@wtfalch/foundry 0.16.16 → 0.17.1

package/dist/plan/executor.js

@@ -2,18 +2,22 @@ import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
 import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
-import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, chatInternalNames, chatMasConfigYaml, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
+import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
+import { entryEdgeAppliedScopeKey, entryEdgeRetiredScopeKey, entryEdgeRouteIdScopeKey, entryEdgeRoutePatternScopeKey, entryEdgeRoutePendingScopeKey, entryEdgeRouteZoneScopeKey, entryEdgeUploadedScopeKey, } from './edge-worker.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
+import { ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS, NAMES_ENTRY_KEY_DAYS, NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY, entryNamesMintedAtScopeKey, entryNamesRetiredScopeKey, entryNamesUndeliveredScopeKey, } from './entry-names-key.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
 /**
@@ -210,14 +214,16 @@ const RATE_LIMIT_REQUESTS_PER_PERIOD = 10;
 const DEFAULT_APP_REPO = 'wtfalch/foundry';
 const DEFAULT_APP_DOCKERFILE = '/apps/hestia/Dockerfile';
 /**
- * The one repo `cmsSite` builds both of its apps from
- * (https://github.com/wtfalch/cms) -- the 2026-09-25 decision this campaign
- * implements (`.plans/2026-09-25-org-sites.md`, that repo): foundry never
- * calls a cms admin API for the org's site, it provisions two ordinary
- * Coolify applications from this one repo, told apart by
- * `dockerfile_location`. `CMS_APP_DOCKERFILE` is the repo's own root
- * `Dockerfile` (`apps/host`, single-org mode); `CMS_SITE_APP_DOCKERFILE`
- * is `apps/site`'s own Dockerfile (the reference renderer).
+ * The shared repo `cmsSite` builds its cms admin app from, always, and its
+ * site app from by default (https://github.com/wtfalch/cms) -- the
+ * 2026-09-25 decision this campaign implements
+ * (`.plans/2026-09-25-org-sites.md`, that repo): foundry never calls a cms
+ * admin API for the org's site, it provisions two ordinary Coolify
+ * applications, told apart by `dockerfile_location`. `CMS_APP_DOCKERFILE`
+ * is the repo's own root `Dockerfile` (`apps/host`, single-org mode);
+ * `CMS_SITE_APP_DOCKERFILE` is `apps/site`'s own Dockerfile (the reference
+ * renderer). An org with `site.repo` set (#245) builds its site app from
+ * that repo instead, the sample skin otherwise ships to every org.
  */
 const CMS_REPO = 'wtfalch/cms';
 const CMS_APP_DOCKERFILE = '/Dockerfile';
@@ -277,6 +283,8 @@ const LOG_DIR = '/app/logs';
  */
 const CMS_APP_SCOPE_KEY = 'coolify_cms_app';
 const SITE_APP_SCOPE_KEY = 'coolify_site_app';
+/** #445: the one Coolify server every resource of this org lands on, chosen once and recorded. */
+const COOLIFY_SERVER_SCOPE_KEY = 'coolify_server';
 /**
  * #117: the cms app's own Postgres database (`<org.slug>-cms-db`), found or
  * created inside `cmsSite` the same way `coolifyDatabase` does for the org's
@@ -652,6 +660,8 @@ export class FoundryStepExecutor {
                 return this.cloudflareAccess(action, org);
             case 'cloudflare:ratelimit':
                 return this.cloudflareRateLimit(org);
+            case 'cloudflare:worker':
+                return this.cloudflareWorker(action, org, context);
             case 'files:organisation':
                 return this.filesOrganisation(action, org, context);
             case 'files:key':
@@ -659,8 +669,6 @@ export class FoundryStepExecutor {
                 return action.key.includes(':')
                     ? this.filesEntryKey(action, org, context)
                     : this.filesRootKey(action, org, context);
-            case 'files:storage':
-                return this.filesStorage(action, org);
             case 'ai:organisation':
                 return this.aiOrganisation(action, org);
             case 'ai:budget':
@@ -670,6 +678,10 @@ export class FoundryStepExecutor {
                 return action.key.includes(':')
                     ? this.aiEntryKey(action, org, context)
                     : this.aiKey(action, org, context);
+            case 'names:key':
+                return this.namesEntryKey(action, org, context);
+            case 'names:reserved-labels':
+                return this.namesReservedLabels(action, org, context);
             case 'coolify:mail':
                 return this.coolifyMail(action, org, context);
             case 'coolify:mail-copy':
@@ -837,6 +849,192 @@ export class FoundryStepExecutor {
         }
         return { resourceId: created.id };
     }
+    /**
+     * `plan/diff.ts`'s `planEdgeWorkers` (#318, F8): deploys one entry's
+     * `edge` Worker and routes it on the org's own zone. Throws by name
+     * without a {@link WorkersPort}, the same `jobsRegistration` shape --
+     * `planEdgeWorkers` reports the step blocked instead while the host has
+     * none, so this only fires against a stale plan. The route is checked
+     * before upload: a foreign route already on the pattern is refused, never
+     * adopted or replaced (`cloudflareAccess`'s own precedent for a foreign
+     * resource on the same name), so a Worker is never deployed only to find
+     * nothing can route to it.
+     *
+     * Order on apply: record (and persist) the uploaded name and clear the
+     * retired marker, upload, record the pending route, create the route only
+     * if needed, delete any *previous* route this entry recorded on its own
+     * zone, then record the new route id/zone/pattern and the applied
+     * declaration last -- every crash point leaves a recorded trace that
+     * retire and destroy can clean up (#318 re-review), and per CLAUDE.md's
+     * "Declared changes apply" nothing is marked done until the
+     * live state actually matches it.
+     */
+    async cloudflareWorker(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `cloudflare:worker for ${org.slug} entry '${entryKey}'`;
+        const workers = this.ports.workers;
+        if (!workers)
+            throw new Error(`${at}: this executor was built without a WorkersPort (#318)`);
+        const desired = action.desired;
+        if (desired.mode === 'retire') {
+            const recorded = context.recordedIds();
+            const mainId = recorded[`cloudflare:worker:${action.key}`];
+            const scriptName = mainId || recorded[entryEdgeUploadedScopeKey(entryKey)];
+            await this.teardownEdgeWorker(entryKey, scriptName, recorded, workers, at);
+            context.recordScopeId(entryEdgeRouteIdScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeRouteZoneScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeRoutePatternScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeAppliedScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), '');
+            // `runSteps` only ever writes the main recorded id from a truthy
+            // `resourceId` (`plan-apply.ts`); this step returns none, so without
+            // this marker the planner's "gone" scan would retire the same,
+            // never-cleared id forever.
+            if (mainId)
+                context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), mainId);
+            return {};
+        }
+        if (!org.domain) {
+            throw new Error(`${at}: edge needs org.domain, and validateHosting already refuses it without one`);
+        }
+        const zone = await this.ports.cloudflare.findZoneByApex(org.domain);
+        if (!zone) {
+            throw new Error(`${at}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
+        }
+        const name = desired.name;
+        const route = desired.route;
+        const bindings = (desired.bindings?.rateLimits ?? []).map((r) => ({
+            type: 'ratelimit',
+            name: r.name,
+            namespace_id: r.namespaceId,
+            simple: { limit: r.limit, period: r.period },
+        }));
+        const existingRoute = await workers.findRoute(zone.id, route);
+        if (existingRoute && existingRoute.script !== name) {
+            throw new Error(`${at}: route '${route}' is already bound to Worker '${existingRoute.script}', not foundry's own '${name}'; foundry does not adopt or replace it`);
+        }
+        // Checked only on an entry's first-ever apply -- a name foundry has
+        // already recorded for itself (even a retired one: redeclaring reuses
+        // the same deterministic name) is foundry's own script to overwrite,
+        // never a stranger's.
+        const recordedBeforeUpload = context.recordedIds();
+        const everUploadedByFoundry = Boolean(recordedBeforeUpload[entryEdgeAppliedScopeKey(entryKey)] ||
+            recordedBeforeUpload[entryEdgeUploadedScopeKey(entryKey)] ||
+            recordedBeforeUpload[`cloudflare:worker:${action.key}`]);
+        if (!everUploadedByFoundry && (await workers.scriptExists(name))) {
+            throw new Error(`${at}: a Worker script named '${name}' already exists and foundry never created it; refuses to overwrite it`);
+        }
+        // Recorded and persisted *before* the upload (#318 re-review): a crash
+        // mid-upload or a failed route create still leaves a trail to the
+        // script, and a retry reads it as foundry's own rather than tripping
+        // the `scriptExists` guard above. The retired marker clears here too,
+        // not only on success: once a redeploy has touched the script, a later
+        // undeclare must retire it even if this apply never finishes.
+        context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), name);
+        context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), '');
+        await context.persistScopeIds();
+        await workers.uploadScript({
+            name,
+            artifactUrl: desired.artifactUrl,
+            artifactSha256: desired.artifactSha256,
+            compatibilityDate: action.desired.compatibilityDate,
+            bindings: bindings.length > 0 ? bindings : undefined,
+        });
+        const recorded = context.recordedIds();
+        const previousRouteId = recorded[entryEdgeRouteIdScopeKey(entryKey)];
+        const previousPending = recorded[entryEdgeRoutePendingScopeKey(entryKey)];
+        const zoneRecord = { id: zone.id, apex: org.domain };
+        let routeId = existingRoute?.id;
+        if (!routeId) {
+            // Recorded before the create, so a route Cloudflare made but foundry
+            // never got to record is still found (`findRoute`) and deleted on
+            // retire or destroy (#318 re-review).
+            const pending = { ...zoneRecord, pattern: route, script: name };
+            context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), JSON.stringify(pending));
+            await context.persistScopeIds();
+            const created = await workers.createRoute(zone.id, route, name);
+            routeId = created.id;
+        }
+        // Any route this entry recorded before that is not the one it now uses
+        // -- the declared pattern moved, or the domain did -- is deleted on its
+        // own zone rather than left live beside the new one. A pending route
+        // from an earlier, interrupted apply under a different pattern likewise.
+        if (previousRouteId && previousRouteId !== routeId) {
+            const previousZone = await this.liveEdgeZone(recorded[entryEdgeRouteZoneScopeKey(entryKey)], at);
+            if (previousZone)
+                await workers.deleteRoute(previousZone, previousRouteId); // Idempotent.
+        }
+        if (previousPending) {
+            await this.deletePendingEdgeRoute(previousPending, routeId, workers, at);
+        }
+        context.recordScopeId(entryEdgeRouteIdScopeKey(entryKey), routeId);
+        context.recordScopeId(entryEdgeRouteZoneScopeKey(entryKey), JSON.stringify(zoneRecord));
+        context.recordScopeId(entryEdgeRoutePatternScopeKey(entryKey), route);
+        context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), '');
+        context.recordScopeId(entryEdgeAppliedScopeKey(entryKey), JSON.stringify({
+            name,
+            artifactUrl: desired.artifactUrl,
+            artifactSha256: desired.artifactSha256,
+            route,
+            bindings: desired.bindings,
+        }));
+        context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), '');
+        // The retired marker was already cleared before the upload above: a
+        // redeclare reuses this entry's deterministic script name, so a marker
+        // left equal to the (identical) main id would read as already retired.
+        return { resourceId: name };
+    }
+    /**
+     * The zone id a recorded route lives in, or `undefined` only when that
+     * zone is *positively* gone -- its apex resolves to no zone, or to a
+     * different zone than the one recorded (#318 re-review). Reads the zone
+     * recorded beside the route, never `org.domain`: the route id and its
+     * zone are always recorded together (the apply branch below writes both
+     * in the same batch, and the pending-route marker carries its own zone
+     * too), so a route id with no zone recorded cannot happen within this
+     * feature -- and re-resolving from `org.domain` as a fallback would risk
+     * looking up the *new* zone after a domain change and leaving the route
+     * live on the old one, the exact bug a recorded-per-route zone exists to
+     * avoid (#318 re-review).
+     */
+    async liveEdgeZone(recordedZone, at) {
+        if (!recordedZone) {
+            throw new Error(`${at}: a route is recorded but its zone is not, so foundry cannot tell which zone holds it; refuses to forget it`);
+        }
+        const { id, apex } = JSON.parse(recordedZone);
+        const zone = await this.ports.cloudflare.findZoneByApex(apex);
+        return zone && zone.id === id ? id : undefined;
+    }
+    /** Deletes the route an interrupted apply was creating, if `findRoute` shows it exists, points at that apply's script, and is not `keepRouteId`. */
+    async deletePendingEdgeRoute(pendingRaw, keepRouteId, workers, at) {
+        const pending = JSON.parse(pendingRaw);
+        const zoneId = await this.liveEdgeZone(JSON.stringify({ id: pending.id, apex: pending.apex }), at);
+        if (!zoneId)
+            return;
+        const found = await workers.findRoute(zoneId, pending.pattern);
+        if (found && found.script === pending.script && found.id !== keepRouteId) {
+            await workers.deleteRoute(zoneId, found.id); // Idempotent.
+        }
+    }
+    /**
+     * Retire and destroy share this: delete the recorded route on its own
+     * zone, then any route an interrupted apply created but never recorded,
+     * then the script. Records nothing -- the caller does.
+     */
+    async teardownEdgeWorker(entryKey, scriptName, recorded, workers, at) {
+        const routeId = recorded[entryEdgeRouteIdScopeKey(entryKey)];
+        if (routeId) {
+            const zoneId = await this.liveEdgeZone(recorded[entryEdgeRouteZoneScopeKey(entryKey)], at);
+            if (zoneId)
+                await workers.deleteRoute(zoneId, routeId); // Idempotent: a no-op if already gone.
+        }
+        const pending = recorded[entryEdgeRoutePendingScopeKey(entryKey)];
+        if (pending)
+            await this.deletePendingEdgeRoute(pending, undefined, workers, at);
+        if (scriptName)
+            await workers.deleteScript(scriptName); // Idempotent: a no-op if already gone.
+    }
     // ---- zitadel --------------------------------------------------------
     async zitadelIssuer(action, org, context) {
         if (action.desired.provision !== true) {
@@ -983,6 +1181,7 @@ export class FoundryStepExecutor {
                 .map((key) => key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length)),
             ...(recorded[CMS_CLIENT_ID_SCOPE_KEY] ? ['cms'] : []),
             ...(recorded[AGORA_CLIENT_ID_SCOPE_KEY] ? ['agora'] : []),
+            ...(recorded[BOULE_CLIENT_ID_SCOPE_KEY] ? ['boule'] : []),
         ].map((name) => recorded[`zitadel:app:${name}`]));
         const projectId = recorded.zitadel_project;
         // No project yet means no apps yet: vacuously safe to decide from (fix
@@ -1256,11 +1455,37 @@ export class FoundryStepExecutor {
         context.recordScopeId('coolify_project', projectUuid);
         return projectUuid;
     }
-    async resolveServer() {
+    /**
+     * #445: one company lands on one Coolify server. The first call for an
+     * org picks a usable, reachable server and records it
+     * ({@link COOLIFY_SERVER_SCOPE_KEY}); every later call -- this apply, or a
+     * later one -- reads that recording back and returns the same server,
+     * regardless of what the pool's order or health looks like by then. A
+     * recorded server that has gone unusable or unreachable is reported
+     * blocked (never silently replaced with a second host, which would split
+     * the org's resources across servers and break their internal container
+     * URLs); a recorded server no longer registered at all is the same.
+     * Deliberately no fallback to `servers[0]` when nothing is usable: an
+     * unusable server picked blind is not a server anyone's resources could
+     * actually be created on.
+     */
+    async resolveServer(org, context) {
         const servers = await this.ports.coolify.listServers();
-        const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
+        const recorded = context.recordedIds()[COOLIFY_SERVER_SCOPE_KEY];
+        if (recorded) {
+            const server = servers.find((s) => s.uuid === recorded);
+            if (!server) {
+                throw new Error(`${org.slug}'s recorded Coolify server ${recorded} is no longer registered on this instance`);
+            }
+            if (!(server.is_usable && server.is_reachable)) {
+                throw new Error(`${org.slug}'s recorded Coolify server ${recorded} is not usable/reachable right now; it is not moved to a second server`);
+            }
+            return server;
+        }
+        const server = servers.find((s) => s.is_usable && s.is_reachable);
         if (!server)
             throw new Error('no usable Coolify server is registered on this instance');
+        context.recordScopeId(COOLIFY_SERVER_SCOPE_KEY, server.uuid);
         return server;
     }
     async coolifyApp(action, org, context) {
@@ -1326,7 +1551,7 @@ export class FoundryStepExecutor {
             haveNames = appliedAppDomains(org, context.recordedIds(), entry.key);
         }
         else {
-            const server = await this.resolveServer();
+            const server = await this.resolveServer(org, context);
             const githubApp = await this.ports.coolify.requireGithubApp();
             const created = await this.ports.coolify.createGithubAppApplication({
                 project_uuid: projectUuid,
@@ -1468,7 +1693,15 @@ export class FoundryStepExecutor {
         // One Lettermint project, `<slug>-app`, belongs to the `app` entry; a
         // second entry sharing the name would delete the first's live token.
         if (entry.key === APP_ENTRY_KEY) {
-            await this.ensureAppLettermintMail(appId, org, context, Boolean(existing));
+            await this.ensureAppLettermintMail(appId, org, context, Boolean(existing), 
+            // #491 (review round 2, finding 3): `diff.ts`'s `planApps` always
+            // sets `platformApex` on this step's `desired` once it's planned at
+            // all -- `null` when no platform is declared, never omitted. The key
+            // being absent outright (as opposed to present and `null`) means a
+            // step planned before this field existed; `ensureAppLettermintMail`
+            // refuses rather than silently falling back once it knows there is
+            // a recorded mail domain to reason about.
+            'platformApex' in action.desired, action.desired.platformApex ?? null, action.desired.platformLettermintProjectId ?? null);
         }
         return { resourceId: appId };
     }
@@ -1529,7 +1762,7 @@ export class FoundryStepExecutor {
                 dbId = found.uuid;
             }
             else {
-                const server = await this.resolveServer();
+                const server = await this.resolveServer(org, context);
                 const dbName = org.slug.replace(/-/g, '_');
                 const created = await this.ports.coolify.createPostgresDatabase({
                     project_uuid: projectUuid,
@@ -1907,12 +2140,73 @@ export class FoundryStepExecutor {
      * comment), never logged, never interpolated into a thrown error -- the
      * same discipline `pushDatabaseUrl`'s doc comment states for a database's
      * own connection string.
+     *
+     * #491: none of the above applies to the org whose mail domain is the
+     * platform's own apex -- it shares the platform's existing Lettermint
+     * project (`platformLettermintProjectId`, from `DeclaredPlatform.mail`)
+     * instead of minting a `<slug>-app` one, and this method never creates or
+     * deletes a project for it. `platformApex`/`platformLettermintProjectId`
+     * come straight off this step's own `desired`, the same "the executor
+     * writes exactly what the plan showed" rule `coolifyMail` already follows
+     * for its own `apex`/`mailHost` -- the caller (`coolifyApp`) refuses a
+     * `desired` missing the `platformApex` key outright as a stale plan --
+     * checked here, after the no-op-until-a-mail-domain-exists return just
+     * below, rather than unconditionally at the call site: every other
+     * `coolify:app` concern (hostnames, ports, settings, the sign-in env...)
+     * has nothing to do with Lettermint and must keep working the moment a
+     * mail domain was never even recorded for this org, the same as before
+     * this field existed (review round 2, finding 3).
      */
-    async ensureAppLettermintMail(appId, org, context, running) {
+    async ensureAppLettermintMail(appId, org, context, running, hasPlatformApexField, platformApex, platformLettermintProjectId) {
         const mailDomain = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
         if (!mailDomain)
             return;
+        if (!hasPlatformApexField) {
+            throw new Error(`coolify:app for ${org.slug}: this step's plan carries no platformApex; plan this org's app again`);
+        }
         const appName = `${org.slug}-app`;
+        // #491: an org whose mail domain is the platform's own apex (Company
+        // Included on companyincluded.com, today) shares the platform's existing
+        // Lettermint project rather than minting a `<slug>-app` one of its own --
+        // `diff.ts`'s `planApp` blocks this whole piece while
+        // `platformLettermintProjectId` is unset, so a plan carrying neither is
+        // stale; never fall back to creating, restricting or deleting anything
+        // here until a fresh plan supplies it.
+        const isPlatformApexOrg = Boolean(platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase());
+        if (isPlatformApexOrg) {
+            if (!platformLettermintProjectId)
+                return;
+            const [projects, envs] = await Promise.all([
+                this.ports.lettermint.listProjects(),
+                this.ports.coolify.listEnvs(appId),
+            ]);
+            // Review round 2, finding 5: a missing held token would otherwise
+            // leave the app with a stale or absent `LETTERMINT_API_TOKEN` and no
+            // signal that anything is wrong -- refused instead, the same "fail
+            // rather than silently point mail at nothing" rule `coolifyMail`
+            // already follows for its own `apex`/`mailHost`.
+            const heldToken = (await this.ports.heldKeys?.resolve(PLATFORM_AUTH_BROKER_MAIL_KEY_REF)) ?? null;
+            if (!heldToken) {
+                throw new Error(`coolify:app for ${org.slug}: the platform's own Lettermint token is not held yet (held-key ref ${PLATFORM_AUTH_BROKER_MAIL_KEY_REF})`);
+            }
+            // Validates and restricts before any env is written -- `ensureLettermintDomainRestriction`'s
+            // own doc comment (review round 2, finding 4) throws on a mistyped id,
+            // and the app must never end up with a pushed token the restriction
+            // step then fails on, the same "never half-ready" order
+            // {@link ensureOrgLettermintRelay} already follows for its own token.
+            await this.ensureLettermintDomainRestriction(org, mailDomain, projects, platformApex, platformLettermintProjectId);
+            const currentToken = envs.find((e) => e.key === 'LETTERMINT_API_TOKEN' && !e.is_preview)?.value;
+            const tokenChanged = currentToken !== heldToken;
+            await this.ports.coolify.bulkUpsertEnvs(appId, [
+                { key: 'MAIL_FROM', value: `${org.mail.noReplyLocalPart ?? 'no-reply'}@${mailDomain}` },
+                { key: 'LETTERMINT_API_TOKEN', value: heldToken },
+            ]);
+            // Same restart rule as the non-apex path below: a running container
+            // read its env at start and keeps a stale token until restarted.
+            if (tokenChanged && running)
+                await this.ports.coolify.restart(appId);
+            return;
+        }
         const [projects, envs] = await Promise.all([
             this.ports.lettermint.listProjects(),
             this.ports.coolify.listEnvs(appId),
@@ -1943,9 +2237,11 @@ export class FoundryStepExecutor {
         // old project is deleted below. A just-created app starts with the new env.
         if (!healthy && running)
             await this.ports.coolify.restart(appId);
-        await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects);
+        await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
         for (const project of allProjects) {
-            if (project.name === appName && project.id !== keepProjectId) {
+            if (project.name === appName &&
+                project.id !== keepProjectId &&
+                project.id !== platformLettermintProjectId) {
                 await this.ports.lettermint.deleteProject(project.id);
             }
         }
@@ -1983,8 +2279,14 @@ export class FoundryStepExecutor {
      * it the same way the app step does, rather than assuming it already
      * exists -- the domain must never end up unrestricted, whichever step gets
      * there first.
+     *
+     * #491: this org's own `<slug>-relay` project is unaffected by whether it
+     * is the platform's own org -- only the domain restriction
+     * (`platformApex`/`platformLettermintProjectId`, forwarded to
+     * {@link ensureLettermintDomainRestriction}) and the delete loop below
+     * (which must never delete the platform's own project) change.
      */
-    async ensureOrgLettermintRelay(org, mailOrg, mailDomain, context) {
+    async ensureOrgLettermintRelay(org, mailOrg, mailDomain, context, platformApex, platformLettermintProjectId) {
         const relayName = `${org.slug}-relay`;
         // #345: `mailOrg.domain` is absent for a level-1 org -- `mailDomain` is
         // `applyOrgMail`'s own resolved result, the one domain `MailPort`'s
@@ -2003,7 +2305,7 @@ export class FoundryStepExecutor {
         let keepProjectId;
         if (healthy && held) {
             keepProjectId = held.id;
-            await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects);
+            await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
         }
         else {
             const created = await this.ports.lettermint.createProject(relayName);
@@ -2014,7 +2316,7 @@ export class FoundryStepExecutor {
                 // reaches Stalwart: a failure here leaves the working route alone.
                 // The restriction covers old and new projects, so the old one keeps
                 // sending until the route switches.
-                await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects);
+                await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
                 await this.ports.mail.applyOrgRelay(relayOrg, created.token);
             }
             catch (err) {
@@ -2027,7 +2329,9 @@ export class FoundryStepExecutor {
             await context.persistScopeIds();
         }
         for (const project of allProjects) {
-            if (project.name === relayName && project.id !== keepProjectId) {
+            if (project.name === relayName &&
+                project.id !== keepProjectId &&
+                project.id !== platformLettermintProjectId) {
                 await this.ports.lettermint.deleteProject(project.id);
             }
         }
@@ -2059,10 +2363,31 @@ export class FoundryStepExecutor {
      * unrestricted domain cannot verify and cannot send, whichever project
      * owns it (post-#140 review finding, restated here rather than only at
      * the one call site it used to have).
+     *
+     * #491: `platformApex`/`platformLettermintProjectId` cover both callers at
+     * once -- when `mailDomain` is the platform's own apex, the platform's
+     * project id is always folded into the restriction, so a plan that shares
+     * the platform's project (rather than minting a `<slug>-app` one) never
+     * ends up restricting that org's domain to nothing. A no-op for every
+     * other org's domain, since `mailDomain` never matches `platformApex` there.
+     * Review round 2, finding 4: a declared id that is not among `allProjects`
+     * (a mistype, or the project was deleted in Lettermint) is refused rather
+     * than folded in anyway -- that would restrict the apex to whatever *is*
+     * live (the relay project, say) plus an id naming nothing, which excludes
+     * the real platform project from its own domain exactly as completely as
+     * never restricting it at all. Centralised here rather than duplicated at
+     * each caller, since both {@link ensureAppLettermintMail} and
+     * {@link ensureOrgLettermintRelay} reach the apex through this one method.
      */
-    async ensureLettermintDomainRestriction(org, mailDomain, allProjects) {
+    async ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId) {
         const appName = `${org.slug}-app`;
         const relayName = `${org.slug}-relay`;
+        const isPlatformApexDomain = Boolean(platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase());
+        if (isPlatformApexDomain && platformLettermintProjectId) {
+            if (!allProjects.some((p) => p.id === platformLettermintProjectId)) {
+                throw new Error(`Lettermint for ${org.slug}: platform.mail.lettermintProjectId ${platformLettermintProjectId} is not a live Lettermint project`);
+            }
+        }
         const existing = await this.findExactLettermintDomain(mailDomain);
         const domain = existing
             ? await this.ports.lettermint.getDomain(existing.id)
@@ -2070,6 +2395,11 @@ export class FoundryStepExecutor {
         const scopedProjectIds = allProjects
             .filter((p) => p.name === appName || p.name === relayName)
             .map((p) => p.id);
+        if (isPlatformApexDomain &&
+            platformLettermintProjectId &&
+            !scopedProjectIds.includes(platformLettermintProjectId)) {
+            scopedProjectIds.push(platformLettermintProjectId);
+        }
         await this.ports.lettermint.restrictDomainToProjects(domain.id, scopedProjectIds);
         const zone = await this.ports.cloudflare.findZoneByApex(mailDomain);
         if (!zone) {
@@ -2161,16 +2491,22 @@ export class FoundryStepExecutor {
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const site = await this.findOrCreateCmsApp({
+            org,
+            context,
             projectUuid,
             environment,
             name: `${org.slug}-site`,
+            repo: org.site.repo ?? CMS_REPO,
             dockerfileLocation: CMS_SITE_APP_DOCKERFILE,
             domain,
         });
         const cms = await this.findOrCreateCmsApp({
+            org,
+            context,
             projectUuid,
             environment,
             name: `${org.slug}-cms`,
+            repo: CMS_REPO,
             dockerfileLocation: CMS_APP_DOCKERFILE,
             domain: cmsHostnameFor(org),
         });
@@ -2281,7 +2617,7 @@ export class FoundryStepExecutor {
         const found = (await this.ports.coolify.listDatabases()).find((d) => d.name === name && d.environment_id === environment.id);
         if (found)
             return found.uuid;
-        const server = await this.resolveServer();
+        const server = await this.resolveServer(org, context);
         const dbName = name.replace(/-/g, '_');
         const created = await this.ports.coolify.createPostgresDatabase({
             project_uuid: projectUuid,
@@ -2368,6 +2704,10 @@ export class FoundryStepExecutor {
      * `coolifyApp`'s own analogous gap (it never restarted a found-but-stopped
      * app either) has since closed the same way, inline in that method (#130);
      * this method is `cmsSite`'s only caller.
+     *
+     * `repo` (#245) lets the site app build from an org's own skin repo
+     * (`org.site.repo`) instead of the shared `CMS_REPO`; `cmsSite` always
+     * passes `CMS_REPO` for the cms admin app, which is never org-specific.
      */
     async findOrCreateCmsApp(input) {
         const existing = await this.ports.coolify.findApplicationByName(input.name, {
@@ -2380,7 +2720,7 @@ export class FoundryStepExecutor {
             }
             return { appId: existing.uuid, existed: true };
         }
-        const server = await this.resolveServer();
+        const server = await this.resolveServer(input.org, input.context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const created = await this.ports.coolify.createGithubAppApplication({
             project_uuid: input.projectUuid,
@@ -2388,7 +2728,7 @@ export class FoundryStepExecutor {
             environment_name: input.environment.name,
             environment_uuid: input.environment.uuid,
             github_app_uuid: githubApp.uuid,
-            git_repository: CMS_REPO,
+            git_repository: input.repo,
             git_branch: 'main',
             build_pack: 'dockerfile',
             name: input.name,
@@ -2426,16 +2766,16 @@ export class FoundryStepExecutor {
         }
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
-        const server = await this.resolveServer();
+        const server = await this.resolveServer(org, context);
         const names = {
             synapse: `${org.slug}-calls-synapse`,
             mas: `${org.slug}-calls-mas`,
             synapseDb: `${org.slug}-calls-synapse-db`,
             masDb: `${org.slug}-calls-mas-db`,
         };
-        const synapseDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.synapseDb, 'synapse', CALLS_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS);
+        const synapseDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.synapseDb, 'synapse', CALLS_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS);
         context.recordScopeId(CALLS_SYNAPSE_DB_SCOPE_KEY, synapseDbId);
-        const masDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.masDb, 'mas', CALLS_MAS_DB_SCOPE_KEY);
+        const masDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.masDb, 'mas', CALLS_MAS_DB_SCOPE_KEY);
         context.recordScopeId(CALLS_MAS_DB_SCOPE_KEY, masDbId);
         const [synapseDbRow, masDbRow] = await Promise.all([
             getDatabaseStarted(this.ports.coolify, synapseDbId),
@@ -2589,14 +2929,14 @@ export class FoundryStepExecutor {
      * database, whose {@link CALLS_SERVICE_DB_SCOPE_KEY} has no
      * `system:kind:key` slot of its own for the same reason.
      */
-    async ensureCallsDatabase(context, projectUuid, environment, name, postgresDb, scopeKey, postgresInitdbArgs) {
+    async ensureCallsDatabase(org, context, projectUuid, environment, name, postgresDb, scopeKey, postgresInitdbArgs) {
         const existing = context.recordedIds()[scopeKey];
         if (existing)
             return existing;
         const found = (await this.ports.coolify.listDatabases()).find((d) => d.name === name && d.environment_id === environment.id);
         if (found)
             return found.uuid;
-        const server = await this.resolveServer();
+        const server = await this.resolveServer(org, context);
         const created = await this.ports.coolify.createPostgresDatabase({
             project_uuid: projectUuid,
             server_uuid: server.uuid,
@@ -2699,6 +3039,34 @@ export class FoundryStepExecutor {
     async coolifyChat(action, org, context) {
         const recorded = context.recordedIds();
         if (recorded[`coolify:chat:${action.key}`]) {
+            // #456: `planChat` plans this distinct, non-re-key action for a live
+            // chat app that predates the owner/runtime database split (#239) --
+            // push only the split and redeploy if it changed, never the re-key
+            // paths below, which throw on literally any other action here.
+            if (action.desired.refreshDatabaseSplit === true) {
+                const serviceAppId = recorded[CHAT_SERVICE_SCOPE_KEY];
+                const serviceDbId = recorded[CHAT_SERVICE_DB_SCOPE_KEY];
+                if (!serviceAppId || !serviceDbId) {
+                    throw new Error(`coolify:chat database split for ${org.slug}: the chat service app or its database is not recorded yet`);
+                }
+                const push = await this.pushDatabaseUrl(serviceAppId, serviceDbId, 'chat');
+                const markerKey = serviceDbEnvAppliedScopeKey('chat');
+                if (!push.pushed) {
+                    // Unlike a fresh provision, this chat was already fully up and
+                    // running -- its service database was already started (the main
+                    // path below never creates an app before confirming that). A push
+                    // refused here means the recorded database id no longer resolves
+                    // to a started database with an `internal_db_url`, which is not a
+                    // "retry once Coolify catches up" condition: fail loudly instead of
+                    // replanning this same step silently forever (#456 review).
+                    throw new Error(`coolify:chat database split for ${org.slug}: the chat service's database (${serviceDbId}) has no internal_db_url -- it may have been deleted or is unreachable; this is not expected for an already-live chat`);
+                }
+                if (push.changed || !recorded[markerKey]) {
+                    await this.ports.coolify.deploy(serviceAppId);
+                }
+                context.recordScopeId(markerKey, '1');
+                return { resourceId: serviceAppId };
+            }
             if (action.desired.usesDomain === false) {
                 throw new NotBuiltError(`coolify:chat reverse re-key for ${org.slug}`, 'moving its chat back onto the original server_name is not built (#7 amendment 3)');
             }
@@ -2722,13 +3090,13 @@ export class FoundryStepExecutor {
         await this.ensureChatAdmins(org, zitadelOrgId, project.id, recorded);
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
-        const server = await this.resolveServer();
+        const server = await this.resolveServer(org, context);
         const names = chatInternalNames(org.slug);
-        const synapseDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.synapseDb, 'synapse', CHAT_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS);
+        const synapseDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.synapseDb, 'synapse', CHAT_SYNAPSE_DB_SCOPE_KEY, CALLS_SYNAPSE_DB_INITDB_ARGS);
         context.recordScopeId(CHAT_SYNAPSE_DB_SCOPE_KEY, synapseDbId);
-        const masDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.masDb, 'mas', CHAT_MAS_DB_SCOPE_KEY);
+        const masDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.masDb, 'mas', CHAT_MAS_DB_SCOPE_KEY);
         context.recordScopeId(CHAT_MAS_DB_SCOPE_KEY, masDbId);
-        const serviceDbId = await this.ensureCallsDatabase(context, projectUuid, environment, names.serviceDb, 'chat', CHAT_SERVICE_DB_SCOPE_KEY);
+        const serviceDbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, names.serviceDb, 'chat', CHAT_SERVICE_DB_SCOPE_KEY);
         context.recordScopeId(CHAT_SERVICE_DB_SCOPE_KEY, serviceDbId);
         const [synapseDbRow, masDbRow, serviceDbRow] = await Promise.all([
             getDatabaseStarted(this.ports.coolify, synapseDbId),
@@ -2841,8 +3209,13 @@ export class FoundryStepExecutor {
             agoraHost,
             masClientId: secrets.value.masClientId,
             masClientSecret: secrets.value.masClientSecret,
-            databaseUrl: serviceDbRow.internal_db_url,
         }));
+        // Split the same way `coolifyApp`'s and `cmsSite`'s own databases are
+        // (#239, #456): `DATABASE_URL_OWNER` is the superuser string,
+        // `DATABASE_URL` is a minted `chat_rt` role -- `chat` is the literal
+        // `postgres_db`/`postgres_user` `ensureCallsDatabase` created the service
+        // database with above, not the Coolify resource name `names.serviceDb`.
+        const serviceDbPush = await this.pushDatabaseUrl(service.appId, serviceDbId, 'chat');
         // A file-storage write alone never reaches a running container. Deploy an
         // app that is new, whose config was freshly minted, or that is not
         // running now. The last test reads the live status, not what this run
@@ -2853,10 +3226,19 @@ export class FoundryStepExecutor {
         for (const app of [mas, synapse, service]) {
             if (!app.existed ||
                 secrets.changed ||
+                (app === service && serviceDbPush.changed) ||
                 !isRunningOrStarting((await this.ports.coolify.getApplication(app.appId)).status)) {
                 await this.ports.coolify.deploy(app.appId);
             }
         }
+        // #456: recorded here too, not only on the `refreshDatabaseSplit` replan
+        // path above -- without it a fresh provision's very first apply never
+        // sets this marker, so `planChat` (`!recordedIds[serviceDbEnvAppliedScopeKey('chat')]`)
+        // reads it as still missing and plans a pointless extra redeploy on the
+        // very next apply for an org that was never behind.
+        if (serviceDbPush.pushed) {
+            context.recordScopeId(serviceDbEnvAppliedScopeKey('chat'), '1');
+        }
         // Last: the marker tells `desiredAgoraEnv` the names and envs are in place.
         context.recordScopeId(CHAT_SERVICE_URL_SCOPE_KEY, chatUpstreams(org.slug).chat);
         return { resourceId: mas.appId };
@@ -2904,13 +3286,13 @@ export class FoundryStepExecutor {
         const synapseHost = `${org.slug}-calls-synapse`;
         const masHost = `${org.slug}-calls-mas`;
         const dbName = `${name}-db`;
-        const dbId = await this.ensureCallsDatabase(context, projectUuid, environment, dbName, dbName.replace(/-/g, '_'), CALLS_SERVICE_DB_SCOPE_KEY);
+        const dbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, dbName, dbName.replace(/-/g, '_'), CALLS_SERVICE_DB_SCOPE_KEY);
         context.recordScopeId(CALLS_SERVICE_DB_SCOPE_KEY, dbId);
         const db = await getDatabaseStarted(this.ports.coolify, dbId);
         if (!db.internal_db_url) {
             throw new Error(`coolify:calls-service for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
-        const server = await this.resolveServer();
+        const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
             project_uuid: projectUuid,
@@ -2936,7 +3318,6 @@ export class FoundryStepExecutor {
         await this.ensureLogVolume(app.appId, org, app.existed);
         const bindingSecret = await this.ensureCallsBindingSecret(app.appId);
         const envs = [
-            { key: 'DATABASE_URL', value: db.internal_db_url },
             { key: 'LIVEKIT_URL', value: CALLS_SFU_PRIVATE_URL },
             { key: 'LIVEKIT_PUBLIC_URL', value: CALLS_SFU_PUBLIC_URL },
             { key: 'LIVEKIT_API_KEY', value: sfu.apiKey },
@@ -2975,17 +3356,40 @@ export class FoundryStepExecutor {
         // unguarded and the planner reports the lost secret instead of minting again.
         if (token)
             context.recordScopeId(CALLS_INTROSPECTION_SCOPE_KEY, token.appId);
+        // Split the same way `coolifyApp`'s and `cmsSite`'s own databases are
+        // (#239, #456): `DATABASE_URL_OWNER` is the superuser string,
+        // `DATABASE_URL` is a minted `<dbName>_rt` role -- the real Postgres
+        // database name `ensureCallsDatabase` created this database with, not
+        // the Coolify resource name.
+        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName.replace(/-/g, '_'));
+        // #456: a crash between the push above and the deploy/marker below
+        // leaves the env right and no marker, so this replans and deploys once
+        // more -- the same rule `coolifyApp`'s own `dbEnvAppliedScopeKey` marker
+        // follows.
+        const dbMarkerKey = serviceDbEnvAppliedScopeKey('calls-service');
+        const dbSplitNeedsRefresh = dbPush.pushed && (dbPush.changed || !context.recordedIds()[dbMarkerKey]);
         // A container reads its name and env only at start, so a running app is
         // restarted once, when this run is the one that gave it its name or its
         // token env (the same rule `coolifyApp` follows when an existing app's
-        // env changed).
+        // env changed). The database split is different: it is only safe once the
+        // image actually contains the migrate step that creates the `_rt` role
+        // (the sibling calls-service PR adding it), so that case redeploys --
+        // rebuilding the image -- rather than restarting the one already running,
+        // the same distinction `coolifyChat`'s own refresh path makes. A restart
+        // here would bring back a container built before that migrate step
+        // existed, still pointed at a role nothing has created.
         const givesTokenEnv = token !== null && context.recordedIds()[CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY] !== tokenMarker;
-        if (app.existed && (!callsServiceHasName(org, context.recordedIds()) || givesTokenEnv)) {
+        if (app.existed && dbSplitNeedsRefresh) {
+            await this.ports.coolify.deploy(app.appId);
+        }
+        else if (app.existed && (!callsServiceHasName(org, context.recordedIds()) || givesTokenEnv)) {
             await this.ports.coolify.restart(app.appId);
         }
         context.recordScopeId(CALLS_SERVICE_NAME_SCOPE_KEY, name);
         if (token && tokenMarker)
             context.recordScopeId(CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, tokenMarker);
+        if (dbPush.pushed)
+            context.recordScopeId(dbMarkerKey, '1');
         return { resourceId: app.appId };
     }
     /**
@@ -3123,6 +3527,19 @@ export class FoundryStepExecutor {
      * pushed once calls are on and this org's calls service app carries its
      * internal name (`desiredAgoraEnv` reads that marker from the recorded ids,
      * not the host values).
+     *
+     * #442: a found-but-already-running app's container binds env only at
+     * start, so writing it alone leaves that process on its old config --
+     * restarted (never redeployed: no new image, so `restart` is the same
+     * primitive `ensureLogVolume`'s own restart uses) whenever the live env
+     * actually differs, or whenever the last restart this step confirmed
+     * ({@link AGORA_ACTIVATED_ENV_SCOPE_KEY}) is not this exact env (an org
+     * applied before this existed, whose live env already matched desired
+     * with nothing ever confirmed running it). A brand new app has nothing
+     * running yet to restart. The activation marker is recorded last, after
+     * the restart (if any) returns without throwing, so a failed restart
+     * leaves it stale and the next plan replans this step even though
+     * Coolify's own env store already matches desired.
      */
     async coolifyAgora(action, org, context) {
         // The host values the plan read, carried in the step: never read again
@@ -3138,7 +3555,7 @@ export class FoundryStepExecutor {
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const name = `${org.slug}-agora`;
-        const server = await this.resolveServer();
+        const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
             project_uuid: projectUuid,
@@ -3155,7 +3572,20 @@ export class FoundryStepExecutor {
         }));
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
+        // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
+        // Coolify's own env store matching `env`, which is why that store alone
+        // can no longer tell a changed value from one already live.
+        const liveEnv = new Map((await this.ports.coolify.listEnvs(app.appId))
+            .filter((e) => !e.is_preview)
+            .map((e) => [e.key, e.value]));
+        const envChanged = agoraEnvDrift(env, Object.fromEntries(liveEnv)).length > 0;
         await this.ports.coolify.bulkUpsertEnvs(app.appId, Object.entries(env).map(([key, value]) => ({ key, value })));
+        const revision = agoraEnvRevision(env);
+        const alreadyActivated = context.recordedIds()[AGORA_ACTIVATED_ENV_SCOPE_KEY] === revision;
+        if (app.existed && (envChanged || !alreadyActivated)) {
+            await this.ports.coolify.restart(app.appId);
+        }
+        context.recordScopeId(AGORA_ACTIVATED_ENV_SCOPE_KEY, revision);
         return { resourceId: app.appId };
     }
     // ---- boule (#161) --------------------------------------------------------
@@ -3195,9 +3625,9 @@ export class FoundryStepExecutor {
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const name = `${org.slug}-boule`;
         const dbName = `${org.slug}-boule-db`.replace(/-/g, '_');
-        const dbId = await this.ensureCallsDatabase(context, projectUuid, environment, `${org.slug}-boule-db`, dbName, BOULE_DATABASE_SCOPE_KEY);
+        const dbId = await this.ensureCallsDatabase(org, context, projectUuid, environment, `${org.slug}-boule-db`, dbName, BOULE_DATABASE_SCOPE_KEY);
         context.recordScopeId(BOULE_DATABASE_SCOPE_KEY, dbId);
-        const server = await this.resolveServer();
+        const server = await this.resolveServer(org, context);
         const githubApp = await this.ports.coolify.requireGithubApp();
         const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
             project_uuid: projectUuid,
@@ -3409,7 +3839,7 @@ export class FoundryStepExecutor {
             appName: `${org.slug}-cloudflared`,
             projectUuid,
             environment,
-            resolveServer: () => this.resolveServer(),
+            resolveServer: () => this.resolveServer(org, context),
             recordedConnectorAppId: context.recordedIds()[CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY] ?? null,
             recordAppId: async (appId) => {
                 context.recordScopeId(CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY, appId);
@@ -3783,22 +4213,26 @@ export class FoundryStepExecutor {
             throw new Error(`coolify:mail for ${org.slug}: this step's plan carries no platform mail ${!apex && !mailHost ? 'apex or host' : !apex ? 'apex' : 'host'}; plan this org's mail again`);
         }
         const options = { apex, mailHost };
+        // #491: `null` unless `diff.ts`'s `planMail` carries them -- absent for
+        // every org but the platform's own, and for a plan predating this field.
+        const platformApex = action.desired.platformApex ?? null;
+        const platformLettermintProjectId = action.desired.platformLettermintProjectId ?? null;
         if (mode === 'off') {
             const parkedMailOrg = mailOrgFor(org, usesDomain, 'hosted');
             await this.ports.mail.parkOrgMail(parkedMailOrg, options);
-            await this.parkLettermintMail(org, parkedMailOrg, context);
+            await this.parkLettermintMail(org, parkedMailOrg, context, platformApex, platformLettermintProjectId);
             return undefined;
         }
         const mailOrg = mailOrgFor(org, usesDomain, mode);
         const result = await this.ports.mail.applyOrgMail(mailOrg, options);
         await this.publishMailDnsRecords(org, result);
-        await this.deleteStaleLettermintDomain(context, result.domain);
+        await this.deleteStaleLettermintDomain(context, result.domain, platformApex);
         context.recordScopeId(MAIL_DOMAIN_SCOPE_KEY, result.domain);
         // #177: what this step wrote from the platform, so `planMail` can see a later change.
         context.recordScopeId(ORG_MAIL_APPLIED_APEX_SCOPE_KEY, options.apex);
         context.recordScopeId(ORG_MAIL_APPLIED_HOST_SCOPE_KEY, options.mailHost);
         await this.ensureOwnerMailbox(org, mailOrg, options, context);
-        await this.ensureOrgLettermintRelay(org, mailOrg, result.domain, context);
+        await this.ensureOrgLettermintRelay(org, mailOrg, result.domain, context, platformApex, platformLettermintProjectId);
         await this.ensureRoleMailboxes(org, mailOrg, result.domain, options, context);
         return { resourceId: result.domain };
     }
@@ -3894,11 +4328,20 @@ export class FoundryStepExecutor {
      * domain recorded) and on a same-domain re-apply (compared
      * case-insensitively, the same rule {@link findExactLettermintDomain}
      * applies to the lookup itself).
+     *
+     * #491 review: also a no-op when the previous domain is the platform's own
+     * apex -- an org that moves its mail *off* that domain (`usesDomain` flips,
+     * or `org.domain` changes) must never delete it here, the same protection
+     * {@link parkLettermintMail} already gives the apex on a move to `off`.
+     * `planMail` only blocks a move *onto* the apex (no project id yet); a move
+     * away from it reaches this method with nothing to block it otherwise.
      */
-    async deleteStaleLettermintDomain(context, newDomain) {
+    async deleteStaleLettermintDomain(context, newDomain, platformApex) {
         const previous = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
         if (!previous || previous.toLowerCase() === newDomain.toLowerCase())
             return;
+        if (platformApex && previous.toLowerCase() === platformApex.toLowerCase())
+            return;
         const stale = await this.findExactLettermintDomain(previous);
         if (stale)
             await this.ports.lettermint.deleteDomain(stale.id);
@@ -3970,20 +4413,28 @@ export class FoundryStepExecutor {
      * A no-op until a previous apply recorded {@link MAIL_DOMAIN_SCOPE_KEY}:
      * nothing was ever provisioned for an org whose mail went straight from
      * never-applied to off.
+     *
+     * #491: when `mailDomain` is the platform's own apex, this must never
+     * delete the platform's own project (the delete loop skips it by id) or
+     * the platform's own domain (returns before the domain lookup/delete).
      */
-    async parkLettermintMail(org, mailOrg, context) {
+    async parkLettermintMail(org, mailOrg, context, platformApex, platformLettermintProjectId) {
         const mailDomain = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
         if (!mailDomain)
             return;
+        const isPlatformApexOrg = Boolean(platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase());
         // #345: `mailOrg.domain` is absent for a level-1 org -- the previously
         // recorded mail domain is the one `MailPort.removeOrgRelay` needs.
         await this.ports.mail.removeOrgRelay({ ...mailOrg, domain: mailDomain });
         const names = new Set([`${org.slug}-app`, `${org.slug}-relay`]);
         const projects = await this.ports.lettermint.listProjects();
         for (const project of projects) {
-            if (names.has(project.name))
+            if (names.has(project.name) && project.id !== platformLettermintProjectId) {
                 await this.ports.lettermint.deleteProject(project.id);
+            }
         }
+        if (isPlatformApexOrg)
+            return;
         const domain = await this.findExactLettermintDomain(mailDomain);
         if (domain)
             await this.ports.lettermint.deleteDomain(domain.id);
@@ -4029,11 +4480,11 @@ export class FoundryStepExecutor {
     }
     // ---- files / ai --------------------------------------------------------
     /**
-     * #80: provisions the org's own organisation on Files, before
-     * {@link filesStorage} can set its spend limit. `provisionOrganisation` is
-     * safely repeatable on its own (`FilesOrganisationPort`'s doc comment), so
-     * this is called every time regardless of whether it already ran --
-     * idempotent by find-or-create, not by checking `recordedIds` first.
+     * #80: provisions the org's own organisation on Files.
+     * `provisionOrganisation` is safely repeatable on its own
+     * (`FilesOrganisationPort`'s doc comment), so this is called every time
+     * regardless of whether it already ran -- idempotent by find-or-create,
+     * not by checking `recordedIds` first.
      *
      * F6b: `action.desired.shareHost` (`diff.ts`'s `planFilesOrganisation`) is
      * passed through every time, even though `entry-files-key.ts` reports the
@@ -4046,15 +4497,23 @@ export class FoundryStepExecutor {
      * repeat-is-a-no-op shape as `provisionOrganisation` itself -- every org
      * gets an Agora (#164), so `diff.ts`'s `planFilesOrganisation` always sets
      * `desired.agoraOrigin`.
+     *
+     * #437: the owner member/name, the core ZITADEL files project and the core
+     * collection (`core-files.ts`) are no longer conditioned on a hosting entry
+     * declaring `uses.files` -- the core bundle (Agora's own uploads) needs
+     * all three just as much as a bespoke entry does, and withholding them
+     * until one existed is why a plain Agora/Boule org never got a usable
+     * Files setup at all. Both the project and the collection are idempotent
+     * by name, so a re-run that already created either finds it instead.
      */
     async filesOrganisation(action, org, context) {
         const files = await this.filesPort();
-        // F6b: an org whose entries use files needs an owner member in its files
-        // organisation, which its own key is minted below. Only a new
-        // organisation takes one, so it is passed when the owner is known now.
-        const owner = org.hosting.entries.some((e) => e.uses?.files)
-            ? filesOwnerUserId(org, context.recordedIds())
-            : undefined;
+        const recorded = context.recordedIds();
+        // F6b: an organisation takes an owner member and name only while it is
+        // being created, so it is passed whenever the owner is known now --
+        // every org, not only one with a hosting entry declaring `uses.files`
+        // (#437).
+        const owner = filesOwnerUserId(org, recorded);
         const provisioned = await files.provisionOrganisation({
             organisationId: org.id,
             ceilingBytes: action.desired.ceilingBytes ?? null,
@@ -4071,6 +4530,22 @@ export class FoundryStepExecutor {
         if (provisioned.agoraKey) {
             await this.deliverFilesAgoraKey(files, org, provisioned.agoraKey, context);
         }
+        // #437: the audience Agora requests to read/browse Files
+        // (`agoras.ts`'s `filesProjectId`), the same `urn:zitadel:iam:org:
+        // project:id:<id>:aud` shape `messagingProjectId` already uses. Retried
+        // on a later apply, same as the owner above, while the org's ZITADEL
+        // org id is not recorded yet (`zitadel:issuer` has not run).
+        const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+        if (zitadelOrgId) {
+            const { project } = await this.ports.zitadel.findOrCreateProject(zitadelOrgId, `${org.slug}-files`);
+            context.recordScopeId(ZITADEL_FILES_PROJECT_SCOPE_KEY, project.id);
+        }
+        // #437: the one collection every file Agora itself uploads goes into
+        // (`agoras.ts`'s `filesCollectionId`) -- Files has no route to list an
+        // organisation's collections and an ordinary member cannot create one,
+        // so it has to exist before Agora ever tries.
+        const collection = await files.ensureCollection(org.id, CORE_FILES_COLLECTION_NAME);
+        context.recordScopeId(FILES_CORE_COLLECTION_SCOPE_KEY, collection.id);
         return { resourceId: provisioned.organisationId };
     }
     /**
@@ -4107,12 +4582,6 @@ export class FoundryStepExecutor {
             context.recordScopeId(FILES_AGORA_UNDELIVERED_SCOPE_KEY, '');
         throw new Error(`${at}: Agora's key ${key.id} could not be delivered after ${AI_KEY_DELIVERY_ATTEMPTS} attempts (${cause}); ${revoked ? 'it was revoked again' : 'revoke it in files'}`);
     }
-    async filesStorage(action, org) {
-        const files = await this.filesPort();
-        await files.setQuota(org.id, action.desired.limitBytes ?? null);
-        await files.setBudget(org.id, action.desired.limitMicros ?? null);
-        return { resourceId: org.id };
-    }
     /**
      * #80: provisions the org's own organisation on AI and switches its AI use
      * on, before {@link aiBudget} can set its own spend limit. Both
@@ -4130,13 +4599,14 @@ export class FoundryStepExecutor {
         return { resourceId: provisioned.organisationId };
     }
     async aiBudget(action, org) {
-        const limitMicros = action.desired.limitMicros ?? null;
-        if (limitMicros === null) {
-            // ai/packages/sdk/src/types.ts:134-137's UpdateBudget.limitMicros is a
-            // required string -- there is no "uncapped" this API can express yet
-            // (Finding, this campaign's report).
-            throw new Error(`ai:budget for ${org.slug}: AI's updateBudget has no uncapped representation (UpdateBudget.limitMicros is a required string); declare a numeric limit until AI's API adds one`);
-        }
+        // #484: ai/packages/sdk/src/types.ts:134-137's UpdateBudget.limitMicros
+        // is a required string -- there is no "uncapped" this API can express
+        // yet (Finding, this campaign's report) -- so a null `desired.limitMicros`
+        // (an org that declares no limit) gets DEFAULT_AI_LIMIT_MICROS here too,
+        // the same substitution diff.ts's planners already make when they fill
+        // this field. Belt and braces: by the time a plan reaches here,
+        // `action.desired.limitMicros` should already be non-null.
+        const limitMicros = action.desired.limitMicros ?? DEFAULT_AI_LIMIT_MICROS;
         const ai = await this.aiPort();
         await ai.updateBudget(org.id, { keyId: null, limitMicros });
         return { resourceId: org.id };
@@ -4345,6 +4815,165 @@ export class FoundryStepExecutor {
             ids.push(keyId);
         context.recordScopeId(listKey, JSON.stringify(ids));
     }
+    /**
+     * F7 (#317): mints one entry's names key directly below the org (names
+     * takes no separate minter key id, unlike ai/files), writes `NAMES_URL`
+     * and `NAMES_API_KEY` to the entry's app env, then restarts it. Retires
+     * the key when `uses.names` is removed. Follows the "one mint" rule
+     * (CLAUDE.md "Platform steps"): the id is recorded as undelivered and
+     * persisted before delivery is attempted, so a crash or a failed write
+     * never leads to a second mint -- `planEntryNamesKeys` blocks instead.
+     */
+    async namesEntryKey(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `names:key for ${org.slug} entry '${entryKey}'`;
+        const names = this.ports.names;
+        if (!names)
+            throw new Error(`${at}: this executor was built without a NamesPort (#317)`);
+        const desired = action.desired;
+        if (desired.mode === 'retire') {
+            const recorded = context.recordedIds();
+            const mainId = recorded[`names:key:${action.key}`];
+            // A key minted but never delivered never gets a main id (the mint
+            // step throws before `runSteps` sees a `resourceId`), so it can
+            // coexist with a separate, already-delivered id from an earlier mint
+            // of the same entry: mint A, deliver, retire (main id A, retired
+            // marker A); re-declare, mint B, fail delivery three times
+            // (undelivered B, main id still A); undeclare again. The old `||`
+            // here always picked A (truthy), leaving B live for up to 365 days
+            // with nothing recorded (#317 re-review) -- both ids are revoked,
+            // independently, whenever both are present.
+            const undeliveredId = recorded[entryNamesUndeliveredScopeKey(entryKey)];
+            const idsToRevoke = [...new Set([mainId, undeliveredId].filter((id) => !!id))];
+            const keyId = mainId || undeliveredId;
+            // Revoke first: the key going dead in names is what retire is for,
+            // and the one thing that must still happen even when the entry's app
+            // is itself already gone. Only once that has succeeded (or 404'd as
+            // already gone) is the env cleanup attempted, itself tolerant of a
+            // 404 on a listEnvs/deleteEnv against an app that no longer exists --
+            // doing this the other way round meant an app already torn down (its
+            // id still recorded) threw on `listEnvs` before `revokeKey` ever ran,
+            // stranding a live key on every retry (#317 review).
+            for (const id of idsToRevoke) {
+                try {
+                    await names.revokeKey(org.id, id);
+                }
+                catch (error) {
+                    // A 404 means it is already gone -- recorded as retired below,
+                    // the same as a successful revoke. Anything else is a real
+                    // failure: thrown, not swallowed, so the key stays live and the
+                    // planner retires it again on the next apply instead of this
+                    // marking it done.
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
+            const appId = recorded[`coolify:app:${action.key}`];
+            if (appId) {
+                // A revoked key's env values are dead, not merely stale -- remove
+                // them so nothing reads a credential names has already revoked. A
+                // 404 on either call means that app or that env is already gone:
+                // nothing to clean up there, and the key is already revoked above,
+                // so it is not a reason to fail the step. Each delete tolerates its
+                // own 404, so one env already gone does not leave the other behind.
+                const tolerateNotFound = async (call, gone) => {
+                    try {
+                        return await call();
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw error;
+                        return gone;
+                    }
+                };
+                const envs = await tolerateNotFound(() => this.ports.coolify.listEnvs(appId), []);
+                for (const envKey of ['NAMES_URL', 'NAMES_API_KEY']) {
+                    const env = envs.find((e) => e.key === envKey && !e.is_preview);
+                    if (env?.uuid) {
+                        const uuid = env.uuid;
+                        await tolerateNotFound(() => this.ports.coolify.deleteEnv(appId, uuid), undefined);
+                    }
+                }
+            }
+            context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
+            context.recordScopeId(entryNamesMintedAtScopeKey(entryKey), '');
+            if (!keyId)
+                return {};
+            context.recordScopeId(entryNamesRetiredScopeKey(entryKey), keyId);
+            return {};
+        }
+        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.names);
+        if (!entry)
+            throw new Error(`${at}: the entry no longer declares uses.names`);
+        const appId = context.recordedIds()[`coolify:app:${action.key}`];
+        if (!appId)
+            throw new Error(`${at}: the entry's app is not recorded yet`);
+        if (!org.domain) {
+            throw new Error(`${at}: names needs org.domain, and validateEntryNames already refuses it without one`);
+        }
+        // A key left over from a previous mint whose delivery never succeeded
+        // is revoked first, not left blocking every later apply forever:
+        // nothing here keeps its secret around to retry delivering it
+        // (CLAUDE.md "No secret leaves"), so the only way to actually recover
+        // is to revoke the stale id and mint a fresh one -- a 404 counts as
+        // already revoked, same as any other retire (#317 re-review).
+        const staleUndelivered = context.recordedIds()[entryNamesUndeliveredScopeKey(entryKey)];
+        if (staleUndelivered) {
+            try {
+                await names.revokeKey(org.id, staleUndelivered);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+            context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
+            await context.persistScopeIds();
+        }
+        const minted = await names.mintKey({
+            organisationId: org.id,
+            domain: org.domain,
+            name: desired.name,
+            expiresDays: NAMES_ENTRY_KEY_DAYS,
+        });
+        context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), minted.id);
+        await context.persistScopeIds();
+        const envs = [
+            { key: 'NAMES_URL', value: desired.namesUrl, literal: true },
+            { key: 'NAMES_API_KEY', value: minted.secret, literal: true },
+        ];
+        let lastError;
+        for (let attempt = 1; attempt <= ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS; attempt++) {
+            try {
+                await this.ports.coolify.bulkUpsertEnvs(appId, envs);
+                await this.ports.coolify.restart(appId);
+                context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
+                // The only trace of this key's age, since nothing here renews it
+                // (#317 review's warning-row ask reads this to flag an expiring key).
+                context.recordScopeId(entryNamesMintedAtScopeKey(entryKey), new Date(context.now?.() ?? Date.now()).toISOString());
+                return { resourceId: minted.id };
+            }
+            catch (e) {
+                lastError = e;
+            }
+        }
+        // Names the key id only; the underlying error is dropped in case it echoes the secret.
+        throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'}); the next apply revokes it and mints a fresh one automatically`);
+    }
+    /**
+     * F7 (#317): `plan/entry-names-key.ts`'s `planNamesReservedLabels` --
+     * tells the names service every label this org's own entries already
+     * hold, so names refuses a customer claiming one of them.
+     */
+    async namesReservedLabels(action, org, context) {
+        const names = this.ports.names;
+        if (!names) {
+            throw new Error(`names:reserved-labels for ${org.slug}: this executor was built without a NamesPort (#317)`);
+        }
+        const labels = action.desired.labels;
+        await names.setReservedLabels(org.id, labels);
+        context.recordScopeId(NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY, JSON.stringify(labels));
+        return {};
+    }
     /**
      * F6b: mints or renews the org's own files key, or revokes the ones a
      * renewal replaced. The key is minted below the files organisation's owner
@@ -4745,6 +5374,45 @@ export class FoundryStepExecutor {
                     await files.revokeOrganisationKey(org.id, target.id);
                     return;
                 }
+                case 'cloudflare:worker': {
+                    // #318: an entry's edge Worker (`<orgId>:<entry>`) and its route.
+                    // No port means no way to delete either -- thrown, not silently
+                    // skipped, so it is reported blocked rather than left live with
+                    // nothing recorded ids point at any more.
+                    const workers = this.ports.workers;
+                    if (!workers) {
+                        throw new Error(`cloudflare:worker '${target.key}' for ${org.slug}: this executor was built without a WorkersPort (#318); cannot delete it`);
+                    }
+                    // The route on its recorded zone (skipped only once that zone is
+                    // positively gone), any route an interrupted apply created but
+                    // never recorded, then the script -- the same teardown retire runs.
+                    // `target.id` is `''` for a route-only partial deploy.
+                    const entryKey = target.key.slice(org.id.length + 1);
+                    await this.teardownEdgeWorker(entryKey, target.id || undefined, recordedIds, workers, `cloudflare:worker '${target.key}' for ${org.slug}`);
+                    return;
+                }
+                case 'names:key': {
+                    // F7 (#317): an entry's key (`<orgId>:<entry>`); names has no org-root key.
+                    // No port means no way to revoke it -- thrown, not silently
+                    // skipped, so the key is reported blocked rather than left live
+                    // with nothing saying so.
+                    const names = this.ports.names;
+                    if (!names) {
+                        throw new Error(`names:key '${target.key}' for ${org.slug}: this executor was built without a NamesPort (#317); cannot revoke it`);
+                    }
+                    try {
+                        await names.revokeKey(org.id, target.id);
+                    }
+                    catch (error) {
+                        // Already gone -- the same already-retired key a retire step
+                        // handled before org destroy ever ran can still reach here
+                        // (#317 review); a 404 is success, not a reason to block
+                        // teardown forever.
+                        if (!isNotFoundError(error))
+                            throw error;
+                    }
+                    return;
+                }
                 case 'coolify:app':
                     await this.ports.coolify.deleteApplication(target.id);
                     return;