@wtfalch/foundry 0.17.1 → 0.19.0

package/dist/plan/executor.js

@@ -2,24 +2,24 @@ import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
 import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, chatInternalNames, chatMasConfigYaml, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
-import { entryEdgeAppliedScopeKey, entryEdgeRetiredScopeKey, entryEdgeRouteIdScopeKey, entryEdgeRoutePatternScopeKey, entryEdgeRoutePendingScopeKey, entryEdgeRouteZoneScopeKey, entryEdgeUploadedScopeKey, } from './edge-worker.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
+import { EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
-import { ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS, NAMES_ENTRY_KEY_DAYS, NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY, entryNamesMintedAtScopeKey, entryNamesRetiredScopeKey, entryNamesUndeliveredScopeKey, } from './entry-names-key.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
+import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * #274 fix round 4: bridges `@wtfalch/providers`' real `ZitadelClient.
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
@@ -240,10 +240,14 @@ const CMS_SITE_APP_DOCKERFILE = '/apps/site/Dockerfile';
  * followed rather than reopened (#164 "Decide" 1). The agora repo's own
  * Dockerfile (`apps/agora/Dockerfile`) already `EXPOSE`s 8080 and serves
  * from a build built at the repository root, the same one-repo shape
- * `CMS_REPO`'s own two apps use -- no `ports_exposes`/`PORT` env is needed
- * the way `CALLS_SERVICE_PORT` is for the calls service's own Node process,
- * since Coolify's github-app build already reads the exposed port the same
- * way it does for `cmsSite`'s two apps above.
+ * `CMS_REPO`'s own two apps use. This comment used to claim that needed no
+ * `ports_exposes` of its own, on the theory that Coolify's github-app build
+ * reads a Dockerfile's `EXPOSE` the same way it does for `cmsSite`'s two
+ * apps above -- wrong (#506): Coolify never reads `EXPOSE` for a build it
+ * runs itself, so without an explicit `agora.ts`'s `AGORA_APP_PORTS_EXPOSES`,
+ * Traefik is left routing to a port nothing listens on, and a company's
+ * Agora answers 502 behind the tunnel. Seen live on Company Included,
+ * 2026-10-05.
  */
 const AGORA_REPO = 'wtfalch/agora';
 const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
@@ -508,11 +512,21 @@ const CALLS_MAS_DB_SCOPE_KEY = 'coolify_calls_mas_database';
  * Synapse refuses to start against a database whose `LC_COLLATE`/`LC_CTYPE`
  * is not `C` (https://element-hq.github.io/synapse/latest/postgres.html);
  * Coolify's official postgres image otherwise creates one with `en_US.utf8`.
- * `postgres_initdb_args` is the only point this can be set -- it cannot be
- * migrated onto an existing database. MAS has no such requirement, so this
- * is passed for the Synapse database only. Not using Synapse's own
- * `allow_unsafe_locale` escape hatch: that trades a loud startup refusal for
- * silent index corruption after a future glibc upgrade.
+ * `createPostgresDatabase` forwards this to Coolify's own
+ * `postgres_initdb_args` field -- but Coolify stores that field and reads it
+ * back unchanged without ever handing it to `initdb`: its Postgres start
+ * action builds the container's env from `postgres_user`/`postgres_password`/
+ * `postgres_db` and runtime envs only
+ * (https://github.com/coollabsio/coolify/blob/main/app/Actions/Database/StartPostgresql.php).
+ * A database created this way still comes up `en_US.utf8` and crash-loops
+ * every Synapse app that reads it; live evidence and the real fix (not yet
+ * chosen) are tracked in #494. This constant and the field it feeds stay in
+ * place, inert, until that lands -- collation cannot be migrated onto an
+ * existing database under any of the candidate fixes either. MAS has no
+ * such requirement, so this is passed for the Synapse database only. Not
+ * using Synapse's own `allow_unsafe_locale` escape hatch regardless of
+ * which fix lands: that trades a loud startup refusal for silent index
+ * corruption after a future glibc upgrade.
  */
 const CALLS_SYNAPSE_DB_INITDB_ARGS = '--locale=C --encoding=UTF8';
 /**
@@ -655,7 +669,7 @@ export class FoundryStepExecutor {
             case 'cloudflare:tunnel':
                 return this.cloudflareTunnel(action, org, context);
             case 'cloudflare:zone':
-                return this.cloudflareZone(action, org);
+                return this.cloudflareZone(action, org, context);
             case 'cloudflare:access':
                 return this.cloudflareAccess(action, org);
             case 'cloudflare:ratelimit':
@@ -678,10 +692,10 @@ export class FoundryStepExecutor {
                 return action.key.includes(':')
                     ? this.aiEntryKey(action, org, context)
                     : this.aiKey(action, org, context);
-            case 'names:key':
-                return this.namesEntryKey(action, org, context);
-            case 'names:reserved-labels':
-                return this.namesReservedLabels(action, org, context);
+            case 'edge:key':
+                return this.edgeEntryKey(action, org, context);
+            case 'edge:reserved-labels':
+                return this.edgeReservedLabels(action, org, context);
             case 'coolify:mail':
                 return this.coolifyMail(action, org, context);
             case 'coolify:mail-copy':
@@ -850,10 +864,10 @@ export class FoundryStepExecutor {
         return { resourceId: created.id };
     }
     /**
-     * `plan/diff.ts`'s `planEdgeWorkers` (#318, F8): deploys one entry's
-     * `edge` Worker and routes it on the org's own zone. Throws by name
+     * `plan/diff.ts`'s `planWorkers` (#318, F8): deploys one entry's
+     * `worker` Worker and routes it on the org's own zone. Throws by name
      * without a {@link WorkersPort}, the same `jobsRegistration` shape --
-     * `planEdgeWorkers` reports the step blocked instead while the host has
+     * `planWorkers` reports the step blocked instead while the host has
      * none, so this only fires against a stale plan. The route is checked
      * before upload: a foreign route already on the pattern is refused, never
      * adopted or replaced (`cloudflareAccess`'s own precedent for a foreign
@@ -879,24 +893,25 @@ export class FoundryStepExecutor {
         if (desired.mode === 'retire') {
             const recorded = context.recordedIds();
             const mainId = recorded[`cloudflare:worker:${action.key}`];
-            const scriptName = mainId || recorded[entryEdgeUploadedScopeKey(entryKey)];
-            await this.teardownEdgeWorker(entryKey, scriptName, recorded, workers, at);
-            context.recordScopeId(entryEdgeRouteIdScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeRouteZoneScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeRoutePatternScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeAppliedScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), '');
+            const scriptName = mainId || recorded[entryWorkerUploadedScopeKey(entryKey)];
+            await this.teardownWorker(entryKey, scriptName, recorded, workers, at);
+            context.recordScopeId(entryWorkerRouteIdScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRouteZoneScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRoutePatternScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerExclusionsScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerAppliedScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), '');
             // `runSteps` only ever writes the main recorded id from a truthy
             // `resourceId` (`plan-apply.ts`); this step returns none, so without
             // this marker the planner's "gone" scan would retire the same,
             // never-cleared id forever.
             if (mainId)
-                context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), mainId);
+                context.recordScopeId(entryWorkerRetiredScopeKey(entryKey), mainId);
             return {};
         }
         if (!org.domain) {
-            throw new Error(`${at}: edge needs org.domain, and validateHosting already refuses it without one`);
+            throw new Error(`${at}: worker needs org.domain, and validateHosting already refuses it without one`);
         }
         const zone = await this.ports.cloudflare.findZoneByApex(org.domain);
         if (!zone) {
@@ -919,8 +934,8 @@ export class FoundryStepExecutor {
         // the same deterministic name) is foundry's own script to overwrite,
         // never a stranger's.
         const recordedBeforeUpload = context.recordedIds();
-        const everUploadedByFoundry = Boolean(recordedBeforeUpload[entryEdgeAppliedScopeKey(entryKey)] ||
-            recordedBeforeUpload[entryEdgeUploadedScopeKey(entryKey)] ||
+        const everUploadedByFoundry = Boolean(recordedBeforeUpload[entryWorkerAppliedScopeKey(entryKey)] ||
+            recordedBeforeUpload[entryWorkerUploadedScopeKey(entryKey)] ||
             recordedBeforeUpload[`cloudflare:worker:${action.key}`]);
         if (!everUploadedByFoundry && (await workers.scriptExists(name))) {
             throw new Error(`${at}: a Worker script named '${name}' already exists and foundry never created it; refuses to overwrite it`);
@@ -931,8 +946,8 @@ export class FoundryStepExecutor {
         // the `scriptExists` guard above. The retired marker clears here too,
         // not only on success: once a redeploy has touched the script, a later
         // undeclare must retire it even if this apply never finishes.
-        context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), name);
-        context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), '');
+        context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), name);
+        context.recordScopeId(entryWorkerRetiredScopeKey(entryKey), '');
         await context.persistScopeIds();
         await workers.uploadScript({
             name,
@@ -941,9 +956,12 @@ export class FoundryStepExecutor {
             compatibilityDate: action.desired.compatibilityDate,
             bindings: bindings.length > 0 ? bindings : undefined,
         });
+        // Before the wildcard route exists, so a hostname foundry serves is never
+        // caught by the Worker, not even briefly.
+        await this.syncWorkerExclusions(entryKey, zone.id, org.domain, desired.exclusions ?? [], workers, context, at);
         const recorded = context.recordedIds();
-        const previousRouteId = recorded[entryEdgeRouteIdScopeKey(entryKey)];
-        const previousPending = recorded[entryEdgeRoutePendingScopeKey(entryKey)];
+        const previousRouteId = recorded[entryWorkerRouteIdScopeKey(entryKey)];
+        const previousPending = recorded[entryWorkerRoutePendingScopeKey(entryKey)];
         const zoneRecord = { id: zone.id, apex: org.domain };
         let routeId = existingRoute?.id;
         if (!routeId) {
@@ -951,7 +969,7 @@ export class FoundryStepExecutor {
             // never got to record is still found (`findRoute`) and deleted on
             // retire or destroy (#318 re-review).
             const pending = { ...zoneRecord, pattern: route, script: name };
-            context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), JSON.stringify(pending));
+            context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), JSON.stringify(pending));
             await context.persistScopeIds();
             const created = await workers.createRoute(zone.id, route, name);
             routeId = created.id;
@@ -961,30 +979,75 @@ export class FoundryStepExecutor {
         // own zone rather than left live beside the new one. A pending route
         // from an earlier, interrupted apply under a different pattern likewise.
         if (previousRouteId && previousRouteId !== routeId) {
-            const previousZone = await this.liveEdgeZone(recorded[entryEdgeRouteZoneScopeKey(entryKey)], at);
+            const previousZone = await this.liveWorkerZone(recorded[entryWorkerRouteZoneScopeKey(entryKey)], at);
             if (previousZone)
                 await workers.deleteRoute(previousZone, previousRouteId); // Idempotent.
         }
         if (previousPending) {
-            await this.deletePendingEdgeRoute(previousPending, routeId, workers, at);
+            await this.deletePendingWorkerRoute(previousPending, routeId, workers, at);
         }
-        context.recordScopeId(entryEdgeRouteIdScopeKey(entryKey), routeId);
-        context.recordScopeId(entryEdgeRouteZoneScopeKey(entryKey), JSON.stringify(zoneRecord));
-        context.recordScopeId(entryEdgeRoutePatternScopeKey(entryKey), route);
-        context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), '');
-        context.recordScopeId(entryEdgeAppliedScopeKey(entryKey), JSON.stringify({
+        context.recordScopeId(entryWorkerRouteIdScopeKey(entryKey), routeId);
+        context.recordScopeId(entryWorkerRouteZoneScopeKey(entryKey), JSON.stringify(zoneRecord));
+        context.recordScopeId(entryWorkerRoutePatternScopeKey(entryKey), route);
+        context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), '');
+        context.recordScopeId(entryWorkerAppliedScopeKey(entryKey), JSON.stringify({
             name,
             artifactUrl: desired.artifactUrl,
             artifactSha256: desired.artifactSha256,
             route,
             bindings: desired.bindings,
+            exclusions: desired.exclusions,
         }));
-        context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), '');
+        context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), '');
         // The retired marker was already cleared before the upload above: a
         // redeclare reuses this entry's deterministic script name, so a marker
         // left equal to the (identical) main id would read as already retired.
         return { resourceId: name };
     }
+    /**
+     * Makes the no-Worker routes recorded for an entry match `patterns`: deletes
+     * the ones no longer wanted (all of them if the zone changed), creates the
+     * missing ones without a script. A route already on a pattern that is bound
+     * to a Worker is foreign and refused; one with no script is adopted. Records
+     * and persists after each change.
+     */
+    async syncWorkerExclusions(entryKey, zoneId, apex, patterns, workers, context, at) {
+        const key = entryWorkerExclusionsScopeKey(entryKey);
+        const raw = context.recordedIds()[key];
+        let state = raw
+            ? JSON.parse(raw)
+            : { id: zoneId, apex, routes: {} };
+        const save = async () => {
+            context.recordScopeId(key, Object.keys(state.routes).length > 0 ? JSON.stringify(state) : '');
+            await context.persistScopeIds();
+        };
+        if (state.id !== zoneId) {
+            const oldZone = await this.liveWorkerZone(JSON.stringify({ id: state.id, apex: state.apex }), at);
+            if (oldZone) {
+                for (const id of Object.values(state.routes))
+                    await workers.deleteRoute(oldZone, id);
+            }
+            state = { id: zoneId, apex, routes: {} };
+            await save();
+        }
+        for (const [pattern, id] of Object.entries(state.routes)) {
+            if (patterns.includes(pattern))
+                continue;
+            await workers.deleteRoute(zoneId, id); // Idempotent.
+            delete state.routes[pattern];
+            await save();
+        }
+        for (const pattern of patterns) {
+            if (state.routes[pattern])
+                continue;
+            const found = await workers.findRoute(zoneId, pattern);
+            if (found?.script) {
+                throw new Error(`${at}: route '${pattern}' is already bound to Worker '${found.script}'; foundry does not replace it`);
+            }
+            state.routes[pattern] = found ? found.id : (await workers.createRoute(zoneId, pattern)).id;
+            await save();
+        }
+    }
     /**
      * The zone id a recorded route lives in, or `undefined` only when that
      * zone is *positively* gone -- its apex resolves to no zone, or to a
@@ -998,7 +1061,7 @@ export class FoundryStepExecutor {
      * live on the old one, the exact bug a recorded-per-route zone exists to
      * avoid (#318 re-review).
      */
-    async liveEdgeZone(recordedZone, at) {
+    async liveWorkerZone(recordedZone, at) {
         if (!recordedZone) {
             throw new Error(`${at}: a route is recorded but its zone is not, so foundry cannot tell which zone holds it; refuses to forget it`);
         }
@@ -1007,9 +1070,9 @@ export class FoundryStepExecutor {
         return zone && zone.id === id ? id : undefined;
     }
     /** Deletes the route an interrupted apply was creating, if `findRoute` shows it exists, points at that apply's script, and is not `keepRouteId`. */
-    async deletePendingEdgeRoute(pendingRaw, keepRouteId, workers, at) {
+    async deletePendingWorkerRoute(pendingRaw, keepRouteId, workers, at) {
         const pending = JSON.parse(pendingRaw);
-        const zoneId = await this.liveEdgeZone(JSON.stringify({ id: pending.id, apex: pending.apex }), at);
+        const zoneId = await this.liveWorkerZone(JSON.stringify({ id: pending.id, apex: pending.apex }), at);
         if (!zoneId)
             return;
         const found = await workers.findRoute(zoneId, pending.pattern);
@@ -1022,16 +1085,25 @@ export class FoundryStepExecutor {
      * zone, then any route an interrupted apply created but never recorded,
      * then the script. Records nothing -- the caller does.
      */
-    async teardownEdgeWorker(entryKey, scriptName, recorded, workers, at) {
-        const routeId = recorded[entryEdgeRouteIdScopeKey(entryKey)];
+    async teardownWorker(entryKey, scriptName, recorded, workers, at) {
+        const routeId = recorded[entryWorkerRouteIdScopeKey(entryKey)];
         if (routeId) {
-            const zoneId = await this.liveEdgeZone(recorded[entryEdgeRouteZoneScopeKey(entryKey)], at);
+            const zoneId = await this.liveWorkerZone(recorded[entryWorkerRouteZoneScopeKey(entryKey)], at);
             if (zoneId)
                 await workers.deleteRoute(zoneId, routeId); // Idempotent: a no-op if already gone.
         }
-        const pending = recorded[entryEdgeRoutePendingScopeKey(entryKey)];
+        const pending = recorded[entryWorkerRoutePendingScopeKey(entryKey)];
         if (pending)
-            await this.deletePendingEdgeRoute(pending, undefined, workers, at);
+            await this.deletePendingWorkerRoute(pending, undefined, workers, at);
+        const exclusions = recorded[entryWorkerExclusionsScopeKey(entryKey)];
+        if (exclusions) {
+            const state = JSON.parse(exclusions);
+            const zoneId = await this.liveWorkerZone(JSON.stringify({ id: state.id, apex: state.apex }), at);
+            if (zoneId) {
+                for (const id of Object.values(state.routes))
+                    await workers.deleteRoute(zoneId, id);
+            }
+        }
         if (scriptName)
             await workers.deleteScript(scriptName); // Idempotent: a no-op if already gone.
     }
@@ -1164,11 +1236,16 @@ export class FoundryStepExecutor {
             throw new Error(`zitadel:login-host for ${org.slug}: the loginHostBindings port is not wired`);
         }
         const host = action.desired.host;
-        await this.ports.zitadel.ensureTrustedDomain(host);
-        // zitadel-login's own routing table, written before any app is repointed
-        // so no app ever points at a host with no binding.
+        // The platform's own shared sign-in host: already trusted and routed by
+        // the shared instance, so it gets no trusted domain or binding here.
+        const shared = action.desired.shared === true;
         const clientIds = loginHostClientIds(recorded);
-        await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+        if (!shared) {
+            await this.ports.zitadel.ensureTrustedDomain(host);
+            // zitadel-login's own routing table, written before any app is repointed
+            // so no app ever points at a host with no binding.
+            await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+        }
         // Only apps whose client id the binding now holds: any other app in the
         // project would lose sign-in. The rest move on a later run, once the
         // recorded client ids differ from the binding and replan this step.
@@ -1269,7 +1346,10 @@ export class FoundryStepExecutor {
         // the binding and replans the step next run; a nonempty pending list
         // does too (`planLoginHost`), independent of the host comparison that
         // normally alone decides it.
-        context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+        if (shared)
+            context.recordScopeId(LOGIN_HOST_SHARED_SCOPE_KEY, '1');
+        else
+            context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }
@@ -3535,11 +3615,25 @@ export class FoundryStepExecutor {
      * actually differs, or whenever the last restart this step confirmed
      * ({@link AGORA_ACTIVATED_ENV_SCOPE_KEY}) is not this exact env (an org
      * applied before this existed, whose live env already matched desired
-     * with nothing ever confirmed running it). A brand new app has nothing
-     * running yet to restart. The activation marker is recorded last, after
-     * the restart (if any) returns without throwing, so a failed restart
-     * leaves it stale and the next plan replans this step even though
-     * Coolify's own env store already matches desired.
+     * with nothing ever confirmed running it). The activation marker is
+     * recorded last, after the restart (if any) returns without throwing, so a
+     * failed restart leaves it stale and the next plan replans this step even
+     * though Coolify's own env store already matches desired.
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link AGORA_DEPLOYED_SCOPE_KEY}). `createGithubAppApplication` never
+     * sets `instant_deploy`, and Coolify defaults it to false, so without an
+     * explicit deploy the app sat created but never built or started.
+     *
+     * #506: `ports_exposes: AGORA_APP_PORTS_EXPOSES` goes on the create call
+     * itself, so Traefik has a port to route to from the moment the app
+     * exists. An app `findOrCreateCallsApp` instead *found* may predate this
+     * fix and carry no `ports_exposes` at all (or the wrong one), so its live
+     * value is read and, when it differs, patched -- and, since the container
+     * listens on `ports_exposes` only at its next deploy (the same rule
+     * `coolifyApp`'s own `settingsNeedDeploy` follows for a port change
+     * there), redeployed even on a run that already has its one #504 deploy
+     * behind it.
      */
     async coolifyAgora(action, org, context) {
         // The host values the plan read, carried in the step: never read again
@@ -3569,9 +3663,22 @@ export class FoundryStepExecutor {
             name,
             domains: coolifyDomains([agoraHostnameFor(org)]),
             dockerfile_location: AGORA_APP_DOCKERFILE,
+            ports_exposes: AGORA_APP_PORTS_EXPOSES,
         }));
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
+        // #506: an app found rather than just created may predate passing
+        // `ports_exposes` at create -- Traefik then routes to a port nothing
+        // listens on and Agora answers 502 behind the tunnel. A freshly created
+        // app already got the right port above, so only a found one is checked.
+        const portDiffers = app.existed &&
+            (await this.ports.coolify.getApplication(app.appId)).ports_exposes !==
+                AGORA_APP_PORTS_EXPOSES;
+        if (portDiffers) {
+            await this.ports.coolify.updateApplication(app.appId, {
+                ports_exposes: AGORA_APP_PORTS_EXPOSES,
+            });
+        }
         // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
         // Coolify's own env store matching `env`, which is why that store alone
         // can no longer tell a changed value from one already live.
@@ -3582,7 +3689,25 @@ export class FoundryStepExecutor {
         await this.ports.coolify.bulkUpsertEnvs(app.appId, Object.entries(env).map(([key, value]) => ({ key, value })));
         const revision = agoraEnvRevision(env);
         const alreadyActivated = context.recordedIds()[AGORA_ACTIVATED_ENV_SCOPE_KEY] === revision;
-        if (app.existed && (envChanged || !alreadyActivated)) {
+        // #504: `createGithubAppApplication` never sets `instant_deploy`, and
+        // Coolify defaults it to false -- a brand new app, and one found by name
+        // that a previous apply created but crashed before deploying, both sat
+        // built but never started. `restart` cannot fix either: it starts a
+        // container that was never built. Deployed once this executor has
+        // confirmed (the marker never changes value once set), never again -- a
+        // live app is only ever restarted from here on, unless #506's port fix
+        // below needs its own deploy.
+        if (!context.recordedIds()[AGORA_DEPLOYED_SCOPE_KEY]) {
+            await this.ports.coolify.deploy(app.appId);
+            context.recordScopeId(AGORA_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (portDiffers) {
+            // #506: a port fix needs its own full deploy -- env drift alone only
+            // needs the cheaper restart, and this deploy already carries this
+            // run's env (pushed above), so the two never both run.
+            await this.ports.coolify.deploy(app.appId);
+        }
+        else if (app.existed && (envChanged || !alreadyActivated)) {
             await this.ports.coolify.restart(app.appId);
         }
         context.recordScopeId(AGORA_ACTIVATED_ENV_SCOPE_KEY, revision);
@@ -3611,6 +3736,10 @@ export class FoundryStepExecutor {
      *
      * `AUTH_APP_KEY` is minted once here; its broker entry is the next step
      * (`bouleBrokerEntry`).
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link BOULE_DEPLOYED_SCOPE_KEY}), the same reason and the same marker
+     * shape {@link coolifyAgora}'s own doc comment explains.
      */
     async coolifyBoule(action, org, context) {
         // The issuer and Archon URL the plan read, carried in the step: the env
@@ -3662,7 +3791,17 @@ export class FoundryStepExecutor {
         if (!dbPush.pushed) {
             throw new Error(`Boule for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
-        if (app.existed && (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed)) {
+        // #504: see `coolifyAgora`'s own comment just above -- `createGithubAppApplication`
+        // never sets `instant_deploy`, so a brand new app (or one found by name
+        // that a previous apply created but crashed before deploying) sat built
+        // but never started. Deployed once this executor has confirmed, never
+        // again -- a live app is only ever restarted from here on.
+        if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
+            await this.ports.coolify.deploy(app.appId);
+            context.recordScopeId(BOULE_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (app.existed &&
+            (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed)) {
             await this.ports.coolify.restart(app.appId);
         }
         return { resourceId: app.appId };
@@ -4151,8 +4290,17 @@ export class FoundryStepExecutor {
      * shared-hostname collision this ticket exists to refuse. An org re-running
      * its own already-recorded zone is unaffected: the store then names this
      * same org as the owner.
+     *
+     * #510: also records the zone's own id under the flat `cloudflare_zone`
+     * scope key, alongside the `cloudflare:zone:<domain>` resource id `runSteps`
+     * already records from this method's return value. Without it, nothing
+     * ever gives `ProvidersCloudflareReader` a zone id to resolve this org's
+     * scope with (`providers-readers.ts`'s `storeScopeResolver` doc comment),
+     * so that reader's `listResources` always returned `[]` and `diff.ts`'s
+     * `planZone` re-proposed "provision a Cloudflare zone" on every apply, even
+     * once the zone was live.
      */
-    async cloudflareZone(action, org) {
+    async cloudflareZone(action, org, context) {
         const domain = action.key;
         const cf = this.ports.cloudflare;
         const existing = await cf.findZoneByApex(domain);
@@ -4161,9 +4309,11 @@ export class FoundryStepExecutor {
             if (owner !== null && owner !== org.id) {
                 throw new Error(`cloudflare:zone for ${org.slug}: zone ${existing.id} (${domain}) is already recorded under org ${owner}; foundry does not adopt it`);
             }
+            context.recordScopeId('cloudflare_zone', existing.id);
             return { resourceId: existing.id };
         }
         const created = await cf.createZone(domain);
+        context.recordScopeId('cloudflare_zone', created.id);
         return { resourceId: created.id };
     }
     // ---- mail -----------------------------------------------------------
@@ -4816,24 +4966,24 @@ export class FoundryStepExecutor {
         context.recordScopeId(listKey, JSON.stringify(ids));
     }
     /**
-     * F7 (#317): mints one entry's names key directly below the org (names
-     * takes no separate minter key id, unlike ai/files), writes `NAMES_URL`
-     * and `NAMES_API_KEY` to the entry's app env, then restarts it. Retires
-     * the key when `uses.names` is removed. Follows the "one mint" rule
+     * F7 (#317): mints one entry's edge key directly below the org (edge
+     * takes no separate minter key id, unlike ai/files), writes `EDGE_URL`
+     * and `EDGE_API_KEY` to the entry's app env, then restarts it. Retires
+     * the key when `uses.edge` is removed. Follows the "one mint" rule
      * (CLAUDE.md "Platform steps"): the id is recorded as undelivered and
      * persisted before delivery is attempted, so a crash or a failed write
-     * never leads to a second mint -- `planEntryNamesKeys` blocks instead.
+     * never leads to a second mint -- `planEntryEdgeKeys` blocks instead.
      */
-    async namesEntryKey(action, org, context) {
+    async edgeEntryKey(action, org, context) {
         const entryKey = action.key.slice(org.id.length + 1);
-        const at = `names:key for ${org.slug} entry '${entryKey}'`;
-        const names = this.ports.names;
-        if (!names)
-            throw new Error(`${at}: this executor was built without a NamesPort (#317)`);
+        const at = `edge:key for ${org.slug} entry '${entryKey}'`;
+        const edge = this.ports.edge;
+        if (!edge)
+            throw new Error(`${at}: this executor was built without an EdgePort (#317)`);
         const desired = action.desired;
         if (desired.mode === 'retire') {
             const recorded = context.recordedIds();
-            const mainId = recorded[`names:key:${action.key}`];
+            const mainId = recorded[`edge:key:${action.key}`];
             // A key minted but never delivered never gets a main id (the mint
             // step throws before `runSteps` sees a `resourceId`), so it can
             // coexist with a separate, already-delivered id from an earlier mint
@@ -4843,10 +4993,10 @@ export class FoundryStepExecutor {
             // here always picked A (truthy), leaving B live for up to 365 days
             // with nothing recorded (#317 re-review) -- both ids are revoked,
             // independently, whenever both are present.
-            const undeliveredId = recorded[entryNamesUndeliveredScopeKey(entryKey)];
+            const undeliveredId = recorded[entryEdgeUndeliveredScopeKey(entryKey)];
             const idsToRevoke = [...new Set([mainId, undeliveredId].filter((id) => !!id))];
             const keyId = mainId || undeliveredId;
-            // Revoke first: the key going dead in names is what retire is for,
+            // Revoke first: the key going dead in edge is what retire is for,
             // and the one thing that must still happen even when the entry's app
             // is itself already gone. Only once that has succeeded (or 404'd as
             // already gone) is the env cleanup attempted, itself tolerant of a
@@ -4856,7 +5006,7 @@ export class FoundryStepExecutor {
             // stranding a live key on every retry (#317 review).
             for (const id of idsToRevoke) {
                 try {
-                    await names.revokeKey(org.id, id);
+                    await edge.revokeKey(org.id, id);
                 }
                 catch (error) {
                     // A 404 means it is already gone -- recorded as retired below,
@@ -4871,7 +5021,7 @@ export class FoundryStepExecutor {
             const appId = recorded[`coolify:app:${action.key}`];
             if (appId) {
                 // A revoked key's env values are dead, not merely stale -- remove
-                // them so nothing reads a credential names has already revoked. A
+                // them so nothing reads a credential edge has already revoked. A
                 // 404 on either call means that app or that env is already gone:
                 // nothing to clean up there, and the key is already revoked above,
                 // so it is not a reason to fail the step. Each delete tolerates its
@@ -4887,7 +5037,7 @@ export class FoundryStepExecutor {
                     }
                 };
                 const envs = await tolerateNotFound(() => this.ports.coolify.listEnvs(appId), []);
-                for (const envKey of ['NAMES_URL', 'NAMES_API_KEY']) {
+                for (const envKey of ['EDGE_URL', 'EDGE_API_KEY']) {
                     const env = envs.find((e) => e.key === envKey && !e.is_preview);
                     if (env?.uuid) {
                         const uuid = env.uuid;
@@ -4895,21 +5045,21 @@ export class FoundryStepExecutor {
                     }
                 }
             }
-            context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
-            context.recordScopeId(entryNamesMintedAtScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeMintedAtScopeKey(entryKey), '');
             if (!keyId)
                 return {};
-            context.recordScopeId(entryNamesRetiredScopeKey(entryKey), keyId);
+            context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), keyId);
             return {};
         }
-        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.names);
+        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.edge);
         if (!entry)
-            throw new Error(`${at}: the entry no longer declares uses.names`);
+            throw new Error(`${at}: the entry no longer declares uses.edge`);
         const appId = context.recordedIds()[`coolify:app:${action.key}`];
         if (!appId)
             throw new Error(`${at}: the entry's app is not recorded yet`);
         if (!org.domain) {
-            throw new Error(`${at}: names needs org.domain, and validateEntryNames already refuses it without one`);
+            throw new Error(`${at}: edge needs org.domain, and validateEntryEdge already refuses it without one`);
         }
         // A key left over from a previous mint whose delivery never succeeded
         // is revoked first, not left blocking every later apply forever:
@@ -4917,39 +5067,39 @@ export class FoundryStepExecutor {
         // (CLAUDE.md "No secret leaves"), so the only way to actually recover
         // is to revoke the stale id and mint a fresh one -- a 404 counts as
         // already revoked, same as any other retire (#317 re-review).
-        const staleUndelivered = context.recordedIds()[entryNamesUndeliveredScopeKey(entryKey)];
+        const staleUndelivered = context.recordedIds()[entryEdgeUndeliveredScopeKey(entryKey)];
         if (staleUndelivered) {
             try {
-                await names.revokeKey(org.id, staleUndelivered);
+                await edge.revokeKey(org.id, staleUndelivered);
             }
             catch (error) {
                 if (!isNotFoundError(error))
                     throw error;
             }
-            context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
             await context.persistScopeIds();
         }
-        const minted = await names.mintKey({
+        const minted = await edge.mintKey({
             organisationId: org.id,
             domain: org.domain,
             name: desired.name,
-            expiresDays: NAMES_ENTRY_KEY_DAYS,
+            expiresDays: EDGE_ENTRY_KEY_DAYS,
         });
-        context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), minted.id);
+        context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), minted.id);
         await context.persistScopeIds();
         const envs = [
-            { key: 'NAMES_URL', value: desired.namesUrl, literal: true },
-            { key: 'NAMES_API_KEY', value: minted.secret, literal: true },
+            { key: 'EDGE_URL', value: desired.edgeUrl, literal: true },
+            { key: 'EDGE_API_KEY', value: minted.secret, literal: true },
         ];
         let lastError;
-        for (let attempt = 1; attempt <= ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS; attempt++) {
+        for (let attempt = 1; attempt <= ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS; attempt++) {
             try {
                 await this.ports.coolify.bulkUpsertEnvs(appId, envs);
                 await this.ports.coolify.restart(appId);
-                context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
+                context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
                 // The only trace of this key's age, since nothing here renews it
                 // (#317 review's warning-row ask reads this to flag an expiring key).
-                context.recordScopeId(entryNamesMintedAtScopeKey(entryKey), new Date(context.now?.() ?? Date.now()).toISOString());
+                context.recordScopeId(entryEdgeMintedAtScopeKey(entryKey), new Date(context.now?.() ?? Date.now()).toISOString());
                 return { resourceId: minted.id };
             }
             catch (e) {
@@ -4957,21 +5107,21 @@ export class FoundryStepExecutor {
             }
         }
         // Names the key id only; the underlying error is dropped in case it echoes the secret.
-        throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'}); the next apply revokes it and mints a fresh one automatically`);
+        throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'}); the next apply revokes it and mints a fresh one automatically`);
     }
     /**
-     * F7 (#317): `plan/entry-names-key.ts`'s `planNamesReservedLabels` --
-     * tells the names service every label this org's own entries already
-     * hold, so names refuses a customer claiming one of them.
+     * F7 (#317): `plan/entry-edge-key.ts`'s `planEdgeReservedLabels` --
+     * tells the edge service every label this org's own entries already
+     * hold, so edge refuses a customer claiming one of them.
      */
-    async namesReservedLabels(action, org, context) {
-        const names = this.ports.names;
-        if (!names) {
-            throw new Error(`names:reserved-labels for ${org.slug}: this executor was built without a NamesPort (#317)`);
+    async edgeReservedLabels(action, org, context) {
+        const edge = this.ports.edge;
+        if (!edge) {
+            throw new Error(`edge:reserved-labels for ${org.slug}: this executor was built without an EdgePort (#317)`);
         }
         const labels = action.desired.labels;
-        await names.setReservedLabels(org.id, labels);
-        context.recordScopeId(NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY, JSON.stringify(labels));
+        await edge.setReservedLabels(org.id, labels);
+        context.recordScopeId(EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, JSON.stringify(labels));
         return {};
     }
     /**
@@ -5250,7 +5400,14 @@ export class FoundryStepExecutor {
                     // `LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY` -- nothing else ever runs
                     // for this org again to finish removing it once destroy deletes
                     // the ZITADEL project and org below, so it has to go here too.
-                    for (const host of [target.id, ...pendingRemovalHosts(recordedIds)]) {
+                    // A shared instance host's trusted domain is not this org's to remove.
+                    // The flag may be missing, so the recorded host is also compared
+                    // with the platform's shared auth host.
+                    const sharedHost = await this.ports.platformOrg?.authHostname?.();
+                    const isShared = recordedIds[LOGIN_HOST_SHARED_SCOPE_KEY] === '1' ||
+                        (sharedHost != null && target.id === sharedHost);
+                    const own = isShared ? [] : [target.id];
+                    for (const host of [...own, ...pendingRemovalHosts(recordedIds)]) {
                         try {
                             await this.ports.zitadel.deleteTrustedDomain(host);
                         }
@@ -5375,7 +5532,7 @@ export class FoundryStepExecutor {
                     return;
                 }
                 case 'cloudflare:worker': {
-                    // #318: an entry's edge Worker (`<orgId>:<entry>`) and its route.
+                    // #318: an entry's Worker (`<orgId>:<entry>`) and its route.
                     // No port means no way to delete either -- thrown, not silently
                     // skipped, so it is reported blocked rather than left live with
                     // nothing recorded ids point at any more.
@@ -5388,20 +5545,20 @@ export class FoundryStepExecutor {
                     // never recorded, then the script -- the same teardown retire runs.
                     // `target.id` is `''` for a route-only partial deploy.
                     const entryKey = target.key.slice(org.id.length + 1);
-                    await this.teardownEdgeWorker(entryKey, target.id || undefined, recordedIds, workers, `cloudflare:worker '${target.key}' for ${org.slug}`);
+                    await this.teardownWorker(entryKey, target.id || undefined, recordedIds, workers, `cloudflare:worker '${target.key}' for ${org.slug}`);
                     return;
                 }
-                case 'names:key': {
-                    // F7 (#317): an entry's key (`<orgId>:<entry>`); names has no org-root key.
+                case 'edge:key': {
+                    // F7 (#317): an entry's key (`<orgId>:<entry>`); edge has no org-root key.
                     // No port means no way to revoke it -- thrown, not silently
                     // skipped, so the key is reported blocked rather than left live
                     // with nothing saying so.
-                    const names = this.ports.names;
-                    if (!names) {
-                        throw new Error(`names:key '${target.key}' for ${org.slug}: this executor was built without a NamesPort (#317); cannot revoke it`);
+                    const edge = this.ports.edge;
+                    if (!edge) {
+                        throw new Error(`edge:key '${target.key}' for ${org.slug}: this executor was built without an EdgePort (#317); cannot revoke it`);
                     }
                     try {
-                        await names.revokeKey(org.id, target.id);
+                        await edge.revokeKey(org.id, target.id);
                     }
                     catch (error) {
                         // Already gone -- the same already-retired key a retire step