}`;
-  let postgresService = firstService.project.services.find((entry) => entry.name === serviceName || entry.id === serviceName) ?? null;
+  const serviceName = treeseedDatabase.serviceName;
+  let postgresService;
+  try {
+    postgresService = (await ensureRailwayPostgresService({
+      projectId: firstService.project.id,
+      environmentId: firstService.environment.id,
+      serviceName,
+      env: topology.env
+    })).service;
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error ?? "");
+    throw new Error(`Railway API Postgres provisioning unsupported for ${serviceName}. ${detail}`);
+  }
   if (!postgresService) {
-    ensureRailwayProjectContext(firstService.configuredService, { env: topology.env, capture: true });
-    const addResult = runRailway(["add", "--database", "postgres", "--json"], {
-      cwd: firstService.configuredService.rootDir,
-      capture: true,
-      allowFailure: true,
+    throw new Error(`Railway API Postgres provisioning unsupported for ${serviceName}. No service was returned.`);
+  }
+  try {
+    const postgresVolume = await ensureRailwayServiceVolume({
+      projectId: firstService.project.id,
+      environmentId: firstService.environment.id,
+      serviceId: postgresService.id,
+      name: `${serviceName}-volume`,
+      mountPath: "/var/lib/postgresql/data",
       env: topology.env
     });
-    if ((addResult.status ?? 1) !== 0) {
-      throw new Error(addResult.stderr?.trim() || addResult.stdout?.trim() || `Railway database provisioning failed for ${serviceName}.`);
+    if (postgresVolume.volume.name !== `${serviceName}-volume`) {
+      throw new Error(`observed volume name ${postgresVolume.volume.name ?? "(unnamed)"}`);
     }
-    const payload = parseRailwayJsonPayload(addResult.stdout);
-    const createdServiceId = typeof payload?.serviceId === "string" && payload.serviceId.trim() ? payload.serviceId.trim() : "";
-    if (!createdServiceId) {
-      throw new Error(`Railway database provisioning did not return a service id for ${serviceName}.`);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error ?? "");
+    throw new Error(`Railway provider limitation while reconciling PostgreSQL volume name ${serviceName}-volume: ${detail}`);
+  }
+  const services = await listRailwayServices({ projectId: firstService.project.id, env: topology.env });
+  for (const service of services) {
+    if (service.id === postgresService.id || service.name === serviceName) {
+      continue;
     }
-    postgresService = await updateRailwayServiceName({
-      serviceId: createdServiceId,
-      name: serviceName,
+    const variables = await listRailwayVariables({
+      projectId: firstService.project.id,
+      environmentId: firstService.environment.id,
+      serviceId: service.id,
       env: topology.env
-    });
+    }).catch(() => ({}));
+    const looksLikePostgres = typeof variables.DATABASE_URL === "string" && typeof variables.PGHOST === "string" && typeof variables.PGUSER === "string" && typeof variables.PGPASSWORD === "string";
+    if (looksLikePostgres) {
+      traceRailwayReconcile(topology.env, "sync:postgres:delete-duplicate", `${service.name}:${service.id}`);
+      await deleteRailwayService({ serviceId: service.id, env: topology.env });
+    }
+  }
+  const detachedPostgresVolumes = await listRailwayVolumes({
+    projectId: firstService.project.id,
+    env: topology.env
+  });
+  for (const volume of detachedPostgresVolumes) {
+    const postgresInstances = volume.instances.filter(
+      (instance) => instance.environmentId === firstService.environment?.id && instance.mountPath === "/var/lib/postgresql/data"
+    );
+    const attachedToCanonical = postgresInstances.some((instance) => instance.serviceId === postgresService.id);
+    const detached = postgresInstances.length > 0 && postgresInstances.every((instance) => !instance.serviceId);
+    if (detached && !attachedToCanonical) {
+      traceRailwayReconcile(topology.env, "sync:postgres:delete-detached-volume", `${volume.name ?? volume.id}:${volume.id}`);
+      await deleteRailwayVolume({ volumeId: volume.id, env: topology.env });
+      let deleted = false;
+      for (let attempt = 0; attempt < 10; attempt += 1) {
+        await new Promise((resolve2) => setTimeout(resolve2, 3e3));
+        const refreshed = await listRailwayVolumes({
+          projectId: firstService.project.id,
+          env: topology.env
+        });
+        deleted = !refreshed.some((candidate) => candidate.id === volume.id);
+        if (deleted) break;
+      }
+      if (!deleted) {
+        recordRailwayProviderDrift(input, scope, {
+          kind: "railway.detached-postgres-volume",
+          action: "delete",
+          status: "blocked",
+          projectId: firstService.project.id,
+          environmentId: firstService.environment.id,
+          volumeId: volume.id,
+          volumeName: volume.name ?? null,
+          reason: "Railway still reports the detached PostgreSQL volume after delete reconciliation."
+        });
+      }
+    }
   }
   for (let attempt = 0; attempt < 20; attempt += 1) {
     const existingVolumes = await listRailwayVolumes({
@@ -1926,10 +2105,10 @@ function collectRailwayEnvironmentSync(input) {
   const variables = Object.fromEntries(aggregateEntries("railway-var"));
   const apiOnlySecrets = {};
   const apiOnlyVariables = {};
-  const marketDatabaseService = input.context.deployConfig.services?.marketDatabase;
-  const marketDatabaseBaseName = typeof marketDatabaseService?.railway?.serviceName === "string" && marketDatabaseService.railway.serviceName.trim() ? marketDatabaseService.railway.serviceName.trim() : `${input.context.deployConfig.slug ?? "treeseed-market"}-postgres`;
-  const marketDatabaseServiceName = `${marketDatabaseBaseName.replace(/-(staging|prod|production)$/u, "")}-${scope === "prod" ? "prod" : scope}`;
-  const marketDatabaseUrl = typeof values.TREESEED_MARKET_DATABASE_URL === "string" && values.TREESEED_MARKET_DATABASE_URL.length > 0 ? values.TREESEED_MARKET_DATABASE_URL : marketDatabaseService?.enabled !== false && marketDatabaseService?.provider === "railway" ? `\${{${marketDatabaseServiceName}.DATABASE_URL}}` : "";
+  const treeseedDatabase = configuredMarketDatabaseService(input.context.tenantRoot, input.context.deployConfig);
+  const treeseedDatabaseService = treeseedDatabase?.service;
+  const treeseedDatabaseServiceName = treeseedDatabase?.serviceName ?? "";
+  const treeseedDatabaseUrl = typeof values.TREESEED_DATABASE_URL === "string" && values.TREESEED_DATABASE_URL.length > 0 ? values.TREESEED_DATABASE_URL : treeseedDatabaseService?.enabled !== false && treeseedDatabaseService?.provider === "railway" ? `\${{${treeseedDatabaseServiceName}.DATABASE_URL}}` : "";
   if (typeof values.CLOUDFLARE_API_TOKEN === "string" && values.CLOUDFLARE_API_TOKEN.length > 0 && shouldExposeManagedHostRuntimeSecret(input.context.deployConfig, "CLOUDFLARE_API_TOKEN")) {
     secrets.CLOUDFLARE_API_TOKEN = values.CLOUDFLARE_API_TOKEN;
     apiOnlySecrets.CLOUDFLARE_API_TOKEN = values.CLOUDFLARE_API_TOKEN;
@@ -1948,8 +2127,8 @@ function collectRailwayEnvironmentSync(input) {
     variables.TREESEED_API_D1_DATABASE_ID = apiD1DatabaseId;
     apiOnlyVariables.TREESEED_API_D1_DATABASE_ID = apiD1DatabaseId;
   }
-  if (marketDatabaseUrl) {
-    secrets.TREESEED_MARKET_DATABASE_URL = marketDatabaseUrl;
+  if (treeseedDatabaseUrl) {
+    secrets.TREESEED_DATABASE_URL = treeseedDatabaseUrl;
   }
   return {
     scope,
@@ -1959,11 +2138,12 @@ function collectRailwayEnvironmentSync(input) {
       return {
         secrets: {
           ...Object.fromEntries(entriesForService("railway-secret", serviceKey)),
-          ...marketDatabaseUrl && ["api", "marketOperationsRunner"].includes(serviceKey) ? { TREESEED_MARKET_DATABASE_URL: marketDatabaseUrl } : {},
+          ...treeseedDatabaseUrl && ["api", "operationsRunner"].includes(serviceKey) ? { TREESEED_DATABASE_URL: treeseedDatabaseUrl } : {},
           ...serviceKey === "api" ? apiOnlySecrets : {}
         },
         variables: {
           ...Object.fromEntries(entriesForService("railway-var", serviceKey)),
+          ...serviceKey === "operationsRunner" ? { TREESEED_MANAGER_ID: scope } : {},
           ...serviceKey === "api" ? apiOnlyVariables : {}
         }
       };
@@ -1980,7 +2160,7 @@ function buildAttachmentDiff(input, observed) {
     };
   }
   return {
-    action: observed.status === "ready" ? "reuse" : "update",
+    action: observed.status === "ready" ? "noop" : "update",
     reasons: observed.status === "ready" ? ["attachment already present"] : ["attachment requires update"],
     before: observed.live,
     after: input.unit.spec
@@ -2186,7 +2366,7 @@ async function reconcileCustomDomainUnit(input, diff) {
         unit: input.unit,
         observed,
         diff,
-        action: diff.action === "create" || diff.action === "update" ? "drift_correct" : diff.action,
+        action: diff.action === "create" || diff.action === "update" ? "update" : diff.action,
         warnings: observed.warnings,
         resourceLocators: observed.locators,
         state,
@@ -2223,7 +2403,7 @@ async function reconcileCustomDomainUnit(input, diff) {
         unit: input.unit,
         observed,
         diff,
-        action: diff.action === "create" || diff.action === "update" ? "drift_correct" : diff.action,
+        action: diff.action === "create" || diff.action === "update" ? "update" : diff.action,
         warnings: observed.warnings,
         resourceLocators: observed.locators,
         state,
@@ -2251,7 +2431,7 @@ function reconcileDnsRecordUnit(input, diff) {
         unit: input.unit,
         observed,
         diff,
-        action: diff.action === "create" || diff.action === "update" ? "drift_correct" : diff.action,
+        action: diff.action === "create" || diff.action === "update" ? "update" : diff.action,
         warnings: observed.warnings,
         resourceLocators: observed.locators,
         state: {
@@ -2334,7 +2514,7 @@ async function verifyRailwayUnit(input) {
           issues: startCommandMatches ? [] : ["Railway start command does not match the desired value."]
         }));
       }
-      const desiredRootDirectory = relativeRailwayRootDir(input.context.tenantRoot, service.rootDir);
+      const desiredRootDirectory = railwayServiceRootDirectory(input.context.tenantRoot, service);
       if (desiredRootDirectory) {
         checks.push(verificationCheck("railway.instance.root-directory", "Railway root directory matches desired config", "api", {
           exists: Boolean(entry.instance?.id),
@@ -2435,7 +2615,10 @@ async function verifyRailwayUnit(input) {
           issues: Object.hasOwn(entry.currentVariables, key) ? [] : [`Railway secret ${key} is missing.`]
         }));
       }
-      const verification = summarizeVerification(input.unit.unitId, checks);
+      const providerDriftWarnings = railwayProviderDrift(input, scope).map(
+        (drift) => `Railway provider drift remains unresolved: ${String(drift.reason ?? drift.kind ?? "unknown drift")}`
+      );
+      const verification = summarizeVerification(input.unit.unitId, checks, providerDriftWarnings);
       if (!verification.verified && attempt < 12 && railwayVerificationMaySettle(verification)) {
         attempt += 1;
         sleepMs(5e3);
@@ -2460,7 +2643,7 @@ function railwayStartCommandMatches(serviceKey, observed, expected) {
   if (observed === expected) {
     return true;
   }
-  if (serviceKey !== "marketOperationsRunner") {
+  if (serviceKey !== "operationsRunner") {
     return false;
   }
   const normalizedObserved = String(observed ?? "").trim().replace(/\s+/gu, " ");
@@ -2469,7 +2652,7 @@ function railwayStartCommandMatches(serviceKey, observed, expected) {
     return true;
   }
   const allowedInlineEnv = [
-    "TREESEED_MARKET_ID",
+    "TREESEED_MANAGER_ID",
     "TREESEED_PLATFORM_RUNNER_ID",
     "TREESEED_PLATFORM_RUNNER_DATA_DIR",
     "TREESEED_PLATFORM_RUNNER_ENVIRONMENT"
@@ -2490,7 +2673,7 @@ function buildRailwayDiff(input, observed) {
     };
   }
   return {
-    action: observed.status === "ready" ? "reuse" : "update",
+    action: observed.status === "ready" ? "noop" : "update",
     reasons: observed.status === "ready" ? ["service already configured"] : ["service requires configuration sync"],
     before: observed.live,
     after: input.unit.spec
@@ -2513,7 +2696,7 @@ async function reconcileRailwayUnit(input, diff) {
     unit: input.unit,
     observed: refreshed,
     diff,
-    action: diff.action === "update" || diff.action === "create" ? "drift_correct" : diff.action,
+    action: diff.action === "update" || diff.action === "create" ? "update" : diff.action,
     warnings: refreshed.warnings,
     resourceLocators: refreshed.locators,
     state: refreshed.live,
@@ -2533,13 +2716,13 @@ function buildRailwayAdapter(unitType) {
         env: buildRailwayEnv(input, scope)
       });
     },
-    observe(input) {
+    refresh(input) {
       return observeRailwayUnit(input);
     },
-    plan(input) {
+    diff(input) {
       return buildRailwayDiff(input, input.observed);
     },
-    reconcile(input) {
+    apply(input) {
       return reconcileRailwayUnit(input, input.diff);
     },
     requiredPostconditions() {
@@ -2569,7 +2752,7 @@ function buildCustomDomainAdapter(unitType, providerId) {
         });
       }
     },
-    observe(input) {
+    refresh(input) {
       return observeCustomDomainUnit(input);
     },
     requiredPostconditions() {
@@ -2578,10 +2761,10 @@ function buildCustomDomainAdapter(unitType, providerId) {
         ...providerId === "railway" ? [{ key: "custom-domain.dns-requirements", description: "Custom domain exposes DNS requirements" }] : []
       ];
     },
-    plan(input) {
+    diff(input) {
       return buildAttachmentDiff(input, input.observed);
     },
-    reconcile(input) {
+    apply(input) {
       return reconcileCustomDomainUnit(input, input.diff);
     },
     verify(input) {
@@ -2596,7 +2779,7 @@ function buildDnsRecordAdapter() {
     supports(candidateUnitType, providerId) {
       return candidateUnitType === "dns-record" && providerId === "cloudflare-dns";
     },
-    observe(input) {
+    refresh(input) {
       return observeDnsRecordUnit(input);
     },
     requiredPostconditions(input) {
@@ -2606,10 +2789,10 @@ function buildDnsRecordAdapter() {
         description: `DNS record ${record.type} ${record.name} matches the desired value`
       }));
     },
-    plan(input) {
+    diff(input) {
       return buildAttachmentDiff(input, input.observed);
     },
-    reconcile(input) {
+    apply(input) {
       return reconcileDnsRecordUnit(input, input.diff);
     },
     verify(input) {
@@ -2634,12 +2817,12 @@ function createCloudflareReconcileAdapters() {
 function createRailwayReconcileAdapters() {
   return [
     buildRailwayAdapter("railway-service:api"),
-    buildRailwayAdapter("railway-service:market-operations-runner"),
+    buildRailwayAdapter("railway-service:operations-runner"),
     buildRailwayAdapter("railway-service:workday-manager"),
     buildRailwayAdapter("railway-service:worker-runner"),
     buildCustomDomainAdapter("custom-domain:api", "railway"),
     buildCompositeAdapter("api-runtime"),
-    buildCompositeAdapter("market-operations-runner-runtime"),
+    buildCompositeAdapter("operations-runner-runtime"),
     buildCompositeAdapter("workday-manager-runtime"),
     buildCompositeAdapter("worker-runner-runtime")
   ];