@wtfalch/foundry 0.21.1 → 0.22.0

package/dist/plan/diff.js

@@ -9,8 +9,8 @@ import { planFilesKeys } from './entry-files-key.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appEnvAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS } from './platform-org.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
 import { withStepSystem } from './step-system.js';
@@ -106,6 +106,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const zone = planZone(org, byKey, claimed);
     const zoneWaiting = zone.blocked !== null;
     const zoneBlocked = [];
+    // #555: steps that write DNS records, which go through edge.
+    const dnsBlocked = [];
+    // #553: a ZITADEL app provision whose app id is recorded needs the typed confirmation.
+    const guardApp = (step) => guardAppProvision(step, org, recordedIds);
     const mail = planMail(org, byKey, claimed, recordedIds, platformReadiness.mailHost, platformReadiness.platformApex, platformReadiness.platformLettermintProjectId);
     // #238: own-domain mail publishes DNS records into the zone, so it waits for
     // an active zone -- blocked, not planned (rule 2).
@@ -115,6 +119,10 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
             key: 'coolify:mail:zone',
         });
     }
+    else if (mail.step && edgeNeeded(platformReadiness, ['zones', 'dns'])) {
+        // #555: its zone lookup and DNS records go through edge.
+        dnsBlocked.push(edgeBlockedItem(org, 'mail', 'coolify:mail', edgeNeeded(platformReadiness, ['zones', 'dns'])));
+    }
     else if (mail.step) {
         plannedSteps.push(mail.step);
     }
@@ -166,8 +174,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // step's recorded client id, the same way `coolifyApp` runs after the
     // hosted app's own `zitadel:app` steps.
     const cmsClient = planCmsClient(org, byKey, claimed);
-    if (cmsClient)
-        plannedSteps.push(cmsClient);
+    const cmsGuarded = guardApp(cmsClient);
+    if (cmsGuarded)
+        plannedSteps.push(cmsGuarded);
     const site = planSite(org, byKey, claimed);
     if (site)
         plannedSteps.push(site);
@@ -182,11 +191,29 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const customers = planCustomers(org, live, claimed, recordedIds);
     if (customers)
         plannedSteps.push(customers);
-    plannedSteps.push(...planIssuerApps(org, byKey, claimed));
-    plannedSteps.push(...planEntryClients(org, byKey, claimed));
+    for (const step of [
+        ...planIssuerApps(org, byKey, claimed),
+        ...planEntryClients(org, byKey, claimed),
+    ]) {
+        const guarded = guardApp(step);
+        if (guarded)
+            plannedSteps.push(guarded);
+    }
     // The Access gate before the database, app, tunnel and zone (#84): on a
     // first apply the hostname is gated before anything answers on it.
-    plannedSteps.push(...planAccess(org, recordedIds));
+    // An Access gate that cannot be planned must not leave the hostname it
+    // guards routed: the tunnel (and its DNS) that exposes it waits too.
+    let accessGateBlocked = false;
+    for (const step of planAccess(org, recordedIds)) {
+        const reason = edgeNeeded(platformReadiness, ['access']);
+        if (reason) {
+            accessGateBlocked = true;
+            dnsBlocked.push(edgeBlockedItem(org, `Access gate for ${step.action.key}`, 'cloudflare:access', reason));
+        }
+        else {
+            plannedSteps.push(step);
+        }
+    }
     // Database before app (hosting-wiring campaign): `plan-apply.ts`'s
     // `runSteps` executes `plannedSteps` in this array order, and the app's own
     // step (`executor.ts`'s `coolifyApp`) pushes the database's connection
@@ -217,7 +244,21 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const tunnel = planTunnel(org, byKey, claimed, recordedIds);
     // #238: a tunnel that is being provisioned waits for an active zone; parking
     // one never does.
-    if (tunnel && zoneWaiting && tunnel.action.desired.enabled !== false) {
+    // #555: provisioning writes the tunnel config, the zone lookup and DNS; a
+    // park only writes the tunnel config (`cloudflareTunnel`'s `enabled === false`
+    // branch), so it needs the tunnels port alone.
+    const tunnelEdgeReason = tunnel
+        ? edgeNeeded(platformReadiness, tunnel.action.desired.enabled === false ? ['tunnels'] : ['tunnels', 'zones', 'dns'])
+        : null;
+    // Parking closes a hostname, so only a provision waits for a blocked gate.
+    const tunnelReason = tunnelEdgeReason ??
+        (tunnel && accessGateBlocked && tunnel.action.desired.enabled !== false
+            ? 'its Access gate is blocked, and the tunnel and DNS would expose the hostname without it'
+            : null);
+    if (tunnel && tunnelReason) {
+        dnsBlocked.push(edgeBlockedItem(org, 'Cloudflare tunnel', 'cloudflare:tunnel', tunnelReason));
+    }
+    else if (tunnel && zoneWaiting && tunnel.action.desired.enabled !== false) {
         zoneBlocked.push({
             description: `${org.slug}'s Cloudflare tunnel is blocked, not planned: the zone for ${org.domain} is not active yet`,
             key: 'cloudflare:tunnel',
@@ -226,13 +267,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     else if (tunnel) {
         plannedSteps.push(tunnel);
     }
-    if (zone.step)
+    const zoneReason = zone.step ? edgeNeeded(platformReadiness, ['zones']) : null;
+    if (zone.step && zoneReason) {
+        dnsBlocked.push(edgeBlockedItem(org, 'Cloudflare zone', 'cloudflare:zone', zoneReason));
+    }
+    else if (zone.step) {
         plannedSteps.push(zone.step);
+    }
     // Right after the zone (#43): `cloudflareRateLimit` resolves the zone by
     // apex domain, so the zone step above must already have run (or the zone
     // must already exist live) by the time this one's action executes.
     const rateLimit = planRateLimit(org, recordedIds);
-    if (rateLimit && zoneWaiting) {
+    const rateLimitReason = rateLimit ? edgeNeeded(platformReadiness, ['zones', 'ratelimits']) : null;
+    if (rateLimit && rateLimitReason) {
+        dnsBlocked.push(edgeBlockedItem(org, 'sign-in rate limit', 'cloudflare:ratelimit', rateLimitReason));
+    }
+    else if (rateLimit && zoneWaiting) {
         zoneBlocked.push({
             description: `${org.slug}'s sign-in rate limit is blocked, not planned: the zone for ${org.domain} is not active yet`,
             key: 'cloudflare:ratelimit',
@@ -246,8 +296,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // Its fixed ZITADEL client before the Coolify app it signs into:
     // `coolifyAgora` reads this step's recorded client id.
     const agoraClient = planAgoraClient(org, byKey, claimed);
-    if (agoraClient)
-        plannedSteps.push(agoraClient);
+    const agoraGuarded = guardApp(agoraClient);
+    if (agoraGuarded)
+        plannedSteps.push(agoraGuarded);
     const agora = planAgora(org, byKey, claimed, recordedIds, agoraHost);
     if (agora.step)
         plannedSteps.push(agora.step);
@@ -255,8 +306,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // shape as Agora and planned right after it. Its fixed ZITADEL client first,
     // for the same reason: `coolifyBoule` reads that step's recorded client id.
     const bouleClient = planBouleClient(org, byKey, claimed);
-    if (bouleClient)
-        plannedSteps.push(bouleClient);
+    const bouleGuarded = guardApp(bouleClient);
+    if (bouleGuarded)
+        plannedSteps.push(bouleGuarded);
     const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null);
     if (boule.step)
         plannedSteps.push(boule.step);
@@ -285,7 +337,12 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // retire, which needs no new zone) still waits for it.
     const edgeWorkers = planWorkers(org, recordedIds, options.edgeWorkers ?? false, options.platformHostnames ?? []);
     for (const step of edgeWorkers.steps) {
-        if (zoneWaiting && step.action.desired.mode === 'apply') {
+        // A retire never looks up the zone (`cloudflareWorker`), so only a deploy needs edge.
+        const workerReason = step.action.desired.mode === 'apply' ? edgeNeeded(platformReadiness, ['zones']) : null;
+        if (workerReason) {
+            dnsBlocked.push(edgeBlockedItem(org, `${step.action.key.slice(org.id.length + 1)} Worker`, step.action.key, workerReason));
+        }
+        else if (zoneWaiting && step.action.desired.mode === 'apply') {
             zoneBlocked.push({
                 description: `${org.slug}'s ${step.action.key.slice(org.id.length + 1)} Worker is blocked, not planned: the zone for ${org.domain} is not active yet`,
                 key: step.action.key,
@@ -361,6 +418,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     if (zone.blocked)
         unmanaged.push({ description: zone.blocked, key: 'cloudflare:zone' });
     unmanaged.push(...zoneBlocked);
+    unmanaged.push(...dnsBlocked);
     // #243: an appEnv source nothing will record is reported, not silently skipped.
     unmanaged.push(...app.blocked);
     unmanaged.push(...brokerEntries.blocked);
@@ -372,6 +430,52 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         versionChanges,
     };
 }
+/**
+ * #553: a plain ZITADEL app provision (not a `recreate`) is planned only when
+ * the live listing lacks the app by name. If an app id is recorded for it,
+ * the listing may simply have missed a live app, and nothing can read an app
+ * by id, so applying silently could replace a live sign-in client. The way
+ * out is the destroying `recreate` path: the step is planned as a
+ * replacement that asks for the typed confirmation, so a person who has
+ * checked the app is gone (deleted by hand in ZITADEL) says so, and apply
+ * then deletes the recorded id (a 404 is fine) and creates a new app.
+ * (A failed recreate clears the recorded id, so it is not caught here.)
+ */
+function guardAppProvision(step, org, recordedIds) {
+    if (!step || step.action.system !== 'zitadel' || step.action.kind !== 'app')
+        return step;
+    if (step.action.desired.recreate === true)
+        return step;
+    const recorded = recordedIds[`zitadel:app:${step.action.key}`];
+    if (!recorded)
+        return step;
+    return {
+        action: { ...step.action, desired: { ...step.action.desired, recreate: true } },
+        step: {
+            description: `replace ZITADEL app '${step.action.key}' for ${org.slug}: recorded app ${recorded} is not in ZITADEL's listing (a listing can miss a live app; if it is live, do not confirm -- apply deletes it and creates a new client id)`,
+            destroys: true,
+            migrates: false,
+        },
+    };
+}
+/**
+ * #555: why a step that needs these edge-routed ports cannot run, or `null`.
+ * `readiness.dnsBlocked` is set while edge is not applied; a port the host
+ * supplies itself (`readiness.ownEdgePorts`, mirroring the executor's
+ * `ports.dns` / `zones` / `access` / `ratelimits` / `tunnels`, which win over
+ * edge) needs no edge, so only a step that would really reach edge is blocked.
+ */
+function edgeNeeded(readiness, needs) {
+    if (!readiness.dnsBlocked)
+        return null;
+    return needs.every((port) => readiness.ownEdgePorts?.[port]) ? null : readiness.dnsBlocked;
+}
+function edgeBlockedItem(org, what, key, reason) {
+    return {
+        description: `${org.slug}'s ${what} is blocked, not planned: ${reason ?? ''} (#555)`,
+        key,
+    };
+}
 /**
  * The org's own ZITADEL org (issuer), a per-org singleton like every other
  * planner in this file, with one extra wrinkle: unlike mail/chat/site/app,
@@ -776,7 +880,24 @@ platformApex, platformLettermintProjectId) {
     const roleNote = rolesOwed > 0 ? `create ${rolesOwed} role mailbox(es) for ${org.slug}` : '';
     const mailboxWork = [ownerNote, roleNote].filter(Boolean).join(' and ');
     const mailboxNote = mailboxWork ? ` and ${mailboxWork}` : '';
-    if (!live) {
+    // #554: no reader lists a live `coolify mail <org>` resource, so "applied"
+    // comes from the record: the domain, mode and `usesDomain` the step last
+    // wrote (`coolifyMail`). A changed declaration differs from it and plans.
+    const recordedDomain = recordedIds[MAIL_DOMAIN_SCOPE_KEY];
+    const recordedMode = recordedIds[ORG_MAIL_APPLIED_MODE_SCOPE_KEY];
+    const recordedUsesDomain = recordedIds[ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY];
+    const domainMatches = Boolean(recordedDomain && org.domain && recordedDomain.toLowerCase() === org.domain.toLowerCase());
+    const appliedFromRecord = !live &&
+        Boolean(recordedDomain) &&
+        // Before `mail_applied_mode` existed, only a received or hosted apply
+        // recorded `mail_domain` (`off` returns before it); production's record is
+        // hosted. An unrecorded mode vouches for `hosted` only.
+        (recordedMode === undefined ? desired.mode === 'hosted' : recordedMode === desired.mode) &&
+        (recordedUsesDomain === undefined
+            ? desired.usesDomain && domainMatches
+            : recordedUsesDomain === String(desired.usesDomain) &&
+                (!desired.usesDomain || domainMatches));
+    if (!live && !appliedFromRecord) {
         return {
             step: {
                 action: { system: 'coolify', kind: 'mail', key: org.id, desired },
@@ -790,8 +911,8 @@ platformApex, platformLettermintProjectId) {
             mailboxBlocked,
         };
     }
-    const liveMode = live.config.mode;
-    const liveUsesDomain = Boolean(live.config.usesDomain);
+    const liveMode = live ? live.config.mode : desired.mode;
+    const liveUsesDomain = live ? Boolean(live.config.usesDomain) : desired.usesDomain;
     if (liveMode === desired.mode && liveUsesDomain === desired.usesDomain) {
         // #177: the platform's apex or mail host moved since this step last wrote
         // them (or it never recorded them). Re-applying is idempotent.
@@ -1476,7 +1597,12 @@ function planCmsClient(org, byKey, claimed) {
     if (live.config.appType === 'web')
         return null;
     return {
-        action: { system: 'zitadel', kind: 'app', key: 'cms', desired },
+        action: {
+            system: 'zitadel',
+            kind: 'app',
+            key: 'cms',
+            desired: { ...desired, recreate: true },
+        },
         step: {
             description: `recreate ZITADEL app 'cms' for ${org.slug} as web (was ${String(live.config.appType)})`,
             destroys: true,
@@ -1580,7 +1706,12 @@ function planAgoraClient(org, byKey, claimed) {
     if (live.config.appType === 'web')
         return null;
     return {
-        action: { system: 'zitadel', kind: 'app', key: 'agora', desired },
+        action: {
+            system: 'zitadel',
+            kind: 'app',
+            key: 'agora',
+            desired: { ...desired, recreate: true },
+        },
         step: {
             description: `recreate ZITADEL app 'agora' for ${org.slug} as web (was ${String(live.config.appType)})`,
             destroys: true,
@@ -1718,7 +1849,12 @@ function planBouleClient(org, byKey, claimed) {
     if (live.config.appType === 'web')
         return null;
     return {
-        action: { system: 'zitadel', kind: 'app', key: 'boule', desired },
+        action: {
+            system: 'zitadel',
+            kind: 'app',
+            key: 'boule',
+            desired: { ...desired, recreate: true },
+        },
         step: {
             description: `recreate ZITADEL app 'boule' for ${org.slug} as web (was ${String(live.config.appType)})`,
             destroys: true,
@@ -2168,6 +2304,19 @@ function planApps(org, byKey, claimed, recordedIds, plannedSteps, authIssuer, re
                 platformLettermintProjectId: readiness.platformLettermintProjectId,
             };
         }
+        // #555: the `app` entry's step publishes the mail domain's DNS records
+        // (`ensureAppLettermintMail`) once one is recorded, and those go through
+        // edge: blocked, not planned, while edge is not applied.
+        const appReason = edgeNeeded(readiness, ['zones', 'dns']);
+        if (appReason &&
+            key === APP_ENTRY_KEY &&
+            app.step &&
+            app.step.action.desired.enabled !== false &&
+            recordedIds[MAIL_DOMAIN_SCOPE_KEY]) {
+            blocked.push(edgeBlockedItem(org, 'app', 'coolify:app', appReason));
+            blocked.push(...app.blocked);
+            continue;
+        }
         if (app.step)
             steps.push(app.step);
         blocked.push(...app.blocked);
@@ -2458,7 +2607,12 @@ function planIssuerApps(org, byKey, claimed) {
         if (live.config.appType === app.kind)
             continue;
         steps.push({
-            action: { system: 'zitadel', kind: 'app', key: app.name, desired },
+            action: {
+                system: 'zitadel',
+                kind: 'app',
+                key: app.name,
+                desired: { ...desired, recreate: true },
+            },
             step: {
                 description: `recreate ZITADEL app '${app.name}' for ${org.slug} as ${app.kind} (was ${String(live.config.appType)})`,
                 destroys: true,

package/dist/plan/executor.d.ts

@@ -12,6 +12,7 @@ import { type EdgePlatformZones, type ZonePort } from './edge-zones.js';
 import { type LoginHostBindingsPort } from './login-host.js';
 import { type MailCopyPort } from './mail-copy.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
+import type { EdgePortName } from './platform-org.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
  * end"): makes each {@link StepAction} `diff.ts` plans true against a real
@@ -421,6 +422,16 @@ export interface CoolifyPort {
         deploymentUuid: string;
         status: string;
     }>;
+    /**
+     * One deployment's status by its uuid (`queued`, `in_progress`, `finished`,
+     * `failed`, `cancelled-by-user`); throws a 404 for a uuid Coolify does not
+     * know. Matches `CoolifyClient.getDeployment` method-for-method. The
+     * platform's Archon step reads it to confirm a deploy it triggered and did
+     * not wait for.
+     */
+    getDeployment(deploymentUuid: string): Promise<{
+        status: string;
+    }>;
 }
 /**
  * The Cloudflare zone calls the platform steps make directly, shaped to match
@@ -799,6 +810,8 @@ export interface ZitadelPort {
             appType: 'web' | 'native' | 'api';
             state: string;
             loginBaseUri?: string | null;
+            /** Present only when the host's listing reads it; `zitadelApp` adopts with it, else with the recorded one. */
+            clientId?: string;
         }>;
         complete: boolean;
     }>;
@@ -987,10 +1000,10 @@ export interface ZitadelPort {
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
  * -- into {@link ZitadelPort.listApps}'s own shape, so a host wiring that
  * real client in satisfies this port without reaching into `executor.ts`
- * itself to build the wrapper by hand. `complete: false` on every call:
- * the real client's own `_search` request has no pagination on it yet
- * (https://github.com/wtfalch/providers/issues/29), so this adapter cannot
- * promise it read more than one page. `loginBaseUri` comes back `undefined`
+ * itself to build the wrapper by hand. `complete: true` on every call:
+ * since providers 0.7.4 the real client pages `_search` to the end. A host
+ * that supplies its own `listApps` keeps whatever `complete` it reports.
+ * Each app's `clientId` (providers 0.7.5) passes through. `loginBaseUri` comes back `undefined`
  * for every app for the identical reason -- the real client does not read
  * it back at all yet, not "read it back as absent" -- which is exactly the
  * state `zitadelLoginHost`'s fail-closed rule exists for: every pending
@@ -1011,6 +1024,8 @@ export interface ZitadelListAppsRawApp {
     name: string;
     appType: 'web' | 'native' | 'api';
     state: string;
+    /** providers 0.7.5: the app's client id. Passed through to `ZitadelPort.listApps`. */
+    clientId?: string;
 }
 /**
  * Provisions one org's organisation on Files (#80), matching
@@ -1555,6 +1570,8 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private edgeZones;
     private edgeWriteSlot;
     constructor(ports: FoundryStepExecutorPorts);
+    /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
+    ownEdgePorts(): Partial<Record<EdgePortName, boolean>>;
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;

package/dist/plan/executor.js

@@ -23,7 +23,7 @@ import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
@@ -32,10 +32,10 @@ import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerR
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
  * -- into {@link ZitadelPort.listApps}'s own shape, so a host wiring that
  * real client in satisfies this port without reaching into `executor.ts`
- * itself to build the wrapper by hand. `complete: false` on every call:
- * the real client's own `_search` request has no pagination on it yet
- * (https://github.com/wtfalch/providers/issues/29), so this adapter cannot
- * promise it read more than one page. `loginBaseUri` comes back `undefined`
+ * itself to build the wrapper by hand. `complete: true` on every call:
+ * since providers 0.7.4 the real client pages `_search` to the end. A host
+ * that supplies its own `listApps` keeps whatever `complete` it reports.
+ * Each app's `clientId` (providers 0.7.5) passes through. `loginBaseUri` comes back `undefined`
  * for every app for the identical reason -- the real client does not read
  * it back at all yet, not "read it back as absent" -- which is exactly the
  * state `zitadelLoginHost`'s fail-closed rule exists for: every pending
@@ -45,7 +45,9 @@ import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerR
 export function adaptZitadelListApps(client) {
     return async (orgId, projectId) => ({
         apps: await client.listApps(orgId, projectId),
-        complete: false,
+        // Sound because package.json requires providers >=0.7.4 as a peer: from
+        // there `listApps` pages `_search` to the end, so this read every app.
+        complete: true,
     });
 }
 // ---------------------------------------------------------------------------
@@ -731,6 +733,16 @@ export class FoundryStepExecutor {
     constructor(ports) {
         this.ports = ports;
     }
+    /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
+    ownEdgePorts() {
+        return {
+            dns: Boolean(this.ports.dns),
+            zones: Boolean(this.ports.zones),
+            access: Boolean(this.ports.access),
+            ratelimits: Boolean(this.ports.ratelimits),
+            tunnels: Boolean(this.ports.tunnels),
+        };
+    }
     async execute(action, context) {
         const { org } = context;
         switch (`${action.system}:${action.kind}`) {
@@ -1459,14 +1471,69 @@ export class FoundryStepExecutor {
             throw new Error(`zitadel:app '${action.key}' for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
         }
         const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
-        // A kind change deletes the recorded app then recreates it (task
-        // brief); the first-ever create for this key has nothing recorded, so
-        // this is a no-op then. A 404 here (already gone) is tolerated the same
-        // way `destroy` tolerates one -- a retry after the delete half already
-        // succeeded but the recreate half failed must find an already-deleted
-        // app a no-op, not a new error that wedges the apply forever.
+        const isCmsClient = action.key === 'cms' && org.site.enabled;
+        const isAgoraClient = action.key === 'agora';
+        const isBouleClient = action.key === 'boule';
+        const authEntry = org.hosting.entries.find((e) => e.key === action.key && e.uses?.auth);
+        const clientIdScopeKey = isCmsClient
+            ? CMS_CLIENT_ID_SCOPE_KEY
+            : isAgoraClient
+                ? AGORA_CLIENT_ID_SCOPE_KEY
+                : isBouleClient
+                    ? BOULE_CLIENT_ID_SCOPE_KEY
+                    : authEntry
+                        ? entryClientIdScopeKey(action.key)
+                        : APP_CLIENT_ID_SCOPE_KEY;
         const priorAppId = recorded[`zitadel:app:${action.key}`];
-        if (priorAppId) {
+        // Only a step the planner flagged as destroying (`recreate`, set with
+        // `destroys: true` so plan-apply asks for the typed confirmation) may
+        // delete an app. A plain provision adopts a live app instead: one with
+        // the recorded id, or one of the same name in the project (an app an
+        // earlier apply created whose response was lost). ZITADEL's listing can
+        // miss a live app (it once dropped both company sign-in clients on
+        // production), and there is no read by app id, so a recorded app the
+        // listing does not show is never replaced: the planner reports it
+        // blocked, and this throws if a stale plan reaches it.
+        if (action.desired.recreate !== true) {
+            const listing = await this.ports.zitadel.listApps(zitadelOrgId, projectId);
+            const liveApps = listing.apps.filter((app) => app.state !== 'APP_STATE_REMOVED');
+            const byId = priorAppId ? liveApps.find((app) => app.id === priorAppId) : undefined;
+            const adopted = byId ?? liveApps.find((app) => app.name === action.key && app.appType === appType);
+            if (adopted) {
+                // Not adopted silently: a wrong type is a recreate (destroying, typed
+                // confirmation) and an inactive app is a person's decision. Neither
+                // can be known from the plan's name-keyed live read, so this throws.
+                if (adopted.appType !== appType || adopted.state !== 'APP_STATE_ACTIVE') {
+                    throw new Error(`zitadel:app '${action.key}' for ${org.slug}: app ${adopted.id} is live as a ${adopted.appType} app in state ${adopted.state}, not an active ${appType} app -- nothing was created or deleted`);
+                }
+                if (appType === 'api') {
+                    // The secret was minted once, at creation; an app matched only by
+                    // name has no recorded delivery, and nothing can recover it.
+                    if (adopted.id !== priorAppId) {
+                        throw new Error(`zitadel:app '${action.key}' for ${org.slug}: an api app ${adopted.id} of that name exists but was never recorded, so its secret cannot be recovered -- nothing was created or deleted; delete that app in ZITADEL, then apply again to mint a new one`);
+                    }
+                }
+                else {
+                    // A client id recorded for another app is never carried over.
+                    const clientId = adopted.clientId ??
+                        (adopted.id === priorAppId ? recorded[clientIdScopeKey] : undefined);
+                    if (!clientId) {
+                        throw new Error(`zitadel:app '${action.key}' for ${org.slug}: app ${adopted.id} is live but the listing gives no client id for it -- nothing was created or deleted`);
+                    }
+                    context.recordScopeId(clientIdScopeKey, clientId);
+                }
+                return { resourceId: adopted.id };
+            }
+            if (priorAppId) {
+                throw new Error(`zitadel:app '${action.key}' for ${org.slug}: recorded app ${priorAppId} is not in the listing, and a listing can miss a live app -- nothing was created or deleted; plan again and confirm the replacement step if the app is really gone`);
+            }
+        }
+        // A kind change (`recreate`) deletes the recorded app then recreates it
+        // (task brief); a 404 (already gone) is tolerated the same way `destroy`
+        // tolerates one -- a retry after the delete half already succeeded but
+        // the recreate half failed must find an already-deleted app a no-op, not
+        // a new error that wedges the apply forever.
+        if (action.desired.recreate === true && priorAppId) {
             try {
                 await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, priorAppId);
             }
@@ -1474,16 +1541,22 @@ export class FoundryStepExecutor {
                 if (!isNotFoundError(error))
                     throw error;
             }
+            // Gone now: a retry after a failed create must not find this id and be
+            // blocked as "recorded but missing" (`diff.ts`'s `guardAppProvision`).
+            // Removed (not blanked) and persisted now: a death before the create
+            // must not leave the stale id behind, nor an empty one for destroy.
+            if (context.forgetId)
+                context.forgetId(`zitadel:app:${action.key}`);
+            else
+                context.recordScopeId(`zitadel:app:${action.key}`, '');
+            await context.persistScopeIds();
             // The recreate half is retried on its own failure (the delete above
             // already tolerates the resulting 404), so a retry can also land here
             // after an earlier attempt's create call actually succeeded against
-            // ZITADEL but whose response this executor never saw (a dropped
-            // connection, a killed process). That app is deleted, not reused: the
-            // lost response also lost its clientSecret and clientId, which
-            // `listApps` cannot return, so reusing it would leave the secret
-            // undelivered and the clientId unrecorded forever. The create below
-            // then runs every side effect. A first-ever create (no `priorAppId`)
-            // has nothing to find here and never pays this read.
+            // ZITADEL but whose response this executor never saw. That app is
+            // deleted, not reused: the lost response also lost its clientSecret
+            // and clientId, which `listApps` cannot return, so reusing it would
+            // leave the secret undelivered and the clientId unrecorded forever.
             const orphan = await this.findRecreatedApp(zitadelOrgId, projectId, action.key, appType);
             if (orphan) {
                 try {
@@ -1512,16 +1585,13 @@ export class FoundryStepExecutor {
         // doc comment relies on. #164: the fixed `agora` client (`diff.ts`'s
         // `planAgoraClient`) is the same shape, always -- there is no
         // `org.site.enabled`-style guard to check, since Agora is always on.
-        const isCmsClient = action.key === 'cms' && org.site.enabled;
         // The Agora client stays `appType: 'web'`: providers' `createOidcApp`
         // makes every non-native app a public client (authorization code + PKCE,
         // `OIDC_AUTH_METHOD_TYPE_NONE`, no secret), which is what Agora's browser
         // SPA needs. Providers cannot create ZITADEL's `USER_AGENT` app kind.
-        const isAgoraClient = action.key === 'agora';
         // #161: the fixed `boule` client signs people into the org's Boule at its
         // own hostname, on the standard `/auth/callback` path (Boule is built on
         // `@wtfalch/auth` like every other web app here).
-        const isBouleClient = action.key === 'boule';
         const hostname = isCmsClient
             ? cmsHostnameFor(org)
             : isAgoraClient
@@ -1542,7 +1612,6 @@ export class FoundryStepExecutor {
             : `https://${hostname}/auth/callback`;
         // An entry with `uses.auth` signs in at its own exact hostnames, one pair
         // of addresses each; a `*` adds none (`entryHostnames`).
-        const authEntry = org.hosting.entries.find((e) => e.key === action.key && e.uses?.auth);
         const hosts = authEntry ? entryHostnames(org, authEntry) : null;
         const created = await this.ports.zitadel.createOidcApp(zitadelOrgId, projectId, {
             name: action.key,
@@ -1567,15 +1636,7 @@ export class FoundryStepExecutor {
             // plain scope id, not `deliverSecret`. A native app signs in via
             // device code with no cookie session of its own, so its clientId is
             // never something an app's env needs.
-            context.recordScopeId(isCmsClient
-                ? CMS_CLIENT_ID_SCOPE_KEY
-                : isAgoraClient
-                    ? AGORA_CLIENT_ID_SCOPE_KEY
-                    : isBouleClient
-                        ? BOULE_CLIENT_ID_SCOPE_KEY
-                        : authEntry
-                            ? entryClientIdScopeKey(action.key)
-                            : APP_CLIENT_ID_SCOPE_KEY, created.clientId);
+            context.recordScopeId(clientIdScopeKey, created.clientId);
         }
         return { resourceId: created.appId };
     }
@@ -4715,6 +4776,9 @@ export class FoundryStepExecutor {
             const parkedMailOrg = mailOrgFor(org, usesDomain, 'hosted');
             await this.ports.mail.parkOrgMail(parkedMailOrg, options);
             await this.parkLettermintMail(org, parkedMailOrg, context, platformApex, platformLettermintProjectId);
+            // #554: so a later declaration of hosted or received is not mistaken for applied.
+            context.recordScopeId(ORG_MAIL_APPLIED_MODE_SCOPE_KEY, mode);
+            context.recordScopeId(ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, String(usesDomain));
             return undefined;
         }
         const mailOrg = mailOrgFor(org, usesDomain, mode);
@@ -4722,12 +4786,16 @@ export class FoundryStepExecutor {
         await this.publishMailDnsRecords(org, result);
         await this.deleteStaleLettermintDomain(context, result.domain, platformApex);
         context.recordScopeId(MAIL_DOMAIN_SCOPE_KEY, result.domain);
-        // #177: what this step wrote from the platform, so `planMail` can see a later change.
-        context.recordScopeId(ORG_MAIL_APPLIED_APEX_SCOPE_KEY, options.apex);
-        context.recordScopeId(ORG_MAIL_APPLIED_HOST_SCOPE_KEY, options.mailHost);
         await this.ensureOwnerMailbox(org, mailOrg, options, context);
         await this.ensureOrgLettermintRelay(org, mailOrg, result.domain, context, platformApex, platformLettermintProjectId);
         await this.ensureRoleMailboxes(org, mailOrg, result.domain, options, context);
+        // #177, #554: what this step wrote, so `planMail` can see a later change
+        // and knows mail is applied. Last on purpose: a crash in the relay or a
+        // mailbox leaves these unrecorded, so the next plan still has the step.
+        context.recordScopeId(ORG_MAIL_APPLIED_APEX_SCOPE_KEY, options.apex);
+        context.recordScopeId(ORG_MAIL_APPLIED_HOST_SCOPE_KEY, options.mailHost);
+        context.recordScopeId(ORG_MAIL_APPLIED_MODE_SCOPE_KEY, mode);
+        context.recordScopeId(ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, String(usesDomain));
         return { resourceId: result.domain };
     }
     /**

package/dist/plan/plan-apply.d.ts

@@ -9,7 +9,7 @@ import { type AdoptCandidate, type AdoptInput, type AdoptPlan } from './adopt.js
 import { type AgoraHostPort } from './agora.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
-import { type HeldKeyResolver } from './platform-org.js';
+import { type EdgePortName, type HeldKeyResolver } from './platform-org.js';
 import type { CallsSfuConnectionPort } from './platform-sfu.js';
 /** Who did it, for `@wtfalch/audit`'s "who, when, the plan, the result" (#9, #19). */
 export interface AuditActor {
@@ -142,6 +142,8 @@ export interface StepExecutionContext {
      * scope key can never collide with the `system:kind:key` form.
      */
     recordScopeId(key: string, id: string): void;
+    /** Removes a recorded id (any key form). Optional: a context without it cannot forget one. */
+    forgetId?(key: string): void;
     /**
      * Writes every id recorded so far to the store now, not only at the end of
      * the run. For an id that must survive a crash mid-step: the ai key's id
@@ -161,6 +163,14 @@ export interface StepExecutor {
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
+    /**
+     * #555: which of the edge-routed ports (`dns`, `zones`, `access`,
+     * `ratelimits`, `tunnels`) this executor was built with its own
+     * implementation of, which it uses before edge. The planner blocks a step
+     * that needs edge only if the port it needs is not listed here. Optional:
+     * an executor without it supplies none.
+     */
+    ownEdgePorts?(): Partial<Record<EdgePortName, boolean>>;
 }
 /**
  * #167: {@link StepExecutionContext}'s platform-scoped counterpart -- what
@@ -212,6 +222,10 @@ export interface PlatformStepExecutor {
         hc?: string;
         /** #540: see `PlanPlatformOptions.blocked.heartbeatsExecutorMissing` (`platform-diff.ts`). */
         heartbeatsExecutorMissing?: boolean;
+        /** See `PlanPlatformOptions.blocked.archonRunsInsideApp`. */
+        archonRunsInsideApp?: boolean;
+        /** See `PlanPlatformOptions.blocked.archonDeployRunning`. */
+        archonDeployRunning?: string;
     }>;
     /**
      * Steps whose live state differs from the declared one in a way the recorded

package/dist/plan/plan-apply.js

@@ -13,7 +13,7 @@ import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, dnsBlockedReason, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
@@ -773,6 +773,9 @@ export class FoundryPlanApply {
             recordScopeId: (key, id) => {
                 serviceIds[key] = id;
             },
+            forgetId: (key) => {
+                delete serviceIds[key];
+            },
             persistScopeIds: async () => {
                 await this.store.putAppliedState({
                     orgId,
@@ -938,7 +941,13 @@ export class FoundryPlanApply {
         catch {
             // not held
         }
-        return { ...readiness, mailKeyHeld, canHoldSecrets: typeof heldKeys?.put === 'function' };
+        return {
+            ...readiness,
+            mailKeyHeld,
+            canHoldSecrets: typeof heldKeys?.put === 'function',
+            dnsBlocked: dnsBlockedReason(platform, recorded),
+            ownEdgePorts: this.executor.ownEdgePorts?.(),
+        };
     }
     /**
      * #177: `AgoraHostValues` from the applied platform, the same
@@ -1171,7 +1180,7 @@ function destroyTargets(serviceIds, orgId) {
             continue;
         }
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
-            if (!resourceKey.startsWith(prefix))
+            if (!resourceKey.startsWith(prefix) || !id)
                 continue;
             // Archon#271: foundry did not create an adopted app or database, so it never deletes it.
             if (adopted.has(resourceKey))
@@ -1224,7 +1233,7 @@ function destroyTargets(serviceIds, orgId) {
         targets.push({ system: 'edge', kind: 'key', key: entryKey, id });
     }
     for (const [resourceKey, id] of Object.entries(serviceIds)) {
-        if (!resourceKey.startsWith('zitadel:app:'))
+        if (!resourceKey.startsWith('zitadel:app:') || !id)
             continue;
         targets.push({
             system: 'zitadel',

package/dist/plan/platform-diff.d.ts

@@ -135,6 +135,15 @@ export declare const PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY = "archon
  * values until someone redeploys by hand (#467).
  */
 export declare const PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY = "archon_envs_deployed_hash";
+/**
+ * The uuid of the deployment Archon's step triggered without waiting
+ * (`PlatformArchonDeps.runsInsideApp`), `pending` between the trigger and the
+ * moment its uuid is known. The next plan reads that deployment's status:
+ * running blocks the step, failed or unknown plans it again, finished lets the
+ * next run of the step confirm it (the integrations key-synced marker) and
+ * clear this.
+ */
+export declare const PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY = "archon_deployment";
 /**
  * #211 round 4: the broker app id Archon last registered its entry with.
  * `provisionPlatformArchon` reads the broker to register with from
@@ -414,6 +423,16 @@ export declare function platformMailMxHost(apex: string): string;
  */
 export declare const ORG_MAIL_APPLIED_APEX_SCOPE_KEY = "mail_applied_apex";
 export declare const ORG_MAIL_APPLIED_HOST_SCOPE_KEY = "mail_applied_host";
+/**
+ * #554: the mode and `usesDomain` the step last applied. No reader lists a
+ * live `coolify mail <org>` resource, so `planMail` decides "applied" from
+ * the record. Records written before these keys existed lack them; a
+ * missing mode vouches for `hosted` only, a missing `usesDomain` only when
+ * the declared domain equals the recorded `mail_domain`. A park records
+ * mode `off`.
+ */
+export declare const ORG_MAIL_APPLIED_MODE_SCOPE_KEY = "mail_applied_mode";
+export declare const ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY = "mail_applied_uses_domain";
 /**
  * The key of a hosting entry in a `coolify:app` or `cloudflare:access` step
  * and in the ids recorded for it: `<orgId>:<entry key>`, so a second entry
@@ -845,6 +864,15 @@ export interface PlanPlatformOptions {
          * steps" note in `platform-providers.ts`'s `FoundryPlatformStepExecutor.blockedSteps`.
          */
         heartbeatsApiKeyMissing?: boolean;
+        /**
+         * The host runs inside Archon's app (`PlatformArchonDeps.runsInsideApp`):
+         * Archon's step redeploys it, so it is ordered last in the plan, after
+         * every step that would otherwise be lost when the old container stops.
+         * Not a block.
+         */
+        archonRunsInsideApp?: boolean;
+        /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
+        archonDeployRunning?: string;
     };
     /**
      * Steps whose live state differs from the declared one in a way the recorded

package/dist/plan/platform-diff.js

@@ -156,6 +156,15 @@ export const PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY = 'archon_integra
  * values until someone redeploys by hand (#467).
  */
 export const PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY = 'archon_envs_deployed_hash';
+/**
+ * The uuid of the deployment Archon's step triggered without waiting
+ * (`PlatformArchonDeps.runsInsideApp`), `pending` between the trigger and the
+ * moment its uuid is known. The next plan reads that deployment's status:
+ * running blocks the step, failed or unknown plans it again, finished lets the
+ * next run of the step confirm it (the integrations key-synced marker) and
+ * clear this.
+ */
+export const PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY = 'archon_deployment';
 /**
  * #211 round 4: the broker app id Archon last registered its entry with.
  * `provisionPlatformArchon` reads the broker to register with from
@@ -451,6 +460,16 @@ export function platformMailMxHost(apex) {
  */
 export const ORG_MAIL_APPLIED_APEX_SCOPE_KEY = 'mail_applied_apex';
 export const ORG_MAIL_APPLIED_HOST_SCOPE_KEY = 'mail_applied_host';
+/**
+ * #554: the mode and `usesDomain` the step last applied. No reader lists a
+ * live `coolify mail <org>` resource, so `planMail` decides "applied" from
+ * the record. Records written before these keys existed lack them; a
+ * missing mode vouches for `hosted` only, a missing `usesDomain` only when
+ * the declared domain equals the recorded `mail_domain`. A park records
+ * mode `off`.
+ */
+export const ORG_MAIL_APPLIED_MODE_SCOPE_KEY = 'mail_applied_mode';
+export const ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY = 'mail_applied_uses_domain';
 /**
  * The key of a hosting entry in a `coolify:app` or `cloudflare:access` step
  * and in the ids recorded for it: `<orgId>:<entry key>`, so a second entry
@@ -969,8 +988,10 @@ export function planPlatform(platform, live, options = {}) {
     // #175: last, on purpose. Archon's sign-in client lives in the sign-in
     // `planAuth` builds, and its env reads what every other service's step
     // records or delivers, so in one apply it runs after all of them.
-    const archon = planArchon(platform, recordedIds, blocked.archon ?? dnsBlocked?.('Archon'), authReady, drifted.archon);
-    if (archon.step)
+    const archon = planArchon(platform, recordedIds, blocked.archon ?? dnsBlocked?.('Archon'), authReady, drifted.archon, blocked.archonDeployRunning);
+    // The host runs inside this app: its step ends by redeploying the process
+    // that runs the plan, so it goes after everything else (pushed below).
+    if (archon.step && !blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
     // #257: after every service above, so a database any of them just
     // recorded is already visible to `recordedIds` on this same plan.
@@ -982,6 +1003,8 @@ export function planPlatform(platform, live, options = {}) {
     const heartbeats = planHeartbeats(platform, recordedIds, hcReady, blocked.heartbeatsExecutorMissing ?? false, blocked.heartbeatsApiKeyMissing ?? false);
     if (heartbeats.step)
         plannedSteps.push(heartbeats.step);
+    if (archon.step && blocked.archonRunsInsideApp)
+        plannedSteps.push(archon.step);
     // #251: one line per service whose recorded applied ref no longer matches
     // what the next apply would use (or, for zitadel, what is actually live).
     // Never pushed into `plannedSteps` -- see `VersionChangeItem`'s own doc
@@ -2227,9 +2250,12 @@ function planAi(platform, recordedIds, executorBlocked) {
  * ({@link PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY}) plans the step again, as
  * {@link planAuth} does.
  */
-function planArchon(platform, recordedIds, executorBlocked, authReady, drifted) {
+function planArchon(platform, recordedIds, executorBlocked, authReady, drifted, deployRunning) {
     if (!platform.archon.enabled)
         return { step: null, blocked: null };
+    // A deploy the step triggered is still running: planning it again would deploy twice.
+    if (deployRunning)
+        return { step: null, blocked: deployRunning };
     const key = resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY);
     const applied = Boolean(recordedIds[key]) &&
         Boolean(recordedIds[PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY]) &&

package/dist/plan/platform-org.d.ts

@@ -35,6 +35,8 @@ export declare const NO_DOMAIN_MAIL_APEX = "oikos.host";
  * names the same "positional arguments that shifted on every merge" problem
  * this avoids).
  */
+/** The edge-routed ports an executor may be given its own implementation of. */
+export type EdgePortName = 'dns' | 'zones' | 'access' | 'ratelimits' | 'tunnels';
 export interface OrgPlatformReadiness {
     /**
      * `null` until the platform's own mail server (#169) is enabled and
@@ -96,6 +98,22 @@ export interface OrgPlatformReadiness {
      * used to say there was none; N1 is no longer deployed by hand).
      */
     edgeReady: boolean;
+    /**
+     * #555: why a company step that writes through edge cannot run yet, `null`
+     * or absent when none is blocked. DNS records, zones, Access apps, rate
+     * limit rules and tunnels all go through edge unless the host supplies its
+     * own port ({@link ownEdgePorts}); while edge is not applied, `diff.ts`
+     * reports each such step blocked instead of planning one that would fail
+     * half way.
+     */
+    dnsBlocked?: string | null;
+    /**
+     * #555: the edge-routed ports the host's executor supplies itself
+     * (`FoundryStepExecutorPorts.dns` / `zones` / `access` / `ratelimits` /
+     * `tunnels`). The executor uses these before edge, so a step that needs
+     * only these is not blocked by {@link dnsBlocked}.
+     */
+    ownEdgePorts?: Partial<Record<EdgePortName, boolean>>;
     /** `https://<platform.edge.hostname>`, which an entry with `uses.edge` gets as `EDGE_URL`. `null` until `edgeReady`. */
     edgeUrl?: string | null;
     /**
@@ -149,6 +167,16 @@ export interface HeldKeyResolver {
  * (which could carry provider detail) goes nowhere.
  */
 export declare function heldPlatformKeyRefs(heldKeys: HeldKeyResolver): Promise<Set<string>>;
+/**
+ * #555: the reason no company step may write DNS yet, `null` when one may.
+ * Every DNS record, zone, Access app, rate limit rule and tunnel call goes
+ * through edge unless the host supplies its own port
+ * ({@link OrgPlatformReadiness.ownEdgePorts}), so edge must be enabled and
+ * applied (the same check as `edgeReady`, without the host-port half). {@link FoundryPlanApply} sets
+ * {@link OrgPlatformReadiness.dnsBlocked} from this; the pure
+ * {@link orgPlatformReadinessFrom} leaves it unset (nothing blocked).
+ */
+export declare function dnsBlockedReason(platform: DeclaredPlatform, platformRecordedIds: Readonly<Record<string, string>>): string | null;
 /**
  * `FoundryPlanApply.computeFreshPlan`'s own precedent for turning a
  * `PlatformStore`'s `get()`/`getServiceIds()` into what an org's plan needs.

package/dist/plan/platform-org.js

@@ -63,6 +63,23 @@ export async function heldPlatformKeyRefs(heldKeys) {
 function coolifyAppApplied(platformRecordedIds, key) {
     return Boolean(platformRecordedIds[`coolify:app:${key}`]);
 }
+/**
+ * #555: the reason no company step may write DNS yet, `null` when one may.
+ * Every DNS record, zone, Access app, rate limit rule and tunnel call goes
+ * through edge unless the host supplies its own port
+ * ({@link OrgPlatformReadiness.ownEdgePorts}), so edge must be enabled and
+ * applied (the same check as `edgeReady`, without the host-port half). {@link FoundryPlanApply} sets
+ * {@link OrgPlatformReadiness.dnsBlocked} from this; the pure
+ * {@link orgPlatformReadinessFrom} leaves it unset (nothing blocked).
+ */
+export function dnsBlockedReason(platform, platformRecordedIds) {
+    if (!platform.edge.enabled) {
+        return 'every DNS record is written through edge, and the platform does not enable edge';
+    }
+    return coolifyAppApplied(platformRecordedIds, PLATFORM_EDGE_KEY)
+        ? null
+        : 'every DNS record is written through edge, and edge is not applied yet';
+}
 /**
  * `FoundryPlanApply.computeFreshPlan`'s own precedent for turning a
  * `PlatformStore`'s `get()`/`getServiceIds()` into what an org's plan needs.

package/dist/plan/platform-providers.d.ts

@@ -290,6 +290,8 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         hc?: string;
         heartbeatsExecutorMissing?: boolean;
         heartbeatsApiKeyMissing?: boolean;
+        archonRunsInsideApp?: boolean;
+        archonDeployRunning?: string;
     }>;
     /**
      * Whether Archon's live Access policy lets through anyone but the declared
@@ -474,7 +476,7 @@ export interface PlatformMailRuntime {
  * {@link PlatformStepExecutionContext}, bundled like {@link PlatformAuthDeps}.
  */
 export interface PlatformArchonDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'getDeployment'>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -493,6 +495,15 @@ export interface PlatformArchonDeps {
      * Access app nobody can pass.
      */
     accessEmails: readonly string[];
+    /**
+     * True when the host process runs inside the Coolify app this step
+     * redeploys (Archon's console is `platform:archon`). A deploy that waits
+     * would be killed with the old container, so the step then records every
+     * applied marker first, and triggers the deploy last, without waiting.
+     * The planner puts the step last in the plan. Next plan: the step runs
+     * again only if the app is not running (`archonRedeployFailed`).
+     */
+    runsInsideApp?: boolean;
     /**
      * Reads a secret an earlier step handed to the host through
      * `deliverSecret`, or `null` when none is held under `ref` yet -- the same

package/dist/plan/platform-providers.js

@@ -8,7 +8,7 @@ import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment,
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -318,6 +318,18 @@ export class FoundryPlatformStepExecutor {
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
+        // Not a block: tells the planner to order Archon's step last (`PlanPlatformOptions.blocked.archonRunsInsideApp`).
+        if (this.archon?.runsInsideApp) {
+            blocked.archonRunsInsideApp = true;
+            // A deploy the step triggered and did not wait for: while it runs, a
+            // second deploy must not be planned.
+            const deployment = recordedIds[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY];
+            if (platform.archon.enabled &&
+                deployment &&
+                (await archonDeploymentState(this.archon.coolify, deployment)) === 'running') {
+                blocked.archonDeployRunning = `Archon is blocked, not planned: its deployment ${deployment} is still running; plan again when it has finished`;
+            }
+        }
         return blocked;
     }
     /**
@@ -347,7 +359,18 @@ export class FoundryPlatformStepExecutor {
                 !brokerDrifted &&
                 !bootstrapOperatorDrifted &&
                 (await archonRollingUpdateDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]));
-            if (accessDrifted || brokerDrifted || bootstrapOperatorDrifted || rollingUpdateDrifted)
+            // The deployment the step triggered failed or Coolify does not know it:
+            // plan the step again, which deploys again. A finished one is confirmed
+            // by the next run of the step (keys-synced), see `provisionPlatformArchon`.
+            const deployment = recordedIds[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY];
+            const redeployFailed = this.archon.runsInsideApp === true &&
+                Boolean(deployment) &&
+                (await archonDeploymentState(this.archon.coolify, deployment)) === 'failed';
+            if (accessDrifted ||
+                brokerDrifted ||
+                bootstrapOperatorDrifted ||
+                rollingUpdateDrifted ||
+                redeployFailed)
                 result.archon = true;
         }
         if (platform.auth.enabled && this.auth) {
@@ -2600,6 +2623,7 @@ async function provisionPlatformArchon(context, deps) {
     const appliedGitRef = recorded[PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY];
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
+    const selfRedeploy = deps.runsInsideApp === true;
     if (deps.accessEmails.length === 0) {
         throw new Error('platform:archon: no Access emails given; refusing to put Archon behind an Access app nobody can pass');
     }
@@ -3030,7 +3054,17 @@ async function provisionPlatformArchon(context, deps) {
     // patch above actually takes effect on the running container, not just on
     // Coolify's stored config.
     const rollingUpdateApplied = recorded[PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY] === '1';
-    const archonDeployedNow = keyUnsynced ||
+    // The deployment an earlier run triggered without waiting: read before
+    // deciding whether to deploy again.
+    const priorDeployment = selfRedeploy ? recorded[PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY] : undefined;
+    const deployState = priorDeployment
+        ? await archonDeploymentState(deps.coolify, priorDeployment)
+        : 'none';
+    if (deployState === 'running' || deployState === 'unreadable') {
+        throw new Error(`platform:archon: the deployment ${priorDeployment} cannot be confirmed yet (${deployState === 'running' ? 'still running' : 'status unreadable'}); plan again later`);
+    }
+    const archonDeployedNow = (keyUnsynced && deployState !== 'finished') ||
+        deployState === 'failed' ||
         app.justCreated ||
         !app.running ||
         changed ||
@@ -3039,7 +3073,7 @@ async function provisionPlatformArchon(context, deps) {
         appliedGitRef !== gitRef ||
         !rollingUpdateApplied ||
         recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] !== hostname;
-    if (archonDeployedNow) {
+    if (archonDeployedNow && !selfRedeploy) {
         // #467: cleared before the deploy below is even attempted, not after --
         // a deploy that then fails, or a crash before `waitForHealthyVersion`
         // passes, must leave this run's attempt unconfirmed. Recording it only
@@ -3111,13 +3145,14 @@ async function provisionPlatformArchon(context, deps) {
     // Coolify's own deployment record finished, which is what actually closes
     // the loophole named in #252 (an old container staying healthy while the
     // deployment itself fails).
-    if (archonDeployedNow) {
+    if (archonDeployedNow && !selfRedeploy) {
         await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
     }
     // #398: the deployment finished and answers health, so Archon now runs with
     // the key id its env carries. `provisionPlatformIntegrations` drops the
     // previous public key only on this marker.
-    if (keyUnsynced && integrationsKeyId) {
+    // With `runsInsideApp` only once Coolify's deployment record says it finished.
+    if (keyUnsynced && integrationsKeyId && (!selfRedeploy || deployState === 'finished')) {
         await record(PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, integrationsKeyId);
     }
     // #475: confirmed only now, after the health check above has passed on a
@@ -3140,6 +3175,36 @@ async function provisionPlatformArchon(context, deps) {
     // it.
     await record(PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, brokerAppId);
     await record(PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, bootstrapOperator ?? 'none');
+    // The host runs inside this app: every marker is recorded above, so the
+    // deploy goes last and is not waited for -- the old container stops during
+    // it, and the response, the lease and the audit row must be done first.
+    if (selfRedeploy && !archonDeployedNow && deployState === 'finished') {
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, ''); // confirmed above
+    }
+    if (selfRedeploy && archonDeployedNow) {
+        await record(`coolify:app:${PLATFORM_ARCHON_KEY}`, appId);
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, 'pending');
+        let deploymentUuid;
+        try {
+            // `force` takes the branch that always creates a real deployment record
+            // (a skipped one answers with a uuid Coolify never stored).
+            const started = (await deps.coolify.deploy(appId, true));
+            const uuid = Array.isArray(started) ? started[0]?.deployment_uuid : undefined;
+            if (typeof uuid !== 'string' || !uuid) {
+                throw new Error('platform:archon: Coolify answered the deploy with no deployment_uuid');
+            }
+            deploymentUuid = uuid;
+        }
+        catch (error) {
+            // Not triggered: forget the applied ref so the next plan runs the step again.
+            await record(PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, '');
+            await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, '');
+            throw error;
+        }
+        // The next plan reads this deployment's status; a kill before this write
+        // leaves `pending`, which that plan reads as unconfirmed and plans again.
+        await record(PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, deploymentUuid);
+    }
     return { resourceId: appId };
 }
 // #211 round 6: mirrors `wtfalch/auth/broker/src/apps.ts`'s own `isValidFrom`
@@ -3560,6 +3625,28 @@ async function archonBootstrapOperatorDrifted(coolify, appId, recordedIds) {
  * version of this check never actually fired. `custom_network_aliases` and
  * `health_check_enabled` are both top-level there.
  */
+/**
+ * The state of the deployment Archon's step triggered without waiting
+ * (`PlatformArchonDeps.runsInsideApp`), from Coolify's own deployment record:
+ * `running` (queued or in progress), `finished`, `failed` (failed, cancelled,
+ * its uuid never recorded, or unknown to Coolify -- a 404), or `unreadable`
+ * for any other error. Status and a served request cannot tell a failed build
+ * from a success (the old container keeps serving), so this record is the
+ * only honest answer.
+ */
+async function archonDeploymentState(coolify, deploymentUuid) {
+    if (deploymentUuid === 'pending')
+        return 'failed';
+    try {
+        const { status } = await coolify.getDeployment(deploymentUuid);
+        if (status === 'queued' || status === 'in_progress')
+            return 'running';
+        return status === 'finished' ? 'finished' : 'failed';
+    }
+    catch (error) {
+        return isNotFoundError(error) ? 'failed' : 'unreadable';
+    }
+}
 async function archonRollingUpdateDrifted(coolify, appId) {
     if (!appId)
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.21.1",
+  "version": "0.22.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -37,6 +37,7 @@
     "calls-sfu:deploy": "node scripts/calls-sfu-deploy.mjs"
   },
   "peerDependencies": {
+    "@wtfalch/providers": ">=0.7.4",
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
@@ -44,7 +45,7 @@
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/edge": "0.9.0",
     "@wtfalch/email": "^0.17.0",
-    "@wtfalch/providers": "0.7.3",
+    "@wtfalch/providers": "0.7.5",
     "ssh2": "1.17.0",
     "zod": "4.6.5"
   },