@wtfalch/foundry 0.18.0 → 0.19.0

package/dist/bootstrap/declare.d.ts

@@ -37,8 +37,17 @@ export interface BootstrapOwner {
  */
 export declare function ownerIdentity(owner: BootstrapOwner): OwnerIdentity;
 /**
- * Company Included's declared org: the platform's owner, running no app or
- * mail of its own. Chat is on, like every org's.
+ * Company Included's declared org: the platform's owner, tier 3 on the
+ * platform's own apex from the start (#512) -- it runs on that domain with
+ * hosted mail, not a level-1 org whose domain gets set by hand afterward.
+ * `issuer`/`calls`/`site` go on the domain too, the same tier-3 defaults
+ * archon#388 gives every company declared there. `calls` and `site` stay
+ * disabled (calls is not in v1; no site is declared), so `usesDomain` is
+ * inert on both until one is switched on. Chat stays off the domain: its
+ * re-key onto a per-org homeserver is not built yet (#463). The org's own
+ * sign-in still never collides with the shared ZITADEL instance's host --
+ * `loginHostnameFor` (#488) falls back to `<slug>-auth.oikos.host` whenever
+ * `auth.<domain>` would equal the platform's own auth hostname.
  */
 export declare function declaredCompanyOrg(company: BootstrapCompany, owner: BootstrapOwner): DeclaredOrg;
 /**

package/dist/bootstrap/declare.js

@@ -55,25 +55,34 @@ export function ownerIdentity(owner) {
     return identity;
 }
 /**
- * Company Included's declared org: the platform's owner, running no app or
- * mail of its own. Chat is on, like every org's.
+ * Company Included's declared org: the platform's owner, tier 3 on the
+ * platform's own apex from the start (#512) -- it runs on that domain with
+ * hosted mail, not a level-1 org whose domain gets set by hand afterward.
+ * `issuer`/`calls`/`site` go on the domain too, the same tier-3 defaults
+ * archon#388 gives every company declared there. `calls` and `site` stay
+ * disabled (calls is not in v1; no site is declared), so `usesDomain` is
+ * inert on both until one is switched on. Chat stays off the domain: its
+ * re-key onto a per-org homeserver is not built yet (#463). The org's own
+ * sign-in still never collides with the shared ZITADEL instance's host --
+ * `loginHostnameFor` (#488) falls back to `<slug>-auth.oikos.host` whenever
+ * `auth.<domain>` would equal the platform's own auth hostname.
  */
 export function declaredCompanyOrg(company, owner) {
     return {
         id: COMPANY_INCLUDED_ORG_ID,
         slug: company.slug,
         displayName: company.name,
-        domain: null,
+        domain: company.apex,
         mail: {
-            mode: 'off',
-            usesDomain: false,
+            mode: 'hosted',
+            usesDomain: true,
             ownerMailboxAddress: null,
             noReplyLocalPart: 'no-reply',
         },
         chat: { enabled: true, usesDomain: false },
-        calls: { enabled: false, usesDomain: false },
-        issuer: { usesDomain: false },
-        site: { enabled: false, usesDomain: false },
+        calls: { enabled: false, usesDomain: true },
+        issuer: { usesDomain: true },
+        site: { enabled: false, usesDomain: true },
         hosting: {
             enabled: false,
             usesDomain: false,

package/dist/index.d.ts

@@ -28,6 +28,8 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export type { ScopeResolver, RecordedIds } from './plan/index.js';
+export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export type { ZitadelListAppsRawApp } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';

package/dist/index.js

@@ -17,6 +17,7 @@ export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesF
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';

package/dist/plan/agora.d.ts

@@ -110,6 +110,18 @@ export declare function agoraHostMissing(host: AgoraHostValues): string[];
 export declare function agoraHostnameFor(org: DeclaredOrg): string;
 /** The port `calls/packages/service/Dockerfile` documents (`EXPOSE 8080`); `config.mjs`'s `PORT` has no default, so the executor pushes it. */
 export declare const CALLS_SERVICE_PORT = "8080";
+/**
+ * The port `wtfalch/agora`'s `apps/agora/Dockerfile` serves Caddy on
+ * (`EXPOSE 8080`). Coolify's github-app build never reads a Dockerfile's
+ * `EXPOSE` on its own, so without this passed as `ports_exposes` Traefik is
+ * left routing to a port nothing listens on and Agora answers 502 behind the
+ * tunnel (#506, seen live on Company Included, 2026-10-05). `executor.ts`'s
+ * `coolifyAgora` sets it at create time and fixes it on a found app whose
+ * live value differs; `diff.ts`'s `planAgora` plans that fix the same way it
+ * plans an env difference, by comparing this constant against the live
+ * app's own `ports_exposes` (`providers-readers.ts`'s `withAgoraPortConfig`).
+ */
+export declare const AGORA_APP_PORTS_EXPOSES = "8080";
 /**
  * Recorded by the executor once the calls service app carries its fixed
  * internal name (`callsServiceInternalName`). `desiredAgoraEnv` waits for it,
@@ -196,6 +208,19 @@ export declare function agoraEnvDrift(desired: Readonly<Record<string, string>>,
  * against (#442's own probe: "one env write, zero restarts, zero deploys").
  */
 export declare const AGORA_ACTIVATED_ENV_SCOPE_KEY = "coolify_agora_activated_env";
+/**
+ * #504: recorded once `coolifyAgora` has actually called `deploy` on this
+ * org's Agora app -- `createGithubAppApplication` never sets
+ * `instant_deploy`, and Coolify defaults it to false, so a freshly created
+ * app (or one found by name that a previous apply created but crashed
+ * before deploying) sat at `exited:unhealthy` with zero deployments
+ * forever: nothing ever deployed it, and `restart` cannot start a container
+ * that was never built. Absent means "never deployed", regardless of
+ * whether the app is found live this run or created fresh -- unlike
+ * {@link AGORA_ACTIVATED_ENV_SCOPE_KEY}, this never changes value once set,
+ * so a later env change restarts rather than deploys again.
+ */
+export declare const AGORA_DEPLOYED_SCOPE_KEY = "coolify_agora_deployed";
 /**
  * A stable digest of `env`, for comparison against what was last recorded
  * under {@link AGORA_ACTIVATED_ENV_SCOPE_KEY}. `AGORA_CONFIG` is compared by

package/dist/plan/agora.js

@@ -118,6 +118,18 @@ export function agoraHostnameFor(org) {
 }
 /** The port `calls/packages/service/Dockerfile` documents (`EXPOSE 8080`); `config.mjs`'s `PORT` has no default, so the executor pushes it. */
 export const CALLS_SERVICE_PORT = '8080';
+/**
+ * The port `wtfalch/agora`'s `apps/agora/Dockerfile` serves Caddy on
+ * (`EXPOSE 8080`). Coolify's github-app build never reads a Dockerfile's
+ * `EXPOSE` on its own, so without this passed as `ports_exposes` Traefik is
+ * left routing to a port nothing listens on and Agora answers 502 behind the
+ * tunnel (#506, seen live on Company Included, 2026-10-05). `executor.ts`'s
+ * `coolifyAgora` sets it at create time and fixes it on a found app whose
+ * live value differs; `diff.ts`'s `planAgora` plans that fix the same way it
+ * plans an env difference, by comparing this constant against the live
+ * app's own `ports_exposes` (`providers-readers.ts`'s `withAgoraPortConfig`).
+ */
+export const AGORA_APP_PORTS_EXPOSES = '8080';
 /**
  * Recorded by the executor once the calls service app carries its fixed
  * internal name (`callsServiceInternalName`). `desiredAgoraEnv` waits for it,
@@ -305,6 +317,19 @@ export function agoraEnvDrift(desired, live) {
  * against (#442's own probe: "one env write, zero restarts, zero deploys").
  */
 export const AGORA_ACTIVATED_ENV_SCOPE_KEY = 'coolify_agora_activated_env';
+/**
+ * #504: recorded once `coolifyAgora` has actually called `deploy` on this
+ * org's Agora app -- `createGithubAppApplication` never sets
+ * `instant_deploy`, and Coolify defaults it to false, so a freshly created
+ * app (or one found by name that a previous apply created but crashed
+ * before deploying) sat at `exited:unhealthy` with zero deployments
+ * forever: nothing ever deployed it, and `restart` cannot start a container
+ * that was never built. Absent means "never deployed", regardless of
+ * whether the app is found live this run or created fresh -- unlike
+ * {@link AGORA_ACTIVATED_ENV_SCOPE_KEY}, this never changes value once set,
+ * so a later env change restarts rather than deploys again.
+ */
+export const AGORA_DEPLOYED_SCOPE_KEY = 'coolify_agora_deployed';
 /**
  * A stable digest of `env`, for comparison against what was last recorded
  * under {@link AGORA_ACTIVATED_ENV_SCOPE_KEY}. `AGORA_CONFIG` is compared by

package/dist/plan/boule.d.ts

@@ -20,6 +20,14 @@ export declare const BOULE_CLIENT_ID_SCOPE_KEY = "boule_client_id";
  * scope id, like the cms and calls databases.
  */
 export declare const BOULE_DATABASE_SCOPE_KEY = "coolify_boule_database";
+/**
+ * #504: the same marker `agora.ts`'s `AGORA_DEPLOYED_SCOPE_KEY` is, for
+ * Boule -- recorded once `coolifyBoule` has actually called `deploy` on this
+ * org's Boule app. See that constant's own doc comment for why: Coolify
+ * defaults `instant_deploy` to false, so without this a freshly created app
+ * sat built but never started, and `restart` cannot fix that.
+ */
+export declare const BOULE_DEPLOYED_SCOPE_KEY = "coolify_boule_deployed";
 /**
  * `boule.<domain>` when the org has a domain, `<slug>-boule.oikos.host`
  * otherwise (the tier rule of boule#128 and foundry#147; `../slug.ts`'s

package/dist/plan/boule.js

@@ -19,6 +19,14 @@ export const BOULE_CLIENT_ID_SCOPE_KEY = 'boule_client_id';
  * scope id, like the cms and calls databases.
  */
 export const BOULE_DATABASE_SCOPE_KEY = 'coolify_boule_database';
+/**
+ * #504: the same marker `agora.ts`'s `AGORA_DEPLOYED_SCOPE_KEY` is, for
+ * Boule -- recorded once `coolifyBoule` has actually called `deploy` on this
+ * org's Boule app. See that constant's own doc comment for why: Coolify
+ * defaults `instant_deploy` to false, so without this a freshly created app
+ * sat built but never started, and `restart` cannot fix that.
+ */
+export const BOULE_DEPLOYED_SCOPE_KEY = 'coolify_boule_deployed';
 /**
  * `boule.<domain>` when the org has a domain, `<slug>-boule.oikos.host`
  * otherwise (the tier rule of boule#128 and foundry#147; `../slug.ts`'s

package/dist/plan/diff.js

@@ -1,6 +1,6 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, bouleEnvDrift, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
@@ -82,7 +82,11 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const byKey = new Map(live.map((r) => [resourceKey(r.system, r.kind, r.key), r]));
     const claimed = new Set();
     const plannedSteps = [];
-    const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady);
+    // The platform's own org: its domain is the platform apex (the same fact
+    // #491 reads for mail). It signs in on the shared instance's own host, so
+    // `issuer.usesDomain` never moves it.
+    const isPlatformOrg = isPlatformOwnOrg(org, platformReadiness.platformApex);
+    const issuer = planIssuer(org, byKey, claimed, platformReadiness.authReady, isPlatformOrg);
     if (issuer.step)
         plannedSteps.push(issuer.step);
     plannedSteps.push(...planOwners(org, recordedIds, platformReadiness.authReady, 'error' in agoraHost ? null : agoraHost.issuer));
@@ -94,7 +98,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // URL (`https://<platform.auth.hostname>`), the same value every org's
     // sign-in already reads through `planOwners` above -- no separate port
     // or plumbing needed to know the platform's own auth hostname.
-    platformAuthHostnameFrom('error' in agoraHost ? null : agoraHost.issuer));
+    platformAuthHostnameFrom('error' in agoraHost ? null : agoraHost.issuer), isPlatformOrg);
     if (loginHost.step)
         plannedSteps.push(loginHost.step);
     // Planned ahead of everything that needs the zone live (#238); its own step
@@ -391,7 +395,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
  * already exists live is unaffected: its own domain-move logic runs
  * regardless, since that never re-provisions the ZITADEL org itself.
  */
-function planIssuer(org, byKey, claimed, authReady) {
+function planIssuer(org, byKey, claimed, authReady, isPlatformOrg = false) {
     const key = resourceKey('zitadel', 'issuer', org.id);
     const live = byKey.get(key);
     const desiredUsesDomain = org.issuer.usesDomain;
@@ -420,9 +424,14 @@ function planIssuer(org, byKey, claimed, authReady) {
         };
     }
     claimed.add(key);
-    const liveUsesDomain = Boolean(live.config.usesDomain);
-    if (liveUsesDomain === desiredUsesDomain)
+    // The platform's own org already signs in on the shared host: no move. A
+    // live issuer that does not say (the reader never does: foundry v1 never
+    // moves one) is not read as a different one either.
+    if (isPlatformOrg ||
+        live.config.usesDomain === undefined ||
+        Boolean(live.config.usesDomain) === desiredUsesDomain) {
         return { step: null, blocked: null };
+    }
     const domain = org.domain ?? 'the org domain';
     return {
         step: {
@@ -519,6 +528,9 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
  * computed `auth.<domain>` against, so the platform's own org never plans
  * its login host equal to the shared ZITADEL instance's own.
  */
+function isPlatformOwnOrg(org, platformApex) {
+    return Boolean(org.domain && platformApex && org.domain.toLowerCase() === platformApex.toLowerCase());
+}
 function platformAuthHostnameFrom(issuer) {
     if (!issuer)
         return null;
@@ -565,16 +577,58 @@ function platformAuthHostnameFrom(issuer) {
  * platform's own domain, never plans the shared ZITADEL instance's own login
  * host as its own -- `auth.companyincluded.com` colliding with itself.
  */
-function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, platformAuthHostname) {
+function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired, platformAuthHostname, isPlatformOrg) {
     const none = { step: null, blocked: null };
     const key = resourceKey('zitadel', 'login-host', org.id);
-    const host = loginHostnameFor(org, platformAuthHostname);
+    // The platform's own org signs in on the shared instance's host whatever
+    // `issuer.usesDomain` says (turning it on would move the issuer).
+    // Before that host is known, plan nothing: a guessed host would delete the
+    // working one, and a normal step would trust a domain `destroy` later deletes.
+    if (isPlatformOrg && platformAuthHostname === null) {
+        return {
+            step: null,
+            blocked: `${org.slug}'s login host is waiting for the platform auth host`,
+        };
+    }
+    const sharedInstanceHost = isPlatformOrg && platformAuthHostname !== null;
+    const host = sharedInstanceHost ? platformAuthHostname : loginHostnameFor(org);
     // #488: the guard in `loginHostnameFor` fired -- the org's own domain host
     // would have been the platform's shared ZITADEL instance host.
-    const sharedInstanceHost = Boolean(org.domain) &&
-        org.issuer.usesDomain &&
-        `auth.${org.domain}` === platformAuthHostname &&
-        host !== `auth.${org.domain}`;
+    if (sharedInstanceHost) {
+        // The host is the shared instance's own: nothing to trust or bind, and an
+        // org with no recorded host already signs in there. Only an org recorded
+        // on another host (the old `<slug>-auth.oikos.host`) plans one step, to
+        // move its apps over and remove the old host; then it plans nothing.
+        const recordedHost = recordedIds[key];
+        const moving = recordedHost !== undefined && recordedHost !== host;
+        const removalOwed = pendingRemovalHosts(recordedIds).length > 0;
+        if (!authReady || !(moving || removalOwed))
+            return none;
+        // The same gates as the normal branch: the executor's shared step also
+        // needs the binding port and the ZITADEL org.
+        const waiting = loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned);
+        return waiting ?? stepFor(true);
+    }
+    function stepFor(shared) {
+        return {
+            step: {
+                action: {
+                    system: 'zitadel',
+                    kind: 'login-host',
+                    key: org.id,
+                    desired: shared ? { host, shared: true } : { host },
+                },
+                step: {
+                    description: shared
+                        ? `move ${org.slug}'s apps onto the platform's own sign-in host ${host}`
+                        : `set ${org.slug}'s login host to ${host}`,
+                    destroys: false,
+                    migrates: false,
+                },
+            },
+            blocked: null,
+        };
+    }
     // Already applied -- a re-run plans nothing unless the host changed, an app
     // client id appeared since the binding was last written (#267, rule 4), or
     // an earlier host change still has a removal owed (#274 fix round 2):
@@ -595,6 +649,10 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     // Isolation between orgs rests on zitadel-login's binding, and repointing
     // an app at a host with no binding breaks its sign-in: trust nothing and
     // repoint nothing until the port that writes the binding is wired.
+    return loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) ?? stepFor(false);
+}
+/** Why a login-host step cannot run yet, or `null` when nothing is missing. */
+function loginHostWaiting(org, host, recordedIds, bindingsWired, issuerPlanned) {
     if (!bindingsWired) {
         return {
             step: null,
@@ -609,24 +667,7 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
             blocked: `${org.slug}'s login host ${host} waits for its ZITADEL org, which is not recorded yet`,
         };
     }
-    return {
-        step: {
-            action: {
-                system: 'zitadel',
-                kind: 'login-host',
-                key: org.id,
-                desired: { host },
-            },
-            step: {
-                description: sharedInstanceHost
-                    ? `set ${org.slug}'s login host to ${host}: its domain host (auth.${org.domain}) is the platform's own shared ZITADEL instance host, so it stays on oikos.host`
-                    : `set ${org.slug}'s login host to ${host}`,
-                destroys: false,
-                migrates: false,
-            },
-        },
-        blocked: null,
-    };
+    return null;
 }
 /** #230: restated from `executor.ts`'s `MAIL_ROLE_MAILBOXES_SCOPE_KEY`, same rule: comma-joined local parts already created. */
 const MAIL_ROLE_MAILBOXES_SCOPE_KEY = 'mail_role_mailboxes';
@@ -1594,6 +1635,13 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
     if (liveEnv.AGORA_CONFIG === undefined && !drift.includes('AGORA_CONFIG')) {
         drift.push('AGORA_CONFIG');
     }
+    // #506: an app Coolify never got `ports_exposes` on (or got the wrong one)
+    // answers 502 behind the tunnel even though its env already matches --
+    // exactly the Company Included incident this issue names. Compared
+    // separately from `drift` above: it is a Coolify application setting, not
+    // an env var, and `providers-readers.ts`'s `withAgoraEnvConfig` reads it
+    // from `getApplication`, never `listEnvs`.
+    const portDrift = live.config.ports_exposes !== AGORA_APP_PORTS_EXPOSES;
     // #442: `drift` alone, once this step has ever run, is comparing `env`
     // against Coolify's own env store -- which the executor's `bulkUpsertEnvs`
     // leaves matching `env` the moment the write succeeds, restarted or not.
@@ -1604,14 +1652,18 @@ function planAgora(org, byKey, claimed, recordedIds, reading) {
     // actually serving this exact `env`; while it disagrees, the step stays
     // planned no matter what Coolify's env store already shows.
     const activated = recordedIds[AGORA_ACTIVATED_ENV_SCOPE_KEY] === agoraEnvRevision(env);
-    if (drift.length === 0 && activated)
+    if (drift.length === 0 && activated && !portDrift)
         return { step: null, blocked: null };
+    const reasons = [
+        ...(drift.length > 0 ? [`${drift.join(', ')} missing or different`] : []),
+        ...(portDrift ? ["ports_exposes wrong -- Traefik can't reach it"] : []),
+    ];
     return {
         step: {
             action,
             step: {
-                description: drift.length > 0
-                    ? `update ${org.slug}'s Agora config (${drift.join(', ')} missing or different)`
+                description: reasons.length > 0
+                    ? `update ${org.slug}'s Agora config (${reasons.join('; ')})`
                     : `activate ${org.slug}'s Agora config -- written but not yet confirmed restarted`,
                 destroys: false,
                 migrates: false,
@@ -1735,13 +1787,13 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
  * park-not-delete rule (#7 corrections 1) -- turning it off never deletes
  * the org's own app, database or tunnel configuration, it parks it.
  */
-function planHostingToggle(system, kind, desiredEnabled, org, byKey, claimed, describeProvision, describePark, stepKey = org.id) {
+function planHostingToggle(system, kind, desiredEnabled, org, byKey, claimed, describeProvision, describePark, stepKey = org.id, isOn = (live) => live.config.enabled !== false) {
     const key = resourceKey(system, kind, stepKey);
     const live = byKey.get(key);
     // A live resource is on unless it says it is parked. Providers' own
     // configs carry no `enabled` field at all, so only a park step's
     // explicit `enabled: false` reads as off.
-    const liveEnabled = live !== undefined && live.config.enabled !== false;
+    const liveEnabled = live !== undefined && isOn(live);
     if (!desiredEnabled) {
         // Nothing declared and nothing live: there is nothing to park.
         if (!live)
@@ -2192,7 +2244,18 @@ function planTunnel(org, byKey, claimed, recordedIds) {
         (org.site.enabled && Boolean(org.domain)) ||
         (org.calls.enabled && org.calls.usesDomain && Boolean(org.domain)) ||
         Boolean(org.domain);
-    const toggled = planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`);
+    const toggled = planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`, org.id, 
+    // Cloudflare's status, read against what is declared: a park cannot change
+    // it, so judging on/off by status alone would never let the plan empty.
+    // Wanted on: only `down` needs a repair (`inactive` is a fresh tunnel
+    // whose connector has not dialled in yet). Wanted off: only a connected
+    // tunnel needs parking; `inactive` and `down` are already parked.
+    (live) => {
+        const status = live.config.status;
+        if (typeof status !== 'string')
+            return live.config.enabled !== false;
+        return desired ? status !== 'down' : status === 'healthy' || status === 'degraded';
+    });
     if (toggled || !desired)
         return toggled;
     // A live, enabled tunnel re-plans the same step again when either:

package/dist/plan/executor.d.ts

@@ -89,6 +89,10 @@ export interface CoolifyPort {
      * `settings`, not at the top level -- confirmed against live Coolify
      * 4.3.23 (PR #482 review); `custom_network_aliases` and
      * `health_check_enabled` are both top-level there.
+     *
+     * #506: also the port Traefik routes to, so `coolifyAgora` can tell an app
+     * that predates passing `ports_exposes` at create apart from one already
+     * fixed.
      */
     getApplication(uuid: string): Promise<{
         uuid: string;
@@ -99,6 +103,7 @@ export interface CoolifyPort {
         };
         custom_network_aliases?: string | null;
         health_check_enabled?: boolean;
+        ports_exposes?: string;
     }>;
     createGithubAppApplication(input: {
         project_uuid: string;
@@ -1410,6 +1415,8 @@ export interface PlatformOrgPortSource {
     files(): Promise<FilesOrganisationPort>;
     ai(): Promise<AiOrganisationPort>;
     jobs(): Promise<JobsSchedulerPort>;
+    /** The platform's shared sign-in host, or `null` when none is declared. */
+    authHostname?(): Promise<string | null>;
 }
 export interface FoundryStepExecutorPorts {
     coolify: CoolifyPort;
@@ -2331,11 +2338,25 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * actually differs, or whenever the last restart this step confirmed
      * ({@link AGORA_ACTIVATED_ENV_SCOPE_KEY}) is not this exact env (an org
      * applied before this existed, whose live env already matched desired
-     * with nothing ever confirmed running it). A brand new app has nothing
-     * running yet to restart. The activation marker is recorded last, after
-     * the restart (if any) returns without throwing, so a failed restart
-     * leaves it stale and the next plan replans this step even though
-     * Coolify's own env store already matches desired.
+     * with nothing ever confirmed running it). The activation marker is
+     * recorded last, after the restart (if any) returns without throwing, so a
+     * failed restart leaves it stale and the next plan replans this step even
+     * though Coolify's own env store already matches desired.
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link AGORA_DEPLOYED_SCOPE_KEY}). `createGithubAppApplication` never
+     * sets `instant_deploy`, and Coolify defaults it to false, so without an
+     * explicit deploy the app sat created but never built or started.
+     *
+     * #506: `ports_exposes: AGORA_APP_PORTS_EXPOSES` goes on the create call
+     * itself, so Traefik has a port to route to from the moment the app
+     * exists. An app `findOrCreateCallsApp` instead *found* may predate this
+     * fix and carry no `ports_exposes` at all (or the wrong one), so its live
+     * value is read and, when it differs, patched -- and, since the container
+     * listens on `ports_exposes` only at its next deploy (the same rule
+     * `coolifyApp`'s own `settingsNeedDeploy` follows for a port change
+     * there), redeployed even on a run that already has its one #504 deploy
+     * behind it.
      */
     private coolifyAgora;
     /**
@@ -2360,6 +2381,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      *
      * `AUTH_APP_KEY` is minted once here; its broker entry is the next step
      * (`bouleBrokerEntry`).
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link BOULE_DEPLOYED_SCOPE_KEY}), the same reason and the same marker
+     * shape {@link coolifyAgora}'s own doc comment explains.
      */
     private coolifyBoule;
     /**
@@ -2501,6 +2526,15 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * shared-hostname collision this ticket exists to refuse. An org re-running
      * its own already-recorded zone is unaffected: the store then names this
      * same org as the owner.
+     *
+     * #510: also records the zone's own id under the flat `cloudflare_zone`
+     * scope key, alongside the `cloudflare:zone:<domain>` resource id `runSteps`
+     * already records from this method's return value. Without it, nothing
+     * ever gives `ProvidersCloudflareReader` a zone id to resolve this org's
+     * scope with (`providers-readers.ts`'s `storeScopeResolver` doc comment),
+     * so that reader's `listResources` always returned `[]` and `diff.ts`'s
+     * `planZone` re-proposed "provision a Cloudflare zone" on every apply, even
+     * once the zone was live.
      */
     private cloudflareZone;
     /**

package/dist/plan/executor.js

@@ -2,8 +2,8 @@ import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
 import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
-import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, chatInternalNames, chatMasConfigYaml, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
@@ -14,7 +14,7 @@ import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScope
 import { EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
@@ -240,10 +240,14 @@ const CMS_SITE_APP_DOCKERFILE = '/apps/site/Dockerfile';
  * followed rather than reopened (#164 "Decide" 1). The agora repo's own
  * Dockerfile (`apps/agora/Dockerfile`) already `EXPOSE`s 8080 and serves
  * from a build built at the repository root, the same one-repo shape
- * `CMS_REPO`'s own two apps use -- no `ports_exposes`/`PORT` env is needed
- * the way `CALLS_SERVICE_PORT` is for the calls service's own Node process,
- * since Coolify's github-app build already reads the exposed port the same
- * way it does for `cmsSite`'s two apps above.
+ * `CMS_REPO`'s own two apps use. This comment used to claim that needed no
+ * `ports_exposes` of its own, on the theory that Coolify's github-app build
+ * reads a Dockerfile's `EXPOSE` the same way it does for `cmsSite`'s two
+ * apps above -- wrong (#506): Coolify never reads `EXPOSE` for a build it
+ * runs itself, so without an explicit `agora.ts`'s `AGORA_APP_PORTS_EXPOSES`,
+ * Traefik is left routing to a port nothing listens on, and a company's
+ * Agora answers 502 behind the tunnel. Seen live on Company Included,
+ * 2026-10-05.
  */
 const AGORA_REPO = 'wtfalch/agora';
 const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
@@ -665,7 +669,7 @@ export class FoundryStepExecutor {
             case 'cloudflare:tunnel':
                 return this.cloudflareTunnel(action, org, context);
             case 'cloudflare:zone':
-                return this.cloudflareZone(action, org);
+                return this.cloudflareZone(action, org, context);
             case 'cloudflare:access':
                 return this.cloudflareAccess(action, org);
             case 'cloudflare:ratelimit':
@@ -1232,11 +1236,16 @@ export class FoundryStepExecutor {
             throw new Error(`zitadel:login-host for ${org.slug}: the loginHostBindings port is not wired`);
         }
         const host = action.desired.host;
-        await this.ports.zitadel.ensureTrustedDomain(host);
-        // zitadel-login's own routing table, written before any app is repointed
-        // so no app ever points at a host with no binding.
+        // The platform's own shared sign-in host: already trusted and routed by
+        // the shared instance, so it gets no trusted domain or binding here.
+        const shared = action.desired.shared === true;
         const clientIds = loginHostClientIds(recorded);
-        await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+        if (!shared) {
+            await this.ports.zitadel.ensureTrustedDomain(host);
+            // zitadel-login's own routing table, written before any app is repointed
+            // so no app ever points at a host with no binding.
+            await bindings.upsertBinding({ host, organizationId: zitadelOrgId, clientIds });
+        }
         // Only apps whose client id the binding now holds: any other app in the
         // project would lose sign-in. The rest move on a later run, once the
         // recorded client ids differ from the binding and replan this step.
@@ -1337,7 +1346,10 @@ export class FoundryStepExecutor {
         // the binding and replans the step next run; a nonempty pending list
         // does too (`planLoginHost`), independent of the host comparison that
         // normally alone decides it.
-        context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
+        if (shared)
+            context.recordScopeId(LOGIN_HOST_SHARED_SCOPE_KEY, '1');
+        else
+            context.recordScopeId(LOGIN_BINDING_SCOPE_KEY, loginBindingState(host, clientIds));
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }
@@ -3603,11 +3615,25 @@ export class FoundryStepExecutor {
      * actually differs, or whenever the last restart this step confirmed
      * ({@link AGORA_ACTIVATED_ENV_SCOPE_KEY}) is not this exact env (an org
      * applied before this existed, whose live env already matched desired
-     * with nothing ever confirmed running it). A brand new app has nothing
-     * running yet to restart. The activation marker is recorded last, after
-     * the restart (if any) returns without throwing, so a failed restart
-     * leaves it stale and the next plan replans this step even though
-     * Coolify's own env store already matches desired.
+     * with nothing ever confirmed running it). The activation marker is
+     * recorded last, after the restart (if any) returns without throwing, so a
+     * failed restart leaves it stale and the next plan replans this step even
+     * though Coolify's own env store already matches desired.
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link AGORA_DEPLOYED_SCOPE_KEY}). `createGithubAppApplication` never
+     * sets `instant_deploy`, and Coolify defaults it to false, so without an
+     * explicit deploy the app sat created but never built or started.
+     *
+     * #506: `ports_exposes: AGORA_APP_PORTS_EXPOSES` goes on the create call
+     * itself, so Traefik has a port to route to from the moment the app
+     * exists. An app `findOrCreateCallsApp` instead *found* may predate this
+     * fix and carry no `ports_exposes` at all (or the wrong one), so its live
+     * value is read and, when it differs, patched -- and, since the container
+     * listens on `ports_exposes` only at its next deploy (the same rule
+     * `coolifyApp`'s own `settingsNeedDeploy` follows for a port change
+     * there), redeployed even on a run that already has its one #504 deploy
+     * behind it.
      */
     async coolifyAgora(action, org, context) {
         // The host values the plan read, carried in the step: never read again
@@ -3637,9 +3663,22 @@ export class FoundryStepExecutor {
             name,
             domains: coolifyDomains([agoraHostnameFor(org)]),
             dockerfile_location: AGORA_APP_DOCKERFILE,
+            ports_exposes: AGORA_APP_PORTS_EXPOSES,
         }));
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
+        // #506: an app found rather than just created may predate passing
+        // `ports_exposes` at create -- Traefik then routes to a port nothing
+        // listens on and Agora answers 502 behind the tunnel. A freshly created
+        // app already got the right port above, so only a found one is checked.
+        const portDiffers = app.existed &&
+            (await this.ports.coolify.getApplication(app.appId)).ports_exposes !==
+                AGORA_APP_PORTS_EXPOSES;
+        if (portDiffers) {
+            await this.ports.coolify.updateApplication(app.appId, {
+                ports_exposes: AGORA_APP_PORTS_EXPOSES,
+            });
+        }
         // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
         // Coolify's own env store matching `env`, which is why that store alone
         // can no longer tell a changed value from one already live.
@@ -3650,7 +3689,25 @@ export class FoundryStepExecutor {
         await this.ports.coolify.bulkUpsertEnvs(app.appId, Object.entries(env).map(([key, value]) => ({ key, value })));
         const revision = agoraEnvRevision(env);
         const alreadyActivated = context.recordedIds()[AGORA_ACTIVATED_ENV_SCOPE_KEY] === revision;
-        if (app.existed && (envChanged || !alreadyActivated)) {
+        // #504: `createGithubAppApplication` never sets `instant_deploy`, and
+        // Coolify defaults it to false -- a brand new app, and one found by name
+        // that a previous apply created but crashed before deploying, both sat
+        // built but never started. `restart` cannot fix either: it starts a
+        // container that was never built. Deployed once this executor has
+        // confirmed (the marker never changes value once set), never again -- a
+        // live app is only ever restarted from here on, unless #506's port fix
+        // below needs its own deploy.
+        if (!context.recordedIds()[AGORA_DEPLOYED_SCOPE_KEY]) {
+            await this.ports.coolify.deploy(app.appId);
+            context.recordScopeId(AGORA_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (portDiffers) {
+            // #506: a port fix needs its own full deploy -- env drift alone only
+            // needs the cheaper restart, and this deploy already carries this
+            // run's env (pushed above), so the two never both run.
+            await this.ports.coolify.deploy(app.appId);
+        }
+        else if (app.existed && (envChanged || !alreadyActivated)) {
             await this.ports.coolify.restart(app.appId);
         }
         context.recordScopeId(AGORA_ACTIVATED_ENV_SCOPE_KEY, revision);
@@ -3679,6 +3736,10 @@ export class FoundryStepExecutor {
      *
      * `AUTH_APP_KEY` is minted once here; its broker entry is the next step
      * (`bouleBrokerEntry`).
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link BOULE_DEPLOYED_SCOPE_KEY}), the same reason and the same marker
+     * shape {@link coolifyAgora}'s own doc comment explains.
      */
     async coolifyBoule(action, org, context) {
         // The issuer and Archon URL the plan read, carried in the step: the env
@@ -3730,7 +3791,17 @@ export class FoundryStepExecutor {
         if (!dbPush.pushed) {
             throw new Error(`Boule for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
-        if (app.existed && (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed)) {
+        // #504: see `coolifyAgora`'s own comment just above -- `createGithubAppApplication`
+        // never sets `instant_deploy`, so a brand new app (or one found by name
+        // that a previous apply created but crashed before deploying) sat built
+        // but never started. Deployed once this executor has confirmed, never
+        // again -- a live app is only ever restarted from here on.
+        if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
+            await this.ports.coolify.deploy(app.appId);
+            context.recordScopeId(BOULE_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (app.existed &&
+            (envChanged || cookieSecret !== null || appKey !== null || dbPush.changed)) {
             await this.ports.coolify.restart(app.appId);
         }
         return { resourceId: app.appId };
@@ -4219,8 +4290,17 @@ export class FoundryStepExecutor {
      * shared-hostname collision this ticket exists to refuse. An org re-running
      * its own already-recorded zone is unaffected: the store then names this
      * same org as the owner.
+     *
+     * #510: also records the zone's own id under the flat `cloudflare_zone`
+     * scope key, alongside the `cloudflare:zone:<domain>` resource id `runSteps`
+     * already records from this method's return value. Without it, nothing
+     * ever gives `ProvidersCloudflareReader` a zone id to resolve this org's
+     * scope with (`providers-readers.ts`'s `storeScopeResolver` doc comment),
+     * so that reader's `listResources` always returned `[]` and `diff.ts`'s
+     * `planZone` re-proposed "provision a Cloudflare zone" on every apply, even
+     * once the zone was live.
      */
-    async cloudflareZone(action, org) {
+    async cloudflareZone(action, org, context) {
         const domain = action.key;
         const cf = this.ports.cloudflare;
         const existing = await cf.findZoneByApex(domain);
@@ -4229,9 +4309,11 @@ export class FoundryStepExecutor {
             if (owner !== null && owner !== org.id) {
                 throw new Error(`cloudflare:zone for ${org.slug}: zone ${existing.id} (${domain}) is already recorded under org ${owner}; foundry does not adopt it`);
             }
+            context.recordScopeId('cloudflare_zone', existing.id);
             return { resourceId: existing.id };
         }
         const created = await cf.createZone(domain);
+        context.recordScopeId('cloudflare_zone', created.id);
         return { resourceId: created.id };
     }
     // ---- mail -----------------------------------------------------------
@@ -5318,7 +5400,14 @@ export class FoundryStepExecutor {
                     // `LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY` -- nothing else ever runs
                     // for this org again to finish removing it once destroy deletes
                     // the ZITADEL project and org below, so it has to go here too.
-                    for (const host of [target.id, ...pendingRemovalHosts(recordedIds)]) {
+                    // A shared instance host's trusted domain is not this org's to remove.
+                    // The flag may be missing, so the recorded host is also compared
+                    // with the platform's shared auth host.
+                    const sharedHost = await this.ports.platformOrg?.authHostname?.();
+                    const isShared = recordedIds[LOGIN_HOST_SHARED_SCOPE_KEY] === '1' ||
+                        (sharedHost != null && target.id === sharedHost);
+                    const own = isShared ? [] : [target.id];
+                    for (const host of [...own, ...pendingRemovalHosts(recordedIds)]) {
                         try {
                             await this.ports.zitadel.deleteTrustedDomain(host);
                         }

package/dist/plan/login-host.d.ts

@@ -22,18 +22,22 @@ import type { DeclaredOrg } from '../org.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: `auth.<domain>` is refused when it would equal `platformAuthHostname`
- * -- the platform's own org, declared with-domain on the platform's own
- * domain, would otherwise compute the shared ZITADEL instance's own login
- * host (`platform.auth.hostname`, e.g. `auth.companyincriminated.com` ->
- * `auth.companyincluded.com`). Archon's login-host write throws on that
- * duplicate host (`archon`'s `validateLoginHostRegistry`); if it were ever
- * written instead, `auth`'s own `company-host.ts` denies every request
- * through a duplicate host, the shared one included. `platformAuthHostname`
- * is `null` when the caller has none to compare against (no platform
- * declared, or sign-in not ready yet), in which case this never refuses.
+ * #488: the platform's own org is not handled here: it signs in on the shared
+ * ZITADEL instance's own host (`platformAuthHostname`), whatever
+ * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
+ * that host itself. That host must never get a trusted
+ * domain or a login binding of its own:
+ * Archon's login-host write throws on a duplicate host, and `auth`'s own
+ * `company-host.ts` denies every request through one, the shared one
+ * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
  */
-export declare function loginHostnameFor(org: DeclaredOrg, platformAuthHostname?: string | null): string;
+export declare function loginHostnameFor(org: DeclaredOrg): string;
+/**
+ * Scope id set to `'1'` once an org's recorded login host is the platform's
+ * shared instance host: that host's trusted domain belongs to the shared
+ * instance, so `destroy` must not remove it.
+ */
+export declare const LOGIN_HOST_SHARED_SCOPE_KEY = "zitadel_login_host_shared";
 /**
  * One entry in zitadel-login's own `LOGIN_HOST_BINDINGS`
  * (`auth/docs/company-login-hosts.md`) -- a single-line JSON document naming

package/dist/plan/login-host.js

@@ -23,30 +23,30 @@ import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: `auth.<domain>` is refused when it would equal `platformAuthHostname`
- * -- the platform's own org, declared with-domain on the platform's own
- * domain, would otherwise compute the shared ZITADEL instance's own login
- * host (`platform.auth.hostname`, e.g. `auth.companyincriminated.com` ->
- * `auth.companyincluded.com`). Archon's login-host write throws on that
- * duplicate host (`archon`'s `validateLoginHostRegistry`); if it were ever
- * written instead, `auth`'s own `company-host.ts` denies every request
- * through a duplicate host, the shared one included. `platformAuthHostname`
- * is `null` when the caller has none to compare against (no platform
- * declared, or sign-in not ready yet), in which case this never refuses.
+ * #488: the platform's own org is not handled here: it signs in on the shared
+ * ZITADEL instance's own host (`platformAuthHostname`), whatever
+ * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
+ * that host itself. That host must never get a trusted
+ * domain or a login binding of its own:
+ * Archon's login-host write throws on a duplicate host, and `auth`'s own
+ * `company-host.ts` denies every request through one, the shared one
+ * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
  */
-export function loginHostnameFor(org, platformAuthHostname = null) {
+export function loginHostnameFor(org) {
     // `issuer.usesDomain` is the issuer's opt-in into the org's domain
     // (`org.ts`'s `IssuerConfig`): a domain alone never moves it, so a domain
     // with `usesDomain` false stays on the tier 1 host.
     if (org.domain && org.issuer.usesDomain) {
-        const host = `auth.${org.domain}`;
-        if (platformAuthHostname && host === platformAuthHostname) {
-            return `${org.slug}-auth.oikos.host`;
-        }
-        return host;
+        return `auth.${org.domain}`;
     }
     return `${org.slug}-auth.oikos.host`;
 }
+/**
+ * Scope id set to `'1'` once an org's recorded login host is the platform's
+ * shared instance host: that host's trusted domain belongs to the shared
+ * instance, so `destroy` must not remove it.
+ */
+export const LOGIN_HOST_SHARED_SCOPE_KEY = 'zitadel_login_host_shared';
 /**
  * Scope id holding what the binding was last written with
  * ({@link loginBindingState}). Client ids are not secrets. The planner

package/dist/plan/platform-org-ports.d.ts

@@ -45,6 +45,7 @@ export declare class PlatformOrgPorts {
     files(): Promise<FilesOrganisationPort>;
     ai(): Promise<AiOrganisationPort>;
     jobs(): Promise<JobsSchedulerPort>;
+    authHostname(): Promise<string | null>;
     private recorded;
     private held;
 }

package/dist/plan/platform-org-ports.js

@@ -47,6 +47,9 @@ export class PlatformOrgPorts {
         const token = await this.held('jobs', JOBS_ADMIN_TOKEN_REF);
         return new HttpJobsSchedulerClient(`https://${platform.jobs.hostname}`, token, this.options.fetch);
     }
+    async authHostname() {
+        return (await this.options.store.get())?.auth.hostname ?? null;
+    }
     async recorded(service, scopeKey) {
         const value = (await this.options.store.getServiceIds())[scopeKey];
         if (!value) {

package/dist/plan/platform-providers.d.ts

@@ -640,8 +640,9 @@ export declare const PLATFORM_AI_MANAGEMENT_KEY_REF = "ai:platform:managementKey
  * What Archon's management key may do in ai: exactly `ai`'s own
  * `ARCHON_AI_PERMISSIONS` (`apps/host/scripts/authz/bootstrap-archon.ts`) --
  * configuration only (offerings, provisioning, offers, budgets, usage, cost)
- * plus deleting (archiving) an organisation, never connections, runs or
- * webhooks. ai's `/v1/platform/keys` route refuses any permission outside
+ * plus deleting (archiving) an organisation and setting another
+ * organisation's webhook address and budget, never connections, runs or
+ * webhook deliveries. ai's `/v1/platform/keys` route refuses any permission outside
  * this same list, so a request for more than this is a 403, not a wider key.
  */
 export declare const PLATFORM_AI_MANAGEMENT_PERMISSIONS: readonly string[];

package/dist/plan/platform-providers.js

@@ -2330,11 +2330,14 @@ const PLATFORM_ARCHON_PROJECT = 'platform';
 const PLATFORM_ARCHON_APP_NAME = 'platform-archon';
 const PLATFORM_ARCHON_DB_NAME = 'platform-archon-db';
 /**
- * The database Coolify creates for Archon. Archon's own
- * `drizzle/0001_runtime_role.sql` names its runtime role
- * `current_database() || '_rt'`, so {@link ARCHON_RUNTIME_ROLE} follows.
+ * The database Archon runs on. Live platform-archon moved to `archon_v2` on
+ * the same server (2026-10-02, the move onto `@wtfalch/db`), while its Coolify
+ * resource still names `archon` as its first database. So both URLs built
+ * here set this database themselves, never `internal_db_url`'s path.
+ * Archon's own migrations grant to `current_database() || '_rt'`, so
+ * {@link ARCHON_RUNTIME_ROLE} follows.
  */
-const ARCHON_POSTGRES_DB = 'archon';
+const ARCHON_POSTGRES_DB = 'archon_v2';
 const ARCHON_RUNTIME_ROLE = `${ARCHON_POSTGRES_DB}_rt`;
 /** Fixed so the tunnel addresses the container directly (see `provisionPlatformAuth`). */
 const PLATFORM_ARCHON_INTERNAL_NAME = 'platform-archon';
@@ -2668,11 +2671,12 @@ async function provisionPlatformArchon(context, deps) {
     // The owner URL must name the adopted database's host, or the app's two
     // database URLs would point at different databases.
     const liveOwnerUrl = await currentEnvValue(deps.coolify, appId, 'DATABASE_URL_OWNER');
+    const ownerUrl = archonDatabaseUrl(db.internal_db_url);
     if (liveOwnerUrl) {
         assertSameDatabaseHost('DATABASE_URL_OWNER', liveOwnerUrl, db.internal_db_url);
     }
     else {
-        envs.push({ key: 'DATABASE_URL_OWNER', value: db.internal_db_url });
+        envs.push({ key: 'DATABASE_URL_OWNER', value: ownerUrl });
     }
     const liveReportingSite = await currentEnvValue(deps.coolify, appId, 'REPORTING_SITE');
     if (!liveReportingSite) {
@@ -2692,7 +2696,7 @@ async function provisionPlatformArchon(context, deps) {
     // reflects the env Archon actually ends up running with, not just this
     // run's delta.
     const archonEnvHashOverrides = new Map([
-        ['DATABASE_URL_OWNER', liveOwnerUrl ?? db.internal_db_url],
+        ['DATABASE_URL_OWNER', liveOwnerUrl ?? ownerUrl],
         ['REPORTING_SITE', liveReportingSite ?? 'archon'],
     ]);
     const effectiveCookieSecret = cookieSecret ?? (await currentEnvValue(deps.coolify, appId, 'AUTH_COOKIE_SECRET'));
@@ -3625,10 +3629,9 @@ async function ensureArchonRuntimeUrl(coolify, appId, dbInternalUrl) {
         return null;
     }
     let host;
-    let pathname;
     let search;
     try {
-        ({ host, pathname, search } = new URL(dbInternalUrl));
+        ({ host, search } = new URL(dbInternalUrl));
     }
     catch {
         // Node's `ERR_INVALID_URL` carries the whole input, credential included, so
@@ -3636,7 +3639,19 @@ async function ensureArchonRuntimeUrl(coolify, appId, dbInternalUrl) {
         throw new Error('platform:archon: the database internal_db_url could not be parsed; not generating DATABASE_URL. Check the database in Coolify and apply again');
     }
     const password = randomBytes(24).toString('base64url');
-    return `postgres://${ARCHON_RUNTIME_ROLE}:${password}@${host}${pathname}${search}`;
+    return `postgres://${ARCHON_RUNTIME_ROLE}:${password}@${host}/${ARCHON_POSTGRES_DB}${search}`;
+}
+/** `internalUrl` on {@link ARCHON_POSTGRES_DB}. The error never carries the URL: it holds a credential. */
+function archonDatabaseUrl(internalUrl) {
+    let url;
+    try {
+        url = new URL(internalUrl);
+    }
+    catch {
+        throw new Error('platform:archon: the database internal_db_url could not be parsed; not generating DATABASE_URL_OWNER. Check the database in Coolify and apply again');
+    }
+    url.pathname = `/${ARCHON_POSTGRES_DB}`;
+    return url.toString();
 }
 /**
  * Thrown by {@link createAiManagementKeyMinter} (never by a test's own
@@ -3720,8 +3735,9 @@ export const PLATFORM_AI_MANAGEMENT_KEY_REF = 'ai:platform:managementKey';
  * What Archon's management key may do in ai: exactly `ai`'s own
  * `ARCHON_AI_PERMISSIONS` (`apps/host/scripts/authz/bootstrap-archon.ts`) --
  * configuration only (offerings, provisioning, offers, budgets, usage, cost)
- * plus deleting (archiving) an organisation, never connections, runs or
- * webhooks. ai's `/v1/platform/keys` route refuses any permission outside
+ * plus deleting (archiving) an organisation and setting another
+ * organisation's webhook address and budget, never connections, runs or
+ * webhook deliveries. ai's `/v1/platform/keys` route refuses any permission outside
  * this same list, so a request for more than this is a 403, not a wider key.
  */
 export const PLATFORM_AI_MANAGEMENT_PERMISSIONS = [
@@ -3732,6 +3748,8 @@ export const PLATFORM_AI_MANAGEMENT_PERMISSIONS = [
     'ai.organisations:provision',
     'ai.organisations:offer',
     'ai.organisations:delete',
+    'ai.organisations:webhook',
+    'ai.organisations:budget',
     'ai.keys:issue',
     'ai.budgets:read',
     'ai.budgets:update',

package/dist/plan/providers-readers.d.ts

@@ -1,6 +1,6 @@
 import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import type { CoolifyClient } from '@wtfalch/providers/coolify';
-import type { ZitadelClient } from '@wtfalch/providers/zitadel';
+import { type ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import type { CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
@@ -53,15 +53,17 @@ export type ScopeResolver = (orgId: OrgId) => Promise<string | null>;
  * resource it creates, keyed `system:kind:key` ({@link storeRecordedIds}
  * below reads those back), and #20's `FoundryStepExecutor` (`executor.ts`)
  * now also calls `StepExecutionContext.recordScopeId` for `coolify_project`,
- * `zitadel_org` and `zitadel_project`, so a resolver built with one of those
- * three `serviceKey`s returns the real id once that step has run. A
- * Cloudflare zone is the one scope id nothing writes yet: `executor.ts`'s
- * `cloudflareZone` records its result only under `cloudflare:zone:<domain>`
- * (a resource id, read back by {@link storeRecordedIds}), not under a plain
- * `cloudflare_zone` scope key — a resolver built with that `serviceKey`
- * still returns `null` for every org. That is the correct "nothing live yet"
- * answer: a reader passed `null` returns `[]`, which `computePlanDetail`
- * (`diff.ts`) already reads as "no live resource".
+ * `zitadel_org`, `zitadel_project` and (#510) `cloudflare_zone`, so a
+ * resolver built with one of those `serviceKey`s returns the real id once
+ * that step has run. Before #510, `cloudflareZone` recorded its result only
+ * under `cloudflare:zone:<domain>` (a resource id, read back by
+ * {@link storeRecordedIds}), never under the plain `cloudflare_zone` scope
+ * key — so a resolver built with that `serviceKey` always returned `null`,
+ * `ProvidersCloudflareReader.listResources` always returned `[]`, and
+ * `diff.ts`'s `planZone` re-proposed provisioning the zone on every apply
+ * even once it was live. A scope key that genuinely has nothing recorded yet
+ * still correctly resolves to `null`: a reader passed `null` returns `[]`,
+ * which `computePlanDetail` (`diff.ts`) already reads as "no live resource".
  */
 export declare function storeScopeResolver(store: DeclaredOrgStore, serviceKey: string): ScopeResolver;
 /**
@@ -112,7 +114,8 @@ export declare class ProvidersCloudflareReader implements CloudflareReader {
 /**
  * Backed by `@wtfalch/providers/zitadel`'s `ZitadelClient.listResources`: one
  * resource per project and per project grant in a ZITADEL org (v1 scope —
- * see that method's own doc comment).
+ * see that method's own doc comment), plus (#510) a synthesized `issuer`
+ * resource once the org's own ZITADEL org is confirmed live.
  */
 export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly client;
@@ -120,6 +123,26 @@ export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly resolveRecordedIds;
     constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
+    /**
+     * #510: `client.listResources` reports only what is *inside* a ZITADEL org
+     * (its projects and grants), never the org record itself, so nothing ever
+     * matched `diff.ts`'s `planIssuer`'s own `zitadel:issuer:<orgId>` lookup —
+     * every plan re-proposed "provision the org's own ZITADEL org" after a
+     * clean apply, even once `zitadel_org` was recorded and live. `orgId` here
+     * is foundry's own id ({@link resourceKey}'s `key` for an issuer, `diff.ts`'s
+     * `planIssuer`), not `zitadelOrgId` — the resource foundry tracks is "this
+     * org's issuer", and ZITADEL's own org id is an implementation detail of
+     * where it lives, the same distinction {@link applyRecordedIds} draws for
+     * every other recorded resource.
+     *
+     * `resolveScope` only reads what was last recorded; it never confirms the
+     * org still exists in ZITADEL. A 404 here means the recorded id no longer
+     * resolves (the org was removed out of band) and reads as "not live" — the
+     * same `[]` answer a never-recorded scope already gives. Any other failure
+     * propagates, same as every other call in this reader. An org ZITADEL still
+     * returns but marks `ORG_STATE_REMOVED` is not live either.
+     */
+    private liveIssuer;
 }
 /**
  * Backed by the same `@wtfalch/providers/coolify`'s `CoolifyClient.listResources`

package/dist/plan/providers-readers.js

@@ -1,3 +1,4 @@
+import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { BOULE_MANAGED_ENV_KEYS } from './boule.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
@@ -8,15 +9,17 @@ import { BOULE_MANAGED_ENV_KEYS } from './boule.js';
  * resource it creates, keyed `system:kind:key` ({@link storeRecordedIds}
  * below reads those back), and #20's `FoundryStepExecutor` (`executor.ts`)
  * now also calls `StepExecutionContext.recordScopeId` for `coolify_project`,
- * `zitadel_org` and `zitadel_project`, so a resolver built with one of those
- * three `serviceKey`s returns the real id once that step has run. A
- * Cloudflare zone is the one scope id nothing writes yet: `executor.ts`'s
- * `cloudflareZone` records its result only under `cloudflare:zone:<domain>`
- * (a resource id, read back by {@link storeRecordedIds}), not under a plain
- * `cloudflare_zone` scope key — a resolver built with that `serviceKey`
- * still returns `null` for every org. That is the correct "nothing live yet"
- * answer: a reader passed `null` returns `[]`, which `computePlanDetail`
- * (`diff.ts`) already reads as "no live resource".
+ * `zitadel_org`, `zitadel_project` and (#510) `cloudflare_zone`, so a
+ * resolver built with one of those `serviceKey`s returns the real id once
+ * that step has run. Before #510, `cloudflareZone` recorded its result only
+ * under `cloudflare:zone:<domain>` (a resource id, read back by
+ * {@link storeRecordedIds}), never under the plain `cloudflare_zone` scope
+ * key — so a resolver built with that `serviceKey` always returned `null`,
+ * `ProvidersCloudflareReader.listResources` always returned `[]`, and
+ * `diff.ts`'s `planZone` re-proposed provisioning the zone on every apply
+ * even once it was live. A scope key that genuinely has nothing recorded yet
+ * still correctly resolves to `null`: a reader passed `null` returns `[]`,
+ * which `computePlanDetail` (`diff.ts`) already reads as "no live resource".
  */
 export function storeScopeResolver(store, serviceKey) {
     return async (orgId) => {
@@ -179,18 +182,34 @@ async function withEnvNamesConfig(client, resource, recorded) {
  * the `agora` kind, like {@link withLogVolumeConfig}. Unlike that read, a
  * failure here is not swallowed: a plan that cannot see the live config must
  * fail, not report it as missing.
+ *
+ * #506: also the live app's own `ports_exposes`, as `config.ports_exposes`,
+ * so `planAgora` can plan the fix for an app Coolify never got that setting
+ * on even when its env already matches -- the exact shape of the Company
+ * Included incident this issue names, where re-planning without this read
+ * would see no drift at all and never run `coolifyAgora` again.
  */
 async function withAgoraEnvConfig(client, resource, recorded) {
     if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('agora:')) {
         return resource;
     }
-    const envs = await client.listEnvs(resource.key);
+    const [envs, app] = await Promise.all([
+        client.listEnvs(resource.key),
+        client.getApplication(resource.key),
+    ]);
     const env = {};
     for (const e of envs) {
         if (!e.is_preview && e.key.startsWith('AGORA_'))
             env[e.key] = e.value;
     }
-    return { ...resource, config: { ...resource.config, env } };
+    // `@wtfalch/providers`' `CoolifyApplication` type does not declare
+    // `ports_exposes` (as of 0.7.3), but `getApplication` returns the raw
+    // Coolify API response (`coolify.ts`'s own `getApplication`, a plain
+    // `request` passthrough), which does carry it -- the same gap that
+    // repo's own CLAUDE.md names for other fields ("verified against a live
+    // instance, not the bundled openapi.yaml").
+    const portsExposes = app.ports_exposes;
+    return { ...resource, config: { ...resource.config, env, ports_exposes: portsExposes } };
 }
 /**
  * #161: the org's own recorded Boule app's live sign-in env vars, as
@@ -273,13 +292,17 @@ export class ProvidersCloudflareReader {
         // A zone needs no mapping: its key is already the zone name, which is
         // foundry's own zone key (`diff.ts`'s `planZone`), so it never matches a
         // recorded provider id and always passes through unchanged.
-        return applyRecordedIds(toFoundryResources('cloudflare', resources), recorded, CLOUDFLARE_DROP_UNRECORDED);
+        return applyRecordedIds(toFoundryResources('cloudflare', resources)
+            // Keyed by the zone id, so a recorded zone id would map it onto the
+            // zone's own key and replace the zone's status; nothing plans from it.
+            .filter((resource) => resource.kind !== 'email_routing'), recorded, CLOUDFLARE_DROP_UNRECORDED);
     }
 }
 /**
  * Backed by `@wtfalch/providers/zitadel`'s `ZitadelClient.listResources`: one
  * resource per project and per project grant in a ZITADEL org (v1 scope —
- * see that method's own doc comment).
+ * see that method's own doc comment), plus (#510) a synthesized `issuer`
+ * resource once the org's own ZITADEL org is confirmed live.
  */
 export class ProvidersZitadelReader {
     client;
@@ -294,11 +317,45 @@ export class ProvidersZitadelReader {
         const zitadelOrgId = await this.resolveScope(orgId);
         if (!zitadelOrgId)
             return [];
-        const [resources, recorded] = await Promise.all([
+        const [resources, recorded, issuer] = await Promise.all([
             this.client.listResources(zitadelOrgId),
             this.resolveRecordedIds(orgId),
+            this.liveIssuer(orgId, zitadelOrgId),
         ]);
-        return applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
+        const mapped = applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
+        return issuer ? [...mapped, issuer] : mapped;
+    }
+    /**
+     * #510: `client.listResources` reports only what is *inside* a ZITADEL org
+     * (its projects and grants), never the org record itself, so nothing ever
+     * matched `diff.ts`'s `planIssuer`'s own `zitadel:issuer:<orgId>` lookup —
+     * every plan re-proposed "provision the org's own ZITADEL org" after a
+     * clean apply, even once `zitadel_org` was recorded and live. `orgId` here
+     * is foundry's own id ({@link resourceKey}'s `key` for an issuer, `diff.ts`'s
+     * `planIssuer`), not `zitadelOrgId` — the resource foundry tracks is "this
+     * org's issuer", and ZITADEL's own org id is an implementation detail of
+     * where it lives, the same distinction {@link applyRecordedIds} draws for
+     * every other recorded resource.
+     *
+     * `resolveScope` only reads what was last recorded; it never confirms the
+     * org still exists in ZITADEL. A 404 here means the recorded id no longer
+     * resolves (the org was removed out of band) and reads as "not live" — the
+     * same `[]` answer a never-recorded scope already gives. Any other failure
+     * propagates, same as every other call in this reader. An org ZITADEL still
+     * returns but marks `ORG_STATE_REMOVED` is not live either.
+     */
+    async liveIssuer(orgId, zitadelOrgId) {
+        try {
+            const found = await this.client.getOrg(zitadelOrgId);
+            if (found.state === 'ORG_STATE_REMOVED')
+                return null;
+        }
+        catch (err) {
+            if (err instanceof ZitadelError && err.status === 404)
+                return null;
+            throw err;
+        }
+        return { system: 'zitadel', kind: 'issuer', key: orgId, config: {} };
     }
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",