@wtfalch/foundry 0.19.1 → 0.21.0

package/dist/plan/platform-providers.js

@@ -6,8 +6,9 @@ import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
+import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -16,6 +17,35 @@ function apexZoneKey(apex) {
 }
 /** The key `runPlatformSteps` records the jobs scheduler app's id under (`system:kind:key`, #173). */
 const JOBS_APP_KEY = `coolify:jobs:${JOBS_SCHEDULER_KEY}`;
+/**
+ * The DNS port for a platform step: edge's recorded address, never a public
+ * hostname, because auth, mail and archon write their records before any of
+ * those exist. Edge's step runs first and records the address
+ * (`planPlatform`), so a missing one means that step has not finished.
+ */
+async function platformDns(deps, recorded, step) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every DNS record is written through it`);
+    }
+    return deps.dns(edgeUrl);
+}
+/** The tunnel port for a platform step; same address and same reason as {@link platformDns}. */
+async function platformTunnels(deps, recorded, step) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every tunnel is managed through it`);
+    }
+    return deps.tunnels(edgeUrl);
+}
+/** The Access port for a platform step; same address and same reason as {@link platformDns}. */
+async function platformAccess(deps, recorded, step) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every Access app is managed through it`);
+    }
+    return deps.access(edgeUrl);
+}
 /**
  * #173: the jobs scheduler's own Coolify project and database, flat scope
  * ids recorded via `PlatformStepExecutionContext.recordScopeId` -- not
@@ -119,6 +149,8 @@ export class FoundryPlatformStepExecutor {
     edge;
     archon;
     backup;
+    hc;
+    heartbeats;
     constructor(cloudflare, declaredOrgStore, options = {}) {
         this.cloudflare = cloudflare;
         this.declaredOrgStore = declaredOrgStore;
@@ -133,6 +165,8 @@ export class FoundryPlatformStepExecutor {
         this.edge = options.edge;
         this.archon = options.archon;
         this.backup = options.backup;
+        this.hc = options.hc;
+        this.heartbeats = options.heartbeats;
     }
     async blockedSteps(platform, recordedIds = {}) {
         const blocked = {};
@@ -257,6 +291,33 @@ export class FoundryPlatformStepExecutor {
             PLATFORM_BACKUP_SERVICE_KEYS.some((service) => Boolean(recordedIds[PLATFORM_BACKUP_DATABASE_SCOPE_KEYS[service]]))) {
             blocked.backupExecutorMissing = true;
         }
+        if (platform.hc.enabled && !this.hc) {
+            blocked.hc =
+                'the heartbeat server is blocked, not planned: the host built the platform executor without its hc dependencies';
+        }
+        else if (platform.hc.enabled && this.hc) {
+            const hcTagBlocked = hcImageTagBlocked(platform.hc.gitRef);
+            if (hcTagBlocked)
+                blocked.hc = hcTagBlocked;
+        }
+        // Only once `hc` is actually applied -- `planHeartbeats` itself already
+        // withholds the step while `hc` is not, so a host with no heartbeats
+        // deps wired carries no standing blocked note before there is anything
+        // for it to reconcile.
+        if (!this.heartbeats && Boolean(recordedIds[`coolify:app:${PLATFORM_HC_KEY}`])) {
+            blocked.heartbeatsExecutorMissing = true;
+        }
+        else if (platform.hc.enabled && this.heartbeats) {
+            // #540 round 2: checked whether or not `hc` is recorded applied yet --
+            // `hcReady` (`planPlatform`) goes true the same round `hc` is merely
+            // *planned*, so this has to hold the heartbeats step back from the
+            // very first round, before `coolify:app:platform:hc` is ever recorded.
+            // See `PLATFORM_HC_API_KEY_REF`'s own doc comment (`platform-diff.ts`)
+            // for why nothing here can mint this key itself.
+            const apiKey = await this.heartbeats.heldKeys?.resolve?.(PLATFORM_HC_API_KEY_REF);
+            if (!apiKey)
+                blocked.heartbeatsApiKeyMissing = true;
+        }
         return blocked;
     }
     /**
@@ -271,7 +332,7 @@ export class FoundryPlatformStepExecutor {
         if (platform.archon.enabled &&
             this.archon &&
             recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]) {
-            const accessDrifted = await archonAccessDrifted(this.archon.cloudflare, platform.archon.hostname, this.archon.accessEmails);
+            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, this.archon.accessEmails);
             const brokerDrifted = !accessDrifted && (await archonBrokerRegistrationDrifted(this.archon.coolify, recordedIds));
             const bootstrapOperatorDrifted = !accessDrifted &&
                 !brokerDrifted &&
@@ -395,6 +456,18 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformMail(context, this.mail);
         }
+        if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_HC_KEY) {
+            if (!this.hc) {
+                throw new Error('platform:hc needs FoundryPlatformStepExecutor to be constructed with its hc dependencies (#540)');
+            }
+            return provisionPlatformHc(context, this.hc);
+        }
+        if (action.system === 'heartbeats' && action.kind === 'reconcile') {
+            if (!this.heartbeats) {
+                throw new Error('heartbeats:reconcile needs FoundryPlatformStepExecutor to be constructed with its heartbeats dependencies (#540)');
+            }
+            return provisionPlatformHeartbeats(context, this.heartbeats);
+        }
         if (action.system === 'cloudflare' && action.kind === 'zone') {
             return this.cloudflareZone(action, context);
         }
@@ -1193,10 +1266,11 @@ async function provisionPlatformAuth(context, deps, owners = []) {
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, authAppsRaw));
     }
     // ---- tunnel and DNS ------------------------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(PLATFORM_AUTH_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(PLATFORM_AUTH_TUNNEL_NAME));
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:auth');
+    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_AUTH_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_AUTH_TUNNEL_NAME));
     await record(PLATFORM_AUTH_TUNNEL_SCOPE_KEY, tunnel.id);
-    await deps.cloudflare.putTunnelConfig(tunnel.id, {
+    await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
@@ -1221,7 +1295,7 @@ async function provisionPlatformAuth(context, deps, owners = []) {
     // step's own tunnel only (see this function's doc comment).
     await ensureCloudflaredConnector({
         coolify: deps.coolify,
-        cloudflare: deps.cloudflare,
+        tunnels,
         tunnelId: tunnel.id,
         appName: PLATFORM_AUTH_CLOUDFLARED_APP_NAME,
         projectUuid,
@@ -1237,9 +1311,10 @@ async function provisionPlatformAuth(context, deps, owners = []) {
         throw new Error(`platform:auth: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:auth');
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1247,7 +1322,7 @@ async function provisionPlatformAuth(context, deps, owners = []) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await deps.cloudflare.updateDnsRecord(zoneId, dnsRecord.id, {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1818,9 +1893,14 @@ async function provisionPlatformMail(context, deps) {
     await record(PLATFORM_MAIL_APP_SCOPE_KEY, appId);
     // Set on every run, not only after a create -- same rule `provisionPlatformAuth` follows for its own apps.
     // The image tag too: a declared release change reaches the app here.
+    // #543: the health-check quartet too, the same reason Archon's own doc
+    // comment gives -- without it Coolify's rolling update stops the old
+    // container before the new one can answer `waitForHealthyVersion`'s own
+    // `'ready'` probe below. Stalwart's own readiness route and HTTP port.
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: PLATFORM_MAIL_INTERNAL_NAME,
         docker_registry_image_tag: imageTag,
+        ...healthCheckSettings(STALWART_READY_PATH, Number(STALWART_HTTP_PORT)),
     });
     // #177: org steps (an org's own `coolify:mail`/`coolify:agora`) read this
     // back instead of a literal, the same way files/ai's own internal
@@ -1884,10 +1964,11 @@ async function provisionPlatformMail(context, deps) {
         await record(PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY, imageTag);
     }
     // ---- tunnel and DNS: web/JMAP/management ------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(PLATFORM_MAIL_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(PLATFORM_MAIL_TUNNEL_NAME));
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:mail');
+    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_MAIL_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_MAIL_TUNNEL_NAME));
     await record(PLATFORM_MAIL_TUNNEL_SCOPE_KEY, tunnel.id);
-    await deps.cloudflare.putTunnelConfig(tunnel.id, {
+    await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
@@ -1899,7 +1980,7 @@ async function provisionPlatformMail(context, deps) {
     // #197: without a connector, `hostname` answers with a Cloudflare error.
     await ensureCloudflaredConnector({
         coolify: deps.coolify,
-        cloudflare: deps.cloudflare,
+        tunnels,
         tunnelId: tunnel.id,
         appName: PLATFORM_MAIL_CLOUDFLARED_APP_NAME,
         projectUuid,
@@ -1914,9 +1995,10 @@ async function provisionPlatformMail(context, deps) {
         throw new Error(`platform:mail: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:mail');
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1924,7 +2006,7 @@ async function provisionPlatformMail(context, deps) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await deps.cloudflare.updateDnsRecord(zoneId, dnsRecord.id, {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1933,9 +2015,9 @@ async function provisionPlatformMail(context, deps) {
     }
     // ---- the MX hostname: a direct, unproxied A record --------------------------
     const serverIp = (platform.serverIpv4 ?? server.ip); // checked by mailServerIpBlocked above
-    const [mxRecord] = await deps.cloudflare.findDnsRecord(zoneId, mailHost, 'A');
+    const [mxRecord] = await dns.findDnsRecord(platform.apex, mailHost, 'A');
     if (!mxRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'A',
             name: mailHost,
             content: serverIp,
@@ -1943,7 +2025,7 @@ async function provisionPlatformMail(context, deps) {
         });
     }
     else if (mxRecord.content !== serverIp) {
-        await deps.cloudflare.updateDnsRecord(zoneId, mxRecord.id, {
+        await dns.updateDnsRecord(platform.apex, mxRecord.id, {
             type: 'A',
             name: mailHost,
             content: serverIp,
@@ -2478,10 +2560,14 @@ export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_clie
  *   by hand outside foundry. {@link archonRollingUpdateDrifted} re-reads
  *   these settings (and the #475 ones) at plan time, so a human turning any
  *   of them back off in the Coolify UI is noticed and repaired, not just a
- *   platform that applied before this patch existed. The same fix for
- *   `platform:auth`, `platform:files`, `platform:ai` and the calls stack's
- *   stateless app is deliberately left to a follow-up once each image's
- *   health probe is confirmed.
+ *   platform that applied before this patch existed. #543 lifted the quartet
+ *   into the shared `healthCheckSettings` helper and applied it to every
+ *   other platform app with a confirmed health route (mail, edge, ai's and
+ *   files' runners) plus every company app `executor.ts` deploys; the
+ *   calls/chat Matrix stacks' Synapse and MAS stay off on purpose (neither
+ *   can answer a health check before the other is up) and `platform:auth`
+ *   and `platform:integrations` are left for a further follow-up, since
+ *   #543 did not establish a reachable url for either.
  */
 async function provisionPlatformArchon(context, deps) {
     const { platform } = context;
@@ -2608,10 +2694,10 @@ async function provisionPlatformArchon(context, deps) {
     await deps.coolify.updateApplication(appId, {
         custom_network_aliases: PLATFORM_ARCHON_INTERNAL_NAME,
         is_consistent_container_name_enabled: false,
-        health_check_enabled: true,
-        health_check_path: ARCHON_HEALTH_CHECK_PATH,
-        health_check_port: Number(ARCHON_PORT),
-        health_check_start_period: ARCHON_HEALTH_CHECK_START_PERIOD_SECONDS,
+        // #543: the quartet below is the shared `healthCheckSettings` helper
+        // every other app foundry creates now also goes through -- Archon's own
+        // fields, unchanged in value, just no longer hand-rolled here.
+        ...healthCheckSettings(ARCHON_HEALTH_CHECK_PATH, Number(ARCHON_PORT), ARCHON_HEALTH_CHECK_START_PERIOD_SECONDS),
         git_branch: gitRef,
     });
     // ---- sign-in client in the platform's own ZITADEL -------------------------
@@ -2878,17 +2964,19 @@ async function provisionPlatformArchon(context, deps) {
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, desiredAuthAppsRaw));
     }
     // ---- Cloudflare Access, before the hostname resolves ----------------------
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:archon');
+    const access = await platformAccess(deps, context.recordedIds(), 'platform:archon');
     let gateClosed = Boolean(recorded[PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY]);
-    const accessAppId = await ensureArchonAccess(deps.cloudflare, hostname, deps.accessEmails, async () => {
+    const accessAppId = await ensureArchonAccess(access, hostname, deps.accessEmails, async () => {
         // The Access app is about to be rebuilt: answer 404 for every hostname
         // meanwhile, so it is never served without the gate. The marker is
         // persisted first: a failure before the real ingress is written back
         // leaves it set, and the next plan repairs the step.
         gateClosed = true;
         await record(PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, '1');
-        const tunnel = await deps.cloudflare.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
+        const tunnel = await tunnels.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
         if (tunnel)
-            await deps.cloudflare.putTunnelConfig(tunnel.id, {
+            await tunnels.putTunnelConfig(tunnel.id, {
                 ingress: [{ service: 'http_status:404' }],
             });
     });
@@ -2940,12 +3028,12 @@ async function provisionPlatformArchon(context, deps) {
         await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
     }
     // ---- tunnel and DNS ---------------------------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(PLATFORM_ARCHON_TUNNEL_NAME));
+    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_ARCHON_TUNNEL_NAME));
     if (recorded[PLATFORM_ARCHON_TUNNEL_SCOPE_KEY] !== tunnel.id) {
         await record(PLATFORM_ARCHON_TUNNEL_SCOPE_KEY, tunnel.id);
     }
-    await deps.cloudflare.putTunnelConfig(tunnel.id, {
+    await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
@@ -2960,7 +3048,7 @@ async function provisionPlatformArchon(context, deps) {
     // #197: without a connector, `hostname` answers with a Cloudflare error.
     await ensureCloudflaredConnector({
         coolify: deps.coolify,
-        cloudflare: deps.cloudflare,
+        tunnels,
         tunnelId: tunnel.id,
         appName: PLATFORM_ARCHON_CLOUDFLARED_APP_NAME,
         projectUuid,
@@ -2974,9 +3062,10 @@ async function provisionPlatformArchon(context, deps) {
         throw new Error(`platform:archon: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:archon');
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -2984,7 +3073,7 @@ async function provisionPlatformArchon(context, deps) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await deps.cloudflare.updateDnsRecord(zoneId, dnsRecord.id, {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -3365,8 +3454,9 @@ function sameEmails(include, emails) {
  * exactly the declared emails. A failed read is not drift: the next plan reads
  * again.
  */
-async function archonAccessDrifted(cf, domain, emails) {
+async function archonAccessDrifted(deps, recorded, domain, emails) {
     try {
+        const cf = await platformAccess(deps, recorded, 'platform:archon');
         const app = (await cf.listAccessApps()).find((a) => a.domain === domain && a.name === PLATFORM_ARCHON_ACCESS_APP_NAME);
         if (!app)
             return true;
@@ -4079,8 +4169,13 @@ async function provisionPlatformAi(context, deps) {
             // Every run, so a changed gitRef reaches an app that already exists.
             git_branch: gitRef,
         };
-        if (spec === PLATFORM_AI_RUNNER)
+        // #543: the health-check quartet too, runner only -- the worker exposes
+        // no port at all (`ports_exposes` is never set on it, just below), so
+        // there is nothing for Coolify's own container probe to reach.
+        if (spec === PLATFORM_AI_RUNNER) {
             patch.ports_exposes = PLATFORM_AI_PORT;
+            Object.assign(patch, healthCheckSettings('/api/health', Number(PLATFORM_AI_PORT)));
+        }
         await coolify.updateApplication(app.appId, patch);
         return app;
     };
@@ -4165,18 +4260,23 @@ async function provisionPlatformAi(context, deps) {
         }
         await coolify.raw('POST', `/applications/${migrate.appId}/stop`);
     }
-    // #252: confirmed before anything below -- the applied ref recorded just
-    // after, and the mint further down -- depends on the new version actually
-    // being live. Never read the old container's healthy status as the new
-    // deployment's (`CLAUDE.md`'s platform-step rule 5): `'deployment-only'`,
-    // because the runner's own doc comment above says why there is no url to
-    // check instead ("Nothing public is wired: no Coolify `domains`, tunnel,
-    // DNS record or Access app"). This replaces the old deploy-then-defer-the-
-    // wait-until-the-mint-needs-it shape (#375) with the one every other
-    // platform step uses: the wait happens once, right here, so a failed
-    // deployment is caught before either thing downstream trusts it.
+    // #252/#543: confirmed before anything below -- the applied ref recorded
+    // just after, and the mint further down -- depends on the new version
+    // actually being live. Never read the old container's healthy status as
+    // the new deployment's (`CLAUDE.md`'s platform-step rule 5). Hoisted above
+    // both waits (`record(PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, ...)` below used
+    // to be the first place this was built) so the runner's own wait can probe
+    // it: the runner exposes `/api/health` on {@link PLATFORM_AI_PORT}
+    // (`ports_exposes` is set on it, just above, for exactly this), so `'ready'`
+    // closes the loophole `'deployment-only'` cannot (a deployment that
+    // "finished" with a crash-looping container). The worker stays
+    // `'deployment-only'`: it has no `ports_exposes` at all (see the comment on
+    // that patch above), so there is no url this executor could ever reach to
+    // probe it, the same reason the runner's own doc comment gives for why
+    // nothing public is wired to either app.
+    const internalUrl = `http://${PLATFORM_AI_RUNNER.internalName}:${PLATFORM_AI_PORT}`;
     if (deployRunner) {
-        await waitForNewDeployment(coolify, runner.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:ai', `the runner stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        await waitForNewDeployment(coolify, runner.appId, { kind: 'ready', url: `${internalUrl}/api/health` }, runtime, sleep, 'platform:ai', `the runner stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
     }
     if (deployWorker) {
         await waitForNewDeployment(coolify, worker.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:ai', `the worker stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
@@ -4189,7 +4289,6 @@ async function provisionPlatformAi(context, deps) {
     // the key is delivered.
     await record(PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
     await record(PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, gitRef);
-    const internalUrl = `http://${PLATFORM_AI_RUNNER.internalName}:${PLATFORM_AI_PORT}`;
     await record(PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, internalUrl);
     // ---- Archon's AI management key, once ------------------------------------
     // #252: nothing left to wait on here -- the deployment above is already
@@ -4773,6 +4872,8 @@ const FILES_RUNNER_APP_NAME = 'files';
 const FILES_RUNNER_INTERNAL_NAME = 'platform-files';
 /** The runner's port (`Dockerfile`'s `runner` stage: `PORT=3000`, `EXPOSE 3000`). */
 const FILES_PORT = '3000';
+/** files' own health route, the same one `healthUrls` (`executor.ts`) assumes every hosted app serves. */
+const FILES_HEALTH_CHECK_PATH = '/api/health';
 /** The Postgres database name; files' runtime role is `<database>_rt`. */
 const FILES_DB = 'files';
 const FILES_RUNTIME_ROLE = `${FILES_DB}_rt`;
@@ -4965,6 +5066,12 @@ shareDomains) {
         dockerfile_target_build: 'runner',
         custom_internal_name: FILES_RUNNER_INTERNAL_NAME,
         git_branch: gitRef,
+        // #543: the health-check quartet, same reason Archon's doc comment
+        // gives. The migrate app gets none -- it idles rather than serves
+        // anything (`waitForMigration`/`waitForMigrateDeployment` below are its
+        // own, different wait), so there is no health route to point Coolify's
+        // probe at.
+        ...healthCheckSettings(FILES_HEALTH_CHECK_PATH, Number(FILES_PORT)),
         // Coolify wants full URLs. Written only when the set changed, so a runner
         // nobody gave a share host keeps no `domains`.
         ...filesShareDomainsPatch(recorded, shareDomains),
@@ -5109,15 +5216,18 @@ shareDomains) {
     // mark a deployment that actually migrated as `failed`.
     await waitForMigrateDeployment(deps.coolify, migrateApp.appId, queuedDeploymentUuid(migrateDeployed) ?? 'untracked', 'platform:files', 'files-migrate', runtime.now ?? Date.now, runtime.migrateTimeoutMs ?? 900_000, runtime.migrateIntervalMs ?? 10_000, sleep);
     await deps.coolify.raw('POST', `/applications/${migrateApp.appId}/stop`);
-    // #252: `'deployment-only'` -- the runner's own doc comment above says why
-    // ("The runner is created without `domains`... Nothing public is wired"):
-    // there is no url this executor, running outside files' own Docker
-    // network, could ever reach, so `coolify.deployAndWait` reaching Coolify's
-    // own deployment record is the whole check. Still enough to catch the bug
-    // this closes: the applied ref recorded below while the *old* container
-    // (never read here) stayed healthy through a failed deploy.
-    await waitForNewDeployment(deps.coolify, runnerApp.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:files', `the runner stays at ${recorded[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
-    await record(PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, `http://${FILES_RUNNER_INTERNAL_NAME}:${FILES_PORT}`);
+    // #252/#543: no public `domains`, tunnel or DNS record is wired to the
+    // runner (its own doc comment: "Nothing public is wired"), but it does
+    // answer {@link FILES_HEALTH_CHECK_PATH} on its own Coolify-network
+    // address -- reachable from this executor the same way `provisionPlatformAi`'s
+    // runner now is. `'ready'` closes the loophole `'deployment-only'` alone
+    // cannot (a deployment Coolify calls "finished" with a crash-looping
+    // container); `coolify.deployAndWait` reaching Coolify's own deployment
+    // record first is still what rules out the old container staying healthy
+    // through a failed deploy.
+    const internalUrl = `http://${FILES_RUNNER_INTERNAL_NAME}:${FILES_PORT}`;
+    await waitForNewDeployment(deps.coolify, runnerApp.appId, { kind: 'ready', url: `${internalUrl}${FILES_HEALTH_CHECK_PATH}` }, runtime, sleep, 'platform:files', `the runner stays at ${recorded[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    await record(PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, internalUrl);
     // Last: a run that failed anywhere above is planned again.
     context.recordScopeId(PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, platform.files.hostname);
     await record(PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
@@ -5322,10 +5432,13 @@ async function provisionPlatformEdge(context, deps) {
     // Set on every run, not only after a create: a throw right after the
     // create must not leave the app on the wrong target for good, and a
     // changed `gitRef` has to reach an app made on an earlier one.
+    // #543: the health-check quartet too -- edge's own `/api/health`, on the
+    // port the `waitForNewDeployment` call below already probes internally.
     await deps.coolify.updateApplication(appId, {
         dockerfile_target_build: 'runner',
         custom_internal_name: EDGE_RUNNER_INTERNAL_NAME,
         git_branch: gitRef,
+        ...healthCheckSettings('/api/health', Number(EDGE_PORT)),
     });
     const runtimeUrl = await ensureEdgeRuntimeUrl(deps.coolify, appId, db.internal_db_url);
     // ---- the platform key, once ----------------------------------------------
@@ -5359,11 +5472,22 @@ async function provisionPlatformEdge(context, deps) {
         { key: 'EDGE_PLATFORM_KEY_HASH', value: keyHash },
         ...(await missingEnvs(deps.coolify, appId, PLATFORM_EDGE_RUNNER_DEFAULTS)),
     ]);
-    // ---- tunnel and DNS -------------------------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(EDGE_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(EDGE_TUNNEL_NAME));
+    // ---- deploy and wait, on edge's own address ---------------------------------
+    // F4.dns: edge is the only caller of Cloudflare, so its own CNAME is
+    // written through edge. Edge has to be up before that, and no public name
+    // routes to it yet: health is checked on its Coolify-network address, which
+    // is then recorded for every step that writes DNS (auth, mail, archon). #252:
+    // the combined helper checks the deployment record, then the `/api/health`
+    // probe.
+    const internalUrl = `http://${EDGE_RUNNER_INTERNAL_NAME}:${EDGE_PORT}`;
+    await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `${internalUrl}/api/health` }, runtime, sleep, 'platform:edge', `edge stays at ${recorded[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    await record(PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, internalUrl);
+    // ---- tunnel and DNS, now that edge answers ---------------------------------
+    const tunnels = await platformTunnels(deps, { [PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]: internalUrl }, 'platform:edge');
+    const existingTunnel = await tunnels.findTunnelByName(EDGE_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(EDGE_TUNNEL_NAME));
     await record(PLATFORM_EDGE_TUNNEL_SCOPE_KEY, tunnel.id);
-    await deps.cloudflare.putTunnelConfig(tunnel.id, {
+    await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             { hostname, service: `http://${EDGE_RUNNER_INTERNAL_NAME}:${EDGE_PORT}` },
             { service: 'http_status:404' },
@@ -5372,7 +5496,7 @@ async function provisionPlatformEdge(context, deps) {
     // #197: without a connector, `hostname` answers with a Cloudflare error.
     await ensureCloudflaredConnector({
         coolify: deps.coolify,
-        cloudflare: deps.cloudflare,
+        tunnels,
         tunnelId: tunnel.id,
         appName: EDGE_CLOUDFLARED_APP_NAME,
         projectUuid,
@@ -5386,9 +5510,10 @@ async function provisionPlatformEdge(context, deps) {
         throw new Error(`platform:edge: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
+    const dns = await deps.dns(internalUrl);
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -5396,24 +5521,236 @@ async function provisionPlatformEdge(context, deps) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await deps.cloudflare.updateDnsRecord(zoneId, dnsRecord.id, {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
             proxied: true,
         });
     }
-    // ---- deploy and wait -------------------------------------------------------
-    // #252: the tunnel and DNS above already route `hostname`, so the combined
-    // helper (deployment-record check, then the `/api/health` probe) can run
-    // in one call -- unlike `platform:mail`, nothing here needs to happen
-    // between the two phases.
-    await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:edge', `edge stays at ${recorded[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
     // Last: a run that failed anywhere above is planned again.
     context.recordScopeId(PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
     await record(PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: appId };
 }
+/** `healthchecks/healthchecks` on Docker Hub -- #540's own "third-party, not this estate's own repo" image. */
+const HC_IMAGE = 'healthchecks/healthchecks';
+const PLATFORM_HC_PROJECT = 'platform';
+const PLATFORM_HC_DB_NAME = 'platform-hc-db';
+const PLATFORM_HC_APP_NAME = 'platform-hc';
+/** The app's fixed `custom_internal_name`, the `EDGE_RUNNER_INTERNAL_NAME` convention. */
+const HC_INTERNAL_NAME = 'platform-hc';
+/** Healthchecks' own default uWSGI/gunicorn port inside the container. */
+const HC_PORT = '8000';
+/**
+ * Healthchecks ships no dedicated readiness route (confirmed against its
+ * `hc/front/urls.py`: the closest is `checks/<uuid>/status/`, which needs a
+ * check's own id) -- `/` (`views.index`) is the documented fallback, a
+ * public page for an anonymous visitor.
+ */
+const HC_HEALTH_CHECK_PATH = '/';
+const PLATFORM_HC_DB = 'hc';
+const PLATFORM_HC_DB_USER = 'hc';
+const HC_TUNNEL_NAME = 'platform-hc-tunnel';
+/** #197: the one Coolify app that runs `cloudflared` for {@link HC_TUNNEL_NAME}. */
+const HC_CLOUDFLARED_APP_NAME = 'platform-hc-cloudflared';
+const PLATFORM_HC_PROJECT_SCOPE_KEY = 'coolify_project_platform_hc';
+const PLATFORM_HC_DB_SCOPE_KEY = 'coolify_platform_hc_database';
+const PLATFORM_HC_APP_SCOPE_KEY = 'coolify_platform_hc_app';
+const PLATFORM_HC_TUNNEL_SCOPE_KEY = 'cloudflare_platform_hc_tunnel';
+const PLATFORM_HC_CONNECTOR_APP_SCOPE_KEY = 'coolify_platform_hc_connector_app';
+const PLATFORM_HC_INTERNAL_URL_SCOPE_KEY = 'platform_hc_internal_url';
+/**
+ * #540 round 2: a thin wrapper over the estate-wide {@link floatingTagBlocked},
+ * the {@link mailImageTagBlocked} pattern for hc's own image tag -- #540
+ * shipped with no guard at all here, and `DEFAULT_HC_IMAGE_TAG` floating at
+ * `'latest'` by default was exactly what `floatingTagBlocked`'s own
+ * `FLOATING_TAGS` set exists to catch.
+ */
+function hcImageTagBlocked(tag) {
+    const reason = floatingTagBlocked('Healthchecks', tag, VERSIONS.hc);
+    return reason ? `the heartbeat server is blocked, not planned: ${reason} as the hc gitRef` : null;
+}
+/**
+ * #540: the platform's own heartbeat server (self-hosted Healthchecks) --
+ * a Coolify Postgres plus one `healthchecks/healthchecks` Docker-image app,
+ * reached through edge's tunnel and DNS at `platform.hc.hostname`. No
+ * ZITADEL client, no sign-in: `hc` is an internal operational tool, read by
+ * nobody outside foundry and whoever holds its checks' ping URLs.
+ *
+ * `REGISTRATION_OPEN=False` is set alongside the rest of the env below --
+ * Healthchecks defaults that setting to `true` (confirmed against its own
+ * `hc/settings.py`, 2026-10), and `hostname` is a public, Cloudflare-proxied
+ * DNS record the moment this step's tunnel and DNS write land, so leaving
+ * it unset would let anyone who finds the hostname sign themselves up.
+ *
+ * Idempotent the {@link provisionPlatformEdge} way: no reader reports this
+ * Coolify app, so the planner's own recorded-id check
+ * (`platform-diff.ts`'s `planHc`) is what stops this running on every
+ * apply, not a live comparison in here.
+ */
+async function provisionPlatformHc(context, deps) {
+    const { platform } = context;
+    const hostname = platform.hc.hostname;
+    const gitRef = platform.hc.gitRef;
+    const tagBlocked = hcImageTagBlocked(gitRef);
+    if (tagBlocked)
+        throw new Error(tagBlocked);
+    const recorded = context.recordedIds();
+    const runtime = deps.runtime ?? {};
+    const sleep = runtime.sleep ?? defaultSleep;
+    const record = async (key, id) => {
+        context.recordScopeId(key, id);
+        await context.persist?.();
+    };
+    let projectUuid = recorded[PLATFORM_HC_PROJECT_SCOPE_KEY];
+    if (!projectUuid) {
+        const found = await deps.coolify.findProjectByName(PLATFORM_HC_PROJECT);
+        projectUuid = found ? found.uuid : (await deps.coolify.createProject(PLATFORM_HC_PROJECT)).uuid;
+        await record(PLATFORM_HC_PROJECT_SCOPE_KEY, projectUuid);
+    }
+    const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
+    const server = await resolvePlatformServer(deps.coolify);
+    // ---- database ------------------------------------------------------------
+    let dbId = recorded[PLATFORM_HC_DB_SCOPE_KEY];
+    if (!dbId) {
+        const found = (await deps.coolify.listDatabases()).find((db) => db.name === PLATFORM_HC_DB_NAME && db.environment_id === environment.id);
+        if (found) {
+            dbId = found.uuid;
+        }
+        else {
+            const created = await deps.coolify.createPostgresDatabase({
+                project_uuid: projectUuid,
+                server_uuid: server.uuid,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                name: PLATFORM_HC_DB_NAME,
+                postgres_db: PLATFORM_HC_DB,
+                postgres_user: PLATFORM_HC_DB_USER,
+            });
+            dbId = created.uuid;
+        }
+        await record(PLATFORM_HC_DB_SCOPE_KEY, dbId);
+    }
+    const db = await getDatabaseStarted(deps.coolify, dbId);
+    if (!db.internal_db_url) {
+        throw new Error('coolify:app for the platform (hc): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
+    }
+    // ---- the app --------------------------------------------------------------
+    const app = await findOrCreatePlatformApp(deps.coolify, PLATFORM_HC_APP_NAME, environment, async () => {
+        return deps.coolify.createDockerImageApplication({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            docker_registry_image_name: HC_IMAGE,
+            docker_registry_image_tag: gitRef,
+            ports_exposes: HC_PORT,
+            name: PLATFORM_HC_APP_NAME,
+            description: `Healthchecks for the platform's own heartbeats (#540, ${HC_IMAGE}:${gitRef})`,
+            instant_deploy: false,
+        });
+    });
+    const appId = app.appId;
+    await record(PLATFORM_HC_APP_SCOPE_KEY, appId);
+    // Set on every run, not only after a create -- `provisionPlatformAuth`'s
+    // own rule. The image tag too, so a declared release change reaches the app.
+    await deps.coolify.updateApplication(appId, {
+        custom_internal_name: HC_INTERNAL_NAME,
+        docker_registry_image_tag: gitRef,
+        ...healthCheckSettings(HC_HEALTH_CHECK_PATH, Number(HC_PORT)),
+    });
+    // ---- env, parsed off the database's own owner credentials -----------------
+    // Healthchecks takes discrete DB_* vars, not a DATABASE_URL (its own
+    // `hc/settings.py`) -- no separate runtime role the way edge/files mint
+    // one: Healthchecks runs migrations and serves from the same one process,
+    // so there is no second, more-restricted role to split off here.
+    let dbHost;
+    let dbPort;
+    let dbName;
+    let dbUser;
+    let dbPassword;
+    try {
+        const parsed = new URL(db.internal_db_url);
+        dbHost = parsed.hostname;
+        dbPort = parsed.port || '5432';
+        dbName = parsed.pathname.replace(/^\//, '');
+        dbUser = decodeURIComponent(parsed.username);
+        dbPassword = decodeURIComponent(parsed.password);
+    }
+    catch {
+        throw new Error("coolify:app for the platform (hc): the database's internal_db_url could not be parsed into DB_* env vars");
+    }
+    const secretKey = await ensureGeneratedEnv(deps.coolify, appId, 'SECRET_KEY', () => randomBytes(32).toString('base64url'));
+    const envs = [
+        { key: 'DB', value: 'postgres' },
+        { key: 'DB_HOST', value: dbHost },
+        { key: 'DB_PORT', value: dbPort },
+        { key: 'DB_NAME', value: dbName },
+        { key: 'DB_USER', value: dbUser },
+        { key: 'DB_PASSWORD', value: dbPassword },
+        { key: 'SITE_ROOT', value: `https://${hostname}` },
+        { key: 'ALLOWED_HOSTS', value: hostname },
+        // Healthchecks defaults this to `true` -- see this function's own doc
+        // comment. `hostname` is public and Cloudflare-proxied, so sign-up stays
+        // closed until a real invite mechanism exists.
+        { key: 'REGISTRATION_OPEN', value: 'False' },
+    ];
+    if (secretKey)
+        envs.push({ key: 'SECRET_KEY', value: secretKey });
+    const envsChanged = await envsDiffer(deps.coolify, appId, envs);
+    await deps.coolify.bulkUpsertEnvs(appId, envs);
+    const declaredChanged = recorded[PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY] !== hostname ||
+        recorded[PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
+    const internalUrl = `http://${HC_INTERNAL_NAME}:${HC_PORT}`;
+    if (app.justCreated || !app.running || envsChanged || declaredChanged) {
+        await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `${internalUrl}${HC_HEALTH_CHECK_PATH}` }, runtime, sleep, 'platform:hc', `hc stays at ${recorded[PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    }
+    await record(PLATFORM_HC_INTERNAL_URL_SCOPE_KEY, internalUrl);
+    // ---- tunnel and DNS ---------------------------------------------------------
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:hc');
+    const existingTunnel = await tunnels.findTunnelByName(HC_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(HC_TUNNEL_NAME));
+    await record(PLATFORM_HC_TUNNEL_SCOPE_KEY, tunnel.id);
+    await tunnels.putTunnelConfig(tunnel.id, {
+        ingress: [{ hostname, service: internalUrl }, { service: 'http_status:404' }],
+    });
+    // #197: without a connector, `hostname` answers with a Cloudflare error.
+    await ensureCloudflaredConnector({
+        coolify: deps.coolify,
+        tunnels,
+        tunnelId: tunnel.id,
+        appName: HC_CLOUDFLARED_APP_NAME,
+        projectUuid,
+        environment,
+        resolveServer: async () => server,
+        recordedConnectorAppId: recorded[PLATFORM_HC_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (connectorAppId) => record(PLATFORM_HC_CONNECTOR_APP_SCOPE_KEY, connectorAppId),
+    });
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:hc');
+    const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
+    if (!dnsRecord) {
+        await dns.createDnsRecord(platform.apex, {
+            type: 'CNAME',
+            name: hostname,
+            content: dnsTarget,
+            proxied: true,
+        });
+    }
+    else if (dnsRecord.content !== dnsTarget) {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
+            type: 'CNAME',
+            name: hostname,
+            content: dnsTarget,
+            proxied: true,
+        });
+    }
+    // Last: a run that failed anywhere above is planned again.
+    context.recordScopeId(PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
+    await record(PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
+    return { resourceId: appId };
+}
 /**
  * The runtime `DATABASE_URL` the names app gets: the value already set on
  * it, else a new `names_rt` credential on the database's host, the
@@ -6186,6 +6523,41 @@ const PLATFORM_BACKUP_S3_STORAGE_FINGERPRINT_SCOPE_KEY = 'coolify_platform_backu
 const PLATFORM_BACKUP_S3_STORAGE_PENDING_SCOPE_KEY = 'coolify_platform_backup_s3_storage_pending';
 /** Coolify's own name for "once a day" -- `createDatabaseBackup`'s `frequency`. */
 const PLATFORM_BACKUP_DEFAULT_FREQUENCY = 'daily';
+/**
+ * The database a service's schedule must name. A schedule that names none
+ * dumps the Coolify resource's first database, which for live Archon is the
+ * abandoned `archon`, not the one it runs on (see {@link ARCHON_POSTGRES_DB}).
+ * Every other service runs on its resource's first database and needs no entry.
+ */
+const PLATFORM_BACKUP_DATABASE_NAMES = {
+    archon: ARCHON_POSTGRES_DB,
+};
+/**
+ * The one schedule both the reader and {@link provisionPlatformBackup} treat
+ * as a service's backup, so the two never disagree: an enabled, `save_s3`
+ * schedule that dumps the right database, else the first enabled, `save_s3`
+ * one with `named: false` (it needs the repair). A service with no entry in
+ * {@link PLATFORM_BACKUP_DATABASE_NAMES} is always `named`. The list
+ * response is not confirmed to carry `databases_to_backup`, so a schedule
+ * without the field is read off its detail route, the same fallback
+ * {@link repointPlatformBackupSchedules} uses for `s3_storage_uuid`.
+ */
+async function findPlatformBackupSchedule(coolify, service, databaseId) {
+    const schedules = (await coolify.listDatabaseBackups(databaseId)).filter((backup) => backup.enabled && backup.save_s3);
+    const database = PLATFORM_BACKUP_DATABASE_NAMES[service];
+    if (!database)
+        return { schedule: schedules[0], named: true };
+    for (const schedule of schedules) {
+        let databases = schedule.databases_to_backup;
+        if (databases === undefined) {
+            const detail = (await coolify.raw('GET', `/databases/${databaseId}/backups/${schedule.uuid}`));
+            databases = detail?.databases_to_backup;
+        }
+        if (databases === database)
+            return { schedule, named: true };
+    }
+    return { schedule: schedules[0], named: false };
+}
 /**
  * Trims a trailing slash and lowercases the host, so a Coolify-normalised
  * endpoint (or one a person typed with a trailing slash) is never read as a
@@ -6547,17 +6919,109 @@ async function provisionPlatformBackup(action, context, deps) {
     const databaseId = action.desired.databaseId;
     const recorded = context.recordedIds();
     const storageUuid = await ensurePlatformBackupStorage(coolify, r2, recorded, context);
-    const existing = (await coolify.listDatabaseBackups(databaseId)).find((backup) => backup.enabled && backup.save_s3);
-    if (!existing) {
-        await coolify.createDatabaseBackup(databaseId, {
+    const service = action.key;
+    const { schedule, named } = await findPlatformBackupSchedule(coolify, service, databaseId);
+    const scheduleUuid = schedule?.uuid ??
+        (await coolify.createDatabaseBackup(databaseId, {
             frequency: deps.frequency ?? PLATFORM_BACKUP_DEFAULT_FREQUENCY,
             enabled: true,
             save_s3: true,
             s3_storage_uuid: storageUuid,
+        })).uuid;
+    // `CoolifyPort.createDatabaseBackup` takes no database name, so a new
+    // schedule is named here too, by the same PATCH that repairs an existing
+    // one dumping the wrong database.
+    if (!named) {
+        await coolify.raw('PATCH', `/databases/${databaseId}/backups/${scheduleUuid}`, {
+            databases_to_backup: PLATFORM_BACKUP_DATABASE_NAMES[service],
         });
     }
     return undefined;
 }
+/**
+ * #540: reconciles the live Healthchecks checks against the ones foundry
+ * wants -- `desiredHeartbeatCheckNames` (`platform-diff.ts`): the uptime
+ * Worker's own, plus one per platform database backup that already has a
+ * recorded database id. Idempotent twice over: `planHeartbeats` only plans
+ * this step when the declared desired set has changed since the last
+ * successful reconcile (its own doc comment says why), and this function
+ * itself lists live checks first, so a name already live is never created
+ * twice -- a second run, even one somehow forced, creates none (it still
+ * re-saves the address every time; see `PlatformHeartbeatsDeps.put`'s own
+ * doc comment for why that is the round-2 fix, not a regression).
+ *
+ * Deletes only a live check whose name matches this step's own naming
+ * scheme (`PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME` or
+ * `platformBackupHeartbeatCheckName`), is no longer desired, AND is held
+ * under that exact name's own ref -- #540 round 2 added the third
+ * condition (`PlatformHeartbeatsDeps.resolve`'s own doc comment says why):
+ * a name match alone is never enough to delete, so this reconcile can
+ * never destroy a check it did not itself create, whether that check is a
+ * stranger's or simply one this step never got to create in the first
+ * place (no `resolve` wired at all reads as "prove nothing", the safe
+ * direction).
+ *
+ * `uptime-worker`'s own ping URL is recorded under
+ * `PLATFORM_UPTIME_HEARTBEAT_URL_REF`, but nothing pings it yet: delivering
+ * it to a running uptime Worker is foundry#542's own job, and that issue is
+ * blocked today on a missing KV/cron/secret-binding capability in
+ * `@wtfalch/edge` (wtfalch/edge#26) -- a known gap, not an oversight here.
+ * Each backup check's ping URL is recorded the same way under
+ * `platformBackupHeartbeatUrlRef(service)`, and nothing pings those either:
+ * Coolify's own `createDatabaseBackup` API (`executor.ts`'s
+ * `CoolifyPort.createDatabaseBackup`) has no notification/webhook field at
+ * all, so there is no way for Coolify's backup scheduler to call this check
+ * when a backup actually runs. Both gaps are named here, not worked around
+ * -- no polling, no wrapping Coolify's scheduler. Every check this function
+ * creates is paused on creation for exactly that reason (see
+ * `HeartbeatsPort.pauseCheck`'s own doc comment): until one of those two
+ * gaps closes, a newly created check would otherwise read "down" within its
+ * own grace period, with nothing actually wrong.
+ */
+async function provisionPlatformHeartbeats(context, deps) {
+    const recorded = context.recordedIds();
+    const desiredNames = desiredHeartbeatCheckNames(recorded);
+    const desiredSet = new Set(desiredNames);
+    const live = await deps.heartbeats.listChecks();
+    const liveByName = new Map(live.map((check) => [check.name, check]));
+    for (const name of desiredNames) {
+        const existing = liveByName.get(name);
+        const put = deps.heldKeys?.put;
+        if (!put) {
+            throw new Error(`heartbeats:reconcile for the platform: ${name}'s ping address needs saving, but the host built the platform executor without a way to hold it (heldKeys.put, #540)`);
+        }
+        if (existing) {
+            // Already live. Re-save its ping address on every run, whether or not
+            // it looks already correct -- see `PlatformHeartbeatsDeps.put`'s own
+            // doc comment for why this, not a one-time save at create, is the fix.
+            await put(heartbeatCheckUrlRef(name), existing.pingUrl);
+            continue;
+        }
+        const created = await deps.heartbeats.createCheck(name);
+        await put(heartbeatCheckUrlRef(name), created.pingUrl);
+        await deps.heartbeats.pauseCheck(created.id);
+    }
+    const ownedNames = new Set([
+        PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME,
+        ...PLATFORM_BACKUP_SERVICE_KEYS.map((service) => platformBackupHeartbeatCheckName(service)),
+    ]);
+    const resolve = deps.heldKeys?.resolve;
+    for (const check of live) {
+        if (!ownedNames.has(check.name) || desiredSet.has(check.name))
+            continue;
+        // #540 round 2: a name match this reconcile holds no ref for is never
+        // deleted -- see this function's own doc comment, third paragraph.
+        const heldValue = resolve ? await resolve(heartbeatCheckUrlRef(check.name)) : null;
+        if (!heldValue)
+            continue;
+        await deps.heartbeats.deleteCheck(check.id);
+    }
+    // Last: so a run that failed anywhere above (an unreconciled create or
+    // delete) leaves this unset and `planHeartbeats` plans the step again --
+    // the same "record markers last" rule `provisionPlatformHc` follows.
+    context.recordScopeId(PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, [...desiredNames].sort().join(','));
+    return undefined;
+}
 /**
  * The real {@link PlatformCloudflareReader}: the platform's apex zone as
  * `planApexZone` expects to see it, and nothing else. The zone's DNS records
@@ -6659,8 +7123,10 @@ export class ProvidersPlatformCoolifyReader {
             if (!databaseId)
                 continue;
             try {
-                const backups = await this.client.listDatabaseBackups(databaseId);
-                const scheduled = backups.find((backup) => backup.enabled && backup.save_s3);
+                // A schedule that dumps the wrong database is not live: the step is
+                // planned again and `provisionPlatformBackup` repairs it.
+                const { schedule, named } = await findPlatformBackupSchedule(this.client, service, databaseId);
+                const scheduled = named ? schedule : undefined;
                 if (scheduled) {
                     resources.push({
                         system: 'coolify',