@wtfalch/foundry 0.19.1 → 0.21.0

package/dist/plan/executor.js

@@ -9,10 +9,17 @@ import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, cal
 import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, chatInternalNames, chatMasConfigYaml, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
+import { waitForNewDeployment, } from './deploy-health.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
+import { createEdgeAccess, } from './edge-access.js';
+import { EDGE_DNS_WRITE_CONCURRENCY, createEdgeDns, limiter, } from './edge-dns.js';
+import { createEdgeRateLimits, } from './edge-ratelimits.js';
+import { createEdgeTunnels } from './edge-tunnels.js';
+import { createEdgeZones } from './edge-zones.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
-import { EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
+import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
+import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
@@ -79,7 +86,9 @@ function normalizedLoginBaseUri(uri) {
  * is non-null by the same `validateSite` guarantee
  * {@link tunnelIngressHostnames}'s own doc comment cites.
  */
-function cmsHostnameFor(org) {
+// #541: exported so `health-targets.ts` reuses this hostname rule rather
+// than restating it; nothing else about this function changes.
+export function cmsHostnameFor(org) {
     return `cms.${org.domain}`;
 }
 /**
@@ -92,7 +101,8 @@ function cmsHostnameFor(org) {
  * ({@link tunnelIngressHostnames}), the same subdomain-of-the-org's-own-domain
  * shape {@link cmsHostnameFor} uses for `cms.<domain>`.
  */
-function callsHostnameFor(org) {
+// #541: exported for the same reason `cmsHostnameFor` just above now is.
+export function callsHostnameFor(org) {
     return org.calls.usesDomain && org.domain
         ? `calls.${org.domain}`
         : `${org.slug}-calls.oikos.host`;
@@ -228,6 +238,14 @@ const DEFAULT_APP_DOCKERFILE = '/apps/hestia/Dockerfile';
 const CMS_REPO = 'wtfalch/cms';
 const CMS_APP_DOCKERFILE = '/Dockerfile';
 const CMS_SITE_APP_DOCKERFILE = '/apps/site/Dockerfile';
+/**
+ * #543: both of `wtfalch/cms`'s apps are Next.js hosts on the same
+ * app-template convention as Archon/edge/ai's runner/Boule -- port 3000,
+ * `/api/health` (`healthUrls`'s own default for a non-static entry). Neither
+ * create call below passes `ports_exposes` (unlike Agora's #506 fix), so
+ * this is the port Coolify's own default build already listens its proxy on.
+ */
+const CMS_APP_PORT = 3000;
 /**
  * #164: the repo `coolifyAgora` builds the org's Agora from
  * (https://github.com/wtfalch/agora) -- the issue's own "How" names this
@@ -261,6 +279,8 @@ const AGORA_APP_DOCKERFILE = '/apps/agora/Dockerfile';
  */
 const BOULE_REPO = 'wtfalch/boule';
 const BOULE_APP_DOCKERFILE = '/Dockerfile';
+/** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
+const BOULE_PORT = 3000;
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -479,6 +499,16 @@ const MAIL_ROLE_MAILBOXES_SCOPE_KEY = 'mail_role_mailboxes';
 const AI_KEY_UNDELIVERED_SCOPE_KEY = 'ai_key_undelivered';
 /** How many times `aiKey` tries `deliverSecret` before giving up. */
 const AI_KEY_DELIVERY_ATTEMPTS = 3;
+/**
+ * #515: the limit `aiBudget` last applied, a flat scope id (no `:`) alongside
+ * `AI_KEY_UNDELIVERED_SCOPE_KEY`'s own. AI's `updateBudget` offers no read
+ * back, so nothing else can tell `diff.ts`'s `planAiBudget` the limit is
+ * already live -- without this, every plan for an applied org proposed
+ * setting it again. `providers-readers.ts`'s `ProvidersAiReader` keeps its
+ * own copy of this literal, the same "restated, not shared" choice this
+ * codebase already makes for `cloudflare_zone`/`zitadel_org`.
+ */
+const AI_BUDGET_LIMIT_SCOPE_KEY = 'ai_budget_limit_micros';
 const DAY_MS = 24 * 60 * 60 * 1000;
 /** What a failed files call says about itself: its HTTP status, never its message, which can echo a value. */
 function filesErrorCause(error) {
@@ -582,6 +612,21 @@ const CALLS_SERVICE_DB_SCOPE_KEY = 'coolify_calls_service_database';
 const CALLS_SERVICE_REPO = 'wtfalch/calls';
 /** `packages/service/Dockerfile`, built from the repo root (that Dockerfile's own top comment). */
 const CALLS_SERVICE_DOCKERFILE = '/packages/service/Dockerfile';
+/**
+ * #543: the calls service's own health route. Restated, not imported, from
+ * `health-targets.ts`'s private `CALLS_HEALTH_PATH` of the same value --
+ * issue #543's own text keeps that issue's (#541) diff and this one
+ * independent of each other.
+ */
+const CALLS_HEALTH_CHECK_PATH = '/healthz';
+/**
+ * #543: the chat service's own health route, reached through Agora's proxy
+ * (`chat-matrix.ts`'s "NO PUBLIC HOSTNAME OF ITS OWN": Synapse and MAS have
+ * none, only this). Restated from `health-targets.ts`'s private
+ * `CHAT_SERVICE_HEALTH_PATH` of the same value, for the same reason as
+ * {@link CALLS_HEALTH_CHECK_PATH} above.
+ */
+const CHAT_SERVICE_HEALTH_CHECK_PATH = '/_chat/health';
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
  * `exited:unhealthy` `` -- `@wtfalch/providers`' own doc comment) means it is
@@ -627,6 +672,43 @@ export async function getDatabaseStarted(coolify, dbId) {
     await sleep(graceMs);
     return db;
 }
+/**
+ * #543: the plain `setTimeout`-based sleep every company-app deploy wait
+ * falls back to when `FoundryStepExecutorPorts.runtime.sleep` is not given --
+ * the same default `platform-providers.ts`'s own per-step `defaultSleep`
+ * constants use.
+ */
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * #543 review: a deploy waits with `'ready'` on a public url only when
+ * nothing still has to create or change the route to it. Otherwise it is
+ * `'deployment-only'`, so a fresh company is not failed for a tunnel, DNS
+ * record or Agora that a later step in the same plan creates. From
+ * `recorded`: a hostname under `org.domain` has a route once the tunnel step
+ * published its DNS record ({@link CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY});
+ * a hostname elsewhere is on the shared wildcard tunnel and already routed.
+ * `viaAgora` (the chat service, reached through Agora's proxy) also needs
+ * Agora deployed ({@link AGORA_DEPLOYED_SCOPE_KEY}). A hostname behind
+ * Cloudflare Access is never probed: with no credentials every answer is a
+ * redirect or 403.
+ */
+function publicHealthCheck(org, recorded, hostname, path, options = {}) {
+    const app = appEntry(org.hosting);
+    const behindAccess = (org.hosting.access ?? []).some((rule) => rule.hostname === hostname) ||
+        (app !== undefined &&
+            app.accessEmails.length > 0 &&
+            entryHostnames(org, app).includes(hostname));
+    if (behindAccess)
+        return { kind: 'deployment-only' };
+    const routed = (host) => !org.domain ||
+        !(host === org.domain || host.endsWith(`.${org.domain}`)) ||
+        (recorded[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY] ?? '').split(',').includes(host);
+    const agoraReady = !options.viaAgora ||
+        (Boolean(recorded[AGORA_DEPLOYED_SCOPE_KEY]) && routed(agoraHostnameFor(org)));
+    if (!agoraReady || !routed(hostname))
+        return { kind: 'deployment-only' };
+    return { kind: 'ready', url: `https://${hostname}${path}` };
+}
 /** Timing for the wait in {@link getDatabaseStarted}; a test swaps `sleep` and `now` for a fake clock. */
 export const databaseStartWait = {
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -640,6 +722,12 @@ export const databaseStartWait = {
 // ---------------------------------------------------------------------------
 export class FoundryStepExecutor {
     ports;
+    edgeDns;
+    edgeTunnels;
+    edgeAccess;
+    edgeRateLimits;
+    edgeZones;
+    edgeWriteSlot;
     constructor(ports) {
         this.ports = ports;
     }
@@ -686,7 +774,7 @@ export class FoundryStepExecutor {
             case 'ai:organisation':
                 return this.aiOrganisation(action, org);
             case 'ai:budget':
-                return this.aiBudget(action, org);
+                return this.aiBudget(action, org, context);
             case 'ai:key':
                 // The org's own key is keyed `<orgId>`, an entry's `<orgId>:<entry>` (F6a).
                 return action.key.includes(':')
@@ -774,7 +862,7 @@ export class FoundryStepExecutor {
                 // `everyone` is Cloudflare's own shape for "match every visitor".
                 return { decision: 'bypass', include: [{ everyone: {} }] };
             case 'service-token': {
-                const token = await this.ports.cloudflare.findServiceTokenByName(rule.serviceTokenName);
+                const token = await this.accessPort().findServiceTokenByName(rule.serviceTokenName);
                 if (!token) {
                     throw new Error(`cloudflare:access for ${org.slug}: no Cloudflare Access service token named '${rule.serviceTokenName}'`);
                 }
@@ -788,7 +876,7 @@ export class FoundryStepExecutor {
      */
     async cloudflareAccessApp(org, opts) {
         const { appName, domain, policyName, policy } = opts;
-        const cf = this.ports.cloudflare;
+        const cf = this.accessPort();
         const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
         const foreign = onDomain.find((a) => a.name !== appName);
         if (foreign) {
@@ -812,12 +900,10 @@ export class FoundryStepExecutor {
      * gate), so `org.domain` is set and that zone is the org's alone, never
      * shared with another org the way `oikos.host` is.
      *
-     * Rate limiting rules attach to a zone's `http_ratelimit` phase entry
-     * point ruleset, one `GET`/`PUT` pair per zone (`@wtfalch/providers` 0.5.0
-     * has no typed method for either -- `CloudflarePort.request`'s own doc
-     * comment) -- so "find by name" here means reading that one ruleset's
-     * `rules[]` and matching `RATE_LIMIT_RULE_DESCRIPTION`, the same shape
-     * `cloudflareAccess` above finds its own Access app by name. The Free
+     * Rate limiting rules go through edge (`RateLimitPort`) -- so "find by
+     * name" here means listing the zone's rules and matching
+     * `RATE_LIMIT_RULE_DESCRIPTION`, the same shape `cloudflareAccess` above
+     * finds its own Access app by name. The Free
      * plan allows exactly one rule per zone, so a rule already there under a
      * different description is refused, never adopted or replaced, mirroring
      * `cloudflareAccess`'s own refusal when a foreign Access app already
@@ -827,40 +913,33 @@ export class FoundryStepExecutor {
         if (!org.domain) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: hosting.usesDomain is set but domain is null`);
         }
-        const cf = this.ports.cloudflare;
+        const cf = this.zonePort();
         const zone = await cf.findZoneByApex(org.domain);
         if (!zone) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
         }
-        const path = `/zones/${zone.id}/rulesets/phases/http_ratelimit/entrypoint`;
-        const existing = await cf.request('GET', path, undefined, true);
-        const rules = existing?.rules ?? [];
+        const rateLimits = this.rateLimitPort();
+        const rules = await rateLimits.listRateLimitRules(zone.id);
         const own = rules.find((r) => r.description === RATE_LIMIT_RULE_DESCRIPTION);
-        if (own)
-            return { resourceId: own.id };
-        const foreign = rules.find((r) => r.description !== RATE_LIMIT_RULE_DESCRIPTION);
-        if (foreign) {
-            throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
-        }
-        const updated = await cf.request('PUT', path, {
-            rules: [
-                {
-                    description: RATE_LIMIT_RULE_DESCRIPTION,
-                    expression: SIGN_IN_PATH_EXPRESSION,
-                    action: 'block',
-                    ratelimit: {
-                        characteristics: ['cf.colo.id', 'ip.src'],
-                        period: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
-                        requests_per_period: RATE_LIMIT_REQUESTS_PER_PERIOD,
-                        mitigation_timeout: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
-                    },
-                },
-            ],
-        });
-        const created = updated.rules?.[0];
-        if (!created) {
-            throw new Error(`cloudflare:ratelimit for ${org.slug}: PUT ${path} did not return the created rule`);
+        if (!own) {
+            const foreign = rules[0];
+            if (foreign) {
+                throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
+            }
         }
+        // Edge adopts a live rule with no edge row (made before edge owned rate
+        // limits) and then makes the rule once: a repeat returns it unchanged.
+        const created = await rateLimits.createRateLimitRule(zone.id, {
+            description: RATE_LIMIT_RULE_DESCRIPTION,
+            expression: SIGN_IN_PATH_EXPRESSION,
+            action: 'block',
+            ratelimit: {
+                characteristics: ['cf.colo.id', 'ip.src'],
+                period: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
+                requests_per_period: RATE_LIMIT_REQUESTS_PER_PERIOD,
+                mitigation_timeout: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
+            },
+        });
         return { resourceId: created.id };
     }
     /**
@@ -913,7 +992,7 @@ export class FoundryStepExecutor {
         if (!org.domain) {
             throw new Error(`${at}: worker needs org.domain, and validateHosting already refuses it without one`);
         }
-        const zone = await this.ports.cloudflare.findZoneByApex(org.domain);
+        const zone = await this.zonePort().findZoneByApex(org.domain);
         if (!zone) {
             throw new Error(`${at}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
         }
@@ -1066,7 +1145,7 @@ export class FoundryStepExecutor {
             throw new Error(`${at}: a route is recorded but its zone is not, so foundry cannot tell which zone holds it; refuses to forget it`);
         }
         const { id, apex } = JSON.parse(recordedZone);
-        const zone = await this.ports.cloudflare.findZoneByApex(apex);
+        const zone = await this.zonePort().findZoneByApex(apex);
         return zone && zone.id === id ? id : undefined;
     }
     /** Deletes the route an interrupted apply was creating, if `findRoute` shows it exists, points at that apply's script, and is not `keepRouteId`. */
@@ -1670,6 +1749,20 @@ export class FoundryStepExecutor {
         }
         if (want.autoDeploy !== have.autoDeploy)
             patch.is_auto_deploy_enabled = want.autoDeploy;
+        // #543: the health-check quartet too, every run -- the same reason
+        // Archon's own doc comment gives (without one, Coolify's rolling update
+        // has nothing to wait on and stops the old container immediately). The
+        // port Coolify's own health probe reaches is whatever `ports_exposes`
+        // names: 80 for a static entry (Coolify's own web server), or the
+        // entry's declared `port`. An entry with neither (an arbitrary buildpack,
+        // no declared port) gets none here -- there is no port this executor
+        // could honestly name for Coolify to probe, the same "nothing to check
+        // instead" reasoning `platform:ai`'s worker and `platform:files`'
+        // migrate job are left out of #543's own quartet for.
+        const healthCheckPort = isStatic ? 80 : want.port;
+        if (healthCheckPort !== null) {
+            Object.assign(patch, healthCheckSettings(entry.healthPath ?? (isStatic ? '/' : '/api/health'), healthCheckPort));
+        }
         // Create names the app after `domains`; a changed name reaches a live app
         // here (rule 3). The internal name is set after create, as the calls
         // stack's apps do.
@@ -1747,10 +1840,23 @@ export class FoundryStepExecutor {
         // declared appEnv changed.
         // A new folder needs a build, which a restart does not do, so a settings
         // change deploys instead (rule 3), and that carries the env too.
-        if (settingsNeedDeploy)
-            await this.ports.coolify.deploy(appId);
-        else if ((appEnv.changed || dbNeedsRestart) && existing)
+        if (settingsNeedDeploy) {
+            // #543: every deploy waits for health through the shared helper, never
+            // a fire-and-forget `deploy` call -- `names[0]` is the same hostname
+            // `healthUrls` probes for this entry; an internal entry (no hostname)
+            // has nothing this executor could reach from outside the app's own
+            // Docker network, so `'deployment-only'` is the honest fallback there
+            // (Coolify's own deployment record is still the whole check).
+            const [hostname] = names;
+            const healthPath = entry.healthPath ?? (isStatic ? '/' : '/api/health');
+            const runtime = this.ports.runtime ?? {};
+            await waitForNewDeployment(this.ports.coolify, appId, hostname
+                ? publicHealthCheck(org, context.recordedIds(), hostname, healthPath)
+                : { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, `coolify:app:${entry.key}`, `${org.slug}'s ${entry.key === APP_ENTRY_KEY ? 'app' : `${entry.key} app`} stays at its previous deploy`);
+        }
+        else if ((appEnv.changed || dbNeedsRestart) && existing) {
             await this.ports.coolify.restart(appId);
+        }
         // Recorded only after the redeploy succeeded: a failed one leaves the old
         // value, so the next plan replans (rule 3). The db marker is not a URL.
         // A port taken back to null was not patched, so the marker keeps the old
@@ -2481,11 +2587,11 @@ export class FoundryStepExecutor {
             scopedProjectIds.push(platformLettermintProjectId);
         }
         await this.ports.lettermint.restrictDomainToProjects(domain.id, scopedProjectIds);
-        const zone = await this.ports.cloudflare.findZoneByApex(mailDomain);
+        const zone = await this.zonePort().findZoneByApex(mailDomain);
         if (!zone) {
             throw new Error(`Lettermint for ${org.slug}: no Cloudflare zone found for ${mailDomain}`);
         }
-        await this.publishLettermintDnsRecords(zone.id, domain.dnsRecords);
+        await this.publishLettermintDnsRecords(zone.name, domain.dnsRecords);
         await this.ports.lettermint.verifyDomain(domain.id);
     }
     /**
@@ -2590,6 +2696,21 @@ export class FoundryStepExecutor {
             dockerfileLocation: CMS_APP_DOCKERFILE,
             domain: cmsHostnameFor(org),
         });
+        // #543: the health-check quartet, every run, on both apps -- their own
+        // `/api/health` (`healthUrls`'s own default for site/cms), on the port
+        // {@link CMS_APP_PORT}'s own doc comment explains. Unlike every other
+        // company app in this file, neither app here is ever deployed through an
+        // explicit `coolify.deploy`/`waitForNewDeployment` call: `findOrCreateCmsApp`
+        // (below) never sets `instant_deploy` either, the same gap #504 found and
+        // fixed for Agora and Boule -- fixing that for cms/site is its own,
+        // separate issue (out of #543's scope: this issue adds waits to existing
+        // deploys, it does not add a deploy where none exists).
+        await this.ports.coolify.updateApplication(site.appId, {
+            ...healthCheckSettings('/api/health', CMS_APP_PORT),
+        });
+        await this.ports.coolify.updateApplication(cms.appId, {
+            ...healthCheckSettings('/api/health', CMS_APP_PORT),
+        });
         // Every app foundry deploys keeps its own logs (#75) -- reused as-is for
         // both of these two, the same unconditional call `coolifyApp` makes for
         // its own one app.
@@ -2967,10 +3088,21 @@ export class FoundryStepExecutor {
         // converges. A brand new app or a freshly minted secret set are the only
         // two reasons the file just written could differ from what the container
         // already has -- reusing existing secrets means byte-identical content.
-        if (!synapse.existed || secrets.changed)
-            await this.ports.coolify.deploy(synapse.appId);
-        if (!mas.existed || secrets.changed)
-            await this.ports.coolify.deploy(mas.appId);
+        //
+        // #543: both waits are `'deployment-only'` -- Synapse and MAS have their
+        // own health check off (just above: "Neither Synapse's nor MAS's health
+        // check can pass before the other is up"), so there is no url either
+        // could honestly be probed at; `coolify.deployAndWait` reaching Coolify's
+        // own deployment record is still the whole check, same as `platform:ai`'s
+        // worker.
+        const runtime = this.ports.runtime ?? {};
+        const sleep = runtime.sleep ?? defaultSleep;
+        if (!synapse.existed || secrets.changed) {
+            await waitForNewDeployment(this.ports.coolify, synapse.appId, { kind: 'deployment-only' }, runtime, sleep, 'coolify:calls', `${org.slug}'s calls Synapse stays at its previous deploy`);
+        }
+        if (!mas.existed || secrets.changed) {
+            await waitForNewDeployment(this.ports.coolify, mas.appId, { kind: 'deployment-only' }, runtime, sleep, 'coolify:calls', `${org.slug}'s calls MAS stays at its previous deploy`);
+        }
         return { resourceId: mas.appId };
     }
     /**
@@ -3186,6 +3318,15 @@ export class FoundryStepExecutor {
      */
     async coolifyChat(action, org, context) {
         const recorded = context.recordedIds();
+        // #543: every deploy below waits for health. The chat service answers
+        // `CHAT_SERVICE_HEALTH_CHECK_PATH` only through Agora's own proxy
+        // (`chat-matrix.ts`'s "NO PUBLIC HOSTNAME OF ITS OWN" -- the service has
+        // no domain of its own), so that is the url every `'ready'` check below
+        // probes; Synapse and MAS stay `'deployment-only'`, the same reason
+        // `coolifyCalls`'s own comment gives for its Synapse/MAS.
+        const runtime = this.ports.runtime ?? {};
+        const sleep = runtime.sleep ?? defaultSleep;
+        const chatServiceHealth = () => publicHealthCheck(org, context.recordedIds(), agoraHostnameFor(org), CHAT_SERVICE_HEALTH_CHECK_PATH, { viaAgora: true });
         if (recorded[`coolify:chat:${action.key}`]) {
             // #456: `planChat` plans this distinct, non-re-key action for a live
             // chat app that predates the owner/runtime database split (#239) --
@@ -3210,7 +3351,7 @@ export class FoundryStepExecutor {
                     throw new Error(`coolify:chat database split for ${org.slug}: the chat service's database (${serviceDbId}) has no internal_db_url -- it may have been deleted or is unreachable; this is not expected for an already-live chat`);
                 }
                 if (push.changed || !recorded[markerKey]) {
-                    await this.ports.coolify.deploy(serviceAppId);
+                    await waitForNewDeployment(this.ports.coolify, serviceAppId, chatServiceHealth(), runtime, sleep, 'coolify:chat', `${org.slug}'s chat service stays at its previous deploy`);
                 }
                 context.recordScopeId(markerKey, '1');
                 return { resourceId: serviceAppId };
@@ -3233,8 +3374,9 @@ export class FoundryStepExecutor {
                 ]);
                 // Deploy first, marker last: a failed deploy leaves the marker unset,
                 // so the next plan still carries this step and the container gets the env.
-                if (client.changed || !hadMarker)
-                    await this.ports.coolify.deploy(serviceAppId);
+                if (client.changed || !hadMarker) {
+                    await waitForNewDeployment(this.ports.coolify, serviceAppId, chatServiceHealth(), runtime, sleep, 'coolify:chat', `${org.slug}'s chat service stays at its previous deploy`);
+                }
                 context.recordScopeId(CHAT_INTROSPECTION_SCOPE_KEY, client.appId);
                 return { resourceId: serviceAppId };
             }
@@ -3336,6 +3478,8 @@ export class FoundryStepExecutor {
         });
         await this.ports.coolify.updateApplication(service.appId, {
             custom_internal_name: names.service,
+            // No Coolify health check on the chat service (#543 review): its image
+            // is node:22-alpine with no curl, which Coolify's container check runs.
         });
         context.recordScopeId(CHAT_SYNAPSE_SCOPE_KEY, synapse.appId);
         context.recordScopeId(CHAT_SERVICE_SCOPE_KEY, service.appId);
@@ -3402,7 +3546,11 @@ export class FoundryStepExecutor {
                 secrets.changed ||
                 (app === service && (serviceDbPush.changed || introspection.changed)) ||
                 !isRunningOrStarting((await this.ports.coolify.getApplication(app.appId)).status)) {
-                await this.ports.coolify.deploy(app.appId);
+                // #543: `'ready'` for the service (it has a real route, probed
+                // through Agora); `'deployment-only'` for Synapse/MAS, same as this
+                // function's two re-key paths above and `coolifyCalls`'s own
+                // Synapse/MAS.
+                await waitForNewDeployment(this.ports.coolify, app.appId, app === service ? chatServiceHealth() : { kind: 'deployment-only' }, runtime, sleep, 'coolify:chat', `${org.slug}'s chat ${app === service ? 'service' : app === synapse ? 'Synapse' : 'MAS'} stays at its previous deploy`);
             }
         }
         // After the write and the deploys, so a failure before them leaves the
@@ -3490,6 +3638,8 @@ export class FoundryStepExecutor {
         // step again for a live app whose marker is missing or stale, so an app
         // made before this existed gets its name here. The marker, recorded last,
         // tells `desiredAgoraEnv` that the name and the env are both in place.
+        // No Coolify health check on the calls service (#543 review): its image
+        // is node:24-alpine with no curl, which Coolify's container check runs.
         await this.ports.coolify.updateApplication(app.appId, { custom_internal_name: name });
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
@@ -3557,7 +3707,11 @@ export class FoundryStepExecutor {
         // existed, still pointed at a role nothing has created.
         const givesTokenEnv = token !== null && context.recordedIds()[CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY] !== tokenMarker;
         if (app.existed && dbSplitNeedsRefresh) {
-            await this.ports.coolify.deploy(app.appId);
+            // #543: every deploy waits for health -- the calls service's own
+            // public hostname and `/healthz`, the same path the quartet above
+            // just set on the app.
+            const runtime = this.ports.runtime ?? {};
+            await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), callsHostnameFor(org), CALLS_HEALTH_CHECK_PATH), runtime, runtime.sleep ?? defaultSleep, 'coolify:calls-service', `${org.slug}'s calls service stays at its previous deploy`);
         }
         else if (app.existed && (!callsServiceHasName(org, context.recordedIds()) || givesTokenEnv)) {
             await this.ports.coolify.restart(app.appId);
@@ -3771,11 +3925,14 @@ export class FoundryStepExecutor {
         const portDiffers = app.existed &&
             (await this.ports.coolify.getApplication(app.appId)).ports_exposes !==
                 AGORA_APP_PORTS_EXPOSES;
-        if (portDiffers) {
-            await this.ports.coolify.updateApplication(app.appId, {
-                ports_exposes: AGORA_APP_PORTS_EXPOSES,
-            });
-        }
+        // #543: the health-check quartet, every run, like Archon's own patch --
+        // Agora is static (Caddy on {@link AGORA_APP_PORTS_EXPOSES}), so the only
+        // health route available is a plain page load at `/` (the same depth
+        // `health-targets.ts` gives it: `'page'`, not an API).
+        await this.ports.coolify.updateApplication(app.appId, {
+            ...(portDiffers ? { ports_exposes: AGORA_APP_PORTS_EXPOSES } : {}),
+            ...healthCheckSettings('/', Number(AGORA_APP_PORTS_EXPOSES)),
+        });
         // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
         // Coolify's own env store matching `env`, which is why that store alone
         // can no longer tell a changed value from one already live.
@@ -3794,16 +3951,16 @@ export class FoundryStepExecutor {
         // confirmed (the marker never changes value once set), never again -- a
         // live app is only ever restarted from here on, unless #506's port fix
         // below needs its own deploy.
-        if (!context.recordedIds()[AGORA_DEPLOYED_SCOPE_KEY]) {
-            await this.ports.coolify.deploy(app.appId);
+        if (!context.recordedIds()[AGORA_DEPLOYED_SCOPE_KEY] || portDiffers) {
+            // #543/#506: every deploy waits for health -- Agora's own page at `/`.
+            // A first deploy and a port fix share this one wait (a port fix needs
+            // its own full deploy; env drift alone only needs the cheaper restart
+            // in the branch below, and this deploy already carries this run's env,
+            // pushed above, so the two never both run).
+            const runtime = this.ports.runtime ?? {};
+            await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), agoraHostnameFor(org), '/'), runtime, runtime.sleep ?? defaultSleep, 'coolify:agora', `${org.slug}'s Agora stays at its previous deploy`);
             context.recordScopeId(AGORA_DEPLOYED_SCOPE_KEY, '1');
         }
-        else if (portDiffers) {
-            // #506: a port fix needs its own full deploy -- env drift alone only
-            // needs the cheaper restart, and this deploy already carries this
-            // run's env (pushed above), so the two never both run.
-            await this.ports.coolify.deploy(app.appId);
-        }
         else if (app.existed && (envChanged || !alreadyActivated)) {
             await this.ports.coolify.restart(app.appId);
         }
@@ -3870,6 +4027,12 @@ export class FoundryStepExecutor {
         }));
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
+        // #543: the health-check quartet, every run, like Archon's own patch --
+        // Boule's own `/api/health` (`healthUrls`'s default) on its Dockerfile's
+        // `EXPOSE 3000` ({@link BOULE_PORT}'s own doc comment).
+        await this.ports.coolify.updateApplication(app.appId, {
+            ...healthCheckSettings('/api/health', BOULE_PORT),
+        });
         const liveEnv = new Map((await this.ports.coolify.listEnvs(app.appId))
             .filter((e) => !e.is_preview)
             .map((e) => [e.key, e.value]));
@@ -3894,7 +4057,9 @@ export class FoundryStepExecutor {
         // but never started. Deployed once this executor has confirmed, never
         // again -- a live app is only ever restarted from here on.
         if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
-            await this.ports.coolify.deploy(app.appId);
+            // #543: every deploy waits for health -- Boule's own public hostname.
+            const runtime = this.ports.runtime ?? {};
+            await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), bouleHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:boule', `${org.slug}'s Boule stays at its previous deploy`);
             context.recordScopeId(BOULE_DEPLOYED_SCOPE_KEY, '1');
         }
         else if (app.existed &&
@@ -3934,6 +4099,87 @@ export class FoundryStepExecutor {
             throw new Error('ai: this executor was built without an ai port (#177)');
         return port;
     }
+    /**
+     * Every DNS record call runs through edge (`edge.dns`, the platform
+     * credential), adopting live records before it first changes them. `dns` on
+     * the ports is a seam for a host or test that supplies its own {@link DnsPort}.
+     */
+    dnsPort() {
+        if (this.ports.dns)
+            return this.ports.dns;
+        if (!this.ports.edge) {
+            throw new Error('dns: this executor was built without an EdgePort (F4.dns)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeDns ??= createEdgeDns(this.ports.edge.dns, { writeSlot: this.edgeWriteSlot });
+        return this.edgeDns;
+    }
+    /**
+     * Every tunnel call runs through edge (`edge.tunnels`, the platform
+     * credential), adopting a live tunnel before it first configures, reads the
+     * token of or deletes it. Shares edge's write slot with {@link dnsPort}.
+     */
+    tunnelPort() {
+        if (this.ports.tunnels)
+            return this.ports.tunnels;
+        if (!this.ports.edge) {
+            throw new Error('tunnels: this executor was built without an EdgePort (F4.tunnels)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeTunnels ??= createEdgeTunnels(this.ports.edge.tunnels, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeTunnels;
+    }
+    /**
+     * Every Access call runs through edge (`edge.access`, the platform
+     * credential), adopting a live app before it first adds a policy to or
+     * deletes it. Shares edge's write slot with {@link dnsPort}.
+     */
+    accessPort() {
+        if (this.ports.access)
+            return this.ports.access;
+        if (!this.ports.edge) {
+            throw new Error('access: this executor was built without an EdgePort (F4.access)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeAccess ??= createEdgeAccess(this.ports.edge.access, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeAccess;
+    }
+    /**
+     * Every rate limiting rule call runs through edge (`edge.ratelimits`, the
+     * platform credential), adopting the live rule before it first creates it.
+     * Shares edge's write slot with {@link dnsPort}.
+     */
+    rateLimitPort() {
+        if (this.ports.ratelimits)
+            return this.ports.ratelimits;
+        if (!this.ports.edge) {
+            throw new Error('ratelimits: this executor was built without an EdgePort (F4.ratelimits)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeRateLimits ??= createEdgeRateLimits(this.ports.edge.ratelimits, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeRateLimits;
+    }
+    /**
+     * Every zone lookup and create runs through edge (`edge.zones`, the
+     * platform credential), adopting a live zone before it first creates it.
+     * Shares edge's write slot with {@link dnsPort}.
+     */
+    zonePort() {
+        if (this.ports.zones)
+            return this.ports.zones;
+        if (!this.ports.edge) {
+            throw new Error('zones: this executor was built without an EdgePort (F4.zones)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeZones ??= createEdgeZones(this.ports.edge.zones, { writeSlot: this.edgeWriteSlot });
+        return this.edgeZones;
+    }
     async jobsPort(org) {
         const port = this.ports.jobsScheduler ?? (await this.ports.platformOrg?.jobs());
         if (!port) {
@@ -4002,7 +4248,7 @@ export class FoundryStepExecutor {
             }
             // Cleared, not deleted (#7 corrections 1): an ingress with only the
             // mandatory catch-all routes nothing.
-            await this.ports.cloudflare.putTunnelConfig(tunnelId, {
+            await this.tunnelPort().putTunnelConfig(tunnelId, {
                 ingress: [{ service: 'http_status:404' }],
             });
             // #235: park stops the connector too -- an ingress with nothing
@@ -4028,8 +4274,9 @@ export class FoundryStepExecutor {
         // domain declared still leaves `destroy` a way to recognise the old
         // id's CNAMEs as this tunnel's own rather than a foreign record.
         const recordedTunnelId = context.recordedIds()[`cloudflare:tunnel:${action.key}`];
-        const existing = await this.ports.cloudflare.findTunnelByName(tunnelName);
-        const tunnel = existing ?? (await this.ports.cloudflare.createTunnel(tunnelName));
+        const tunnels = this.tunnelPort();
+        const existing = await tunnels.findTunnelByName(tunnelName);
+        const tunnel = existing ?? (await tunnels.createTunnel(tunnelName));
         const previousIds = parseTunnelPreviousIds(context.recordedIds());
         if (recordedTunnelId && recordedTunnelId !== tunnel.id) {
             previousIds.add(recordedTunnelId);
@@ -4056,7 +4303,7 @@ export class FoundryStepExecutor {
             hostname,
             service: COOLIFY_PROXY_ORIGIN,
         }));
-        await this.ports.cloudflare.putTunnelConfig(tunnel.id, {
+        await this.tunnelPort().putTunnelConfig(tunnel.id, {
             ingress: [...ingress, { service: 'http_status:404' }],
         });
         // #235: a connector for this org's own tunnel, the same call every
@@ -4070,7 +4317,7 @@ export class FoundryStepExecutor {
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         await ensureCloudflaredConnector({
             coolify: this.ports.coolify,
-            cloudflare: this.ports.cloudflare,
+            tunnels: this.tunnelPort(),
             tunnelId: tunnel.id,
             appName: `${org.slug}-cloudflared`,
             projectUuid,
@@ -4201,7 +4448,7 @@ export class FoundryStepExecutor {
      * nothing of this domain's left in that set either way.
      */
     async deleteStaleTunnelDnsRecords(tunnelId, previousIds, previousDomain, previousHostnames, context) {
-        const zone = await this.ports.cloudflare.findZoneByApex(previousDomain);
+        const zone = await this.zonePort().findZoneByApex(previousDomain);
         if (!zone)
             return;
         const dnsTargets = new Set([`${tunnelId}.cfargotunnel.com`]);
@@ -4209,13 +4456,13 @@ export class FoundryStepExecutor {
             if (id !== tunnelId)
                 dnsTargets.add(`${id}.cfargotunnel.com`);
         }
-        const cf = this.ports.cloudflare;
+        const dns = this.dnsPort();
         const records = previousHostnames.length > 0
-            ? (await Promise.all(previousHostnames.map((hostname) => cf.findDnsRecord(zone.id, hostname, 'CNAME')))).flat()
-            : await cf.listDnsRecords(zone.id, { type: 'CNAME' });
+            ? (await Promise.all(previousHostnames.map((hostname) => dns.findDnsRecord(zone.name, hostname, 'CNAME')))).flat()
+            : await dns.listDnsRecords(zone.name, { type: 'CNAME' });
         for (const record of records) {
             if (dnsTargets.has(record.content)) {
-                await cf.deleteDnsRecord(zone.id, record.id);
+                await dns.deleteDnsRecord(zone.name, record.id);
             }
         }
         if (previousHostnames.length > 0) {
@@ -4283,8 +4530,8 @@ export class FoundryStepExecutor {
      * both read this set.
      */
     async publishTunnelDnsRecords(org, domain, tunnelId, previousIds, previousHostnames, context) {
-        const cf = this.ports.cloudflare;
-        const zone = await cf.findZoneByApex(domain);
+        const dns = this.dnsPort();
+        const zone = await this.zonePort().findZoneByApex(domain);
         if (!zone) {
             throw new Error(`cloudflare:tunnel for ${org.slug}: no Cloudflare zone found for ${domain} to point its hostnames at -- cloudflare:zone must provision it first`);
         }
@@ -4296,14 +4543,14 @@ export class FoundryStepExecutor {
         const toCreate = [];
         const toRepoint = [];
         for (const hostname of hostnames) {
-            const [a] = await cf.findDnsRecord(zone.id, hostname, 'A');
-            const [aaaa] = await cf.findDnsRecord(zone.id, hostname, 'AAAA');
+            const [a] = await dns.findDnsRecord(zone.name, hostname, 'A');
+            const [aaaa] = await dns.findDnsRecord(zone.name, hostname, 'AAAA');
             const foreign = a ?? aaaa;
             if (foreign) {
                 conflicts.push(`${hostname} already has a ${foreign.type} record`);
                 continue;
             }
-            const [cname] = await cf.findDnsRecord(zone.id, hostname, 'CNAME');
+            const [cname] = await dns.findDnsRecord(zone.name, hostname, 'CNAME');
             if (cname && cname.content !== dnsTarget) {
                 if (previousTargets.has(cname.content)) {
                     toRepoint.push({ hostname, recordId: cname.id });
@@ -4335,7 +4582,7 @@ export class FoundryStepExecutor {
         for (const hostname of settled)
             recordTracked(hostname);
         for (const hostname of toCreate) {
-            await cf.createDnsRecord(zone.id, {
+            await dns.createDnsRecord(zone.name, {
                 type: 'CNAME',
                 name: hostname,
                 content: dnsTarget,
@@ -4344,7 +4591,7 @@ export class FoundryStepExecutor {
             recordTracked(hostname);
         }
         for (const { hostname, recordId } of toRepoint) {
-            await cf.updateDnsRecord(zone.id, recordId, {
+            await dns.updateDnsRecord(zone.name, recordId, {
                 type: 'CNAME',
                 name: hostname,
                 content: dnsTarget,
@@ -4363,9 +4610,9 @@ export class FoundryStepExecutor {
         // tracking under `domain`, so it is dropped from the shared set either
         // way.
         for (const hostname of droppedHostnames) {
-            const [cname] = await cf.findDnsRecord(zone.id, hostname, 'CNAME');
+            const [cname] = await dns.findDnsRecord(zone.name, hostname, 'CNAME');
             if (cname && (cname.content === dnsTarget || previousTargets.has(cname.content))) {
-                await cf.deleteDnsRecord(zone.id, cname.id);
+                await dns.deleteDnsRecord(zone.name, cname.id);
             }
             tracked.delete(trackedTunnelDnsEntry(domain, hostname));
             context.recordScopeId(CLOUDFLARE_TUNNEL_DNS_TRACKED_SCOPE_KEY, trackedTunnelDnsState(tracked));
@@ -4399,7 +4646,7 @@ export class FoundryStepExecutor {
      */
     async cloudflareZone(action, org, context) {
         const domain = action.key;
-        const cf = this.ports.cloudflare;
+        const cf = this.zonePort();
         const existing = await cf.findZoneByApex(domain);
         if (existing) {
             const owner = await this.ports.declaredOrgStore.findOrgIdForZone(existing.id);
@@ -4600,12 +4847,12 @@ export class FoundryStepExecutor {
      * publishes it.
      */
     async publishMailDnsRecords(org, result) {
-        const zone = await this.ports.cloudflare.findZoneByApex(result.domain);
+        const zone = await this.zonePort().findZoneByApex(result.domain);
         if (!zone) {
             throw new Error(`coolify:mail for ${org.slug}: no Cloudflare zone found for ${result.domain}`);
         }
         for (const record of result.records) {
-            await this.upsertMailDnsRecord(zone.id, record);
+            await this.upsertMailDnsRecord(zone.name, record);
         }
     }
     /**
@@ -4619,7 +4866,7 @@ export class FoundryStepExecutor {
      * a record someone proxied by hand is put back. An `MX` record carries the
      * priority it was given, which Cloudflare requires.
      *
-     * Found by an exact name+type match (`CloudflarePort.findDnsRecord`'s own
+     * Found by an exact name+type match (`DnsPort.findDnsRecord`'s own
      * doc comment) so a stale record of a different type is never taken for a
      * match. A name can hold several `TXT` records (an apex often holds a site
      * verification beside SPF), so a `TXT` record only replaces one that
@@ -4628,8 +4875,8 @@ export class FoundryStepExecutor {
      * whatever it was.
      */
     async upsertMailDnsRecord(zoneId, record) {
-        const cf = this.ports.cloudflare;
-        const found = await cf.findDnsRecord(zoneId, record.name, record.type);
+        const dns = this.dnsPort();
+        const found = await dns.findDnsRecord(zoneId, record.name, record.type);
         const existing = record.type === 'TXT'
             ? found.find((r) => txtRecordTag(r.content) === txtRecordTag(record.value))
             : found[0];
@@ -4641,10 +4888,10 @@ export class FoundryStepExecutor {
             ...(record.priority === undefined ? {} : { priority: record.priority }),
         };
         if (existing) {
-            await cf.updateDnsRecord(zoneId, existing.id, rec);
+            await dns.updateDnsRecord(zoneId, existing.id, rec);
         }
         else {
-            await cf.createDnsRecord(zoneId, rec);
+            await dns.createDnsRecord(zoneId, rec);
         }
     }
     /**
@@ -4700,13 +4947,13 @@ export class FoundryStepExecutor {
      * `dkim_secondary`, none of them SPF -- so that merge has no case left to
      * handle here and is dropped rather than kept as dead code.
      */
-    async publishLettermintDnsRecords(zoneId, records) {
+    async publishLettermintDnsRecords(zone, records) {
         for (const record of records) {
             if (record.type === 'TXT' && record.value.toLowerCase().startsWith('v=dmarc1')) {
-                await this.ensureLettermintDmarcRecord(this.ports.cloudflare, zoneId, record);
+                await this.ensureLettermintDmarcRecord(this.dnsPort(), zone, record);
                 continue;
             }
-            await this.upsertMailDnsRecord(zoneId, record);
+            await this.upsertMailDnsRecord(zone, record);
         }
     }
     /**
@@ -4714,11 +4961,11 @@ export class FoundryStepExecutor {
      * already set (`p=quarantine`/`p=reject`) should not be relaxed back to
      * Lettermint's own `p=none` default.
      */
-    async ensureLettermintDmarcRecord(cf, zoneId, record) {
-        const hasDmarc = (await cf.findDnsRecord(zoneId, record.name, 'TXT')).some((r) => txtRecordTag(r.content) === 'v=dmarc1');
+    async ensureLettermintDmarcRecord(dns, zoneId, record) {
+        const hasDmarc = (await dns.findDnsRecord(zoneId, record.name, 'TXT')).some((r) => txtRecordTag(r.content) === 'v=dmarc1');
         if (hasDmarc)
             return;
-        await cf.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(zoneId, {
             type: 'TXT',
             name: record.name,
             content: record.value,
@@ -4845,7 +5092,7 @@ export class FoundryStepExecutor {
         await ai.setOrganisationOffers(org.id, action.desired.offers ?? []);
         return { resourceId: provisioned.organisationId };
     }
-    async aiBudget(action, org) {
+    async aiBudget(action, org, context) {
         // #484: ai/packages/sdk/src/types.ts:134-137's UpdateBudget.limitMicros
         // is a required string -- there is no "uncapped" this API can express
         // yet (Finding, this campaign's report) -- so a null `desired.limitMicros`
@@ -4856,6 +5103,10 @@ export class FoundryStepExecutor {
         const limitMicros = action.desired.limitMicros ?? DEFAULT_AI_LIMIT_MICROS;
         const ai = await this.aiPort();
         await ai.updateBudget(org.id, { keyId: null, limitMicros });
+        // #515: recorded only once `updateBudget` has actually succeeded, so a
+        // crash or a thrown call before this line leaves nothing recorded and
+        // the step replans, rather than recording a limit that was never applied.
+        context.recordScopeId(AI_BUDGET_LIMIT_SCOPE_KEY, limitMicros);
         return { resourceId: org.id };
     }
     /**
@@ -5115,7 +5366,7 @@ export class FoundryStepExecutor {
                         throw error;
                 }
             }
-            const appId = recorded[`coolify:app:${action.key}`];
+            const appId = recorded[edgeKeyAppRecordKey(org, entryKey)];
             if (appId) {
                 // A revoked key's env values are dead, not merely stale -- remove
                 // them so nothing reads a credential edge has already revoked. A
@@ -5149,10 +5400,14 @@ export class FoundryStepExecutor {
             context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), keyId);
             return {};
         }
-        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.edge);
-        if (!entry)
+        if (entryKey === BOULE_EDGE_ENTRY_KEY) {
+            if (!org.domain)
+                throw new Error(`${at}: Boule's edge key needs org.domain`);
+        }
+        else if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.edge)) {
             throw new Error(`${at}: the entry no longer declares uses.edge`);
-        const appId = context.recordedIds()[`coolify:app:${action.key}`];
+        }
+        const appId = context.recordedIds()[edgeKeyAppRecordKey(org, entryKey)];
         if (!appId)
             throw new Error(`${at}: the entry's app is not recorded yet`);
         if (!org.domain) {
@@ -5590,15 +5845,15 @@ export class FoundryStepExecutor {
                     }
                     for (const [dnsDomain, dnsHostnames] of hostnamesByDomain) {
                         try {
-                            const zone = await this.ports.cloudflare.findZoneByApex(dnsDomain);
+                            const zone = await this.zonePort().findZoneByApex(dnsDomain);
                             if (zone) {
-                                const cf = this.ports.cloudflare;
+                                const dns = this.dnsPort();
                                 const records = dnsHostnames.length > 0
-                                    ? (await Promise.all(dnsHostnames.map((hostname) => cf.findDnsRecord(zone.id, hostname, 'CNAME')))).flat()
-                                    : await cf.listDnsRecords(zone.id, { type: 'CNAME' });
+                                    ? (await Promise.all(dnsHostnames.map((hostname) => dns.findDnsRecord(zone.name, hostname, 'CNAME')))).flat()
+                                    : await dns.listDnsRecords(zone.name, { type: 'CNAME' });
                                 for (const record of records) {
                                     if (dnsTargets.has(record.content)) {
-                                        await cf.deleteDnsRecord(zone.id, record.id);
+                                        await dns.deleteDnsRecord(zone.name, record.id);
                                     }
                                 }
                             }
@@ -5608,11 +5863,11 @@ export class FoundryStepExecutor {
                                 throw error;
                         }
                     }
-                    await this.ports.cloudflare.deleteTunnel(target.id);
+                    await this.tunnelPort().deleteTunnel(target.id);
                     return;
                 }
                 case 'cloudflare:access':
-                    await this.ports.cloudflare.deleteAccessApp(target.id);
+                    await this.accessPort().deleteAccessApp(target.id);
                     return;
                 case 'ai:key': {
                     // F6a: an entry's key (`<orgId>:<entry>`). REVOKE SEAM (ai#157): a