@wtfalch/foundry 0.17.0 → 0.18.0

package/dist/plan/executor.js

@@ -9,14 +9,17 @@ import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, cal
 import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, chatInternalNames, chatMasConfigYaml, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
+import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
+import { EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
+import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * #274 fix round 4: bridges `@wtfalch/providers`' real `ZitadelClient.
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
@@ -505,11 +508,21 @@ const CALLS_MAS_DB_SCOPE_KEY = 'coolify_calls_mas_database';
  * Synapse refuses to start against a database whose `LC_COLLATE`/`LC_CTYPE`
  * is not `C` (https://element-hq.github.io/synapse/latest/postgres.html);
  * Coolify's official postgres image otherwise creates one with `en_US.utf8`.
- * `postgres_initdb_args` is the only point this can be set -- it cannot be
- * migrated onto an existing database. MAS has no such requirement, so this
- * is passed for the Synapse database only. Not using Synapse's own
- * `allow_unsafe_locale` escape hatch: that trades a loud startup refusal for
- * silent index corruption after a future glibc upgrade.
+ * `createPostgresDatabase` forwards this to Coolify's own
+ * `postgres_initdb_args` field -- but Coolify stores that field and reads it
+ * back unchanged without ever handing it to `initdb`: its Postgres start
+ * action builds the container's env from `postgres_user`/`postgres_password`/
+ * `postgres_db` and runtime envs only
+ * (https://github.com/coollabsio/coolify/blob/main/app/Actions/Database/StartPostgresql.php).
+ * A database created this way still comes up `en_US.utf8` and crash-loops
+ * every Synapse app that reads it; live evidence and the real fix (not yet
+ * chosen) are tracked in #494. This constant and the field it feeds stay in
+ * place, inert, until that lands -- collation cannot be migrated onto an
+ * existing database under any of the candidate fixes either. MAS has no
+ * such requirement, so this is passed for the Synapse database only. Not
+ * using Synapse's own `allow_unsafe_locale` escape hatch regardless of
+ * which fix lands: that trades a loud startup refusal for silent index
+ * corruption after a future glibc upgrade.
  */
 const CALLS_SYNAPSE_DB_INITDB_ARGS = '--locale=C --encoding=UTF8';
 /**
@@ -657,6 +670,8 @@ export class FoundryStepExecutor {
                 return this.cloudflareAccess(action, org);
             case 'cloudflare:ratelimit':
                 return this.cloudflareRateLimit(org);
+            case 'cloudflare:worker':
+                return this.cloudflareWorker(action, org, context);
             case 'files:organisation':
                 return this.filesOrganisation(action, org, context);
             case 'files:key':
@@ -673,6 +688,10 @@ export class FoundryStepExecutor {
                 return action.key.includes(':')
                     ? this.aiEntryKey(action, org, context)
                     : this.aiKey(action, org, context);
+            case 'edge:key':
+                return this.edgeEntryKey(action, org, context);
+            case 'edge:reserved-labels':
+                return this.edgeReservedLabels(action, org, context);
             case 'coolify:mail':
                 return this.coolifyMail(action, org, context);
             case 'coolify:mail-copy':
@@ -840,6 +859,250 @@ export class FoundryStepExecutor {
         }
         return { resourceId: created.id };
     }
+    /**
+     * `plan/diff.ts`'s `planWorkers` (#318, F8): deploys one entry's
+     * `worker` Worker and routes it on the org's own zone. Throws by name
+     * without a {@link WorkersPort}, the same `jobsRegistration` shape --
+     * `planWorkers` reports the step blocked instead while the host has
+     * none, so this only fires against a stale plan. The route is checked
+     * before upload: a foreign route already on the pattern is refused, never
+     * adopted or replaced (`cloudflareAccess`'s own precedent for a foreign
+     * resource on the same name), so a Worker is never deployed only to find
+     * nothing can route to it.
+     *
+     * Order on apply: record (and persist) the uploaded name and clear the
+     * retired marker, upload, record the pending route, create the route only
+     * if needed, delete any *previous* route this entry recorded on its own
+     * zone, then record the new route id/zone/pattern and the applied
+     * declaration last -- every crash point leaves a recorded trace that
+     * retire and destroy can clean up (#318 re-review), and per CLAUDE.md's
+     * "Declared changes apply" nothing is marked done until the
+     * live state actually matches it.
+     */
+    async cloudflareWorker(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `cloudflare:worker for ${org.slug} entry '${entryKey}'`;
+        const workers = this.ports.workers;
+        if (!workers)
+            throw new Error(`${at}: this executor was built without a WorkersPort (#318)`);
+        const desired = action.desired;
+        if (desired.mode === 'retire') {
+            const recorded = context.recordedIds();
+            const mainId = recorded[`cloudflare:worker:${action.key}`];
+            const scriptName = mainId || recorded[entryWorkerUploadedScopeKey(entryKey)];
+            await this.teardownWorker(entryKey, scriptName, recorded, workers, at);
+            context.recordScopeId(entryWorkerRouteIdScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRouteZoneScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRoutePatternScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerExclusionsScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerAppliedScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), '');
+            // `runSteps` only ever writes the main recorded id from a truthy
+            // `resourceId` (`plan-apply.ts`); this step returns none, so without
+            // this marker the planner's "gone" scan would retire the same,
+            // never-cleared id forever.
+            if (mainId)
+                context.recordScopeId(entryWorkerRetiredScopeKey(entryKey), mainId);
+            return {};
+        }
+        if (!org.domain) {
+            throw new Error(`${at}: worker needs org.domain, and validateHosting already refuses it without one`);
+        }
+        const zone = await this.ports.cloudflare.findZoneByApex(org.domain);
+        if (!zone) {
+            throw new Error(`${at}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
+        }
+        const name = desired.name;
+        const route = desired.route;
+        const bindings = (desired.bindings?.rateLimits ?? []).map((r) => ({
+            type: 'ratelimit',
+            name: r.name,
+            namespace_id: r.namespaceId,
+            simple: { limit: r.limit, period: r.period },
+        }));
+        const existingRoute = await workers.findRoute(zone.id, route);
+        if (existingRoute && existingRoute.script !== name) {
+            throw new Error(`${at}: route '${route}' is already bound to Worker '${existingRoute.script}', not foundry's own '${name}'; foundry does not adopt or replace it`);
+        }
+        // Checked only on an entry's first-ever apply -- a name foundry has
+        // already recorded for itself (even a retired one: redeclaring reuses
+        // the same deterministic name) is foundry's own script to overwrite,
+        // never a stranger's.
+        const recordedBeforeUpload = context.recordedIds();
+        const everUploadedByFoundry = Boolean(recordedBeforeUpload[entryWorkerAppliedScopeKey(entryKey)] ||
+            recordedBeforeUpload[entryWorkerUploadedScopeKey(entryKey)] ||
+            recordedBeforeUpload[`cloudflare:worker:${action.key}`]);
+        if (!everUploadedByFoundry && (await workers.scriptExists(name))) {
+            throw new Error(`${at}: a Worker script named '${name}' already exists and foundry never created it; refuses to overwrite it`);
+        }
+        // Recorded and persisted *before* the upload (#318 re-review): a crash
+        // mid-upload or a failed route create still leaves a trail to the
+        // script, and a retry reads it as foundry's own rather than tripping
+        // the `scriptExists` guard above. The retired marker clears here too,
+        // not only on success: once a redeploy has touched the script, a later
+        // undeclare must retire it even if this apply never finishes.
+        context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), name);
+        context.recordScopeId(entryWorkerRetiredScopeKey(entryKey), '');
+        await context.persistScopeIds();
+        await workers.uploadScript({
+            name,
+            artifactUrl: desired.artifactUrl,
+            artifactSha256: desired.artifactSha256,
+            compatibilityDate: action.desired.compatibilityDate,
+            bindings: bindings.length > 0 ? bindings : undefined,
+        });
+        // Before the wildcard route exists, so a hostname foundry serves is never
+        // caught by the Worker, not even briefly.
+        await this.syncWorkerExclusions(entryKey, zone.id, org.domain, desired.exclusions ?? [], workers, context, at);
+        const recorded = context.recordedIds();
+        const previousRouteId = recorded[entryWorkerRouteIdScopeKey(entryKey)];
+        const previousPending = recorded[entryWorkerRoutePendingScopeKey(entryKey)];
+        const zoneRecord = { id: zone.id, apex: org.domain };
+        let routeId = existingRoute?.id;
+        if (!routeId) {
+            // Recorded before the create, so a route Cloudflare made but foundry
+            // never got to record is still found (`findRoute`) and deleted on
+            // retire or destroy (#318 re-review).
+            const pending = { ...zoneRecord, pattern: route, script: name };
+            context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), JSON.stringify(pending));
+            await context.persistScopeIds();
+            const created = await workers.createRoute(zone.id, route, name);
+            routeId = created.id;
+        }
+        // Any route this entry recorded before that is not the one it now uses
+        // -- the declared pattern moved, or the domain did -- is deleted on its
+        // own zone rather than left live beside the new one. A pending route
+        // from an earlier, interrupted apply under a different pattern likewise.
+        if (previousRouteId && previousRouteId !== routeId) {
+            const previousZone = await this.liveWorkerZone(recorded[entryWorkerRouteZoneScopeKey(entryKey)], at);
+            if (previousZone)
+                await workers.deleteRoute(previousZone, previousRouteId); // Idempotent.
+        }
+        if (previousPending) {
+            await this.deletePendingWorkerRoute(previousPending, routeId, workers, at);
+        }
+        context.recordScopeId(entryWorkerRouteIdScopeKey(entryKey), routeId);
+        context.recordScopeId(entryWorkerRouteZoneScopeKey(entryKey), JSON.stringify(zoneRecord));
+        context.recordScopeId(entryWorkerRoutePatternScopeKey(entryKey), route);
+        context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), '');
+        context.recordScopeId(entryWorkerAppliedScopeKey(entryKey), JSON.stringify({
+            name,
+            artifactUrl: desired.artifactUrl,
+            artifactSha256: desired.artifactSha256,
+            route,
+            bindings: desired.bindings,
+            exclusions: desired.exclusions,
+        }));
+        context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), '');
+        // The retired marker was already cleared before the upload above: a
+        // redeclare reuses this entry's deterministic script name, so a marker
+        // left equal to the (identical) main id would read as already retired.
+        return { resourceId: name };
+    }
+    /**
+     * Makes the no-Worker routes recorded for an entry match `patterns`: deletes
+     * the ones no longer wanted (all of them if the zone changed), creates the
+     * missing ones without a script. A route already on a pattern that is bound
+     * to a Worker is foreign and refused; one with no script is adopted. Records
+     * and persists after each change.
+     */
+    async syncWorkerExclusions(entryKey, zoneId, apex, patterns, workers, context, at) {
+        const key = entryWorkerExclusionsScopeKey(entryKey);
+        const raw = context.recordedIds()[key];
+        let state = raw
+            ? JSON.parse(raw)
+            : { id: zoneId, apex, routes: {} };
+        const save = async () => {
+            context.recordScopeId(key, Object.keys(state.routes).length > 0 ? JSON.stringify(state) : '');
+            await context.persistScopeIds();
+        };
+        if (state.id !== zoneId) {
+            const oldZone = await this.liveWorkerZone(JSON.stringify({ id: state.id, apex: state.apex }), at);
+            if (oldZone) {
+                for (const id of Object.values(state.routes))
+                    await workers.deleteRoute(oldZone, id);
+            }
+            state = { id: zoneId, apex, routes: {} };
+            await save();
+        }
+        for (const [pattern, id] of Object.entries(state.routes)) {
+            if (patterns.includes(pattern))
+                continue;
+            await workers.deleteRoute(zoneId, id); // Idempotent.
+            delete state.routes[pattern];
+            await save();
+        }
+        for (const pattern of patterns) {
+            if (state.routes[pattern])
+                continue;
+            const found = await workers.findRoute(zoneId, pattern);
+            if (found?.script) {
+                throw new Error(`${at}: route '${pattern}' is already bound to Worker '${found.script}'; foundry does not replace it`);
+            }
+            state.routes[pattern] = found ? found.id : (await workers.createRoute(zoneId, pattern)).id;
+            await save();
+        }
+    }
+    /**
+     * The zone id a recorded route lives in, or `undefined` only when that
+     * zone is *positively* gone -- its apex resolves to no zone, or to a
+     * different zone than the one recorded (#318 re-review). Reads the zone
+     * recorded beside the route, never `org.domain`: the route id and its
+     * zone are always recorded together (the apply branch below writes both
+     * in the same batch, and the pending-route marker carries its own zone
+     * too), so a route id with no zone recorded cannot happen within this
+     * feature -- and re-resolving from `org.domain` as a fallback would risk
+     * looking up the *new* zone after a domain change and leaving the route
+     * live on the old one, the exact bug a recorded-per-route zone exists to
+     * avoid (#318 re-review).
+     */
+    async liveWorkerZone(recordedZone, at) {
+        if (!recordedZone) {
+            throw new Error(`${at}: a route is recorded but its zone is not, so foundry cannot tell which zone holds it; refuses to forget it`);
+        }
+        const { id, apex } = JSON.parse(recordedZone);
+        const zone = await this.ports.cloudflare.findZoneByApex(apex);
+        return zone && zone.id === id ? id : undefined;
+    }
+    /** Deletes the route an interrupted apply was creating, if `findRoute` shows it exists, points at that apply's script, and is not `keepRouteId`. */
+    async deletePendingWorkerRoute(pendingRaw, keepRouteId, workers, at) {
+        const pending = JSON.parse(pendingRaw);
+        const zoneId = await this.liveWorkerZone(JSON.stringify({ id: pending.id, apex: pending.apex }), at);
+        if (!zoneId)
+            return;
+        const found = await workers.findRoute(zoneId, pending.pattern);
+        if (found && found.script === pending.script && found.id !== keepRouteId) {
+            await workers.deleteRoute(zoneId, found.id); // Idempotent.
+        }
+    }
+    /**
+     * Retire and destroy share this: delete the recorded route on its own
+     * zone, then any route an interrupted apply created but never recorded,
+     * then the script. Records nothing -- the caller does.
+     */
+    async teardownWorker(entryKey, scriptName, recorded, workers, at) {
+        const routeId = recorded[entryWorkerRouteIdScopeKey(entryKey)];
+        if (routeId) {
+            const zoneId = await this.liveWorkerZone(recorded[entryWorkerRouteZoneScopeKey(entryKey)], at);
+            if (zoneId)
+                await workers.deleteRoute(zoneId, routeId); // Idempotent: a no-op if already gone.
+        }
+        const pending = recorded[entryWorkerRoutePendingScopeKey(entryKey)];
+        if (pending)
+            await this.deletePendingWorkerRoute(pending, undefined, workers, at);
+        const exclusions = recorded[entryWorkerExclusionsScopeKey(entryKey)];
+        if (exclusions) {
+            const state = JSON.parse(exclusions);
+            const zoneId = await this.liveWorkerZone(JSON.stringify({ id: state.id, apex: state.apex }), at);
+            if (zoneId) {
+                for (const id of Object.values(state.routes))
+                    await workers.deleteRoute(zoneId, id);
+            }
+        }
+        if (scriptName)
+            await workers.deleteScript(scriptName); // Idempotent: a no-op if already gone.
+    }
     // ---- zitadel --------------------------------------------------------
     async zitadelIssuer(action, org, context) {
         if (action.desired.provision !== true) {
@@ -1498,7 +1761,15 @@ export class FoundryStepExecutor {
         // One Lettermint project, `<slug>-app`, belongs to the `app` entry; a
         // second entry sharing the name would delete the first's live token.
         if (entry.key === APP_ENTRY_KEY) {
-            await this.ensureAppLettermintMail(appId, org, context, Boolean(existing));
+            await this.ensureAppLettermintMail(appId, org, context, Boolean(existing), 
+            // #491 (review round 2, finding 3): `diff.ts`'s `planApps` always
+            // sets `platformApex` on this step's `desired` once it's planned at
+            // all -- `null` when no platform is declared, never omitted. The key
+            // being absent outright (as opposed to present and `null`) means a
+            // step planned before this field existed; `ensureAppLettermintMail`
+            // refuses rather than silently falling back once it knows there is
+            // a recorded mail domain to reason about.
+            'platformApex' in action.desired, action.desired.platformApex ?? null, action.desired.platformLettermintProjectId ?? null);
         }
         return { resourceId: appId };
     }
@@ -1937,12 +2208,73 @@ export class FoundryStepExecutor {
      * comment), never logged, never interpolated into a thrown error -- the
      * same discipline `pushDatabaseUrl`'s doc comment states for a database's
      * own connection string.
+     *
+     * #491: none of the above applies to the org whose mail domain is the
+     * platform's own apex -- it shares the platform's existing Lettermint
+     * project (`platformLettermintProjectId`, from `DeclaredPlatform.mail`)
+     * instead of minting a `<slug>-app` one, and this method never creates or
+     * deletes a project for it. `platformApex`/`platformLettermintProjectId`
+     * come straight off this step's own `desired`, the same "the executor
+     * writes exactly what the plan showed" rule `coolifyMail` already follows
+     * for its own `apex`/`mailHost` -- the caller (`coolifyApp`) refuses a
+     * `desired` missing the `platformApex` key outright as a stale plan --
+     * checked here, after the no-op-until-a-mail-domain-exists return just
+     * below, rather than unconditionally at the call site: every other
+     * `coolify:app` concern (hostnames, ports, settings, the sign-in env...)
+     * has nothing to do with Lettermint and must keep working the moment a
+     * mail domain was never even recorded for this org, the same as before
+     * this field existed (review round 2, finding 3).
      */
-    async ensureAppLettermintMail(appId, org, context, running) {
+    async ensureAppLettermintMail(appId, org, context, running, hasPlatformApexField, platformApex, platformLettermintProjectId) {
         const mailDomain = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
         if (!mailDomain)
             return;
+        if (!hasPlatformApexField) {
+            throw new Error(`coolify:app for ${org.slug}: this step's plan carries no platformApex; plan this org's app again`);
+        }
         const appName = `${org.slug}-app`;
+        // #491: an org whose mail domain is the platform's own apex (Company
+        // Included on companyincluded.com, today) shares the platform's existing
+        // Lettermint project rather than minting a `<slug>-app` one of its own --
+        // `diff.ts`'s `planApp` blocks this whole piece while
+        // `platformLettermintProjectId` is unset, so a plan carrying neither is
+        // stale; never fall back to creating, restricting or deleting anything
+        // here until a fresh plan supplies it.
+        const isPlatformApexOrg = Boolean(platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase());
+        if (isPlatformApexOrg) {
+            if (!platformLettermintProjectId)
+                return;
+            const [projects, envs] = await Promise.all([
+                this.ports.lettermint.listProjects(),
+                this.ports.coolify.listEnvs(appId),
+            ]);
+            // Review round 2, finding 5: a missing held token would otherwise
+            // leave the app with a stale or absent `LETTERMINT_API_TOKEN` and no
+            // signal that anything is wrong -- refused instead, the same "fail
+            // rather than silently point mail at nothing" rule `coolifyMail`
+            // already follows for its own `apex`/`mailHost`.
+            const heldToken = (await this.ports.heldKeys?.resolve(PLATFORM_AUTH_BROKER_MAIL_KEY_REF)) ?? null;
+            if (!heldToken) {
+                throw new Error(`coolify:app for ${org.slug}: the platform's own Lettermint token is not held yet (held-key ref ${PLATFORM_AUTH_BROKER_MAIL_KEY_REF})`);
+            }
+            // Validates and restricts before any env is written -- `ensureLettermintDomainRestriction`'s
+            // own doc comment (review round 2, finding 4) throws on a mistyped id,
+            // and the app must never end up with a pushed token the restriction
+            // step then fails on, the same "never half-ready" order
+            // {@link ensureOrgLettermintRelay} already follows for its own token.
+            await this.ensureLettermintDomainRestriction(org, mailDomain, projects, platformApex, platformLettermintProjectId);
+            const currentToken = envs.find((e) => e.key === 'LETTERMINT_API_TOKEN' && !e.is_preview)?.value;
+            const tokenChanged = currentToken !== heldToken;
+            await this.ports.coolify.bulkUpsertEnvs(appId, [
+                { key: 'MAIL_FROM', value: `${org.mail.noReplyLocalPart ?? 'no-reply'}@${mailDomain}` },
+                { key: 'LETTERMINT_API_TOKEN', value: heldToken },
+            ]);
+            // Same restart rule as the non-apex path below: a running container
+            // read its env at start and keeps a stale token until restarted.
+            if (tokenChanged && running)
+                await this.ports.coolify.restart(appId);
+            return;
+        }
         const [projects, envs] = await Promise.all([
             this.ports.lettermint.listProjects(),
             this.ports.coolify.listEnvs(appId),
@@ -1973,9 +2305,11 @@ export class FoundryStepExecutor {
         // old project is deleted below. A just-created app starts with the new env.
         if (!healthy && running)
             await this.ports.coolify.restart(appId);
-        await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects);
+        await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
         for (const project of allProjects) {
-            if (project.name === appName && project.id !== keepProjectId) {
+            if (project.name === appName &&
+                project.id !== keepProjectId &&
+                project.id !== platformLettermintProjectId) {
                 await this.ports.lettermint.deleteProject(project.id);
             }
         }
@@ -2013,8 +2347,14 @@ export class FoundryStepExecutor {
      * it the same way the app step does, rather than assuming it already
      * exists -- the domain must never end up unrestricted, whichever step gets
      * there first.
+     *
+     * #491: this org's own `<slug>-relay` project is unaffected by whether it
+     * is the platform's own org -- only the domain restriction
+     * (`platformApex`/`platformLettermintProjectId`, forwarded to
+     * {@link ensureLettermintDomainRestriction}) and the delete loop below
+     * (which must never delete the platform's own project) change.
      */
-    async ensureOrgLettermintRelay(org, mailOrg, mailDomain, context) {
+    async ensureOrgLettermintRelay(org, mailOrg, mailDomain, context, platformApex, platformLettermintProjectId) {
         const relayName = `${org.slug}-relay`;
         // #345: `mailOrg.domain` is absent for a level-1 org -- `mailDomain` is
         // `applyOrgMail`'s own resolved result, the one domain `MailPort`'s
@@ -2033,7 +2373,7 @@ export class FoundryStepExecutor {
         let keepProjectId;
         if (healthy && held) {
             keepProjectId = held.id;
-            await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects);
+            await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
         }
         else {
             const created = await this.ports.lettermint.createProject(relayName);
@@ -2044,7 +2384,7 @@ export class FoundryStepExecutor {
                 // reaches Stalwart: a failure here leaves the working route alone.
                 // The restriction covers old and new projects, so the old one keeps
                 // sending until the route switches.
-                await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects);
+                await this.ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId);
                 await this.ports.mail.applyOrgRelay(relayOrg, created.token);
             }
             catch (err) {
@@ -2057,7 +2397,9 @@ export class FoundryStepExecutor {
             await context.persistScopeIds();
         }
         for (const project of allProjects) {
-            if (project.name === relayName && project.id !== keepProjectId) {
+            if (project.name === relayName &&
+                project.id !== keepProjectId &&
+                project.id !== platformLettermintProjectId) {
                 await this.ports.lettermint.deleteProject(project.id);
             }
         }
@@ -2089,10 +2431,31 @@ export class FoundryStepExecutor {
      * unrestricted domain cannot verify and cannot send, whichever project
      * owns it (post-#140 review finding, restated here rather than only at
      * the one call site it used to have).
+     *
+     * #491: `platformApex`/`platformLettermintProjectId` cover both callers at
+     * once -- when `mailDomain` is the platform's own apex, the platform's
+     * project id is always folded into the restriction, so a plan that shares
+     * the platform's project (rather than minting a `<slug>-app` one) never
+     * ends up restricting that org's domain to nothing. A no-op for every
+     * other org's domain, since `mailDomain` never matches `platformApex` there.
+     * Review round 2, finding 4: a declared id that is not among `allProjects`
+     * (a mistype, or the project was deleted in Lettermint) is refused rather
+     * than folded in anyway -- that would restrict the apex to whatever *is*
+     * live (the relay project, say) plus an id naming nothing, which excludes
+     * the real platform project from its own domain exactly as completely as
+     * never restricting it at all. Centralised here rather than duplicated at
+     * each caller, since both {@link ensureAppLettermintMail} and
+     * {@link ensureOrgLettermintRelay} reach the apex through this one method.
      */
-    async ensureLettermintDomainRestriction(org, mailDomain, allProjects) {
+    async ensureLettermintDomainRestriction(org, mailDomain, allProjects, platformApex, platformLettermintProjectId) {
         const appName = `${org.slug}-app`;
         const relayName = `${org.slug}-relay`;
+        const isPlatformApexDomain = Boolean(platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase());
+        if (isPlatformApexDomain && platformLettermintProjectId) {
+            if (!allProjects.some((p) => p.id === platformLettermintProjectId)) {
+                throw new Error(`Lettermint for ${org.slug}: platform.mail.lettermintProjectId ${platformLettermintProjectId} is not a live Lettermint project`);
+            }
+        }
         const existing = await this.findExactLettermintDomain(mailDomain);
         const domain = existing
             ? await this.ports.lettermint.getDomain(existing.id)
@@ -2100,6 +2463,11 @@ export class FoundryStepExecutor {
         const scopedProjectIds = allProjects
             .filter((p) => p.name === appName || p.name === relayName)
             .map((p) => p.id);
+        if (isPlatformApexDomain &&
+            platformLettermintProjectId &&
+            !scopedProjectIds.includes(platformLettermintProjectId)) {
+            scopedProjectIds.push(platformLettermintProjectId);
+        }
         await this.ports.lettermint.restrictDomainToProjects(domain.id, scopedProjectIds);
         const zone = await this.ports.cloudflare.findZoneByApex(mailDomain);
         if (!zone) {
@@ -2739,6 +3107,34 @@ export class FoundryStepExecutor {
     async coolifyChat(action, org, context) {
         const recorded = context.recordedIds();
         if (recorded[`coolify:chat:${action.key}`]) {
+            // #456: `planChat` plans this distinct, non-re-key action for a live
+            // chat app that predates the owner/runtime database split (#239) --
+            // push only the split and redeploy if it changed, never the re-key
+            // paths below, which throw on literally any other action here.
+            if (action.desired.refreshDatabaseSplit === true) {
+                const serviceAppId = recorded[CHAT_SERVICE_SCOPE_KEY];
+                const serviceDbId = recorded[CHAT_SERVICE_DB_SCOPE_KEY];
+                if (!serviceAppId || !serviceDbId) {
+                    throw new Error(`coolify:chat database split for ${org.slug}: the chat service app or its database is not recorded yet`);
+                }
+                const push = await this.pushDatabaseUrl(serviceAppId, serviceDbId, 'chat');
+                const markerKey = serviceDbEnvAppliedScopeKey('chat');
+                if (!push.pushed) {
+                    // Unlike a fresh provision, this chat was already fully up and
+                    // running -- its service database was already started (the main
+                    // path below never creates an app before confirming that). A push
+                    // refused here means the recorded database id no longer resolves
+                    // to a started database with an `internal_db_url`, which is not a
+                    // "retry once Coolify catches up" condition: fail loudly instead of
+                    // replanning this same step silently forever (#456 review).
+                    throw new Error(`coolify:chat database split for ${org.slug}: the chat service's database (${serviceDbId}) has no internal_db_url -- it may have been deleted or is unreachable; this is not expected for an already-live chat`);
+                }
+                if (push.changed || !recorded[markerKey]) {
+                    await this.ports.coolify.deploy(serviceAppId);
+                }
+                context.recordScopeId(markerKey, '1');
+                return { resourceId: serviceAppId };
+            }
             if (action.desired.usesDomain === false) {
                 throw new NotBuiltError(`coolify:chat reverse re-key for ${org.slug}`, 'moving its chat back onto the original server_name is not built (#7 amendment 3)');
             }
@@ -2881,8 +3277,13 @@ export class FoundryStepExecutor {
             agoraHost,
             masClientId: secrets.value.masClientId,
             masClientSecret: secrets.value.masClientSecret,
-            databaseUrl: serviceDbRow.internal_db_url,
         }));
+        // Split the same way `coolifyApp`'s and `cmsSite`'s own databases are
+        // (#239, #456): `DATABASE_URL_OWNER` is the superuser string,
+        // `DATABASE_URL` is a minted `chat_rt` role -- `chat` is the literal
+        // `postgres_db`/`postgres_user` `ensureCallsDatabase` created the service
+        // database with above, not the Coolify resource name `names.serviceDb`.
+        const serviceDbPush = await this.pushDatabaseUrl(service.appId, serviceDbId, 'chat');
         // A file-storage write alone never reaches a running container. Deploy an
         // app that is new, whose config was freshly minted, or that is not
         // running now. The last test reads the live status, not what this run
@@ -2893,10 +3294,19 @@ export class FoundryStepExecutor {
         for (const app of [mas, synapse, service]) {
             if (!app.existed ||
                 secrets.changed ||
+                (app === service && serviceDbPush.changed) ||
                 !isRunningOrStarting((await this.ports.coolify.getApplication(app.appId)).status)) {
                 await this.ports.coolify.deploy(app.appId);
             }
         }
+        // #456: recorded here too, not only on the `refreshDatabaseSplit` replan
+        // path above -- without it a fresh provision's very first apply never
+        // sets this marker, so `planChat` (`!recordedIds[serviceDbEnvAppliedScopeKey('chat')]`)
+        // reads it as still missing and plans a pointless extra redeploy on the
+        // very next apply for an org that was never behind.
+        if (serviceDbPush.pushed) {
+            context.recordScopeId(serviceDbEnvAppliedScopeKey('chat'), '1');
+        }
         // Last: the marker tells `desiredAgoraEnv` the names and envs are in place.
         context.recordScopeId(CHAT_SERVICE_URL_SCOPE_KEY, chatUpstreams(org.slug).chat);
         return { resourceId: mas.appId };
@@ -2976,7 +3386,6 @@ export class FoundryStepExecutor {
         await this.ensureLogVolume(app.appId, org, app.existed);
         const bindingSecret = await this.ensureCallsBindingSecret(app.appId);
         const envs = [
-            { key: 'DATABASE_URL', value: db.internal_db_url },
             { key: 'LIVEKIT_URL', value: CALLS_SFU_PRIVATE_URL },
             { key: 'LIVEKIT_PUBLIC_URL', value: CALLS_SFU_PUBLIC_URL },
             { key: 'LIVEKIT_API_KEY', value: sfu.apiKey },
@@ -3015,17 +3424,40 @@ export class FoundryStepExecutor {
         // unguarded and the planner reports the lost secret instead of minting again.
         if (token)
             context.recordScopeId(CALLS_INTROSPECTION_SCOPE_KEY, token.appId);
+        // Split the same way `coolifyApp`'s and `cmsSite`'s own databases are
+        // (#239, #456): `DATABASE_URL_OWNER` is the superuser string,
+        // `DATABASE_URL` is a minted `<dbName>_rt` role -- the real Postgres
+        // database name `ensureCallsDatabase` created this database with, not
+        // the Coolify resource name.
+        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName.replace(/-/g, '_'));
+        // #456: a crash between the push above and the deploy/marker below
+        // leaves the env right and no marker, so this replans and deploys once
+        // more -- the same rule `coolifyApp`'s own `dbEnvAppliedScopeKey` marker
+        // follows.
+        const dbMarkerKey = serviceDbEnvAppliedScopeKey('calls-service');
+        const dbSplitNeedsRefresh = dbPush.pushed && (dbPush.changed || !context.recordedIds()[dbMarkerKey]);
         // A container reads its name and env only at start, so a running app is
         // restarted once, when this run is the one that gave it its name or its
         // token env (the same rule `coolifyApp` follows when an existing app's
-        // env changed).
+        // env changed). The database split is different: it is only safe once the
+        // image actually contains the migrate step that creates the `_rt` role
+        // (the sibling calls-service PR adding it), so that case redeploys --
+        // rebuilding the image -- rather than restarting the one already running,
+        // the same distinction `coolifyChat`'s own refresh path makes. A restart
+        // here would bring back a container built before that migrate step
+        // existed, still pointed at a role nothing has created.
         const givesTokenEnv = token !== null && context.recordedIds()[CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY] !== tokenMarker;
-        if (app.existed && (!callsServiceHasName(org, context.recordedIds()) || givesTokenEnv)) {
+        if (app.existed && dbSplitNeedsRefresh) {
+            await this.ports.coolify.deploy(app.appId);
+        }
+        else if (app.existed && (!callsServiceHasName(org, context.recordedIds()) || givesTokenEnv)) {
             await this.ports.coolify.restart(app.appId);
         }
         context.recordScopeId(CALLS_SERVICE_NAME_SCOPE_KEY, name);
         if (token && tokenMarker)
             context.recordScopeId(CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, tokenMarker);
+        if (dbPush.pushed)
+            context.recordScopeId(dbMarkerKey, '1');
         return { resourceId: app.appId };
     }
     /**
@@ -3849,22 +4281,26 @@ export class FoundryStepExecutor {
             throw new Error(`coolify:mail for ${org.slug}: this step's plan carries no platform mail ${!apex && !mailHost ? 'apex or host' : !apex ? 'apex' : 'host'}; plan this org's mail again`);
         }
         const options = { apex, mailHost };
+        // #491: `null` unless `diff.ts`'s `planMail` carries them -- absent for
+        // every org but the platform's own, and for a plan predating this field.
+        const platformApex = action.desired.platformApex ?? null;
+        const platformLettermintProjectId = action.desired.platformLettermintProjectId ?? null;
         if (mode === 'off') {
             const parkedMailOrg = mailOrgFor(org, usesDomain, 'hosted');
             await this.ports.mail.parkOrgMail(parkedMailOrg, options);
-            await this.parkLettermintMail(org, parkedMailOrg, context);
+            await this.parkLettermintMail(org, parkedMailOrg, context, platformApex, platformLettermintProjectId);
             return undefined;
         }
         const mailOrg = mailOrgFor(org, usesDomain, mode);
         const result = await this.ports.mail.applyOrgMail(mailOrg, options);
         await this.publishMailDnsRecords(org, result);
-        await this.deleteStaleLettermintDomain(context, result.domain);
+        await this.deleteStaleLettermintDomain(context, result.domain, platformApex);
         context.recordScopeId(MAIL_DOMAIN_SCOPE_KEY, result.domain);
         // #177: what this step wrote from the platform, so `planMail` can see a later change.
         context.recordScopeId(ORG_MAIL_APPLIED_APEX_SCOPE_KEY, options.apex);
         context.recordScopeId(ORG_MAIL_APPLIED_HOST_SCOPE_KEY, options.mailHost);
         await this.ensureOwnerMailbox(org, mailOrg, options, context);
-        await this.ensureOrgLettermintRelay(org, mailOrg, result.domain, context);
+        await this.ensureOrgLettermintRelay(org, mailOrg, result.domain, context, platformApex, platformLettermintProjectId);
         await this.ensureRoleMailboxes(org, mailOrg, result.domain, options, context);
         return { resourceId: result.domain };
     }
@@ -3960,11 +4396,20 @@ export class FoundryStepExecutor {
      * domain recorded) and on a same-domain re-apply (compared
      * case-insensitively, the same rule {@link findExactLettermintDomain}
      * applies to the lookup itself).
+     *
+     * #491 review: also a no-op when the previous domain is the platform's own
+     * apex -- an org that moves its mail *off* that domain (`usesDomain` flips,
+     * or `org.domain` changes) must never delete it here, the same protection
+     * {@link parkLettermintMail} already gives the apex on a move to `off`.
+     * `planMail` only blocks a move *onto* the apex (no project id yet); a move
+     * away from it reaches this method with nothing to block it otherwise.
      */
-    async deleteStaleLettermintDomain(context, newDomain) {
+    async deleteStaleLettermintDomain(context, newDomain, platformApex) {
         const previous = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
         if (!previous || previous.toLowerCase() === newDomain.toLowerCase())
             return;
+        if (platformApex && previous.toLowerCase() === platformApex.toLowerCase())
+            return;
         const stale = await this.findExactLettermintDomain(previous);
         if (stale)
             await this.ports.lettermint.deleteDomain(stale.id);
@@ -4036,20 +4481,28 @@ export class FoundryStepExecutor {
      * A no-op until a previous apply recorded {@link MAIL_DOMAIN_SCOPE_KEY}:
      * nothing was ever provisioned for an org whose mail went straight from
      * never-applied to off.
+     *
+     * #491: when `mailDomain` is the platform's own apex, this must never
+     * delete the platform's own project (the delete loop skips it by id) or
+     * the platform's own domain (returns before the domain lookup/delete).
      */
-    async parkLettermintMail(org, mailOrg, context) {
+    async parkLettermintMail(org, mailOrg, context, platformApex, platformLettermintProjectId) {
         const mailDomain = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
         if (!mailDomain)
             return;
+        const isPlatformApexOrg = Boolean(platformApex && mailDomain.toLowerCase() === platformApex.toLowerCase());
         // #345: `mailOrg.domain` is absent for a level-1 org -- the previously
         // recorded mail domain is the one `MailPort.removeOrgRelay` needs.
         await this.ports.mail.removeOrgRelay({ ...mailOrg, domain: mailDomain });
         const names = new Set([`${org.slug}-app`, `${org.slug}-relay`]);
         const projects = await this.ports.lettermint.listProjects();
         for (const project of projects) {
-            if (names.has(project.name))
+            if (names.has(project.name) && project.id !== platformLettermintProjectId) {
                 await this.ports.lettermint.deleteProject(project.id);
+            }
         }
+        if (isPlatformApexOrg)
+            return;
         const domain = await this.findExactLettermintDomain(mailDomain);
         if (domain)
             await this.ports.lettermint.deleteDomain(domain.id);
@@ -4214,13 +4667,14 @@ export class FoundryStepExecutor {
         return { resourceId: provisioned.organisationId };
     }
     async aiBudget(action, org) {
-        const limitMicros = action.desired.limitMicros ?? null;
-        if (limitMicros === null) {
-            // ai/packages/sdk/src/types.ts:134-137's UpdateBudget.limitMicros is a
-            // required string -- there is no "uncapped" this API can express yet
-            // (Finding, this campaign's report).
-            throw new Error(`ai:budget for ${org.slug}: AI's updateBudget has no uncapped representation (UpdateBudget.limitMicros is a required string); declare a numeric limit until AI's API adds one`);
-        }
+        // #484: ai/packages/sdk/src/types.ts:134-137's UpdateBudget.limitMicros
+        // is a required string -- there is no "uncapped" this API can express
+        // yet (Finding, this campaign's report) -- so a null `desired.limitMicros`
+        // (an org that declares no limit) gets DEFAULT_AI_LIMIT_MICROS here too,
+        // the same substitution diff.ts's planners already make when they fill
+        // this field. Belt and braces: by the time a plan reaches here,
+        // `action.desired.limitMicros` should already be non-null.
+        const limitMicros = action.desired.limitMicros ?? DEFAULT_AI_LIMIT_MICROS;
         const ai = await this.aiPort();
         await ai.updateBudget(org.id, { keyId: null, limitMicros });
         return { resourceId: org.id };
@@ -4429,6 +4883,165 @@ export class FoundryStepExecutor {
             ids.push(keyId);
         context.recordScopeId(listKey, JSON.stringify(ids));
     }
+    /**
+     * F7 (#317): mints one entry's edge key directly below the org (edge
+     * takes no separate minter key id, unlike ai/files), writes `EDGE_URL`
+     * and `EDGE_API_KEY` to the entry's app env, then restarts it. Retires
+     * the key when `uses.edge` is removed. Follows the "one mint" rule
+     * (CLAUDE.md "Platform steps"): the id is recorded as undelivered and
+     * persisted before delivery is attempted, so a crash or a failed write
+     * never leads to a second mint -- `planEntryEdgeKeys` blocks instead.
+     */
+    async edgeEntryKey(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `edge:key for ${org.slug} entry '${entryKey}'`;
+        const edge = this.ports.edge;
+        if (!edge)
+            throw new Error(`${at}: this executor was built without an EdgePort (#317)`);
+        const desired = action.desired;
+        if (desired.mode === 'retire') {
+            const recorded = context.recordedIds();
+            const mainId = recorded[`edge:key:${action.key}`];
+            // A key minted but never delivered never gets a main id (the mint
+            // step throws before `runSteps` sees a `resourceId`), so it can
+            // coexist with a separate, already-delivered id from an earlier mint
+            // of the same entry: mint A, deliver, retire (main id A, retired
+            // marker A); re-declare, mint B, fail delivery three times
+            // (undelivered B, main id still A); undeclare again. The old `||`
+            // here always picked A (truthy), leaving B live for up to 365 days
+            // with nothing recorded (#317 re-review) -- both ids are revoked,
+            // independently, whenever both are present.
+            const undeliveredId = recorded[entryEdgeUndeliveredScopeKey(entryKey)];
+            const idsToRevoke = [...new Set([mainId, undeliveredId].filter((id) => !!id))];
+            const keyId = mainId || undeliveredId;
+            // Revoke first: the key going dead in edge is what retire is for,
+            // and the one thing that must still happen even when the entry's app
+            // is itself already gone. Only once that has succeeded (or 404'd as
+            // already gone) is the env cleanup attempted, itself tolerant of a
+            // 404 on a listEnvs/deleteEnv against an app that no longer exists --
+            // doing this the other way round meant an app already torn down (its
+            // id still recorded) threw on `listEnvs` before `revokeKey` ever ran,
+            // stranding a live key on every retry (#317 review).
+            for (const id of idsToRevoke) {
+                try {
+                    await edge.revokeKey(org.id, id);
+                }
+                catch (error) {
+                    // A 404 means it is already gone -- recorded as retired below,
+                    // the same as a successful revoke. Anything else is a real
+                    // failure: thrown, not swallowed, so the key stays live and the
+                    // planner retires it again on the next apply instead of this
+                    // marking it done.
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
+            const appId = recorded[`coolify:app:${action.key}`];
+            if (appId) {
+                // A revoked key's env values are dead, not merely stale -- remove
+                // them so nothing reads a credential edge has already revoked. A
+                // 404 on either call means that app or that env is already gone:
+                // nothing to clean up there, and the key is already revoked above,
+                // so it is not a reason to fail the step. Each delete tolerates its
+                // own 404, so one env already gone does not leave the other behind.
+                const tolerateNotFound = async (call, gone) => {
+                    try {
+                        return await call();
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw error;
+                        return gone;
+                    }
+                };
+                const envs = await tolerateNotFound(() => this.ports.coolify.listEnvs(appId), []);
+                for (const envKey of ['EDGE_URL', 'EDGE_API_KEY']) {
+                    const env = envs.find((e) => e.key === envKey && !e.is_preview);
+                    if (env?.uuid) {
+                        const uuid = env.uuid;
+                        await tolerateNotFound(() => this.ports.coolify.deleteEnv(appId, uuid), undefined);
+                    }
+                }
+            }
+            context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeMintedAtScopeKey(entryKey), '');
+            if (!keyId)
+                return {};
+            context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), keyId);
+            return {};
+        }
+        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.edge);
+        if (!entry)
+            throw new Error(`${at}: the entry no longer declares uses.edge`);
+        const appId = context.recordedIds()[`coolify:app:${action.key}`];
+        if (!appId)
+            throw new Error(`${at}: the entry's app is not recorded yet`);
+        if (!org.domain) {
+            throw new Error(`${at}: edge needs org.domain, and validateEntryEdge already refuses it without one`);
+        }
+        // A key left over from a previous mint whose delivery never succeeded
+        // is revoked first, not left blocking every later apply forever:
+        // nothing here keeps its secret around to retry delivering it
+        // (CLAUDE.md "No secret leaves"), so the only way to actually recover
+        // is to revoke the stale id and mint a fresh one -- a 404 counts as
+        // already revoked, same as any other retire (#317 re-review).
+        const staleUndelivered = context.recordedIds()[entryEdgeUndeliveredScopeKey(entryKey)];
+        if (staleUndelivered) {
+            try {
+                await edge.revokeKey(org.id, staleUndelivered);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+            context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
+            await context.persistScopeIds();
+        }
+        const minted = await edge.mintKey({
+            organisationId: org.id,
+            domain: org.domain,
+            name: desired.name,
+            expiresDays: EDGE_ENTRY_KEY_DAYS,
+        });
+        context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), minted.id);
+        await context.persistScopeIds();
+        const envs = [
+            { key: 'EDGE_URL', value: desired.edgeUrl, literal: true },
+            { key: 'EDGE_API_KEY', value: minted.secret, literal: true },
+        ];
+        let lastError;
+        for (let attempt = 1; attempt <= ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS; attempt++) {
+            try {
+                await this.ports.coolify.bulkUpsertEnvs(appId, envs);
+                await this.ports.coolify.restart(appId);
+                context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
+                // The only trace of this key's age, since nothing here renews it
+                // (#317 review's warning-row ask reads this to flag an expiring key).
+                context.recordScopeId(entryEdgeMintedAtScopeKey(entryKey), new Date(context.now?.() ?? Date.now()).toISOString());
+                return { resourceId: minted.id };
+            }
+            catch (e) {
+                lastError = e;
+            }
+        }
+        // Names the key id only; the underlying error is dropped in case it echoes the secret.
+        throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'}); the next apply revokes it and mints a fresh one automatically`);
+    }
+    /**
+     * F7 (#317): `plan/entry-edge-key.ts`'s `planEdgeReservedLabels` --
+     * tells the edge service every label this org's own entries already
+     * hold, so edge refuses a customer claiming one of them.
+     */
+    async edgeReservedLabels(action, org, context) {
+        const edge = this.ports.edge;
+        if (!edge) {
+            throw new Error(`edge:reserved-labels for ${org.slug}: this executor was built without an EdgePort (#317)`);
+        }
+        const labels = action.desired.labels;
+        await edge.setReservedLabels(org.id, labels);
+        context.recordScopeId(EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, JSON.stringify(labels));
+        return {};
+    }
     /**
      * F6b: mints or renews the org's own files key, or revokes the ones a
      * renewal replaced. The key is minted below the files organisation's owner
@@ -4829,6 +5442,45 @@ export class FoundryStepExecutor {
                     await files.revokeOrganisationKey(org.id, target.id);
                     return;
                 }
+                case 'cloudflare:worker': {
+                    // #318: an entry's Worker (`<orgId>:<entry>`) and its route.
+                    // No port means no way to delete either -- thrown, not silently
+                    // skipped, so it is reported blocked rather than left live with
+                    // nothing recorded ids point at any more.
+                    const workers = this.ports.workers;
+                    if (!workers) {
+                        throw new Error(`cloudflare:worker '${target.key}' for ${org.slug}: this executor was built without a WorkersPort (#318); cannot delete it`);
+                    }
+                    // The route on its recorded zone (skipped only once that zone is
+                    // positively gone), any route an interrupted apply created but
+                    // never recorded, then the script -- the same teardown retire runs.
+                    // `target.id` is `''` for a route-only partial deploy.
+                    const entryKey = target.key.slice(org.id.length + 1);
+                    await this.teardownWorker(entryKey, target.id || undefined, recordedIds, workers, `cloudflare:worker '${target.key}' for ${org.slug}`);
+                    return;
+                }
+                case 'edge:key': {
+                    // F7 (#317): an entry's key (`<orgId>:<entry>`); edge has no org-root key.
+                    // No port means no way to revoke it -- thrown, not silently
+                    // skipped, so the key is reported blocked rather than left live
+                    // with nothing saying so.
+                    const edge = this.ports.edge;
+                    if (!edge) {
+                        throw new Error(`edge:key '${target.key}' for ${org.slug}: this executor was built without an EdgePort (#317); cannot revoke it`);
+                    }
+                    try {
+                        await edge.revokeKey(org.id, target.id);
+                    }
+                    catch (error) {
+                        // Already gone -- the same already-retired key a retire step
+                        // handled before org destroy ever ran can still reach here
+                        // (#317 review); a 404 is success, not a reason to block
+                        // teardown forever.
+                        if (!isNotFoundError(error))
+                            throw error;
+                    }
+                    return;
+                }
                 case 'coolify:app':
                     await this.ports.coolify.deleteApplication(target.id);
                     return;