@wtfalch/foundry 0.33.1 → 0.35.1

package/dist/plan/platform-providers.js

@@ -1,24 +1,33 @@
 import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, randomUUID, sign, } from 'node:crypto';
 import { isIPv4 } from 'node:net';
 import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalch/email/postmaster';
-import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
+import { VERSIONS, floatingTagBlocked, pinnedRef, pinnedTagFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ownerMailboxes } from '../org.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
+import { recordBuiltCommit } from './build-record.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
+import { placedOnPlatform } from './destinations.js';
 import { ACCESS_POLICY_NAME, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
-import { healthCheckSettings } from './health-check-settings.js';
+import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
+import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
+import { LIMITS, limited } from './own-limits.js';
+export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonAuthOrganizationId, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
+import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
+import { recordOwnDnsHostname } from './own-dns.js';
+import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
-import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
+import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, waitForSystemApi, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
-function apexZoneKey(apex) {
+export function apexZoneKey(apex) {
     return `cloudflare:zone:${apex}`;
 }
 /** The key `runPlatformSteps` records the jobs scheduler app's id under (`system:kind:key`, #173). */
@@ -29,7 +38,7 @@ const JOBS_APP_KEY = `coolify:jobs:${JOBS_SCHEDULER_KEY}`;
  * those exist. Edge's step runs first and records the address
  * (`planPlatform`), so a missing one means that step has not finished.
  */
-async function platformDns(deps, recorded, step) {
+export async function platformDns(deps, recorded, step) {
     const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
     if (!edgeUrl) {
         throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every DNS record is written through it`);
@@ -37,7 +46,7 @@ async function platformDns(deps, recorded, step) {
     return deps.dns(edgeUrl);
 }
 /** The tunnel port for a platform step; same address and same reason as {@link platformDns}. */
-async function platformTunnels(deps, recorded, step) {
+export async function platformTunnels(deps, recorded, step) {
     const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
     if (!edgeUrl) {
         throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every tunnel is managed through it`);
@@ -69,81 +78,22 @@ const JOBS_DATABASE_SCOPE_KEY = 'coolify_jobs_database';
  * never rotates a token the host already holds.
  */
 const JOBS_ADMIN_TOKEN_SCOPE_KEY = 'jobs_admin_token_set';
-/** How many times `coolifyJobs` tries `deliverSecret` before giving up. */
+/**
+ * An own org's scheduler only: the app's uuid, recorded and persisted before
+ * the admin token leaves and cleared once the token is delivered and written.
+ * Left set, the planner reports the scheduler blocked and never mints again.
+ */
+export const JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY = 'jobs_admin_token_undelivered';
+/** An own org's scheduler only: the git ref its app last deployed, so a changed declared ref plans the step again. */
+export const JOBS_APPLIED_GIT_REF_SCOPE_KEY = 'jobs_applied_git_ref';
+/** How many times `provisionJobsHost` tries `deliverSecret` before giving up. */
 const JOBS_ADMIN_TOKEN_DELIVERY_ATTEMPTS = 3;
-/** The ref the scheduler's admin token is delivered under: the host's real `JobsSchedulerPort` adapter reads it back. */
-export const JOBS_ADMIN_TOKEN_REF = 'jobs:scheduler:adminToken';
 /** The name of the Coolify project every platform-level service (starting with jobs, #173) lives in. */
 const PLATFORM_COOLIFY_PROJECT_NAME = 'platform';
 /** https://github.com/wtfalch/jobs -- the scheduler's own repo, Dockerfile at its root (its own `Dockerfile`'s doc comment). */
 const JOBS_SCHEDULER_REPO = 'wtfalch/jobs';
-/** The scheduler's fixed `custom_internal_name` and the port it listens on (jobs' `PORT`, default 8080). */
-const JOBS_INTERNAL_NAME = 'platform-jobs';
+/** The port the scheduler listens on (jobs' `PORT`, default 8080). */
 const JOBS_PORT = '8080';
-/**
- * The real {@link PlatformStepExecutor} for the two steps built so far:
- * `cloudflare:zone` for the platform's apex (#167) and `coolify:jobs` for the
- * jobs scheduler (#173). `coolify` is optional so every #167-era caller --
- * anything that only ever plans the apex zone -- keeps constructing this with
- * two arguments; a `coolify:jobs` step reaching this executor with no
- * `coolify` port configured throws, naming what is missing, rather than
- * silently doing nothing.
- *
- * `cloudflareZone` mirrors `executor.ts`'s `cloudflareZone`: find the zone by
- * apex and adopt it, create it only when absent. companyincluded.com already
- * exists on Cloudflare, empty, so the first apply adopts it. The owner org
- * (Company Included, whose own domain is the apex) may record the same zone
- * under its own applied state, so that owner is allowed. Any other org that
- * recorded it makes this refuse to adopt. There is no delete here and
- * `PlatformStepExecutor` has none: neither path ever removes the zone.
- *
- * `coolifyJobs` mirrors `executor.ts`'s `coolifyApp`/`coolifyDatabase`,
- * simplified for one platform-level singleton rather than one per org: find
- * or create a dedicated `platform` Coolify project, find or create the
- * scheduler's own database, find or create the scheduler app itself (from
- * https://github.com/wtfalch/jobs, one Dockerfile at its repo root, on the
- * declared `gitRef`), then push the database's `internal_db_url` in as
- * `DATABASE_URL`. There is no park branch yet, matching `planJobs`'s own
- * scope note -- `platform.jobs.enabled` going from true to false plans
- * nothing, so this method is never asked to stop or delete anything.
- *
- * #170 adds `sfu:livekit`, the platform's shared calls SFU. `sfu` is
- * optional: an existing host that constructs this executor for the zone step
- * alone keeps compiling, and a plan that includes an `sfu:livekit` step
- * without it configured refuses clearly rather than silently doing nothing.
- * #152: the step mints one LiveKit key per org with calls enabled rather
- * than one shared pair, so it also needs `declaredOrgStore.list()` -- the
- * same store this class already takes for `findOrgIdForZone`.
- *
- * #168 adds `coolify:app` keyed {@link PLATFORM_AUTH_KEY}, the platform's own
- * sign-in ({@link provisionPlatformAuth}), once a host passes
- * {@link PlatformAuthDeps}.
- *
- * #169 adds `coolify:app` keyed {@link PLATFORM_MAIL_KEY}, the platform's own
- * mail server ({@link provisionPlatformMail}), once a host passes
- * {@link PlatformMailDeps}.
- *
- * #174 adds `coolify:app` keyed {@link PLATFORM_INTEGRATIONS_KEY},
- * the integrations host ({@link provisionPlatformIntegrations}), once a host
- * passes {@link PlatformIntegrationsDeps}.
- *
- * #171 adds `coolify:app` keyed {@link PLATFORM_FILES_KEY}, the files host
- * ({@link provisionPlatformFiles}), once a host passes {@link PlatformFilesDeps}.
- *
- * #172 adds `coolify:app` keyed {@link PLATFORM_AI_KEY}, the platform's AI
- * host ({@link provisionPlatformAi}), once a host passes {@link PlatformAiDeps}.
- *
- * #478 adds `coolify:app` keyed {@link PLATFORM_EDGE_KEY}, the edge host
- * ({@link provisionPlatformEdge}), once a host passes {@link PlatformEdgeDeps}.
- *
- * #175 adds `coolify:app` keyed {@link PLATFORM_ARCHON_KEY}, Archon itself
- * ({@link provisionPlatformArchon}), once a host passes
- * {@link PlatformArchonDeps}.
- *
- * #257 adds `coolify:backup:<service>`, a nightly R2 backup of each
- * platform database ({@link provisionPlatformBackup}), once a host passes
- * {@link PlatformBackupDeps}.
- */
 export class FoundryPlatformStepExecutor {
     cloudflare;
     declaredOrgStore;
@@ -163,6 +113,7 @@ export class FoundryPlatformStepExecutor {
     heartbeats;
     uptime;
     accessProvider;
+    oikosIngress;
     constructor(cloudflare, declaredOrgStore, options = {}) {
         this.cloudflare = cloudflare;
         this.declaredOrgStore = declaredOrgStore;
@@ -182,8 +133,23 @@ export class FoundryPlatformStepExecutor {
         this.heartbeats = options.heartbeats;
         this.uptime = options.uptime;
         this.accessProvider = options.accessProvider;
+        this.oikosIngress = options.oikosIngress;
+    }
+    platformPorts = new WeakMap();
+    /** The port placed on the platform's destination, made once per port so a server is listed once. */
+    onPlatform(coolify) {
+        let made = this.platformPorts.get(coolify);
+        if (!made) {
+            made = placedOnPlatform(coolify);
+            this.platformPorts.set(coolify, made);
+        }
+        return made;
+    }
+    /** `deps` with its Coolify port placed on the platform destination, then limited by `profile`. */
+    limitedOnPlatform(deps, profile) {
+        return { ...deps, coolify: limited(this.onPlatform(deps.coolify), profile) };
     }
-    async blockedSteps(platform, recordedIds = {}) {
+    async blockedSteps(platform, recordedIds = {}, owner = {}) {
         const blocked = {};
         if (platform.auth.enabled && !this.auth) {
             blocked.auth =
@@ -223,6 +189,14 @@ export class FoundryPlatformStepExecutor {
             if (mailBlocked)
                 blocked.mail = mailBlocked;
         }
+        if (platform.mail.relay === true) {
+            const relayBlocked = this.mail
+                ? (mailRelayBlockedReason() ??
+                    (await relayServerBlockedReason(platform, this.mail, recordedIds)))
+                : MAIL_RELAY_BLOCKED.executorMissing;
+            if (relayBlocked)
+                blocked.relay = relayBlocked;
+        }
         if (platform.integrations.enabled && !this.integrations) {
             blocked.integrations =
                 'the integrations host is blocked, not planned: the host built the platform executor without its integrations dependencies';
@@ -281,6 +255,23 @@ export class FoundryPlatformStepExecutor {
             if (edgeBlocked)
                 blocked.edge = edgeBlocked;
         }
+        if (platform.edge.enabled && !oikosIngressApplied(recordedIds)) {
+            const edgeUrl = recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+            if (!this.oikosIngress) {
+                blocked.oikosIngress = OIKOS_INGRESS_BLOCKED.executorMissing;
+            }
+            else if (edgeUrl) {
+                let zoneBlocked;
+                try {
+                    zoneBlocked = await oikosIngressZoneBlocked(await this.oikosIngress.zones(edgeUrl), this.oikosIngress.callTimeoutMs);
+                }
+                catch {
+                    zoneBlocked = OIKOS_INGRESS_BLOCKED.zoneUnchecked;
+                }
+                if (zoneBlocked)
+                    blocked.oikosIngress = zoneBlocked;
+            }
+        }
         if (platform.archon.enabled) {
             if (!this.archon) {
                 blocked.archon =
@@ -291,7 +282,7 @@ export class FoundryPlatformStepExecutor {
                     'Archon is blocked, not planned: the host names no email the Cloudflare Access app in front of it may let through';
             }
             else {
-                const inputs = await collectArchonServiceInputs(platform, this.archon, recordedIds);
+                const inputs = await collectArchonServiceInputs(platform, this.archon, recordedIds, owner.files ?? null);
                 if ('blocked' in inputs) {
                     blocked.archon = inputs.blocked;
                 }
@@ -304,6 +295,22 @@ export class FoundryPlatformStepExecutor {
                 }
             }
         }
+        // Archon's own sign-in organisation lives in the owner company's ZITADEL, reached through the sign-in dependencies.
+        if (platform.archon.enabled) {
+            if (!this.auth) {
+                blocked.archonOrg =
+                    "Archon's sign-in organisation is blocked, not planned: the host built the platform executor without its auth dependencies";
+            }
+            else if (!this.auth.zitadelForInstance) {
+                blocked.archonOrg =
+                    "Archon's sign-in organisation is blocked, not planned: the host built the platform's auth dependencies without zitadelForInstance, so it cannot reach the owner company's ZITADEL";
+            }
+            const ownerCompany = await this.declaredOrgStore.get(platform.ownerOrgId);
+            const inviteBlocked = ownerInviteBlockedReason(ownerCompany, Boolean(this.auth?.ownerInviteMail));
+            if (inviteBlocked) {
+                blocked.archonOrgInvite = inviteBlocked.replace("the platform owner's invite", "the first person's invite into Archon's sign-in organisation");
+            }
+        }
         // Only once a database actually exists to back up -- the same
         // "nothing to report yet" rule `planBackups` (`platform-diff.ts`)
         // itself follows for "no database", so an otherwise-unrelated platform
@@ -321,21 +328,30 @@ export class FoundryPlatformStepExecutor {
             if (hcTagBlocked)
                 blocked.hc = hcTagBlocked;
         }
-        // Only once `hc` is actually applied -- `planHeartbeats` itself already
-        // withholds the step while `hc` is not, so a host with no heartbeats
+        // foundry#544: `'hosted'` needs none of `hc`'s own applied state -- only
+        // the self-hosted provider's standing note depends on `hc` being
+        // recorded applied at all. `planHeartbeats` itself already withholds the
+        // step while neither provider is ready, so a host with no heartbeats
         // deps wired carries no standing blocked note before there is anything
         // for it to reconcile.
-        if (!this.heartbeats && Boolean(recordedIds[`coolify:app:${PLATFORM_HC_KEY}`])) {
+        const heartbeatsHosted = platform.heartbeatsProvider === 'hosted';
+        if (!this.heartbeats &&
+            (heartbeatsHosted || Boolean(recordedIds[`coolify:app:${PLATFORM_HC_KEY}`]))) {
             blocked.heartbeatsExecutorMissing = true;
         }
-        else if (platform.hc.enabled && this.heartbeats) {
+        else if ((heartbeatsHosted || platform.hc.enabled) && this.heartbeats) {
             // #540 round 2: checked whether or not `hc` is recorded applied yet --
             // `hcReady` (`planPlatform`) goes true the same round `hc` is merely
             // *planned*, so this has to hold the heartbeats step back from the
             // very first round, before `coolify:app:platform:hc` is ever recorded.
             // See `PLATFORM_HC_API_KEY_REF`'s own doc comment (`platform-diff.ts`)
-            // for why nothing here can mint this key itself.
-            const apiKey = await this.heartbeats.heldKeys?.resolve?.(PLATFORM_HC_API_KEY_REF);
+            // for why nothing here can mint this key itself; foundry#544's
+            // `PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF` is the same rule for the
+            // outside provider's own key.
+            const apiKeyRef = heartbeatsHosted
+                ? PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF
+                : PLATFORM_HC_API_KEY_REF;
+            const apiKey = await this.heartbeats.heldKeys?.resolve?.(apiKeyRef);
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
@@ -343,7 +359,7 @@ export class FoundryPlatformStepExecutor {
         // #604: only once edge and sign-in are applied (the planner reports
         // that case itself) and no provider is recorded yet.
         if (platform.edge.enabled &&
-            platform.auth.enabled &&
+            owner.signIn &&
             !recordedIds[ACCESS_PROVIDER_RECORD_KEY] &&
             recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]) {
             if (!this.accessProvider?.zitadel.createOidcAppWithSecret) {
@@ -365,9 +381,10 @@ export class FoundryPlatformStepExecutor {
             platform.archon.enabled &&
             recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY]) {
             try {
-                const zitadel = this.archon.zitadelForInstance?.(`https://${platform.auth.hostname}`) ??
-                    this.archon.zitadel;
-                if (zitadel.updateOidcAppIdTokenUserinfoAssertion)
+                const zitadel = owner.signIn
+                    ? this.archon.zitadelForInstance?.(owner.signIn.issuerUrl, owner.signIn.bearerRef)
+                    : undefined;
+                if (zitadel?.updateOidcAppIdTokenUserinfoAssertion)
                     blocked.archonIdTokenUserinfo = true;
             }
             catch (e) {
@@ -469,18 +486,25 @@ export class FoundryPlatformStepExecutor {
      * login-client token is no longer the sole live PAT on its ZITADEL machine
      * user.
      */
-    async driftedSteps(platform, recordedIds = {}) {
+    async driftedSteps(platform, recordedIds = {}, owner = {}) {
         const result = {};
         if (platform.archon.enabled &&
             this.archon &&
             recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]) {
-            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, this.archon.accessEmails, platform.uptime.enabled
+            const ownerCompany = await this.declaredOrgStore.get(platform.ownerOrgId);
+            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, archonAccessEmails(this.archon.accessEmails, ownerCompany), platform.uptime.enabled
                 ? recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
                 : undefined);
-            const brokerDrifted = !accessDrifted && (await archonBrokerRegistrationDrifted(this.archon.coolify, recordedIds));
+            const archonOrgId = recordedIds[PLATFORM_ARCHON_ORG_SCOPE_KEY];
+            const brokerDrifted = !accessDrifted &&
+                (await archonBrokerRegistrationDrifted(this.archon.coolify, owner.signIn ?? null, archonOrgId, recordedIds));
             const authOrgDrifted = !accessDrifted &&
                 !brokerDrifted &&
-                (await archonAuthOrgDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], recordedIds));
+                (await archonAuthOrgDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], {
+                    AUTH_ORGANIZATION_ID: archonOrgId,
+                    CI_ORGANIZATION_ID: owner.signIn?.organisationId,
+                    ARCHON_FIRST_OWNER_LINK: archonFirstOwnerLink(recordedIds, owner.signIn ?? null),
+                }));
             const authzDrifted = !accessDrifted &&
                 !brokerDrifted &&
                 !authOrgDrifted &&
@@ -585,13 +609,13 @@ export class FoundryPlatformStepExecutor {
                 throw new Error('platform:auth needs FoundryPlatformStepExecutor to be constructed with its auth dependencies (#168)');
             }
             const company = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformAuth(context, this.auth, company);
+            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), company);
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_FILES_KEY) {
             if (!this.files) {
                 throw new Error('platform:files needs FoundryPlatformStepExecutor to be constructed with its files dependencies (#171)');
             }
-            return provisionPlatformFiles(context, this.files, filesShareDomains(await this.declaredOrgStore.list()));
+            return provisionPlatformFiles(context, this.limitedOnPlatform(this.files, LIMITS.platformFiles), filesShareDomains(await this.declaredOrgStore.list()));
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -599,19 +623,19 @@ export class FoundryPlatformStepExecutor {
             if (!this.integrations) {
                 throw new Error('platform:integrations needs FoundryPlatformStepExecutor to be constructed with its integrations dependencies (#174)');
             }
-            return provisionPlatformIntegrations(action, context, this.integrations);
+            return provisionPlatformIntegrations(action, context, this.limitedOnPlatform(this.integrations, LIMITS.platformIntegrations));
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_AI_KEY) {
             if (!this.ai) {
                 throw new Error('platform:ai needs FoundryPlatformStepExecutor to be constructed with its ai dependencies (#172)');
             }
-            return provisionPlatformAi(context, this.ai);
+            return provisionPlatformAi(context, this.limitedOnPlatform(this.ai, LIMITS.platformAi));
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_EDGE_KEY) {
             if (!this.edge) {
                 throw new Error('platform:edge needs FoundryPlatformStepExecutor to be constructed with its edge dependencies (#478)');
             }
-            return provisionPlatformEdge(context, this.edge);
+            return provisionPlatformEdge(context, this.limitedOnPlatform(this.edge, LIMITS.platformEdge));
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -620,19 +644,36 @@ export class FoundryPlatformStepExecutor {
                 throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
             }
             const ownerCompany = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformArchon(context, this.archon, ownerCompany);
+            return provisionPlatformArchon(context, this.limitedOnPlatform(this.archon, LIMITS.platformArchon), ownerCompany);
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_MAIL_KEY) {
             if (!this.mail) {
                 throw new Error('platform:mail needs FoundryPlatformStepExecutor to be constructed with its mail dependencies (#169)');
             }
-            return provisionPlatformMail(context, this.mail);
+            return provisionPlatformMail(context, this.limitedOnPlatform(this.mail, LIMITS.platformMail));
+        }
+        if (action.system === 'coolify' &&
+            action.kind === 'app' &&
+            action.key === PLATFORM_MAIL_RELAY_KEY) {
+            if (!this.mail) {
+                throw new Error('platform:mail-relay needs FoundryPlatformStepExecutor to be constructed with its mail dependencies');
+            }
+            return provisionPlatformMailRelay(action, context, this.limitedOnPlatform(this.mail, LIMITS.platformMailRelay));
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_HC_KEY) {
             if (!this.hc) {
                 throw new Error('platform:hc needs FoundryPlatformStepExecutor to be constructed with its hc dependencies (#540)');
             }
-            return provisionPlatformHc(context, this.hc);
+            return provisionPlatformHc(context, this.limitedOnPlatform(this.hc, LIMITS.platformHc));
+        }
+        if (action.system === 'zitadel' &&
+            action.kind === 'archon-org' &&
+            action.key === PLATFORM_ARCHON_KEY) {
+            if (!this.auth) {
+                throw new Error("platform:archon-org needs FoundryPlatformStepExecutor to be constructed with its auth dependencies: Archon's sign-in organisation is made through them");
+            }
+            const ownerCompany = await this.declaredOrgStore.get(context.platform.ownerOrgId);
+            return provisionPlatformArchonOrg(context, this.auth, ownerCompany);
         }
         if (action.system === 'zitadel' &&
             action.kind === 'id-token-userinfo' &&
@@ -670,6 +711,14 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformUptime(context, this.uptime);
         }
+        if (action.system === 'coolify' &&
+            action.kind === 'app' &&
+            action.key === PLATFORM_OIKOS_INGRESS_KEY) {
+            if (!this.oikosIngress) {
+                throw new Error('platform:oikos-ingress needs FoundryPlatformStepExecutor to be constructed with its oikos ingress dependencies');
+            }
+            return provisionPlatformOikosIngress(context, this.limitedOnPlatform(this.oikosIngress, LIMITS.platformIngress));
+        }
         if (action.system === 'cloudflare' && action.kind === 'zone') {
             return this.cloudflareZone(action, context);
         }
@@ -743,104 +792,152 @@ export class FoundryPlatformStepExecutor {
         if (!deliverSecret) {
             throw new Error('platform step coolify:jobs needs a deliverSecret -- construct FoundryPlatformStepExecutor with one, to hand the scheduler admin token to the host (#173)');
         }
-        const hostname = action.desired.hostname;
-        const gitRef = action.desired.gitRef;
-        const recorded = context.recordedIds();
-        let projectUuid = recorded[JOBS_PROJECT_SCOPE_KEY];
-        if (!projectUuid) {
-            const found = await coolify.findProjectByName(PLATFORM_COOLIFY_PROJECT_NAME);
-            projectUuid = found
-                ? found.uuid
-                : (await coolify.createProject(PLATFORM_COOLIFY_PROJECT_NAME)).uuid;
-            context.recordScopeId(JOBS_PROJECT_SCOPE_KEY, projectUuid);
-        }
-        const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
-        let dbId = recorded[JOBS_DATABASE_SCOPE_KEY];
-        if (!dbId) {
-            const dbName = `${JOBS_SCHEDULER_KEY}-scheduler-db`;
-            const found = (await coolify.listDatabases()).find((db) => db.name === dbName && db.environment_id === environment.id);
-            if (found) {
-                dbId = found.uuid;
-            }
-            else {
-                const server = await resolvePlatformServer(coolify);
-                const created = await coolify.createPostgresDatabase({
-                    project_uuid: projectUuid,
-                    server_uuid: server.uuid,
-                    environment_name: environment.name,
-                    environment_uuid: environment.uuid,
-                    name: dbName,
-                    postgres_db: 'jobs',
-                    postgres_user: 'jobs',
-                });
-                dbId = created.uuid;
-            }
-            context.recordScopeId(JOBS_DATABASE_SCOPE_KEY, dbId);
-        }
-        const existingApp = await coolify.findApplicationByName(JOBS_SCHEDULER_KEY, {
-            environmentIds: [environment.id],
+        return provisionJobsHost(scopeFromPlatform(context), {
+            coolify: limited(this.onPlatform(coolify), LIMITS.platformJobs),
+            deliverSecret,
+            runtime: this.runtime,
+        }, platformTarget(), {
+            hostname: action.desired.hostname,
+            gitRef: action.desired.gitRef,
+            project: platformJobsProject,
         });
-        let appId;
-        if (existingApp) {
-            appId = existingApp.uuid;
+    }
+}
+/** The platform's jobs scheduler lives in the shared `platform` project. */
+const platformJobsProject = {
+    async ensure(coolify, scope) {
+        const recorded = scope.recordedIds()[JOBS_PROJECT_SCOPE_KEY];
+        if (recorded)
+            return recorded;
+        const found = await coolify.findProjectByName(PLATFORM_COOLIFY_PROJECT_NAME);
+        const projectUuid = found
+            ? found.uuid
+            : (await coolify.createProject(PLATFORM_COOLIFY_PROJECT_NAME)).uuid;
+        scope.recordScopeId(JOBS_PROJECT_SCOPE_KEY, projectUuid);
+        return projectUuid;
+    },
+};
+/**
+ * Provisions one jobs scheduler (database, app, admin token) for `target`:
+ * the platform's, or an own org's. Every name and the held-key ref come from
+ * the target.
+ *
+ * An org target also guards the mint (`CLAUDE.md`, "Platform steps" rules 1
+ * and 3): the token's id is recorded as undelivered and persisted before the
+ * token leaves, the delivered guard is recorded after the env write, and the
+ * applied git ref is recorded so a changed ref plans the step again. The
+ * platform's step keeps its provision-only behaviour.
+ */
+export async function provisionJobsHost(scope, deps, target, input) {
+    const { coolify, deliverSecret, runtime } = deps;
+    const { hostname, gitRef } = input;
+    const own = target.kind === 'org';
+    const label = own ? `own step coolify:own-jobs for ${target.id}` : 'platform step coolify:jobs';
+    const projectUuid = await input.project.ensure(coolify, scope);
+    const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+    let dbId = scope.recordedIds()[JOBS_DATABASE_SCOPE_KEY];
+    if (!dbId) {
+        const dbName = target.names.jobsDb;
+        const found = (await coolify.listDatabases()).find((db) => db.name === dbName && db.environment_id === environment.id);
+        if (found) {
+            dbId = found.uuid;
         }
         else {
             const server = await resolvePlatformServer(coolify);
-            const githubApp = await coolify.requireGithubApp();
-            const created = await coolify.createGithubAppApplication({
+            const created = await coolify.createPostgresDatabase({
                 project_uuid: projectUuid,
                 server_uuid: server.uuid,
                 environment_name: environment.name,
                 environment_uuid: environment.uuid,
-                github_app_uuid: githubApp.uuid,
-                git_repository: JOBS_SCHEDULER_REPO,
-                git_branch: gitRef,
-                build_pack: 'dockerfile',
-                name: JOBS_SCHEDULER_KEY,
-                domains: coolifyDomains([hostname]),
+                name: dbName,
+                postgres_db: 'jobs',
+                postgres_user: 'jobs',
             });
-            appId = created.uuid;
+            dbId = created.uuid;
         }
-        // Set on every run, like `platform:files`' runner: the name another
-        // container reaches the scheduler by. It only takes effect on a deploy.
-        await coolify.updateApplication(appId, {
-            custom_internal_name: JOBS_INTERNAL_NAME,
-            ports_exposes: JOBS_PORT,
+        scope.recordScopeId(JOBS_DATABASE_SCOPE_KEY, dbId);
+    }
+    const existingApp = await coolify.findApplicationByName(target.names.jobsApp, {
+        environmentIds: [environment.id],
+    });
+    let appId;
+    if (existingApp) {
+        appId = existingApp.uuid;
+    }
+    else {
+        const server = await resolvePlatformServer(coolify);
+        const githubApp = await coolify.requireGithubApp();
+        const created = await coolify.createGithubAppApplication({
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            github_app_uuid: githubApp.uuid,
+            git_repository: JOBS_SCHEDULER_REPO,
+            git_branch: gitRef,
+            build_pack: 'dockerfile',
+            name: target.names.jobsApp,
+            ...(hostname ? { domains: coolifyDomains([hostname]) } : {}),
         });
-        const db = await getDatabaseStarted(coolify, dbId);
-        if (!db.internal_db_url) {
-            throw new Error(`platform step coolify:jobs: database ${dbId} has no internal_db_url yet; not deploying the scheduler without a database`);
-        }
-        // The scheduler migrates as `DATABASE_URL_OWNER` and creates its own
-        // `jobs_rt` role from `DATABASE_URL` (jobs README, "Deploying"). An app
-        // with no owner URL still holds the owner's URL in `DATABASE_URL`, so
-        // that is never reused: a runtime URL is minted, once, and kept after.
-        const hasOwnerUrl = (await coolify.listEnvs(appId)).some((e) => e.key === 'DATABASE_URL_OWNER' && !e.is_preview && e.value);
-        const runtimeUrl = await ensureAiRuntimeUrl(coolify, hasOwnerUrl ? [appId] : [], db.internal_db_url, 'platform step coolify:jobs');
-        const envs = [
-            { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
-            { key: 'DATABASE_URL', value: runtimeUrl },
-        ];
-        // Whether the scheduler runs on envs other than the ones written below.
-        // Marked and persisted before the first write, and cleared only after the
-        // deploy, so a run that dies in between leaves the mark and the next run
-        // deploys again (`CLAUDE.md` rule 4).
-        const pending = Boolean(recorded[JOBS_DEPLOY_PENDING_SCOPE_KEY]) || (await envsDiffer(coolify, appId, envs));
-        if (pending) {
-            context.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '1');
-            await context.persist?.();
-        }
-        // SCHEDULER_ADMIN_TOKEN gates the admin API the org registrations use
-        // (jobs README, "The admin API"); unset, every admin route answers 401.
-        // Delivered to the host before it is written to the app, so a failed
-        // delivery leaves nothing set and the rerun simply generates a new one.
-        let tokenJustSet = false;
-        if (!context.recordedIds()[JOBS_ADMIN_TOKEN_SCOPE_KEY]) {
-            const token = randomBytes(32).toString('hex');
+        appId = created.uuid;
+    }
+    // An org's declared ref is applied to the app it already has; the platform's
+    // is a manual redeploy.
+    const refChanged = own && Boolean(existingApp) && scope.recordedIds()[JOBS_APPLIED_GIT_REF_SCOPE_KEY] !== gitRef;
+    // Set on every run, like `platform:files`' runner: the name another
+    // container reaches the scheduler by. It only takes effect on a deploy.
+    await coolify.updateApplication(appId, {
+        custom_internal_name: target.internal.jobs,
+        ports_exposes: JOBS_PORT,
+        // A connect, not a GET: every route but the admin one answers 401, 404 or 405, which a GET check fails.
+        ...commandHealthCheckSettings(tcpProbe(JOBS_PORT)),
+        ...(refChanged ? { git_branch: gitRef } : {}),
+    });
+    const db = await getDatabaseStarted(coolify, dbId);
+    if (!db.internal_db_url) {
+        throw new Error(`${label}: database ${dbId} has no internal_db_url yet; not deploying the scheduler without a database`);
+    }
+    // The scheduler migrates as `DATABASE_URL_OWNER` and creates its own
+    // `jobs_rt` role from `DATABASE_URL` (jobs README, "Deploying"). An app
+    // with no owner URL still holds the owner's URL in `DATABASE_URL`, so
+    // that is never reused: a runtime URL is minted, once, and kept after.
+    const hasOwnerUrl = (await coolify.listEnvs(appId)).some((e) => e.key === 'DATABASE_URL_OWNER' && !e.is_preview && e.value);
+    const runtimeUrl = await ensureAiRuntimeUrl(coolify, hasOwnerUrl ? [appId] : [], db.internal_db_url, label);
+    const envs = [
+        { key: 'DATABASE_URL_OWNER', value: db.internal_db_url },
+        { key: 'DATABASE_URL', value: runtimeUrl },
+    ];
+    // Whether the scheduler runs on envs other than the ones written below.
+    // Marked and persisted before the first write, and cleared only after the
+    // deploy, so a run that dies in between leaves the mark and the next run
+    // deploys again (`CLAUDE.md` rule 4).
+    const pending = Boolean(scope.recordedIds()[JOBS_DEPLOY_PENDING_SCOPE_KEY]) ||
+        refChanged ||
+        (await envsDiffer(coolify, appId, envs));
+    if (pending) {
+        scope.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '1');
+        await scope.persist();
+    }
+    // SCHEDULER_ADMIN_TOKEN gates the admin API the org registrations use
+    // (jobs README, "The admin API"); unset, every admin route answers 401.
+    // Delivered to the host before it is written to the app.
+    let tokenJustSet = false;
+    if (!scope.recordedIds()[JOBS_ADMIN_TOKEN_SCOPE_KEY]) {
+        const lost = own ? scope.recordedIds()[JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY] : undefined;
+        const resumed = lost ? await deps.readSecret?.(target.refs.jobsAdminToken) : null;
+        if (lost && !resumed) {
+            throw new Error(`${label}: a scheduler admin token (${lost}) was minted but never confirmed delivered; remove the recorded key ${JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+        }
+        const token = resumed || randomBytes(32).toString('hex');
+        if (!resumed) {
+            if (own) {
+                scope.recordScopeId(JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, appId);
+                await scope.persist();
+            }
             let delivered = false;
             for (let attempt = 1; attempt <= JOBS_ADMIN_TOKEN_DELIVERY_ATTEMPTS && !delivered; attempt++) {
                 try {
-                    await deliverSecret(JOBS_ADMIN_TOKEN_REF, token);
+                    await deliverSecret(target.refs.jobsAdminToken, token);
                     delivered = true;
                 }
                 catch {
@@ -848,48 +945,49 @@ export class FoundryPlatformStepExecutor {
                 }
             }
             if (!delivered) {
-                throw new Error(`platform step coolify:jobs: the scheduler admin token could not be delivered after ${JOBS_ADMIN_TOKEN_DELIVERY_ATTEMPTS} attempts`);
+                throw new Error(`${label}: the scheduler admin token could not be delivered after ${JOBS_ADMIN_TOKEN_DELIVERY_ATTEMPTS} attempts`);
             }
-            envs.push({ key: 'SCHEDULER_ADMIN_TOKEN', value: token });
-            await coolify.bulkUpsertEnvs(appId, envs);
-            context.recordScopeId(JOBS_ADMIN_TOKEN_SCOPE_KEY, appId);
-            tokenJustSet = true;
         }
-        else {
-            await coolify.bulkUpsertEnvs(appId, envs);
-        }
-        // The app is created with `instant_deploy: false` and an env change needs
-        // a redeploy, so deploy after a create or a new token. Also when it is not
-        // running, so a deploy that failed on an earlier run is retried.
-        const running = (await coolify.getApplication(appId)).status?.startsWith('running') ?? false;
-        // An app applied before its internal address was recorded has no fixed
-        // name yet, so it deploys once to get it; after that it deploys on the
-        // other conditions only.
-        const addressNew = !context.recordedIds()[JOBS_INTERNAL_URL_SCOPE_KEY];
-        // The address is recorded only once the deployment finished: the scheduler
-        // has no route that answers without its admin token (every other path is a
-        // 401, 404 or 405), so the deployment record is the whole check, as for
-        // the AI worker. A deploy that fails or times out throws here, records
-        // nothing and leaves the step planned.
-        if (!existingApp || tokenJustSet || pending || !running || addressNew) {
-            await waitForNewDeployment(coolify, appId, { kind: 'deployment-only' }, this.runtime, this.runtime.sleep ?? defaultSleep, 'platform step coolify:jobs', 'the scheduler keeps its old address');
-        }
-        if (pending) {
-            context.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '');
-            await context.persist?.();
-        }
-        context.recordScopeId(JOBS_INTERNAL_URL_SCOPE_KEY, `http://${JOBS_INTERNAL_NAME}:${JOBS_PORT}`);
-        return { resourceId: appId };
+        envs.push({ key: 'SCHEDULER_ADMIN_TOKEN', value: token });
+        await coolify.bulkUpsertEnvs(appId, envs);
+        scope.recordScopeId(JOBS_ADMIN_TOKEN_SCOPE_KEY, appId);
+        if (own)
+            scope.recordScopeId(JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, '');
+        tokenJustSet = true;
     }
+    else {
+        await coolify.bulkUpsertEnvs(appId, envs);
+    }
+    // The app is created with `instant_deploy: false` and an env change needs
+    // a redeploy, so deploy after a create or a new token. Also when it is not
+    // running, so a deploy that failed on an earlier run is retried.
+    const running = (await coolify.getApplication(appId)).status?.startsWith('running') ?? false;
+    // An app applied before its internal address was recorded has no fixed
+    // name yet, so it deploys once to get it; after that it deploys on the
+    // other conditions only.
+    const addressNew = !scope.recordedIds()[JOBS_INTERNAL_URL_SCOPE_KEY];
+    // The address is recorded only once the deployment finished: the scheduler
+    // has no route that answers without its admin token (every other path is a
+    // 401, 404 or 405), so the deployment record is the whole check, as for
+    // the AI worker. A deploy that fails or times out throws here, records
+    // nothing and leaves the step planned.
+    if (!existingApp || tokenJustSet || pending || !running || addressNew) {
+        const built = await waitForNewDeployment(coolify, appId, { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, label, 'the scheduler keeps its old address');
+        await recordBuiltCommit(coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: 'jobs' }, (key, value) => scope.recordScopeId(key, value));
+    }
+    if (pending) {
+        scope.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '');
+        await scope.persist();
+    }
+    if (own)
+        scope.recordScopeId(JOBS_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
+    scope.recordScopeId(JOBS_INTERNAL_URL_SCOPE_KEY, `http://${target.internal.jobs}:${JOBS_PORT}`);
+    return { resourceId: appId };
 }
 // ---------------------------------------------------------------------------
 // #168: the platform's own sign-in (ZITADEL)
 // ---------------------------------------------------------------------------
 const PLATFORM_AUTH_PROJECT = 'platform';
-const PLATFORM_AUTH_DB_NAME = 'platform-auth-db';
-const PLATFORM_AUTH_ZITADEL_APP_NAME = 'platform-auth-zitadel';
-const PLATFORM_AUTH_LOGIN_APP_NAME = 'platform-auth-login';
-const PLATFORM_AUTH_BROKER_APP_NAME = 'platform-auth-broker';
 /**
  * Fixed `custom_internal_name`s (`diff.ts`'s `coolifyCalls` sets the same
  * kind of name on Synapse/MAS) so the Cloudflare tunnel below can address
@@ -897,12 +995,7 @@ const PLATFORM_AUTH_BROKER_APP_NAME = 'platform-auth-broker';
  * -- bypassing Coolify's own Traefik, which dispatches purely by `Host`
  * header and so cannot give two different apps the same public hostname.
  */
-const PLATFORM_AUTH_ZITADEL_INTERNAL_NAME = 'platform-auth-zitadel';
 export const PLATFORM_AUTH_LOGIN_INTERNAL_NAME = 'platform-auth-login';
-const PLATFORM_AUTH_BROKER_INTERNAL_NAME = 'platform-auth-broker';
-const PLATFORM_AUTH_TUNNEL_NAME = 'platform-auth-tunnel';
-/** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_AUTH_TUNNEL_NAME}. */
-const PLATFORM_AUTH_CLOUDFLARED_APP_NAME = 'platform-auth-cloudflared';
 /** `wtfalch/auth`'s `docker-compose.yml`: `image: ghcr.io/zitadel/zitadel:${ZITADEL_VERSION:-v4.17.3}`. Pinned in `versions.json` (#247). */
 const AUTH_ZITADEL_IMAGE = 'ghcr.io/zitadel/zitadel';
 const AUTH_ZITADEL_IMAGE_TAG = VERSIONS.zitadel;
@@ -917,6 +1010,22 @@ const AUTH_BROKER_DOCKERFILE = '/broker/Dockerfile';
  * own `ZITADEL_PORT: 8080` and the login image's own `EXPOSE`.
  */
 const AUTH_ZITADEL_PORT = '8080';
+/**
+ * The inline Dockerfile of the ZITADEL app. The published image is distroless (no shell, no `curl`) and has no
+ * HEALTHCHECK, and Coolify runs its own check as `sh -c`. So the app is a Dockerfile app: the image's own `ready`
+ * command is its exec-form HEALTHCHECK, which Coolify keeps while its own check is off. `ready` asks the port and
+ * TLS mode from the same `ZITADEL_*` settings the server reads. The start period covers the first run, which sets
+ * up the database and the first instance before it listens. The start command is the one
+ * {@link AUTH_ZITADEL_RUN_OPTIONS} names.
+ */
+export function zitadelDockerfile() {
+    return [
+        `FROM ${AUTH_ZITADEL_IMAGE}:${pinnedRef('zitadel')}`,
+        `EXPOSE ${AUTH_ZITADEL_PORT}`,
+        'CMD ["start-from-init", "--masterkeyFromEnv", "--tlsMode", "external"]',
+        'HEALTHCHECK --interval=15s --timeout=5s --start-period=180s --retries=5 CMD ["/app/zitadel", "ready"]',
+    ].join('\n');
+}
 export const AUTH_LOGIN_PORT = '3000';
 /** `broker/Dockerfile`'s own `ENV PORT=3000` / `EXPOSE 3000`. */
 const AUTH_BROKER_PORT = '3000';
@@ -942,8 +1051,8 @@ export const AUTH_ZITADEL_PATH_PATTERN = '^/(oidc|oauth|saml|management|admin|sy
 const AUTH_BROKER_PATH_PATTERN = '^/api(/|$)';
 const PLATFORM_AUTH_PROJECT_SCOPE_KEY = 'coolify_project_platform_auth';
 const PLATFORM_AUTH_DB_SCOPE_KEY = 'coolify_platform_auth_database';
-const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = 'coolify_platform_auth_zitadel_app';
-const PLATFORM_AUTH_LOGIN_SCOPE_KEY = 'coolify_platform_auth_login_app';
+export const PLATFORM_AUTH_ZITADEL_SCOPE_KEY = 'coolify_platform_auth_zitadel_app';
+export const PLATFORM_AUTH_LOGIN_SCOPE_KEY = 'coolify_platform_auth_login_app';
 const PLATFORM_AUTH_TUNNEL_SCOPE_KEY = 'cloudflare_platform_auth_tunnel';
 /** Recorded once the ZITADEL app has been deployed, so ZITADEL may have written to its database. */
 const PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY = 'zitadel_platform_auth_deployed';
@@ -1072,6 +1181,10 @@ function loginClientRecordValue(userId, patId, token) {
  * miss for a credential-liveness check than for Archon's own Access policy.
  */
 async function authLoginClientDrifted(platform, auth, recordedIds) {
+    return authLoginClientDriftedAt({ hostname: platform.auth.hostname }, auth, recordedIds);
+}
+/** {@link authLoginClientDrifted} for any instance; `bearerRef` is passed to `zitadelForInstance` only when set. */
+async function authLoginClientDriftedAt(instance, auth, recordedIds) {
     const record = parseLoginClientRecord(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]);
     if (!record)
         return false;
@@ -1081,7 +1194,10 @@ async function authLoginClientDrifted(platform, auth, recordedIds) {
     if (!orgId || !loginAppId || !brokerAppId)
         return true;
     try {
-        const zitadel = auth.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? auth.zitadel;
+        const issuer = `https://${instance.hostname}`;
+        const zitadel = (instance.bearerRef && instance.bearerRef !== PLATFORM_AUTH_INSTANCE_BEARER_REF
+            ? auth.zitadelForInstance?.(issuer, instance.bearerRef)
+            : auth.zitadelForInstance?.(issuer)) ?? auth.zitadel;
         const livePats = await zitadel.listLoginClientPats(orgId, record.userId);
         if (livePats.length !== 1 || livePats[0] !== record.patId)
             return true;
@@ -1240,28 +1356,33 @@ async function liveLoginClientTokenHash(coolify, appId) {
  * #197: a `cloudflared` connector for this tunnel is run
  * ({@link ensureCloudflaredConnector}), so `hostname` answers.
  */
-async function provisionPlatformAuth(context, deps, ownerCompany = null) {
-    const { platform } = context;
+export async function provisionAuthStack(scope, deps, target, input) {
+    const { hostname, apex, gitRef, ownerCompany, network } = input;
     const owners = ownerCompany?.owners ?? [];
-    const hostname = platform.auth.hostname;
-    const gitRef = platform.auth.gitRef;
-    const recorded = context.recordedIds();
+    const recorded = scope.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
+    const label = target.kind === 'platform' ? 'platform:auth' : `${target.id}:auth`;
+    const subject = target.kind === 'platform' ? 'the platform' : target.id;
+    const issuer = `https://${hostname}`;
+    const instanceZitadel = () => {
+        const forInstance = target.refs.instanceBearer === PLATFORM_AUTH_INSTANCE_BEARER_REF
+            ? deps.zitadelForInstance?.(issuer)
+            : deps.zitadelForInstance?.(issuer, target.refs.instanceBearer);
+        if (forInstance)
+            return forInstance;
+        if (target.kind === 'org') {
+            throw new Error(`own step coolify:own-auth for ${target.id}: the host supplies no ZITADEL port for the company's own instance`);
+        }
+        return deps.zitadel;
+    };
     // Records an id and writes it out now, so a crash before the step ends
     // cannot lose a resource a provider already created.
     const record = async (key, id) => {
-        context.recordScopeId(key, id);
-        await context.persist?.();
+        scope.recordScopeId(key, id);
+        await scope.persist();
     };
-    let projectUuid = recorded[PLATFORM_AUTH_PROJECT_SCOPE_KEY];
-    if (!projectUuid) {
-        const found = await deps.coolify.findProjectByName(PLATFORM_AUTH_PROJECT);
-        projectUuid = found
-            ? found.uuid
-            : (await deps.coolify.createProject(PLATFORM_AUTH_PROJECT)).uuid;
-        await record(PLATFORM_AUTH_PROJECT_SCOPE_KEY, projectUuid);
-    }
+    const projectUuid = await input.project.ensure(deps.coolify, scope);
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
     // ---- database ----------------------------------------------------------
     let dbId = recorded[PLATFORM_AUTH_DB_SCOPE_KEY];
@@ -1277,7 +1398,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            name: PLATFORM_AUTH_DB_NAME,
+            name: target.names.authDb,
             postgres_db: 'zitadel',
             postgres_user: 'zitadel',
         });
@@ -1290,22 +1411,19 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         // `coolifyCalls` follows the same rule for its own databases): Coolify
         // can take a moment to report a freshly created database's
         // `internal_db_url`, so the next apply retries from a clean state.
-        throw new Error('coolify:app for the platform (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
+        throw new Error(`coolify:app for ${subject} (auth): the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
     }
     // ---- the ZITADEL app itself ---------------------------------------------
-    const zitadelApp = await findOrCreatePlatformApp(deps.coolify, PLATFORM_AUTH_ZITADEL_APP_NAME, environment, async () => {
+    const zitadelApp = await findOrCreatePlatformApp(deps.coolify, target.names.authZitadel, environment, async () => {
         const server = await resolvePlatformServer(deps.coolify);
-        return deps.coolify.createDockerImageApplication({
+        return deps.coolify.createDockerfileApplication({
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: AUTH_ZITADEL_IMAGE,
-            docker_registry_image_tag: AUTH_ZITADEL_IMAGE_TAG,
-            ports_exposes: AUTH_ZITADEL_PORT,
-            custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS,
-            name: PLATFORM_AUTH_ZITADEL_APP_NAME,
-            description: `ZITADEL for the platform's own sign-in (#168, ${AUTH_ZITADEL_IMAGE}:${AUTH_ZITADEL_IMAGE_TAG})`,
+            dockerfile: zitadelDockerfile(),
+            name: target.names.authZitadel,
+            description: `ZITADEL for ${target.kind === 'platform' ? "the platform's" : `${target.id}'s`} own sign-in (#168, ${AUTH_ZITADEL_IMAGE}:${AUTH_ZITADEL_IMAGE_TAG})`,
             instant_deploy: false,
         });
     });
@@ -1315,14 +1433,21 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     // create must not leave the app unnamed for good, and the tunnel addresses
     // the app by this name. (The port cannot read the current name back, and
     // setting the same value again is harmless.)
-    // The run options go in the same patch, so an app made before they existed
-    // gets them too.
-    await deps.coolify.updateApplication(zitadelAppId, {
-        custom_internal_name: PLATFORM_AUTH_ZITADEL_INTERNAL_NAME,
-        custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS,
-    });
     // The container only takes new run options at its next deploy.
     const zitadelRunOptionsNew = recorded[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] !== AUTH_ZITADEL_RUN_OPTIONS;
+    // A new app is a Dockerfile app that starts with `zitadelDockerfile()`'s CMD, so it gets no run options.
+    // An app made before that is an image app, found by name and never replaced: it keeps its run options (sent
+    // here until the deploy that applied them is recorded), has no Docker-level check, and takes none until its
+    // organisation is provisioned again from zero. The Coolify check stays off on both: the Dockerfile's
+    // HEALTHCHECK is the live one, and Coolify's rolling update follows it.
+    await deps.coolify.updateApplication(zitadelAppId, {
+        custom_internal_name: target.internal.authZitadel,
+        ports_exposes: AUTH_ZITADEL_PORT,
+        health_check_enabled: false,
+        ...(zitadelRunOptionsNew && !zitadelApp.justCreated
+            ? { custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS }
+            : {}),
+    });
     // #251: only on create, never unconditionally -- nothing here patches
     // `docker_registry_image_tag` on an app `findOrCreatePlatformApp` found
     // already running, so that is the only moment this tag is actually live.
@@ -1333,7 +1458,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         await record(PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, AUTH_ZITADEL_IMAGE_TAG);
     }
     // ---- the zitadel-login app -----------------------------------------------
-    const loginApp = await findOrCreatePlatformApp(deps.coolify, PLATFORM_AUTH_LOGIN_APP_NAME, environment, async () => {
+    const loginApp = await findOrCreatePlatformApp(deps.coolify, target.names.authLogin, environment, async () => {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
@@ -1345,17 +1470,19 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             git_repository: AUTH_REPO,
             git_branch: gitRef,
             build_pack: 'dockerfile',
-            name: PLATFORM_AUTH_LOGIN_APP_NAME,
+            name: target.names.authLogin,
             dockerfile_location: AUTH_LOGIN_DOCKERFILE,
         });
     });
     const loginAppId = loginApp.appId;
     await record(PLATFORM_AUTH_LOGIN_SCOPE_KEY, loginAppId);
+    // The Dockerfile's own HEALTHCHECK is the live check (`IMAGE_HEALTHCHECK_SETTINGS`).
     await deps.coolify.updateApplication(loginAppId, {
-        custom_internal_name: PLATFORM_AUTH_LOGIN_INTERNAL_NAME,
+        custom_internal_name: target.internal.authLogin,
+        ...IMAGE_HEALTHCHECK_SETTINGS,
     });
     // ---- the broker app (#204) -------------------------------------------------
-    const brokerApp = await findOrCreatePlatformApp(deps.coolify, PLATFORM_AUTH_BROKER_APP_NAME, environment, async () => {
+    const brokerApp = await findOrCreatePlatformApp(deps.coolify, target.names.authBroker, environment, async () => {
         const server = await resolvePlatformServer(deps.coolify);
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
@@ -1367,21 +1494,24 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             git_repository: AUTH_REPO,
             git_branch: gitRef,
             build_pack: 'dockerfile',
-            name: PLATFORM_AUTH_BROKER_APP_NAME,
+            name: target.names.authBroker,
             dockerfile_location: AUTH_BROKER_DOCKERFILE,
         });
     });
     const brokerAppId = brokerApp.appId;
     await record(PLATFORM_AUTH_BROKER_SCOPE_KEY, brokerAppId);
     await deps.coolify.updateApplication(brokerAppId, {
-        custom_internal_name: PLATFORM_AUTH_BROKER_INTERNAL_NAME,
+        custom_internal_name: target.internal.authBroker,
+        ...IMAGE_HEALTHCHECK_SETTINGS,
     });
     // ---- env -----------------------------------------------------------------
     // Generated once, handed straight to `bulkUpsertEnvs` and nowhere else --
     // never returned, recorded, logged or interpolated into a thrown error, the
     // same rule `executor.ts`'s `ensureAuthCookieSecret` follows for a value
     // this package mints itself rather than receiving from a provider.
-    const masterkey = await ensureMasterkey(deps.coolify, zitadelAppId, databaseInUse);
+    const masterkey = await ensureMasterkey(deps.coolify, zitadelAppId, databaseInUse, label);
+    if (masterkey)
+        runtime.onSecret?.(masterkey);
     // #283: the instance is created once, with the system API, by a platform
     // whose admin machine user is not recorded yet (one that already has it was
     // built from a first instance and keeps it). The keypair is regenerated on
@@ -1391,7 +1521,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     if (lostInstance &&
         !recorded[PLATFORM_AUTH_INSTANCE_SCOPE_KEY] &&
         !recorded[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY]) {
-        throw new Error(instanceWithoutBearerMessage(hostname, `instance ${lostInstance}`));
+        throw new Error(instanceWithoutBearerMessage(hostname, `instance ${lostInstance}`, label));
     }
     const needsInstance = !recorded[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY] && !recorded[PLATFORM_AUTH_INSTANCE_SCOPE_KEY];
     const systemKeys = needsInstance ? generateSystemApiKeypair() : undefined;
@@ -1404,6 +1534,10 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         { key: 'ZITADEL_DATABASE_POSTGRES_DSN', value: db.internal_db_url },
         { key: 'ZITADEL_FIRSTINSTANCE_SKIP', value: 'true' },
         { key: 'ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED', value: 'true' },
+        // A username is unique per organisation, and the login name is `name@<org domain>`. Without it a
+        // name is unique across the instance, so the owner's account in Archon's own organisation
+        // collides with the same owner's account in the company's organisation.
+        { key: 'ZITADEL_DEFAULTINSTANCE_DOMAINPOLICY_USERLOGINMUSTBEDOMAIN', value: 'true' },
         {
             key: 'ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_BASEURI',
             value: `https://${hostname}/`,
@@ -1421,6 +1555,10 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             value: `https://${hostname}/login?samlRequest=`,
         },
         { key: 'ZITADEL_LOGSTORE_ACCESS_STDOUT_ENABLED', value: 'true' },
+        // ZITADEL 4.17.3 logs every mail's template data at warning level ("missing
+        // translation" for `<Type>.Footer`), which holds the one-time invite code.
+        // Errors (a failed SMTP send among them) are still written.
+        { key: 'ZITADEL_LOG_LEVEL', value: 'error' },
     ];
     if (masterkey)
         zitadelEnvs.push({ key: 'ZITADEL_MASTERKEY', value: masterkey });
@@ -1433,7 +1571,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     const loginEnvs = [
         {
             key: 'ZITADEL_API_URL',
-            value: `http://${PLATFORM_AUTH_ZITADEL_INTERNAL_NAME}:${AUTH_ZITADEL_PORT}`,
+            value: `http://${target.internal.authZitadel}:${AUTH_ZITADEL_PORT}`,
         },
         {
             key: 'CUSTOM_REQUEST_HEADERS',
@@ -1447,8 +1585,8 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         // invite's own path (set a password, then nowhere to go). Only set once
         // Archon is declared, and only ever to Archon: the platform's one landing
         // app for anyone who reaches the login app outside an app's own sign-in.
-        ...(platform.archon.enabled
-            ? [{ key: 'DEFAULT_REDIRECT_URI', value: `https://${platform.archon.hostname}` }]
+        ...(input.defaultRedirectUri
+            ? [{ key: 'DEFAULT_REDIRECT_URI', value: input.defaultRedirectUri }]
             : []),
     ];
     // #210: read back now, not inside the deploy-decision block below -- this
@@ -1456,7 +1594,9 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     // the same way `envsDiffer`/`bulkUpsertEnvs` below already do for every
     // other broker env, so a single apply that finds the key already held can
     // also see `LETTERMINT_API_TOKEN` as met and deploy in that same run.
-    const heldMailKey = await deps.heldKeys?.resolve(PLATFORM_AUTH_BROKER_MAIL_KEY_REF);
+    const heldMailKey = await deps.heldKeys?.resolve(target.refs.brokerMailKey);
+    if (heldMailKey)
+        runtime.onSecret?.(heldMailKey);
     // `AUTH_APPS` and `ZITADEL_SERVICE_USER_TOKEN`/`_FILE` are not pushed here
     // -- this function's own doc comment, "Known gaps". `LETTERMINT_API_TOKEN`
     // is, once held (#210): pushing it costs nothing even while the broker
@@ -1465,7 +1605,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     const brokerEnvs = [
         {
             key: 'ZITADEL_API_URL',
-            value: `http://${PLATFORM_AUTH_ZITADEL_INTERNAL_NAME}:${AUTH_ZITADEL_PORT}`,
+            value: `http://${target.internal.authZitadel}:${AUTH_ZITADEL_PORT}`,
         },
         { key: 'ZITADEL_DOMAIN', value: hostname },
         ...(heldMailKey ? [{ key: 'LETTERMINT_API_TOKEN', value: heldMailKey }] : []),
@@ -1517,25 +1657,25 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, authAppsRaw));
     }
     // ---- tunnel and DNS ------------------------------------------------------
-    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:auth');
-    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_AUTH_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_AUTH_TUNNEL_NAME));
+    const tunnels = await network.tunnels();
+    const existingTunnel = await tunnels.findTunnelByName(target.names.authTunnel);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(target.names.authTunnel));
     await record(PLATFORM_AUTH_TUNNEL_SCOPE_KEY, tunnel.id);
     await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
                 path: AUTH_ZITADEL_PATH_PATTERN,
-                service: `http://${PLATFORM_AUTH_ZITADEL_INTERNAL_NAME}:${AUTH_ZITADEL_PORT}`,
+                service: `http://${target.internal.authZitadel}:${AUTH_ZITADEL_PORT}`,
             },
             {
                 hostname,
                 path: AUTH_BROKER_PATH_PATTERN,
-                service: `http://${PLATFORM_AUTH_BROKER_INTERNAL_NAME}:${AUTH_BROKER_PORT}`,
+                service: `http://${target.internal.authBroker}:${AUTH_BROKER_PORT}`,
             },
             {
                 hostname,
-                service: `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`,
+                service: `http://${target.internal.authLogin}:${AUTH_LOGIN_PORT}`,
             },
             { service: 'http_status:404' },
         ],
@@ -1548,7 +1688,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         coolify: deps.coolify,
         tunnels,
         tunnelId: tunnel.id,
-        appName: PLATFORM_AUTH_CLOUDFLARED_APP_NAME,
+        appName: target.names.authCloudflared,
         projectUuid,
         environment,
         resolveServer: () => resolvePlatformServer(deps.coolify),
@@ -1557,15 +1697,15 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     });
     // The apex zone step records the zone id before this step runs, but it
     // creates no record for the hostname, so it is created here.
-    const zoneId = recorded[apexZoneKey(platform.apex)] ?? (await exactZone(deps.cloudflare, platform.apex))?.id;
+    const zoneId = await network.zoneId(apex);
     if (!zoneId) {
-        throw new Error(`platform:auth: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
+        throw new Error(`${label}: no Cloudflare zone for ${apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const dns = await platformDns(deps, context.recordedIds(), 'platform:auth');
-    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
+    const dns = await network.dns();
+    const [dnsRecord] = await dns.findDnsRecord(apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await dns.createDnsRecord(platform.apex, {
+        await dns.createDnsRecord(apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1573,25 +1713,36 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
+        await dns.updateDnsRecord(apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
             proxied: true,
         });
     }
+    if (target.kind === 'org')
+        await recordOwnDnsHostname(scope, hostname);
     // ---- foundry's own admin machine user, once ------------------------------
     if (!recorded[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY]) {
         const lost = recorded[PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY];
         if (lost) {
             // The planner reports this and plans nothing; this is the same rule for
             // a caller that reaches the step anyway.
-            throw new Error(`platform:auth: the admin key of ZITADEL machine user ${lost} was minted but never delivered; delete that user and the recorded key ${PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+            throw new Error(`${label}: the admin key of ZITADEL machine user ${lost} was minted but never delivered; delete that user and the recorded key ${PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
         }
         if (systemKeys) {
             // ZITADEL answers /debug/healthz without an instance; the openid
             // document below only exists once the instance does.
-            await waitForInstance(`https://${hostname}/debug/healthz`, runtime, sleep);
+            await waitForInstance(`https://${hostname}/debug/healthz`, runtime, sleep, label);
+            // Healthy is not ready for the system API: its gateway answers 503 for a moment after the server listens.
+            await waitForSystemApi({ customDomain: hostname, privateKey: systemKeys.privateKey, label }, {
+                fetch: runtime.fetch,
+                now: runtime.now ?? Date.now,
+                sleep,
+                timeoutMs: runtime.readyTimeoutMs,
+                intervalMs: runtime.readyIntervalMs,
+                requestTimeoutMs: runtime.readyRequestTimeoutMs,
+            });
             // Sent exactly once. Anything that may have reached ZITADEL leaves a
             // marker first, so the next run refuses instead of creating again.
             let created;
@@ -1601,6 +1752,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                     privateKey: systemKeys.privateKey,
                     instanceName: PLATFORM_AUTH_ORG_NAME,
                     firstOrgName: PLATFORM_AUTH_ORG_NAME,
+                    label,
                     owner: {
                         userName: PLATFORM_AUTH_BEARER_USER_NAME,
                         name: 'Foundry (instance owner)',
@@ -1614,12 +1766,13 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                 throw error;
             }
             const { instanceId, pat } = created;
+            runtime.onSecret?.(pat);
             // Recorded before the PAT leaves this function, like the admin key below.
             await record(PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, instanceId);
             const attempts = runtime.deliverAttempts ?? 3;
             for (let attempt = 1;; attempt += 1) {
                 try {
-                    await deps.deliverSecret(PLATFORM_AUTH_INSTANCE_BEARER_REF, pat);
+                    await deps.deliverSecret(target.refs.instanceBearer, pat);
                     break;
                 }
                 catch (error) {
@@ -1627,7 +1780,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                         const reason = redactSecrets(error instanceof Error ? error.message : String(error), [
                             pat,
                         ]);
-                        throw new Error(`platform:auth: the owner token of ZITADEL instance ${instanceId} was created but could not be delivered after ${attempts} tries (${reason}); ${instanceWithoutBearerMessage(hostname, `instance ${instanceId}`)}`);
+                        throw new Error(`${label}: the owner token of ZITADEL instance ${instanceId} was created but could not be delivered after ${attempts} tries (${reason}); ${instanceWithoutBearerMessage(hostname, `instance ${instanceId}`, label)}`);
                     }
                     await sleep(1000 * attempt);
                 }
@@ -1637,8 +1790,8 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         }
         // Minting needs a running instance behind the tunnel: the first apply
         // gets here right after the deploy.
-        await waitForInstance(`https://${hostname}/.well-known/openid-configuration`, runtime, sleep);
-        const zitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        await waitForInstance(`https://${hostname}/.well-known/openid-configuration`, runtime, sleep, label);
+        const zitadel = instanceZitadel();
         const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
         // #216 round 5: recorded here too (mirroring `provisionPlatformArchon`),
         // so `authLoginClientDrifted` (below) never needs its own ZITADEL call
@@ -1646,10 +1799,21 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         if (recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY] !== org.id) {
             await record(PLATFORM_ZITADEL_ORG_SCOPE_KEY, org.id);
         }
+        // The new instance starts with open self-registration and its host is
+        // already public: close it in the people organisation before anything
+        // else runs. The sign-in policy step records the close and repeats it;
+        // closing twice changes nothing.
+        try {
+            await zitadel.closeSelfRegistration(org.id);
+        }
+        catch {
+            throw new Error(`${label}: closing self-registration failed in ZITADEL org ${org.id}`);
+        }
         const { userId, token } = await zitadel.mintAdminMachineUser(org.id, {
             userName: PLATFORM_AUTH_ADMIN_USER_NAME,
             name: 'Foundry (platform admin)',
         });
+        runtime.onSecret?.(token);
         // Recorded and persisted before the token leaves this function: if
         // delivery fails for good, the next plan reports the lost key rather than
         // skipping or minting again. Only a delivered key records the guard.
@@ -1661,12 +1825,12 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         const attempts = runtime.deliverAttempts ?? 3;
         for (let attempt = 1;; attempt += 1) {
             try {
-                await deps.deliverSecret('zitadel:platform:admin', token);
+                await deps.deliverSecret(target.refs.authAdmin, token);
                 break;
             }
             catch {
                 if (attempt >= attempts) {
-                    throw new Error(`platform:auth: the admin key of ZITADEL machine user ${userId} was minted but could not be delivered after ${attempts} tries`);
+                    throw new Error(`${label}: the admin key of ZITADEL machine user ${userId} was minted but could not be delivered after ${attempts} tries`);
                 }
                 await sleep(1000 * attempt);
             }
@@ -1731,11 +1895,19 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     // make the same call, not just trust that a record exists, or a drifted
     // platform would be planned again forever without ever actually healing.
     const loginClientOtherInputsMissing = brokerMissingInputs.filter((m) => m !== 'ZITADEL_SERVICE_USER_TOKEN');
-    const freshRecordedIds = context.recordedIds();
+    const freshRecordedIds = scope.recordedIds();
     const freshLoginClientRecord = parseLoginClientRecord(freshRecordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]);
-    const loginClientNeedsMint = !freshLoginClientRecord || (await authLoginClientDrifted(platform, deps, freshRecordedIds));
+    const loginClientNeedsMint = !freshLoginClientRecord ||
+        (await authLoginClientDriftedAt({ hostname, bearerRef: target.refs.instanceBearer }, deps, freshRecordedIds));
     if (loginClientNeedsMint && loginClientOtherInputsMissing.length === 0) {
-        const loginClientZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        // An own org never mints a second time on top of a token that may be live:
+        // the platform's re-mint revokes the old one, which would take the org's
+        // sign-in down if the first delivery had in fact landed.
+        const loginClientLost = freshRecordedIds[PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY];
+        if (target.kind === 'org' && loginClientLost && !freshLoginClientRecord) {
+            throw new Error(`${label}: the login-client token of ZITADEL machine user ${loginClientLost} was minted but never confirmed delivered; remove the recorded key ${PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+        }
+        const loginClientZitadel = instanceZitadel();
         const { org: loginClientOrg } = await loginClientZitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
         // #216 round 5: backfills the org id for a platform whose admin block
         // (above) ran before this recording existed and has not run since --
@@ -1747,6 +1919,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             userName: PLATFORM_AUTH_LOGIN_CLIENT_USER_NAME,
             name: 'Foundry (platform login client)',
         });
+        runtime.onSecret?.(loginClientToken);
         // Recorded and persisted before the token leaves this function -- the
         // same "one mint" rule the admin block above follows. Never read back to
         // block planning; `planAuth` (`platform-diff.ts`) reads it only to
@@ -1788,8 +1961,8 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             // saying "its prior token was already revoked" there would describe a
             // revoke that never happened, so the message only says so when it did.
             throw new Error(revokedPriorPat
-                ? `platform:auth: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; its prior token was already revoked, so the login app and broker are down until a later apply mints and delivers a fresh one`
-                : `platform:auth: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; this is its first token, so the login app and broker still have none until a later apply mints and delivers one`);
+                ? `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; its prior token was already revoked, so the login app and broker are down until a later apply mints and delivers a fresh one`
+                : `${label}: the login-client token of ZITADEL machine user ${loginClientUserId} could not be delivered after ${deliverAttempts} tries; this is its first token, so the login app and broker still have none until a later apply mints and delivers one`);
         }
         // #216 round 4/5: records what was actually delivered -- the user id,
         // the exact PAT id, and (round 5) a hash of the exact token -- so the
@@ -1802,7 +1975,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     // ---- the owner company's own sign-in org ----------------------------------
     // Archon signs people in from this org; the `foundry` org holds none. The
     // company executor finds the same org by name (its slug) and makes no second.
-    const ownerOrgZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+    const ownerOrgZitadel = instanceZitadel();
     let ownerSignInOrgId;
     if (ownerCompany) {
         ({ orgId: ownerSignInOrgId } = await ensureSignInOrg({
@@ -1810,9 +1983,9 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
             zitadel: ownerOrgZitadel,
             name: ownerCompany.slug,
             domain: signInOrgDomain(ownerCompany),
-            recordScopeId: (key, id) => context.recordScopeId(key, id),
+            recordScopeId: (key, id) => scope.recordScopeId(key, id),
             persistScopeIds: async () => {
-                await context.persist?.();
+                await scope.persist();
             },
             orgScopeKey: PLATFORM_OWNER_ORG_SCOPE_KEY,
             domainScopeKey: PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY,
@@ -1827,19 +2000,22 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     const mailToken = heldMailKey || (await currentEnvValue(deps.coolify, brokerAppId, 'LETTERMINT_API_TOKEN'));
     const smtpTarget = resolveAuthSmtp(deps.smtp);
     if (mailToken) {
-        const mailZitadel = deps.zitadelForInstance?.(`https://${hostname}`) ?? deps.zitadel;
+        const mailZitadel = instanceZitadel();
         let smtpPassword;
         try {
             // Runs every time the step does (idempotent), so a rotated token lands.
             smtpPassword = (await deps.smtp?.password?.()) ?? mailToken;
+            runtime.onSecret?.(smtpPassword);
             const smtp = await mailZitadel.ensureSmtpProvider({
                 host: smtpTarget.host,
                 user: smtpTarget.user,
                 password: smtpPassword,
-                senderAddress: `noreply@${platform.apex}`,
+                senderAddress: input.smtpSender,
                 senderName: PLATFORM_AUTH_MAIL_SENDER_NAME,
                 tls: smtpTarget.tls,
-                description: PLATFORM_AUTH_SMTP_DESCRIPTION,
+                description: target.kind === 'platform'
+                    ? PLATFORM_AUTH_SMTP_DESCRIPTION
+                    : `foundry:org:${target.id}:lettermint`,
             });
             await record(PLATFORM_AUTH_SMTP_SCOPE_KEY, smtp.id);
         }
@@ -1849,10 +2025,10 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                 mailToken,
                 ...(smtpPassword ? [smtpPassword] : []),
             ]);
-            throw new Error(`platform:auth: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
+            throw new Error(`${label}: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
         }
-        const inviteRecorded = context.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
-        const inviteOrgRecorded = context.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY];
+        const inviteRecorded = scope.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+        const inviteOrgRecorded = scope.recordedIds()[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY];
         // An invite recorded for another org (the `foundry` org, before the owner moved) is made again.
         if (!inviteRecorded || (inviteRecorded !== 'none' && inviteOrgRecorded !== ownerSignInOrgId)) {
             const owner = owners[0];
@@ -1870,14 +2046,14 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                             zitadel: mailZitadel,
                             mail: deps.ownerInviteMail,
                             orgId: ownerSignInOrgId,
-                            authIssuer: `https://${hostname}`,
+                            authIssuer: issuer,
                             owner: {
                                 givenName: owner.givenName,
                                 familyName: owner.familyName,
                                 mailboxAddress,
                                 personalEmail: owner.email,
                             },
-                            label: 'platform:auth',
+                            label,
                             ...(inviteRecorded && inviteRecorded !== 'none'
                                 ? { invitedUserId: inviteRecorded }
                                 : {}),
@@ -1892,7 +2068,7 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
                             mailToken,
                             ...(smtpPassword ? [smtpPassword] : []),
                         ]);
-                        throw new Error(`platform:auth: could not invite the platform owner into ZITADEL org ${ownerSignInOrgId}: ${cause}`);
+                        throw new Error(`${label}: could not invite the platform owner into ZITADEL org ${ownerSignInOrgId}: ${cause}`);
                     }
                     // The user id first: a crash between the two replans the invite, never skips it.
                     await record(PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, invitedUserId);
@@ -1903,6 +2079,137 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
     }
     return { resourceId: zitadelAppId };
 }
+/** The platform's sign-in project: the shared `platform` project, its id recorded under the sign-in's own scope key. */
+const platformAuthProject = {
+    async ensure(coolify, scope) {
+        const recorded = scope.recordedIds()[PLATFORM_AUTH_PROJECT_SCOPE_KEY];
+        if (recorded)
+            return recorded;
+        const found = await coolify.findProjectByName(PLATFORM_AUTH_PROJECT);
+        const uuid = found ? found.uuid : (await coolify.createProject(PLATFORM_AUTH_PROJECT)).uuid;
+        scope.recordScopeId(PLATFORM_AUTH_PROJECT_SCOPE_KEY, uuid);
+        await scope.persist();
+        return uuid;
+    },
+};
+/** The platform's sign-in: {@link provisionAuthStack} with {@link platformTarget} and the platform's own inputs. */
+async function provisionPlatformAuth(context, deps, ownerCompany = null) {
+    const { platform } = context;
+    const scope = scopeFromPlatform(context);
+    return provisionAuthStack(scope, deps, platformTarget(), {
+        hostname: platform.auth.hostname,
+        apex: platform.apex,
+        gitRef: platform.auth.gitRef,
+        project: platformAuthProject,
+        network: platformNetwork(deps, scope, 'platform:auth'),
+        smtpSender: `noreply@${platform.apex}`,
+        defaultRedirectUri: platform.archon.enabled ? `https://${platform.archon.hostname}` : null,
+        ownerCompany,
+    });
+}
+/**
+ * Archon's own sign-in organisation (`zitadel:archon-org` keyed
+ * {@link PLATFORM_ARCHON_KEY}), in the owner company's ZITADEL and apart from
+ * the organisation that holds the company's people: the org, its primary
+ * domain, closed self-registration, a login policy that forces a second
+ * factor, and the first person's invite (a link mailed to their personal
+ * address). Each call records its key right after it succeeded, so a failure
+ * leaves the earlier keys recorded and the next plan names the step again; a
+ * repeat converges because every call looks before it writes. The errors name
+ * the org only, never the cause: the cause can carry an address or the invite.
+ * The invite code reaches only the mail port (30 second timeout, see
+ * `inviteOwnerWithLink`) and is never recorded or logged.
+ */
+async function provisionPlatformArchonOrg(context, deps, ownerCompany) {
+    const ownerSignIn = context.owner?.signIn ?? null;
+    if (!ownerSignIn || !ownerCompany) {
+        throw new Error("platform:archon-org: the owner company's sign-in has not been applied yet; Archon's organisation is made in its ZITADEL");
+    }
+    if (!deps.zitadelForInstance) {
+        throw new Error("platform:archon-org: the host built the platform's auth dependencies without zitadelForInstance, so it cannot reach the owner company's ZITADEL");
+    }
+    const zitadel = deps.zitadelForInstance(ownerSignIn.issuerUrl, ownerSignIn.bearerRef);
+    const record = async (key, value) => {
+        context.recordScopeId(key, value);
+        await context.persist?.();
+    };
+    const name = archonOrgName(ownerCompany.slug);
+    let orgId;
+    try {
+        ({ orgId } = await ensureSignInOrg({
+            zitadel,
+            name,
+            domain: archonOrgDomain(signInOrgDomain(ownerCompany)),
+            recordScopeId: (key, id) => context.recordScopeId(key, id),
+            persistScopeIds: async () => {
+                await context.persist?.();
+            },
+            orgScopeKey: PLATFORM_ARCHON_ORG_SCOPE_KEY,
+            domainScopeKey: PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY,
+            domainBlockedScopeKey: PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY,
+            registrationClosedScopeKey: PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY,
+        }));
+    }
+    catch {
+        throw new Error(`platform:archon-org: making the sign-in organisation ${name} (its domain and closed registration) failed in ZITADEL`);
+    }
+    await context.persist?.();
+    try {
+        await zitadel.enforceSecondFactor(orgId);
+    }
+    catch {
+        throw new Error(`platform:archon-org: forcing a second factor failed in ZITADEL org ${orgId}`);
+    }
+    await record(PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, orgId);
+    const recorded = context.recordedIds();
+    const inviteRecorded = recorded[PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY];
+    // An invite made in another org (an earlier Archon org) is made again.
+    if (!inviteRecorded ||
+        (inviteRecorded !== 'none' && recorded[PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY] !== orgId)) {
+        const owner = ownerCompany.owners[0];
+        if (!owner) {
+            await record(PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, 'none');
+        }
+        else {
+            const mailboxAddress = ownerMailboxes(ownerCompany)[0]?.address;
+            // `ownerInviteBlockedReason` reports these two as blocked; the step goes on without the invite.
+            if (mailboxAddress && deps.ownerInviteMail) {
+                let invitedUserId;
+                try {
+                    ({ userId: invitedUserId } = await inviteOwnerWithLink({
+                        zitadel,
+                        mail: deps.ownerInviteMail,
+                        orgId,
+                        authIssuer: ownerSignIn.issuerUrl,
+                        owner: {
+                            givenName: owner.givenName,
+                            familyName: owner.familyName,
+                            mailboxAddress,
+                            personalEmail: owner.email,
+                        },
+                        label: 'platform:archon-org',
+                        ...(deps.runtime?.onSecret ? { onSecret: deps.runtime.onSecret } : {}),
+                        ...(inviteRecorded && inviteRecorded !== 'none'
+                            ? { invitedUserId: inviteRecorded }
+                            : {}),
+                    }));
+                }
+                catch (error) {
+                    const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
+                        owner.email,
+                        owner.email.toLowerCase(),
+                        mailboxAddress,
+                    ]);
+                    throw new Error(`platform:archon-org: could not invite the first person into ZITADEL org ${orgId}: ${cause}`);
+                }
+                // The user id first: a crash between the two replans the invite, never skips it.
+                await record(PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, invitedUserId);
+                await record(PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, orgId);
+            }
+        }
+    }
+    return {};
+}
 /**
  * Reserves the username `admin` and switches self-registration off in the
  * platform's sign-in org (`zitadel:sign-in-policy` keyed {@link PLATFORM_AUTH_KEY}).
@@ -1977,11 +2284,7 @@ const PLATFORM_AUTH_MAIL_SENDER_NAME = 'Company Included';
 // #169: the platform's own mail server (Stalwart)
 // ---------------------------------------------------------------------------
 const PLATFORM_MAIL_PROJECT = 'platform';
-const PLATFORM_MAIL_APP_NAME = 'platform-mail-stalwart';
-const PLATFORM_MAIL_INTERNAL_NAME = 'platform-mail-stalwart';
-const PLATFORM_MAIL_TUNNEL_NAME = 'platform-mail-tunnel';
-/** #197: the one Coolify app that runs `cloudflared` for {@link PLATFORM_MAIL_TUNNEL_NAME}. */
-const PLATFORM_MAIL_CLOUDFLARED_APP_NAME = 'platform-mail-cloudflared';
+export const PLATFORM_MAIL_INTERNAL_NAME = 'platform-mail-stalwart';
 /**
  * `stalw.art/docs/install/docker`: the official image. `platform.mail.gitRef`
  * carries its tag -- `platform.ts`'s `PlatformService.gitRef` doc comment
@@ -2004,7 +2307,6 @@ const STALWART_PORTS_EXPOSES = [STALWART_HTTP_PORT, ...STALWART_SMTP_PORTS].join
  * not here -- it stays behind the tunnel, exactly like `platform:auth`'s
  * ZITADEL/login apps.
  */
-const STALWART_PORTS_MAPPINGS = STALWART_SMTP_PORTS.map((p) => `${p}:${p}`).join(',');
 /**
  * The v0.16 image's two VOLUMEs (its Dockerfile): the data store, and the
  * `config.json` Stalwart writes when bootstrap completes. The pre-0.16 image
@@ -2028,9 +2330,10 @@ const STALWART_RECOVERY_USER = 'admin';
  */
 const STALWART_READY_PATH = '/healthz/ready';
 /** Where the server the app was created on is recorded, so the MX record follows the app, not a later pick. */
-const PLATFORM_MAIL_SERVER_SCOPE_KEY = 'coolify_platform_mail_server';
+export const PLATFORM_MAIL_SERVER_SCOPE_KEY = 'coolify_platform_mail_server';
 const PLATFORM_MAIL_PROJECT_SCOPE_KEY = 'coolify_project_platform_mail';
 const PLATFORM_MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+const PLATFORM_MAIL_RELAY_APP_SCOPE_KEY = 'coolify_platform_mail_relay_app';
 const PLATFORM_MAIL_TUNNEL_SCOPE_KEY = 'cloudflare_platform_mail_tunnel';
 /**
  * Recorded once the app has been deployed at least once -- same role as
@@ -2198,24 +2501,21 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  *   (the guard only ever blocks a retry and names an id to revoke by), but
  *   worth tightening if `createApiKey` ever starts returning its own id.
  */
-async function provisionPlatformMail(context, deps) {
-    const { platform } = context;
-    const hostname = platform.mail.hostname;
-    const mailHost = platformMailMxHost(platform.apex);
-    const imageTag = platform.mail.gitRef;
-    const recorded = context.recordedIds();
+export async function provisionMailServer(scope, deps, target, input) {
+    const { hostname, apex, mailHost, imageTag, hostPorts, issuerUrl, mxRecord, network } = input;
+    const zone = input.zone ?? apex;
+    const label = target.kind === 'org' ? `own step coolify:own-mail for ${target.id}` : 'platform:mail';
+    const keyDescription = target.kind === 'org' ? `foundry:org:${target.id}:admin` : PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION;
+    const recorded = scope.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
     const record = async (key, id) => {
-        context.recordScopeId(key, id);
-        await context.persist?.();
+        scope.recordScopeId(key, id);
+        await scope.persist();
     };
     let projectUuid = recorded[PLATFORM_MAIL_PROJECT_SCOPE_KEY];
     if (!projectUuid) {
-        const found = await deps.coolify.findProjectByName(PLATFORM_MAIL_PROJECT);
-        projectUuid = found
-            ? found.uuid
-            : (await deps.coolify.createProject(PLATFORM_MAIL_PROJECT)).uuid;
+        projectUuid = await input.project.ensure(deps.coolify, scope);
         await record(PLATFORM_MAIL_PROJECT_SCOPE_KEY, projectUuid);
     }
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
@@ -2226,23 +2526,27 @@ async function provisionPlatformMail(context, deps) {
     // One server for both the app and the MX record: recorded the first time,
     // read back after, so a later run never points `mx.<apex>` somewhere the
     // app is not.
+    const portsChanged = (recorded[PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY] ??
+        (target.kind === 'org' ? '' : PLATFORM_MAIL_HOST_PORTS_DIRECT)) !== hostPorts;
     const server = await resolveMailServer(deps.coolify, recorded[PLATFORM_MAIL_SERVER_SCOPE_KEY]);
     await record(PLATFORM_MAIL_SERVER_SCOPE_KEY, server.uuid);
-    const serverIpBlocked = mailServerIpBlocked(server.ip, platform.serverIpv4);
+    const serverIpBlocked = mxRecord ? mailServerIpBlocked(server.ip, mxRecord.serverIpv4) : null;
     if (serverIpBlocked)
         throw new Error(serverIpBlocked);
-    const app = await findOrCreatePlatformApp(deps.coolify, PLATFORM_MAIL_APP_NAME, environment, async () => {
+    const app = await findOrCreatePlatformApp(deps.coolify, target.names.mailApp, environment, async () => {
         return deps.coolify.createDockerImageApplication({
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             docker_registry_image_name: STALWART_IMAGE,
-            docker_registry_image_tag: imageTag,
+            docker_registry_image_tag: pinnedTagFor('stalwart', imageTag),
             ports_exposes: STALWART_PORTS_EXPOSES,
-            ports_mappings: STALWART_PORTS_MAPPINGS,
-            name: PLATFORM_MAIL_APP_NAME,
-            description: `Stalwart for the platform's own mail (#169, ${STALWART_IMAGE}:${imageTag})`,
+            ...(hostPorts ? { ports_mappings: hostPorts } : {}),
+            name: target.names.mailApp,
+            description: target.kind === 'org'
+                ? `Stalwart for ${target.id}'s own mail (${STALWART_IMAGE}:${imageTag})`
+                : `Stalwart for the platform's own mail (#169, ${STALWART_IMAGE}:${imageTag})`,
             instant_deploy: false,
         });
     });
@@ -2255,14 +2559,16 @@ async function provisionPlatformMail(context, deps) {
     // container before the new one can answer `waitForHealthyVersion`'s own
     // `'ready'` probe below. Stalwart's own readiness route and HTTP port.
     await deps.coolify.updateApplication(appId, {
-        custom_internal_name: PLATFORM_MAIL_INTERNAL_NAME,
-        docker_registry_image_tag: imageTag,
+        custom_internal_name: target.internal.mail,
+        docker_registry_image_tag: pinnedTagFor('stalwart', imageTag),
         ...healthCheckSettings(STALWART_READY_PATH, Number(STALWART_HTTP_PORT)),
+        // Only a platform that uses the shared relay, or one that did, changes a published port.
+        ...(portsChanged ? { ports_mappings: hostPorts } : {}),
     });
     // #177: org steps (an org's own `coolify:mail`/`coolify:agora`) read this
     // back instead of a literal, the same way files/ai's own internal
     // addresses are recorded.
-    await record(PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, `http://${PLATFORM_MAIL_INTERNAL_NAME}:${STALWART_HTTP_PORT}`);
+    await record(PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, `http://${target.internal.mail}:${STALWART_HTTP_PORT}`);
     // ---- storage ---------------------------------------------------------------
     const storages = await deps.coolify.listStorages(appId);
     // An app made before this release only has the old `/opt/stalwart` volume.
@@ -2274,7 +2580,7 @@ async function provisionPlatformMail(context, deps) {
             continue;
         }
         await deps.coolify.createPersistentStorage(appId, {
-            name: `${PLATFORM_MAIL_APP_NAME}-${wanted.suffix}`,
+            name: `${target.names.mailApp}-${wanted.suffix}`,
             mount_path: wanted.mount_path,
         });
         storagesAdded = true;
@@ -2295,7 +2601,12 @@ async function provisionPlatformMail(context, deps) {
     const declaredChanged = recorded[PLATFORM_MAIL_DEPLOYED_HOSTNAME_SCOPE_KEY] !== hostname ||
         recorded[PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY] !== imageTag;
     // A new storage binds into the container only at its next start.
-    const mailDeployedNow = app.justCreated || !app.running || envsChanged || declaredChanged || storagesAdded;
+    const mailDeployedNow = app.justCreated ||
+        !app.running ||
+        envsChanged ||
+        declaredChanged ||
+        storagesAdded ||
+        portsChanged;
     if (mailDeployedNow) {
         // A container still up from before would answer the readiness probe with
         // the old deployment's health. Stop it and see it stopped first, so the
@@ -2311,7 +2622,7 @@ async function provisionPlatformMail(context, deps) {
         // instead would just poll a hostname that cannot resolve yet on a first
         // apply. Either way it runs before any applied ref is recorded.
         // The old container was stopped above (or never ran), so nothing stays live.
-        await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:mail', app.justCreated || !app.running
+        await waitForDeploymentFinished(deps.coolify, appId, runtime, label, app.justCreated || !app.running
             ? `mail stays at ${recorded[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`
             : 'mail is stopped until the next apply');
         await record(PLATFORM_MAIL_DEPLOYED_SCOPE_KEY, appId);
@@ -2319,17 +2630,19 @@ async function provisionPlatformMail(context, deps) {
         // settings, mint) does not make the next run stop and redeploy the app.
         await record(PLATFORM_MAIL_DEPLOYED_HOSTNAME_SCOPE_KEY, hostname);
         await record(PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY, imageTag);
+        if (hostPorts)
+            await record(PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, hostPorts);
     }
     // ---- tunnel and DNS: web/JMAP/management ------------------------------------
-    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:mail');
-    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_MAIL_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_MAIL_TUNNEL_NAME));
+    const tunnels = await network.tunnels();
+    const existingTunnel = await tunnels.findTunnelByName(target.names.mailTunnel);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(target.names.mailTunnel));
     await record(PLATFORM_MAIL_TUNNEL_SCOPE_KEY, tunnel.id);
     await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
-                service: `http://${PLATFORM_MAIL_INTERNAL_NAME}:${STALWART_HTTP_PORT}`,
+                service: `http://${target.internal.mail}:${STALWART_HTTP_PORT}`,
             },
             { service: 'http_status:404' },
         ],
@@ -2339,7 +2652,7 @@ async function provisionPlatformMail(context, deps) {
         coolify: deps.coolify,
         tunnels,
         tunnelId: tunnel.id,
-        appName: PLATFORM_MAIL_CLOUDFLARED_APP_NAME,
+        appName: target.names.mailCloudflared,
         projectUuid,
         environment,
         // The Stalwart app's own server, so the connector shares its Docker network.
@@ -2347,15 +2660,15 @@ async function provisionPlatformMail(context, deps) {
         recordedConnectorAppId: recorded[PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY] ?? null,
         recordAppId: (appId) => record(PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, appId),
     });
-    const zoneId = recorded[apexZoneKey(platform.apex)] ?? (await exactZone(deps.cloudflare, platform.apex))?.id;
+    const zoneId = await network.zoneId(zone);
     if (!zoneId) {
-        throw new Error(`platform:mail: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
+        throw new Error(`${label}: no Cloudflare zone for ${zone} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const dns = await platformDns(deps, context.recordedIds(), 'platform:mail');
-    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
+    const dns = await network.dns();
+    const [dnsRecord] = await dns.findDnsRecord(zone, hostname, 'CNAME');
     if (!dnsRecord) {
-        await dns.createDnsRecord(platform.apex, {
+        await dns.createDnsRecord(zone, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -2363,31 +2676,35 @@ async function provisionPlatformMail(context, deps) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
+        await dns.updateDnsRecord(zone, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
             proxied: true,
         });
     }
+    if (target.kind === 'org')
+        await recordOwnDnsHostname(scope, hostname);
     // ---- the MX hostname: a direct, unproxied A record --------------------------
-    const serverIp = (platform.serverIpv4 ?? server.ip); // checked by mailServerIpBlocked above
-    const [mxRecord] = await dns.findDnsRecord(platform.apex, mailHost, 'A');
-    if (!mxRecord) {
-        await dns.createDnsRecord(platform.apex, {
-            type: 'A',
-            name: mailHost,
-            content: serverIp,
-            proxied: false,
-        });
-    }
-    else if (mxRecord.content !== serverIp) {
-        await dns.updateDnsRecord(platform.apex, mxRecord.id, {
-            type: 'A',
-            name: mailHost,
-            content: serverIp,
-            proxied: false,
-        });
+    if (mxRecord) {
+        const serverIp = (mxRecord.serverIpv4 ?? server.ip); // checked by mailServerIpBlocked above
+        const [existingMx] = await dns.findDnsRecord(zone, mailHost, 'A');
+        if (!existingMx) {
+            await dns.createDnsRecord(zone, {
+                type: 'A',
+                name: mailHost,
+                content: serverIp,
+                proxied: false,
+            });
+        }
+        else if (existingMx.content !== serverIp) {
+            await dns.updateDnsRecord(zone, existingMx.id, {
+                type: 'A',
+                name: mailHost,
+                content: serverIp,
+                proxied: false,
+            });
+        }
     }
     // #252: phase 2, now that the tunnel and DNS above actually route
     // `hostname`. `'ready'`, not `'version'`: Stalwart's `/healthz/ready`
@@ -2404,7 +2721,7 @@ async function provisionPlatformMail(context, deps) {
     const ensureMailReady = async () => {
         if (mailReadyConfirmed)
             return;
-        await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}${STALWART_READY_PATH}` }, runtime, sleep, 'platform:mail', `mail stays at ${recorded[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        await waitForHealthyVersion(appId, { kind: 'ready', url: `https://${hostname}${STALWART_READY_PATH}` }, runtime, sleep, label, `mail stays at ${recorded[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
         mailReadyConfirmed = true;
     };
     // Also probe when the applied ref lags the target: the deployed refs are
@@ -2419,7 +2736,7 @@ async function provisionPlatformMail(context, deps) {
     // projects -- its id is the OIDC audience Stalwart's directory checks an
     // access token's `aud` claim against, so no host has to register a
     // resource API for this by hand.
-    const issuer = `https://${platform.auth.hostname}`;
+    const issuer = issuerUrl;
     const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
     const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
     const { project } = await zitadel.findOrCreateProject(org.id, PLATFORM_MAIL_ZITADEL_PROJECT_NAME);
@@ -2445,7 +2762,7 @@ async function provisionPlatformMail(context, deps) {
         await ensureMailReady();
         const recoveryEnv = (await deps.coolify.listEnvs(appId)).find((e) => e.key === 'STALWART_RECOVERY_ADMIN' && !e.is_preview);
         if (!recoveryEnv) {
-            throw new Error('platform:mail: STALWART_RECOVERY_ADMIN is not set on the app; cannot authenticate to re-apply the OIDC audience');
+            throw new Error(`${label}: STALWART_RECOVERY_ADMIN is not set on the app; cannot authenticate to re-apply the OIDC audience`);
         }
         const password = recoveryEnv.value.slice(`${STALWART_RECOVERY_USER}:`.length);
         try {
@@ -2453,7 +2770,7 @@ async function provisionPlatformMail(context, deps) {
                 url: `https://${hostname}`,
                 user: STALWART_RECOVERY_USER,
                 password,
-                apex: platform.apex,
+                apex,
             });
             await applyMailSettings(admin, {
                 coolify: deps.coolify,
@@ -2462,8 +2779,8 @@ async function provisionPlatformMail(context, deps) {
                 sleep,
                 hostname,
                 settings: {
-                    mailHost,
-                    apex: platform.apex,
+                    mailHost: hostname,
+                    apex,
                     oidc: { issuerUrl: issuer, audience: project.id },
                 },
             });
@@ -2481,12 +2798,12 @@ async function provisionPlatformMail(context, deps) {
     if (!recorded[PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY]) {
         const lost = recorded[PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY];
         if (lost) {
-            throw new Error(`platform:mail: an admin API key ("${lost}") was minted but never delivered; revoke it in Stalwart and remove the recorded key ${PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+            throw new Error(`${label}: an admin API key ("${lost}") was minted but never delivered; revoke it in Stalwart and remove the recorded key ${PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
         }
         await ensureMailReady();
         const recoveryEnv = (await deps.coolify.listEnvs(appId)).find((e) => e.key === 'STALWART_RECOVERY_ADMIN' && !e.is_preview);
         if (!recoveryEnv) {
-            throw new Error('platform:mail: STALWART_RECOVERY_ADMIN is not set on the app; cannot authenticate to mint the admin key');
+            throw new Error(`${label}: STALWART_RECOVERY_ADMIN is not set on the app; cannot authenticate to mint the admin key`);
         }
         const password = recoveryEnv.value.slice(`${STALWART_RECOVERY_USER}:`.length);
         try {
@@ -2494,7 +2811,7 @@ async function provisionPlatformMail(context, deps) {
                 url: `https://${hostname}`,
                 user: STALWART_RECOVERY_USER,
                 password,
-                apex: platform.apex,
+                apex,
             });
             await applyMailSettings(admin, {
                 coolify: deps.coolify,
@@ -2503,8 +2820,8 @@ async function provisionPlatformMail(context, deps) {
                 sleep,
                 hostname,
                 settings: {
-                    mailHost,
-                    apex: platform.apex,
+                    mailHost: hostname,
+                    apex,
                     oidc: { issuerUrl: issuer, audience: project.id },
                 },
             });
@@ -2512,17 +2829,17 @@ async function provisionPlatformMail(context, deps) {
             // Recorded and persisted before the secret leaves this function: if
             // delivery fails for good, the next plan reports the lost key rather
             // than skipping or minting again.
-            await record(PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION);
-            const secret = await admin.createApiKey(PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, 'inherit');
+            await record(PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, keyDescription);
+            const secret = await admin.createApiKey(keyDescription, 'inherit');
             const attempts = runtime.deliverAttempts ?? 3;
             for (let attempt = 1;; attempt += 1) {
                 try {
-                    await deps.deliverSecret('stalwart:platform:admin', secret);
+                    await deps.deliverSecret(target.refs.mailAdminKey, secret);
                     break;
                 }
                 catch {
                     if (attempt >= attempts) {
-                        throw new Error(`platform:mail: the admin API key ("${PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION}") was minted but could not be delivered after ${attempts} tries`);
+                        throw new Error(`${label}: the admin API key ("${keyDescription}") was minted but could not be delivered after ${attempts} tries`);
                     }
                     await sleep(1000 * attempt);
                 }
@@ -2539,6 +2856,29 @@ async function provisionPlatformMail(context, deps) {
     await record(PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, imageTag);
     return { resourceId: appId };
 }
+/** The platform's mail project: the shared `platform` project, its id recorded by the mail step under its own key. */
+const platformMailProject = {
+    async ensure(coolify) {
+        const found = await coolify.findProjectByName(PLATFORM_MAIL_PROJECT);
+        return found ? found.uuid : (await coolify.createProject(PLATFORM_MAIL_PROJECT)).uuid;
+    },
+};
+/** The platform's mail server: {@link provisionMailServer} with {@link platformTarget} and the platform's own inputs. */
+async function provisionPlatformMail(context, deps) {
+    const { platform } = context;
+    const scope = scopeFromPlatform(context);
+    return provisionMailServer(scope, deps, platformTarget(), {
+        hostname: platform.mail.hostname,
+        apex: platform.apex,
+        mailHost: platformMailMxHost(platform.apex),
+        imageTag: platform.mail.gitRef,
+        hostPorts: platformMailHostPorts(platform),
+        issuerUrl: `https://${platform.auth.hostname}`,
+        mxRecord: { serverIpv4: platform.serverIpv4 },
+        project: platformMailProject,
+        network: platformNetwork(deps, scope, 'platform:mail'),
+    });
+}
 /**
  * Why the Stalwart image tag cannot be used, or `null`. #248: a thin wrapper
  * over the estate-wide {@link floatingTagBlocked} -- the mail step's own
@@ -2604,6 +2944,90 @@ async function mailBlockedReason(platform, mail, recordedIds) {
         return "the platform's mail server is blocked, not planned: no usable Coolify server could be resolved for it";
     }
 }
+async function provisionPlatformOikosIngress(context, deps) {
+    const recorded = context.recordedIds();
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl)
+        throw new Error(OIKOS_INGRESS_BLOCKED.edgeNotApplied);
+    return provisionOikosIngress(context, {
+        coolify: deps.coolify,
+        tunnels: await platformTunnels(deps, recorded, 'platform:oikos-ingress'),
+        dns: await platformDns(deps, recorded, 'platform:oikos-ingress'),
+        ratelimits: await deps.ratelimits(edgeUrl),
+        zones: await deps.zones(edgeUrl),
+        resolveServer: () => resolvePlatformServer(deps.coolify),
+        callTimeoutMs: deps.callTimeoutMs,
+    });
+}
+/** Why the shared mail relay cannot be built from its pinned base image, or `null`. */
+function mailRelayBlockedReason() {
+    const tagBlocked = floatingTagBlocked('mail relay base', VERSIONS.alpine, '3.22.1');
+    return tagBlocked ? `the platform's mail relay is blocked, not planned: ${tagBlocked}` : null;
+}
+/** Why `mx.<apex>` has no address to point at, or `null`. Skipped once the relay is applied, as the mail step's own check was. */
+async function relayServerBlockedReason(platform, mail, recordedIds) {
+    if (platform.serverIpv4 || recordedIds[`coolify:app:${PLATFORM_MAIL_RELAY_KEY}`])
+        return null;
+    try {
+        const server = await resolveMailServer(mail.coolify, recordedIds[PLATFORM_MAIL_SERVER_SCOPE_KEY]);
+        return mailServerIpBlocked(server.ip, platform.serverIpv4);
+    }
+    catch {
+        return "the platform's mail relay is blocked, not planned: no usable Coolify server could be resolved for it";
+    }
+}
+/**
+ * Runs the shared mail relay step in the platform mail project and on the
+ * platform server (recorded by the mail step when one ran, else found or made).
+ */
+async function provisionPlatformMailRelay(action, context, deps) {
+    const recorded = context.recordedIds();
+    // No platform mail step runs any more (the owner company runs its own mail), so
+    // the relay finds or makes its project and server itself, as the mail step did.
+    let projectUuid = recorded[PLATFORM_MAIL_PROJECT_SCOPE_KEY];
+    if (!projectUuid) {
+        const found = await deps.coolify.findProjectByName(PLATFORM_MAIL_PROJECT);
+        projectUuid = found
+            ? found.uuid
+            : (await deps.coolify.createProject(PLATFORM_MAIL_PROJECT)).uuid;
+        context.recordScopeId(PLATFORM_MAIL_PROJECT_SCOPE_KEY, projectUuid);
+        await context.persist?.();
+    }
+    let serverUuid = recorded[PLATFORM_MAIL_SERVER_SCOPE_KEY];
+    if (!serverUuid) {
+        serverUuid = (await resolveMailServer(deps.coolify, undefined)).uuid;
+        context.recordScopeId(PLATFORM_MAIL_SERVER_SCOPE_KEY, serverUuid);
+        await context.persist?.();
+    }
+    // The relay answers port 25 on `mx.<apex>`, and no mail step writes that name any more: the relay does,
+    // first, so a failed write leaves the step planned (the routes are recorded last).
+    const mxHost = platformMailMxHost(context.platform.apex);
+    const server = await resolveMailServer(deps.coolify, serverUuid);
+    const serverIpBlocked = mailServerIpBlocked(server.ip, context.platform.serverIpv4);
+    if (serverIpBlocked)
+        throw new Error(serverIpBlocked);
+    const serverIp = (context.platform.serverIpv4 ?? server.ip);
+    const network = platformNetwork(deps, scopeFromPlatform(context), 'platform:mail-relay');
+    const zoneId = await network.zoneId(context.platform.apex);
+    if (!zoneId) {
+        throw new Error(`platform:mail-relay: no Cloudflare zone for ${context.platform.apex} to put ${mxHost} in`);
+    }
+    const dns = await network.dns();
+    const [existingMx] = await dns.findDnsRecord(context.platform.apex, mxHost, 'A');
+    const mxRecord = { type: 'A', name: mxHost, content: serverIp, proxied: false };
+    if (!existingMx) {
+        await dns.createDnsRecord(context.platform.apex, mxRecord);
+    }
+    else if (existingMx.content !== serverIp) {
+        await dns.updateDnsRecord(context.platform.apex, existingMx.id, mxRecord);
+    }
+    return provisionMailRelay(action, context, deps, {
+        projectUuid,
+        serverUuid,
+        hostname: mxHost,
+        appScopeKey: PLATFORM_MAIL_RELAY_APP_SCOPE_KEY,
+    });
+}
 /**
  * #211: the broker cannot start without `ZITADEL_SERVICE_USER_TOKEN`/`_FILE`,
  * `LETTERMINT_API_TOKEN` and `AUTH_APPS`. `provisionPlatformAuth` already
@@ -2834,9 +3258,75 @@ const PLATFORM_ARCHON_PROJECT_SCOPE_KEY = 'coolify_project_platform_archon';
 const PLATFORM_ARCHON_DB_SCOPE_KEY = 'coolify_platform_archon_database';
 const PLATFORM_ARCHON_TUNNEL_SCOPE_KEY = 'cloudflare_platform_archon_tunnel';
 const PLATFORM_ARCHON_ACCESS_SCOPE_KEY = 'cloudflare_platform_archon_access_app';
-const PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_platform_archon_project';
+/**
+ * Archon paths a machine calls and Archon authenticates itself (its `proxy.ts`:
+ * `PUBLIC_EXACT` and `ORG_CHANGES_PATH_RE`). Each gets its own Access app with
+ * one bypass policy, because the hostname app would otherwise ask a machine for
+ * an emailed code. `/api/uptime/targets` and `/api/uptime/results` are left out
+ * on purpose: they pass the hostname app through the uptime service-token
+ * policy, and a bypass would make that token meaningless. `*` is one path
+ * segment (the organisation id).
+ */
+export const PLATFORM_ARCHON_PUBLIC_PATHS = [
+    { name: 'prices', path: '/api/prices' },
+    { name: 'vipps-webhook', path: '/vipps/webhook' },
+    { name: 'vipps-agreement', path: '/vipps/agreement' },
+    { name: 'usage-tick', path: '/api/usage/tick' },
+    { name: 'reporting-collect', path: '/api/reporting/collect' },
+    { name: 'org-changes', path: '/api/orgs/*/changes' },
+];
+const PLATFORM_ARCHON_PUBLIC_POLICY_NAME = 'foundry: public path';
+const archonPublicAppName = (name) => `${PLATFORM_ARCHON_ACCESS_APP_NAME}:public:${name}`;
+/** The scope key one bypass app's id is recorded under. */
+export const archonPublicAccessScopeKey = (name) => `cloudflare_platform_archon_access_public_${name.replace(/-/g, '_')}`;
+/** Whether a policy list is exactly the one bypass-for-everyone policy. */
+function onlyBypassEveryone(policies) {
+    const only = policies[0];
+    return (policies.length === 1 &&
+        only?.name === PLATFORM_ARCHON_PUBLIC_POLICY_NAME &&
+        only.decision === 'bypass' &&
+        Array.isArray(only.include) &&
+        only.include.length === 1 &&
+        JSON.stringify(only.include[0]) === '{"everyone":{}}');
+}
+/**
+ * One Access app per public path, each with the one policy bypass/everyone and
+ * no identity provider. Adopts only an app of its own name on the exact domain,
+ * refuses another name there, and rebuilds one whose policies are not exactly
+ * the bypass. A rebuild needs no closed gate: the hostname app covers the path
+ * meanwhile, which only asks for more.
+ */
+async function ensureArchonPublicAccess(cf, hostname, recorded, record) {
+    for (const { name, path } of PLATFORM_ARCHON_PUBLIC_PATHS) {
+        const domain = `${hostname}${path}`;
+        const appName = archonPublicAppName(name);
+        const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
+        const foreign = onDomain.find((a) => a.name !== appName);
+        if (foreign) {
+            throw new Error(`platform:archon: Access app '${foreign.name}' already holds ${domain}; foundry does not adopt it`);
+        }
+        let id = onDomain[0]?.id;
+        if (id && !onlyBypassEveryone(await cf.listAccessPolicies(id))) {
+            await cf.deleteAccessApp(id);
+            id = undefined;
+        }
+        if (!id) {
+            id = (await cf.createAccessApp({ name: appName, domain, type: 'self_hosted' })).id;
+            await cf.createAccessPolicy(id, {
+                name: PLATFORM_ARCHON_PUBLIC_POLICY_NAME,
+                decision: 'bypass',
+                include: [{ everyone: {} }],
+            });
+        }
+        const key = archonPublicAccessScopeKey(name);
+        if (recorded[key] !== id)
+            await record(key, id);
+    }
+}
 /** The hostname the sign-in client's redirect URIs were made for; a change makes a new client. */
 const PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY = 'zitadel_platform_archon_client_hostname';
+/** The owner's ZITADEL organisation the sign-in client was made in; a change makes a new client. */
+const PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY = 'zitadel_platform_archon_client_org';
 /** Archon's OIDC client id: public, not a secret, so a plain scope id. */
 export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_client_id';
 /**
@@ -2847,13 +3337,16 @@ export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_clie
  * names the ids only, never the cause.
  */
 async function switchOnArchonIdTokenUserinfo(context, deps) {
-    const { platform } = context;
     const recorded = context.recordedIds();
-    const zitadel = deps.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? deps.zitadel;
+    // The client lives in the owner company's ZITADEL; without its sign-in there is nothing to switch on.
+    const ownerSignIn = context.owner?.signIn ?? null;
+    const zitadel = ownerSignIn
+        ? deps.zitadelForInstance?.(ownerSignIn.issuerUrl, ownerSignIn.bearerRef)
+        : undefined;
     // The planner plans nothing without the method; a stale plan does nothing.
-    if (!zitadel.updateOidcAppIdTokenUserinfoAssertion)
+    if (!ownerSignIn || !zitadel?.updateOidcAppIdTokenUserinfoAssertion)
         return {};
-    const orgId = recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    const orgId = ownerSignIn.organisationId;
     const projectId = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
     const appId = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
     if (!orgId || !projectId || !appId) {
@@ -2979,7 +3472,25 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const hostname = platform.archon.hostname;
     const gitRef = platform.archon.gitRef;
     const recorded = context.recordedIds();
-    const issuer = `https://${platform.auth.hostname}`;
+    // Operators sign in through the owner company's own sign-in, never a platform one.
+    const ownerSignIn = context.owner?.signIn ?? null;
+    const ownerFiles = context.owner?.files ?? null;
+    if (!ownerSignIn) {
+        throw new Error("platform:archon: the owner company's sign-in has not been applied yet; Archon's sign-in client lives in it");
+    }
+    const issuer = ownerSignIn.issuerUrl;
+    // Archon signs people in from its own organisation; the company's is only handed on as CI_ORGANIZATION_ID.
+    const authOrgId = recorded[PLATFORM_ARCHON_ORG_SCOPE_KEY];
+    const ciOrgId = ownerSignIn.organisationId;
+    if (!authOrgId) {
+        throw new Error("platform:archon: Archon's own sign-in organisation is not recorded yet; zitadel:archon-org runs first");
+    }
+    // Archon accepts sign-ins from that organisation only once it forces a second factor and keeps registration closed.
+    if (recorded[PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY] !== authOrgId ||
+        recorded[PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY] !== authOrgId) {
+        throw new Error("platform:archon: Archon's sign-in organisation does not force a second factor and keep registration closed yet; zitadel:archon-org runs first");
+    }
+    const firstOwnerLink = archonFirstOwnerLink(recorded, ownerSignIn);
     const appliedGitRef = recorded[PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY];
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
@@ -2987,13 +3498,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (deps.accessEmails.length === 0) {
         throw new Error('platform:archon: no Access emails given; refusing to put Archon behind an Access app nobody can pass');
     }
-    // The sign-in client below is created inside the platform's own ZITADEL,
-    // which `platform:auth` builds. The planner orders that step first and
-    // blocks this one while auth is off; this is the same rule for a caller
-    // that reaches the step anyway.
-    if (!platform.auth.enabled || !recorded[`coolify:app:${PLATFORM_AUTH_KEY}`]) {
-        throw new Error("platform:archon: the platform's own sign-in (platform:auth) has not been applied yet; Archon's sign-in client lives in it");
-    }
+    const accessEmails = archonAccessEmails(deps.accessEmails, ownerCompany);
     const record = async (key, id) => {
         context.recordScopeId(key, id);
         await context.persist?.();
@@ -3001,7 +3506,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // Every service the platform declares must have delivered what Archon reads.
     // The planner blocks first; this is the same rule for a caller that reaches
     // the step anyway, and it is where the values are read for the env below.
-    const inputs = await collectArchonServiceInputs(platform, deps, recorded);
+    const inputs = await collectArchonServiceInputs(platform, deps, recorded, ownerFiles);
     if ('blocked' in inputs)
         throw new Error(`platform:archon: ${inputs.blocked}`);
     // #213: Archon's own onboarding reads these back as held keys before it
@@ -3106,11 +3611,25 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         ...healthCheckSettings(ARCHON_HEALTH_CHECK_PATH, Number(ARCHON_PORT), ARCHON_HEALTH_CHECK_START_PERIOD_SECONDS),
         git_branch: gitRef,
     });
-    // ---- sign-in client in the platform's own ZITADEL -------------------------
-    const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
-    const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
-    if (recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY] !== org.id) {
-        await record(PLATFORM_ZITADEL_ORG_SCOPE_KEY, org.id);
+    // ---- sign-in client in the owner company's own ZITADEL --------------------
+    // Only the owner's own instance, by its issuer and bearer reference: the
+    // platform's `deps.zitadel` is never used, so a missing factory is an error.
+    if (!deps.zitadelForInstance) {
+        throw new Error("platform:archon: the host built the platform executor without zitadelForInstance, so it cannot reach the owner company's ZITADEL");
+    }
+    const zitadel = deps.zitadelForInstance(issuer, ownerSignIn.bearerRef);
+    const org = { id: authOrgId };
+    // The client made in another organisation (the company's, before Archon had its own) is deleted
+    // once the new one serves: its ids are kept here before the recorded ones are overwritten.
+    const oldClientOrg = recorded[PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY];
+    const oldProject = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
+    const oldApp = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (oldClientOrg &&
+        oldClientOrg !== authOrgId &&
+        oldProject &&
+        oldApp &&
+        !recorded[PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY]) {
+        await record(PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, `${oldClientOrg}|${oldProject}|${oldApp}`);
     }
     const { project } = await zitadel.findOrCreateProject(org.id, PLATFORM_ARCHON_ZITADEL_PROJECT);
     if (recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY] !== project.id) {
@@ -3119,7 +3638,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // The client's redirect URIs name the hostname, and no call updates them, so
     // a client made for another hostname is deleted and made again. Its id is
     // public and there is no secret to lose.
-    let clientId = recorded[PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY] === hostname
+    let clientId = recorded[PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY] === hostname &&
+        recorded[PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY] === org.id
         ? recorded[PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY]
         : undefined;
     if (!clientId) {
@@ -3151,18 +3671,18 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         // Made with the setting on (providers 0.9.0): nothing to repair on this id.
         context.recordScopeId(PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, created.appId);
         context.recordScopeId(PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY, hostname);
+        context.recordScopeId(PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY, org.id);
         await record(PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY, created.clientId);
         clientId = created.clientId;
     }
     // ---- env ------------------------------------------------------------------
-    // People sign in from the owner company's sign-in org. The project, client
-    // and Access app above stay in the `foundry` org, which holds no people.
-    const authOrgId = archonAuthOrganizationId(context.recordedIds()) ?? org.id;
     const envs = [
         { key: 'APP_URL', value: `https://${hostname}` },
         { key: 'AUTH_ISSUER', value: issuer },
         { key: 'AUTH_ORGANIZATION_ID', value: authOrgId },
+        { key: 'CI_ORGANIZATION_ID', value: ciOrgId },
         { key: 'AUTH_CLIENT_ID', value: clientId },
+        ...(firstOwnerLink ? [{ key: 'ARCHON_FIRST_OWNER_LINK', value: firstOwnerLink }] : []),
     ];
     // #265: an owner URL or reporting site already on the app is kept as it is.
     // The owner URL must name the adopted database's host, or the app's two
@@ -3235,7 +3755,12 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // empty, and `readBrokerApps`/`validateBrokerAppEntry` would refuse it the
     // moment this step tried to register it. See `ensureGeneratedEnv`'s own
     // doc comment for why no other call site gets this argument.
-    const appKey = (await ensureGeneratedEnv(deps.coolify, appId, 'AUTH_APP_KEY', () => randomBytes(32).toString('base64url'), 32)) ?? (await currentEnvValue(deps.coolify, appId, 'AUTH_APP_KEY'));
+    // A key minted for another organisation (the company's) is never kept: Archon's new
+    // entry gets a fresh one, so the key the old entry held stops being Archon's.
+    const freshKey = recorded[PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY] !== authOrgId;
+    const appKey = freshKey
+        ? randomBytes(32).toString('base64url')
+        : ((await ensureGeneratedEnv(deps.coolify, appId, 'AUTH_APP_KEY', () => randomBytes(32).toString('base64url'), 32)) ?? (await currentEnvValue(deps.coolify, appId, 'AUTH_APP_KEY')));
     if (!appKey) {
         throw new Error(`platform:archon: app ${appId} lost its AUTH_APP_KEY between two reads`);
     }
@@ -3244,7 +3769,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // rule above), and hashed as the live value so it never reads as a changed
     // env.
     const keepLiveFilesEnv = new Set();
-    for (const key of ['FILES_URL', 'FILES_AUDIENCE']) {
+    // The owner's own files host, once applied, replaces whatever is live.
+    for (const key of ownerFiles ? [] : ['FILES_URL', 'FILES_AUDIENCE']) {
         const live = await currentEnvValue(deps.coolify, appId, key);
         if (live) {
             keepLiveFilesEnv.add(key);
@@ -3302,6 +3828,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
             throw error;
         throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), carried));
     }
+    // The fresh key is in Archon's env now: from here a repeat keeps it. Recorded before the broker write,
+    // so a failure there is repaired by writing the same key, not by minting another.
+    if (freshKey)
+        await record(PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, authOrgId);
     // #436 round 2: `bulkUpsertEnvs` only adds or updates, so the
     // `FILES_MANAGEMENT_KEY` this step used to write before the fix above
     // would otherwise survive on an Archon already deployed with it --
@@ -3325,7 +3855,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         const staleUptime = !platform.uptime.enabled && stale.key === 'UPTIME_TOKEN';
         // People now come from the owner company's store, so a first operator set by an older apply goes.
         const staleOperator = stale.key === 'AUTHZ_BOOTSTRAP_OPERATOR';
-        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime || staleOperator) && stale.uuid) {
+        // The link is written only while both ids are known; one that is no longer wanted goes.
+        const staleLink = !firstOwnerLink && stale.key === 'ARCHON_FIRST_OWNER_LINK';
+        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime || staleOperator || staleLink) &&
+            stale.uuid) {
             await deps.coolify.deleteEnv(appId, stale.uuid);
             staleKeyDeleted = true;
         }
@@ -3338,10 +3871,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // returns), and this step is unreachable until that resourceId is recorded
     // (the guard at the top of this function) -- so a missing id here means a
     // caller reached this step some other way.
-    const brokerAppId = recorded[PLATFORM_AUTH_BROKER_SCOPE_KEY];
-    if (!brokerAppId) {
-        throw new Error('platform:archon: platform:auth has not recorded its broker app id yet; apply platform:auth again');
-    }
+    const brokerAppId = ownerSignIn.brokerAppId;
     const brokerApps = await readBrokerApps(deps.coolify, brokerAppId);
     // #211 round 2: merged into the matching entry, not replacing it -- the
     // broker's own `App` (`broker/src/apps.ts`) carries fields this step never
@@ -3355,14 +3885,22 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // first -- a previous bug, or a hand-edited AUTH_APPS, can leave more than
     // one. The first is kept (and updated below); the rest are dropped, so no
     // duplicate carries a stale key a broker client could still present.
+    // No other entry may sign in Archon's organisation: its key would reach Archon's people.
+    const conflicts = archonOrgConflicts(brokerApps, authOrgId);
+    if (conflicts.length > 0) {
+        throw new Error(`platform:archon: broker entry ${conflicts.map((n) => `'${n}'`).join(', ')} signs in Archon's own organisation; no other entry may`);
+    }
     const archonMatchIndices = brokerApps
-        .map((a, i) => (a.organizationId === authOrgId || a.organizationId === org.id) &&
-        a.name === PLATFORM_ARCHON_ZITADEL_APP
-        ? i
-        : -1)
+        .map((a, i) => a.organizationId === authOrgId && a.name === PLATFORM_ARCHON_ZITADEL_APP ? i : -1)
         .filter((i) => i >= 0);
     const archonEntryIndex = archonMatchIndices[0] ?? -1;
-    const duplicateIndices = new Set(archonMatchIndices.slice(1));
+    // Archon's entry in an organisation it used to sign in from (the company's, before Archon had its
+    // own) goes, key and all. An entry of that name in any other organisation is not Archon's to touch.
+    const oldOrgs = archonOldOrgIds(recorded, ciOrgId, authOrgId);
+    const oldEntryIndices = new Set(brokerApps
+        .map((a, i) => a.name === PLATFORM_ARCHON_ZITADEL_APP && oldOrgs.has(a.organizationId) ? i : -1)
+        .filter((i) => i >= 0));
+    const duplicateIndices = new Set([...archonMatchIndices.slice(1), ...oldEntryIndices]);
     const archonEntry = {
         ...(archonEntryIndex >= 0 ? brokerApps[archonEntryIndex] : {}),
         organizationId: authOrgId,
@@ -3377,11 +3915,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         // the wrong platform or not at all.
         from: `Company Included <noreply@${platform.apex}>`,
     };
-    const desiredBrokerApps = archonEntryIndex >= 0
-        ? brokerApps
-            .map((a, i) => (i === archonEntryIndex ? archonEntry : a))
-            .filter((_, i) => !duplicateIndices.has(i))
-        : [...brokerApps, archonEntry];
+    const keptBrokerApps = brokerApps
+        .map((a, i) => (i === archonEntryIndex ? archonEntry : a))
+        .filter((_, i) => !duplicateIndices.has(i));
+    const desiredBrokerApps = archonEntryIndex >= 0 ? keptBrokerApps : [...keptBrokerApps, archonEntry];
     const desiredAuthApps = [{ key: 'AUTH_APPS', value: JSON.stringify(desiredBrokerApps) }];
     // Rebuilt and compared every run (not gated on a freshly minted key), so a
     // clientId or hostname change reaches the broker too, and so a previous
@@ -3416,6 +3953,23 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         await deps.coolify.deploy(brokerAppId);
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, desiredAuthAppsRaw));
     }
+    // ---- the old sign-in client ------------------------------------------------
+    // The broker no longer knows it, and Archon's env names the new one: delete the old client, so
+    // no account of the company's organisation can still sign in to it. A repeat deletes nothing twice.
+    const retiredClient = context.recordedIds()[PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY];
+    if (retiredClient) {
+        const [oldOrgId, oldProjectId, oldAppId] = retiredClient.split('|');
+        if (oldOrgId && oldProjectId && oldAppId) {
+            try {
+                await zitadel.deleteApp(oldOrgId, oldProjectId, oldAppId);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        await record(PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, '');
+    }
     // ---- Cloudflare Access, before the hostname resolves ----------------------
     const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:archon');
     const access = await platformAccess(deps, context.recordedIds(), 'platform:archon');
@@ -3423,7 +3977,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const uptimeAccessTokenId = platform.uptime.enabled
         ? recorded[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
         : undefined;
-    const accessAppId = await ensureArchonAccess(access, hostname, deps.accessEmails, uptimeAccessTokenId, async () => {
+    const { id: accessAppId, pinId } = await ensureArchonAccess(access, hostname, accessEmails, uptimeAccessTokenId, async () => {
         // The Access app is about to be rebuilt: answer 404 for every hostname
         // meanwhile, so it is never served without the gate. The marker is
         // persisted first: a failure before the real ingress is written back
@@ -3439,6 +3993,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (recorded[PLATFORM_ARCHON_ACCESS_SCOPE_KEY] !== accessAppId) {
         await record(PLATFORM_ARCHON_ACCESS_SCOPE_KEY, accessAppId);
     }
+    if (recorded[PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY] !== pinId) {
+        await record(PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, pinId);
+    }
+    await ensureArchonPublicAccess(access, hostname, context.recordedIds(), record);
     // ---- deploy ---------------------------------------------------------------
     // #252: phase 1 of the shared deploy-health helper only -- Coolify's own
     // deployment record reaching `'finished'`, which is enough on its own to
@@ -3491,7 +4049,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         // retry intends is identical to what a successful one intends, so
         // leaving the old confirmation in place would read as still correct.
         await record(PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, '');
-        await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
+        const built = await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
+        await recordBuiltCommit(deps.coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: 'archon' }, record);
     }
     // ---- tunnel and DNS ---------------------------------------------------------
     const existingTunnel = await tunnels.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
@@ -3597,6 +4156,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // it.
     await record(PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, brokerAppId);
     await record(PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, authOrgId);
+    await record(PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, ciOrgId);
+    await record(PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, firstOwnerLink);
+    await record(PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, ownerSignIn.hostname);
+    await record(PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, archonFilesMarker(ownerFiles));
     // The host runs inside this app: every marker is recorded above, so the
     // deploy goes last and is not waited for -- the old container stops during
     // it, and the response, the lease and the audit row must be done first.
@@ -3908,6 +4471,9 @@ const PLATFORM_ARCHON_UPTIME_POLICY_NAME = 'foundry: uptime service token';
  * is added in place, one for another token rebuilds the app.
  */
 async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate) {
+    // The app accepts the one-time PIN and nothing else, so a person is mailed a code
+    // instead of being offered the company's own sign-in provider.
+    const { id: pinId } = await cf.ensureOneTimePinProvider();
     const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
     const foreign = onDomain.find((a) => a.name !== PLATFORM_ARCHON_ACCESS_APP_NAME);
     if (foreign) {
@@ -3918,6 +4484,8 @@ async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate)
             name: PLATFORM_ARCHON_ACCESS_APP_NAME,
             domain,
             type: 'self_hosted',
+            allowedIdps: [pinId],
+            autoRedirectToIdentity: true,
         });
         await cf.createAccessPolicy(created.id, archonAccessPolicy(emails));
         if (uptimeTokenId) {
@@ -3927,7 +4495,7 @@ async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate)
     };
     const existing = onDomain[0];
     if (!existing)
-        return (await create()).id;
+        return { id: (await create()).id, pinId };
     const policies = await cf.listAccessPolicies(existing.id);
     const other = policies.find((p) => p.name !== ACCESS_POLICY_NAME && p.name !== PLATFORM_ARCHON_UPTIME_POLICY_NAME);
     if (other) {
@@ -3936,19 +4504,52 @@ async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate)
     const emailPolicies = policies.filter((p) => p.name === ACCESS_POLICY_NAME);
     const tokenPolicies = policies.filter((p) => p.name === PLATFORM_ARCHON_UPTIME_POLICY_NAME);
     const staleToken = tokenPolicies.some((p) => !uptimePolicyIntact(p, uptimeTokenId));
-    if (emailPolicies.every((p) => sameEmails(p.include, emails)) && !staleToken) {
+    if (emailPolicies.every((p) => sameEmails(p.include, emails)) &&
+        !staleToken &&
+        accessAppPinned(existing, pinId)) {
         if (emailPolicies.length === 0) {
             await cf.createAccessPolicy(existing.id, archonAccessPolicy(emails));
         }
         if (uptimeTokenId && tokenPolicies.length === 0) {
             await cf.createAccessPolicy(existing.id, archonUptimePolicy(uptimeTokenId));
         }
-        return existing.id;
+        return { id: existing.id, pinId };
     }
-    // No call updates an app's policy: rebuild the app, hostname closed meanwhile.
+    // No call updates an app's policy or its providers (edge keeps an existing app's
+    // `allowedIdps`): rebuild the app, hostname closed meanwhile.
     await closeGate();
     await cf.deleteAccessApp(existing.id);
-    return (await create()).id;
+    return { id: (await create()).id, pinId };
+}
+/** Whether the Access app accepts the one-time PIN provider alone and sends a visitor straight to it. */
+function accessAppPinned(app, pinId) {
+    return (Array.isArray(app.allowedIdps) &&
+        app.allowedIdps.length === 1 &&
+        app.allowedIdps[0] === pinId &&
+        app.autoRedirectToIdentity === true);
+}
+/**
+ * Who Archon's Access app lets through. Each person is let in on the personal
+ * address their invite was mailed to, never on a work address: the work
+ * mailbox is on the platform's own mail, which the platform's own sign-in
+ * reaches. So the owner company's first owner's work addresses leave the host's
+ * list and their personal address joins it; every other address stays as the
+ * host gave it. Case-insensitive, de-duplicated, order kept.
+ */
+export function archonAccessEmails(hostEmails, ownerCompany) {
+    const first = ownerCompany?.owners[0];
+    // The first owner's work address: the one their Archon invite is made for.
+    const firstWork = ownerCompany && first ? ownerMailboxes(ownerCompany)[0]?.address : null;
+    const work = new Set(firstWork ? [firstWork.toLowerCase()] : []);
+    const out = [];
+    const seen = new Set();
+    for (const email of [...hostEmails.filter((e) => !work.has(e.toLowerCase())), first?.email]) {
+        if (!email || seen.has(email.toLowerCase()))
+            continue;
+        seen.add(email.toLowerCase());
+        out.push(email);
+    }
+    return out;
 }
 function archonAccessPolicy(emails) {
     return {
@@ -4006,6 +4607,10 @@ async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId
         const app = (await cf.listAccessApps()).find((a) => a.domain === domain && a.name === PLATFORM_ARCHON_ACCESS_APP_NAME);
         if (!app)
             return true;
+        // Read against the provider id the app was last made with: a plan asks edge to make nothing.
+        const pinId = recorded[PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY];
+        if (!pinId || !accessAppPinned(app, pinId))
+            return true;
         const policies = await cf.listAccessPolicies(app.id);
         const emailPolicies = policies.filter((p) => p.name === ACCESS_POLICY_NAME);
         const tokenPolicies = policies.filter((p) => p.name === PLATFORM_ARCHON_UPTIME_POLICY_NAME);
@@ -4016,7 +4621,15 @@ async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId
         }
         if (!tokenPolicies.every((p) => uptimePolicyIntact(p, uptimeTokenId)))
             return true;
-        return uptimeTokenId !== undefined && tokenPolicies.length === 0;
+        if (uptimeTokenId !== undefined && tokenPolicies.length === 0)
+            return true;
+        const apps = await cf.listAccessApps();
+        for (const { name, path } of PLATFORM_ARCHON_PUBLIC_PATHS) {
+            const bypass = apps.find((a) => a.domain === `${domain}${path}` && a.name === archonPublicAppName(name));
+            if (!bypass || !onlyBypassEveryone(await cf.listAccessPolicies(bypass.id)))
+                return true;
+        }
+        return false;
     }
     catch {
         return false;
@@ -4036,19 +4649,43 @@ async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId
  * recorded) is not drift either -- `planArchon`'s other checks already cover
  * a step that has never applied.
  */
-async function archonBrokerRegistrationDrifted(coolify, recordedIds) {
-    const brokerAppId = recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY];
-    const orgId = archonAuthOrganizationId(recordedIds);
-    if (!brokerAppId || !orgId)
+async function archonBrokerRegistrationDrifted(coolify, signIn, archonOrgId, recorded = {}) {
+    if (!signIn || !archonOrgId)
         return false;
     try {
-        const apps = await readBrokerApps(coolify, brokerAppId);
-        return !apps.some((a) => a.organizationId === orgId && a.name === PLATFORM_ARCHON_ZITADEL_APP);
+        const apps = await readBrokerApps(coolify, signIn.brokerAppId);
+        const own = apps.some((a) => a.organizationId === archonOrgId && a.name === PLATFORM_ARCHON_ZITADEL_APP);
+        // The company's old entry for Archon must be gone, and no other entry may sign in Archon's org.
+        const oldOrgs = archonOldOrgIds(recorded, signIn.organisationId, archonOrgId);
+        const stale = apps.some((a) => a.name === PLATFORM_ARCHON_ZITADEL_APP && oldOrgs.has(a.organizationId));
+        return !own || stale || archonOrgConflicts(apps, archonOrgId).length > 0;
     }
     catch {
         return false;
     }
 }
+/** The organisations Archon signed in from before its own: the company's, and the one its last apply recorded. */
+function archonOldOrgIds(recorded, ciOrgId, archonOrgId) {
+    const old = new Set([ciOrgId]);
+    const applied = recorded[PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY];
+    if (applied)
+        old.add(applied);
+    if (archonOrgId)
+        old.delete(archonOrgId);
+    return old;
+}
+/**
+ * The names of the broker entries that sign in Archon's organisation without
+ * being Archon's own. There must be none: a key of another app would then
+ * reach Archon's people (passkeys, password reset, deactivation).
+ */
+export function archonOrgConflicts(entries, archonOrgId) {
+    if (!archonOrgId)
+        return [];
+    return entries
+        .filter((e) => e.organizationId === archonOrgId && e.name !== PLATFORM_ARCHON_ZITADEL_APP)
+        .map((e) => e.name.slice(0, 100));
+}
 /** The decoded password of a connection URL, or `undefined` when it has none or cannot be parsed. */
 function passwordOf(url) {
     try {
@@ -4181,17 +4818,31 @@ async function archonAuthzDatabaseDrifted(coolify, appId, owner) {
     }
 }
 /**
- * Whether Archon's live `AUTH_ORGANIZATION_ID` is not the sign-in org it
- * should accept ({@link archonAuthOrganizationId}). Without this nothing
- * replans Archon when the owner company's org changes, since the step plans
- * only on hostname, `gitRef` and the Access list. A failed read is not drift.
+ * Whether one of Archon's live sign-in envs is not what it should be:
+ * `AUTH_ORGANIZATION_ID` (Archon's own organisation), `CI_ORGANIZATION_ID` (the
+ * company's) and `ARCHON_FIRST_OWNER_LINK` (absent when no link is wanted).
+ * A name with no expected value is not checked, except the link. Without this
+ * nothing replans Archon when an org changes behind its back. A failed read is
+ * not drift.
  */
-async function archonAuthOrgDrifted(coolify, appId, recordedIds) {
-    const expected = archonAuthOrganizationId(recordedIds);
-    if (!appId || !expected)
+async function archonAuthOrgDrifted(coolify, appId, expected) {
+    if (!appId)
         return false;
     try {
-        return (await currentEnvValue(coolify, appId, 'AUTH_ORGANIZATION_ID')) !== expected;
+        for (const [key, want] of Object.entries(expected)) {
+            // A value expected as absent (an empty link) must be absent too; the key itself is never named in a value.
+            if (key === 'ARCHON_FIRST_OWNER_LINK') {
+                if (((await currentEnvValue(coolify, appId, key)) || undefined) !== (want || undefined)) {
+                    return true;
+                }
+                continue;
+            }
+            if (!want)
+                continue;
+            if ((await currentEnvValue(coolify, appId, key)) !== want)
+                return true;
+        }
+        return false;
     }
     catch {
         return false;
@@ -4274,13 +4925,15 @@ async function archonRollingUpdateDrifted(coolify, appId) {
  * held-key ref, never a value. Also read at plan time, so the text must not
  * vary between calls.
  */
-async function collectArchonServiceInputs(platform, deps, recorded) {
+async function collectArchonServiceInputs(platform, deps, recorded, ownerFiles = null) {
     const block = (why) => ({
         blocked: `Archon is blocked, not planned: ${why}`,
     });
     const envs = [];
     const heldByRef = new Map();
-    const services = ['files', 'ai', 'integrations', 'jobs'].filter((s) => platform[s].enabled);
+    // Files is the owner company's own host, not a platform service: its env is
+    // added once that step has applied, and Archon starts without it until then.
+    const services = ['ai', 'integrations', 'jobs'].filter((s) => platform[s].enabled);
     if (services.length > 0 && !deps.heldKeys) {
         return block(`the host built the platform executor without a held-key reader, and ${services.join(', ')} ${services.length === 1 ? 'is' : 'are'} enabled`);
     }
@@ -4333,31 +4986,7 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
     }
     const held = (ref) => heldByRef.get(ref);
     for (const service of services) {
-        if (service === 'files') {
-            envs.push(
-            // #501: Files is private and has no DNS, so FILES_URL is the recorded
-            // internal address; FILES_AUDIENCE is the exact HTTPS origin the
-            // signature is made for, equal to Files' own `APP_URL`.
-            { key: 'FILES_URL', value: recorded[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] }, { key: 'FILES_AUDIENCE', value: `https://${platform.files.hostname}` }, 
-            // #436: Company Included's own Files organisation, provisioned by
-            // the ordinary per-org `planFilesOrganisation` step under its own
-            // org id -- `executor.ts`'s `filesOrganisation` calls
-            // `provisionOrganisation({ organisationId: org.id, ... })`, so
-            // `platform.ownerOrgId` is already that organisation's id, with no
-            // separate platform-level mint needed.
-            { key: 'FILES_ORGANISATION_ID', value: platform.ownerOrgId }, 
-            // #436: the signed-assertion identity `filesSigner()` reads
-            // (`archon`'s `src/lib/authz/files-management.ts`), not the bearer
-            // token `FILES_MANAGEMENT_KEY` used to name here -- that name made
-            // Archon take the issued-key branch of `filesManagementFetch`,
-            // which then failed on the `FILES_MANAGEMENT_SCOPE` this step never
-            // set, surfacing as "Files is not configured" (foundry#436).
-            { key: 'FILES_MANAGEMENT_ISSUER', value: FILES_MANAGEMENT_ISSUER }, { key: 'FILES_MANAGEMENT_KEY_ID', value: FILES_MANAGEMENT_KEY_ID }, {
-                key: 'FILES_MANAGEMENT_PRIVATE_KEY',
-                value: held(ARCHON_SERVICE_INPUTS.files.refs[0]),
-            });
-        }
-        else if (service === 'ai') {
+        if (service === 'ai') {
             envs.push({
                 key: 'AI_URL',
                 value: recorded[PLATFORM_AI_INTERNAL_URL_SCOPE_KEY],
@@ -4393,6 +5022,22 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
             { key: 'JOBS_URL', value: recorded[JOBS_INTERNAL_URL_SCOPE_KEY] }, { key: 'JOBS_ADMIN_TOKEN', value: held(JOBS_ADMIN_TOKEN_REF) });
         }
     }
+    if (ownerFiles) {
+        let key = null;
+        try {
+            key = (await deps.heldKeys?.resolve(ownerFiles.managementKeyRef)) ?? null;
+        }
+        catch {
+            // The cause is dropped in case it echoes a secret.
+            return block(`the held key ${ownerFiles.managementKeyRef} could not be read`);
+        }
+        if (!key)
+            return block(`the held key ${ownerFiles.managementKeyRef} is not held yet`);
+        envs.push(
+        // Files is private and has no DNS, so FILES_URL is the recorded internal
+        // address; FILES_AUDIENCE is the exact HTTPS origin the signature is for.
+        { key: 'FILES_URL', value: ownerFiles.internalUrl }, { key: 'FILES_AUDIENCE', value: ownerFiles.audience }, { key: 'FILES_ORGANISATION_ID', value: ownerFiles.organisationId }, { key: 'FILES_MANAGEMENT_ISSUER', value: FILES_MANAGEMENT_ISSUER }, { key: 'FILES_MANAGEMENT_KEY_ID', value: FILES_MANAGEMENT_KEY_ID }, { key: 'FILES_MANAGEMENT_PRIVATE_KEY', value: key });
+    }
     return { envs };
 }
 /**
@@ -4534,8 +5179,6 @@ function parseAiKeyMintedBody(body) {
         secret: record.secret,
     };
 }
-/** The ref the AI management key is delivered under; the host's `AiOrganisationPort` adapter reads it back. */
-export const PLATFORM_AI_MANAGEMENT_KEY_REF = 'ai:platform:managementKey';
 /**
  * What Archon's management key may do in ai: exactly `ai`'s own
  * `ARCHON_AI_PERMISSIONS` (`apps/host/scripts/authz/bootstrap-archon.ts`) --
@@ -4884,13 +5527,15 @@ async function provisionPlatformAi(context, deps) {
             // Every run, so a changed gitRef reaches an app that already exists.
             git_branch: gitRef,
         };
-        // #543: the health-check quartet too, runner only -- the worker exposes
-        // no port at all (`ports_exposes` is never set on it, just below), so
-        // there is nothing for Coolify's own container probe to reach.
+        // #543: the health-check quartet too, on the runner. The worker exposes no
+        // port (`ports_exposes` is never set on it, just below); its Dockerfile's
+        // HEALTHCHECK checks the age of the heartbeat file it writes, and that is the live one.
         if (spec === PLATFORM_AI_RUNNER) {
             patch.ports_exposes = PLATFORM_AI_PORT;
             Object.assign(patch, healthCheckSettings('/api/health', Number(PLATFORM_AI_PORT)));
         }
+        if (spec === PLATFORM_AI_WORKER)
+            Object.assign(patch, IMAGE_HEALTHCHECK_SETTINGS);
         await coolify.updateApplication(app.appId, patch);
         return app;
     };
@@ -4991,7 +5636,8 @@ async function provisionPlatformAi(context, deps) {
     // nothing public is wired to either app.
     const internalUrl = `http://${PLATFORM_AI_RUNNER.internalName}:${PLATFORM_AI_PORT}`;
     if (deployRunner) {
-        await waitForNewDeployment(coolify, runner.appId, { kind: 'ready', url: `${internalUrl}/api/health` }, runtime, sleep, 'platform:ai', `the runner stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        const built = await waitForNewDeployment(coolify, runner.appId, { kind: 'ready', url: `${internalUrl}/api/health` }, runtime, sleep, 'platform:ai', `the runner stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        await recordBuiltCommit(coolify, { appId: runner.appId, deploymentUuid: built.deploymentUuid, name: 'ai' }, record);
     }
     if (deployWorker) {
         await waitForNewDeployment(coolify, worker.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:ai', `the worker stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
@@ -5077,6 +5723,54 @@ async function provisionPlatformAi(context, deps) {
         }
         await record(PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, credentialId);
     }
+    // ---- the public route ------------------------------------------------------
+    // A company's entries run on their own network and cannot dial `platform-ai`, so they call
+    // `https://<hostname>`. The route is the heartbeat server's (`platform:hc`): a tunnel that dials the
+    // runner by its internal name, a connector app, and a proxied CNAME. No Coolify `domains`, no Access
+    // app: ai authenticates every caller by its bearer key, and a gate in front would stop that.
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:ai');
+    const tunnel = (await tunnels.findTunnelByName(AI_TUNNEL_NAME)) ??
+        (await tunnels.createTunnel(AI_TUNNEL_NAME));
+    // Recorded last, once the DNS record is written: planAi and aiUrl read it as "the route is complete",
+    // so a failure below is planned again and no entry is given a dead AI_URL. The tunnel is found by name on the rerun.
+    await tunnels.putTunnelConfig(tunnel.id, {
+        ingress: [
+            { hostname, path: AI_ENTRY_PATH_PATTERN, service: internalUrl },
+            { service: 'http_status:404' },
+        ],
+    });
+    const server = await resolvePlatformServer(coolify);
+    await ensureCloudflaredConnector({
+        coolify,
+        tunnels,
+        tunnelId: tunnel.id,
+        appName: AI_CLOUDFLARED_APP_NAME,
+        projectUuid,
+        environment,
+        resolveServer: async () => server,
+        recordedConnectorAppId: context.recordedIds()[PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (connectorAppId) => record(PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, connectorAppId),
+    });
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:ai');
+    const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
+    if (!dnsRecord) {
+        await dns.createDnsRecord(platform.apex, {
+            type: 'CNAME',
+            name: hostname,
+            content: dnsTarget,
+            proxied: true,
+        });
+    }
+    else if (dnsRecord.content !== dnsTarget) {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
+            type: 'CNAME',
+            name: hostname,
+            content: dnsTarget,
+            proxied: true,
+        });
+    }
+    await record(PLATFORM_AI_TUNNEL_SCOPE_KEY, tunnel.id);
     return { resourceId: runner.appId };
 }
 /**
@@ -5305,7 +5999,7 @@ async function missingEnvs(coolify, appId, defaults) {
 }
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /** Polls `url` until it answers 2xx, or throws once `readyTimeoutMs` has passed. */
-async function waitForInstance(url, runtime, sleep) {
+async function waitForInstance(url, runtime, sleep, label = 'platform:auth') {
     const fetchImpl = runtime.fetch ?? globalThis.fetch;
     const now = runtime.now ?? Date.now;
     const timeout = runtime.readyTimeoutMs ?? 300_000;
@@ -5313,7 +6007,9 @@ async function waitForInstance(url, runtime, sleep) {
     const deadline = now() + timeout;
     for (;;) {
         try {
-            const response = await fetchImpl(url);
+            const response = await fetchImpl(url, {
+                signal: AbortSignal.timeout(runtime.readyRequestTimeoutMs ?? 10_000),
+            });
             if (response.ok)
                 return;
         }
@@ -5321,7 +6017,7 @@ async function waitForInstance(url, runtime, sleep) {
             // Not up yet: DNS, the tunnel or the container.
         }
         if (now() >= deadline) {
-            throw new Error(`platform:auth: the new ZITADEL instance did not answer at ${url} within ${Math.round(timeout / 1000)}s; retry this apply`);
+            throw new Error(`${label}: the new ZITADEL instance did not answer at ${url} within ${Math.round(timeout / 1000)}s; retry this apply`);
         }
         await sleep(interval);
     }
@@ -5547,12 +6243,12 @@ async function currentEnvValue(coolify, appId, key) {
  * deployed app means someone removed it. This throws, and a person sets the key that database was
  * initialised with (or deletes an unused database) and applies again.
  */
-async function ensureMasterkey(coolify, appId, databaseInUse) {
+async function ensureMasterkey(coolify, appId, databaseInUse, label = 'platform:auth') {
     const envs = await coolify.listEnvs(appId);
     if (envs.some((e) => e.key === 'ZITADEL_MASTERKEY' && !e.is_preview))
         return null;
     if (databaseInUse) {
-        throw new Error(`platform:auth: app ${appId} has no ZITADEL_MASTERKEY but its database is already in use; not generating a new one. Set ZITADEL_MASTERKEY on that app to the key the database was initialised with, or delete the database if ZITADEL never ran on it, then apply again`);
+        throw new Error(`${label}: app ${appId} has no ZITADEL_MASTERKEY but its database is already in use; not generating a new one. Set ZITADEL_MASTERKEY on that app to the key the database was initialised with, or delete the database if ZITADEL never ran on it, then apply again`);
     }
     return randomBytes(24).toString('base64');
 }
@@ -5568,23 +6264,21 @@ async function ensureMasterkey(coolify, appId, databaseInUse) {
  */
 export const FILES_MANAGEMENT_ISSUER = 'foundry';
 export const FILES_MANAGEMENT_KEY_ID = 'foundry-1';
-/** The ref the management private key (PKCS#8 PEM) is delivered under. */
-export const FILES_MANAGEMENT_KEY_REF = 'files:platform:managementKey';
 /** The ref the files host's introspection client secret is delivered under. */
 export const FILES_INTROSPECTION_SECRET_REF = 'zitadel:platform:files:introspection';
 /** https://github.com/wtfalch/files -- root Dockerfile with `migration` and `runner` targets. */
 const FILES_REPO = 'wtfalch/files';
 const PLATFORM_FILES_PROJECT = 'platform';
-const PLATFORM_FILES_DB_NAME = 'platform-files-db';
+export const PLATFORM_FILES_DB_NAME = 'platform-files-db';
 /** The two Coolify apps files' `apps/host/README.md` ("Deploying on Coolify") names. */
-const FILES_MIGRATE_APP_NAME = 'files-migrate';
-const FILES_RUNNER_APP_NAME = 'files';
+export const FILES_MIGRATE_APP_NAME = 'files-migrate';
+export const FILES_RUNNER_APP_NAME = 'files';
 /**
  * The runner's fixed `custom_internal_name`: the name another container on
  * the Coolify network reaches it by, and so the host part of
  * {@link PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY}'s recorded address.
  */
-const FILES_RUNNER_INTERNAL_NAME = 'platform-files';
+export const FILES_RUNNER_INTERNAL_NAME = 'platform-files';
 /** The runner's port (`Dockerfile`'s `runner` stage: `PORT=3000`, `EXPOSE 3000`). */
 const FILES_PORT = '3000';
 /** files' own health route, the same one `healthUrls` (`executor.ts`) assumes every hosted app serves. */
@@ -5681,22 +6375,106 @@ async function provisionPlatformFiles(context, deps,
 /** {@link filesShareDomains} of every declared org: each is a runner domain and a public host. */
 shareDomains) {
     const { platform } = context;
-    const gitRef = platform.files.gitRef;
-    const recorded = context.recordedIds();
+    return provisionFilesHost(scopeFromPlatform(context), deps, platformTarget(), {
+        hostname: platform.files.hostname,
+        gitRef: platform.files.gitRef,
+        project: platformFilesProject,
+        issuer: `https://${platform.auth.hostname}`,
+        zitadelOrg: { name: PLATFORM_AUTH_ORG_NAME },
+        zitadelProject: {
+            name: FILES_ZITADEL_PROJECT_NAME,
+            scopeKey: PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY,
+        },
+        shareDomains,
+    });
+}
+/** The platform's files host lives in the shared `platform` project. */
+const platformFilesProject = {
+    async ensure(coolify, scope) {
+        const recorded = scope.recordedIds()[PLATFORM_FILES_PROJECT_SCOPE_KEY];
+        if (recorded)
+            return recorded;
+        const found = await coolify.findProjectByName(PLATFORM_FILES_PROJECT);
+        const projectUuid = found
+            ? found.uuid
+            : (await coolify.createProject(PLATFORM_FILES_PROJECT)).uuid;
+        scope.recordScopeId(PLATFORM_FILES_PROJECT_SCOPE_KEY, projectUuid);
+        await scope.persist();
+        return projectUuid;
+    },
+};
+/** The credential id of the keyring an own files host runs on; recorded once both apps carry it. */
+export const OWN_FILES_KEYS_SCOPE_KEY = 'files_keys_id';
+/** The credential id minted and not yet confirmed delivered. */
+export const OWN_FILES_KEYS_UNDELIVERED_SCOPE_KEY = 'files_keys_undelivered';
+/**
+ * An own files host's keyring, before its env writes. Both refs held: those values, no mint (a rerun
+ * after a failed run resumes here). Nothing held: one mint, which is checked, registered as a
+ * secret, recorded by id as undelivered, then delivered to both refs. A re-mint is harmless: it
+ * yields an equivalent credential. Returns the guard id for {@link FilesHostInput.keysGuardId}.
+ */
+export async function resolveOwnFilesKeys(scope, deps, target, mint, workerUrl, label) {
+    const runtime = deps.runtime ?? {};
+    const recorded = scope.recordedIds();
+    const credential = await deps.readSecret?.(target.refs.keysCredential);
+    const verifyKeys = await deps.readSecret?.(target.refs.keysVerifyKeys);
+    if (credential && verifyKeys) {
+        runtime.onSecret?.(credential);
+        return {
+            keys: { workerUrl, credential, verifyKeys },
+            guardId: recorded[OWN_FILES_KEYS_SCOPE_KEY] ||
+                recorded[OWN_FILES_KEYS_UNDELIVERED_SCOPE_KEY] ||
+                'held',
+        };
+    }
+    const answer = await mint();
+    runtime.onSecret?.(answer.credential);
+    const keys = { workerUrl, credential: answer.credential, verifyKeys: answer.verifyKeys };
+    const invalid = answer.credential
+        ? filesDepsInvalid({ keys })
+        : 'credential';
+    if (invalid)
+        throw new Error(`${label}: the keys worker's answer is not usable (${invalid})`);
+    // Recorded and persisted before the credential leaves this function.
+    scope.recordScopeId(OWN_FILES_KEYS_UNDELIVERED_SCOPE_KEY, answer.credentialId);
+    await scope.persist();
+    const attempts = runtime.deliverAttempts ?? 3;
+    const sleep = runtime.sleep ?? defaultSleep;
+    await deliverWithRetry(deps.deliverSecret, target.refs.keysCredential, answer.credential, attempts, sleep, `the keys credential (${answer.credentialId})`, label);
+    await deliverWithRetry(deps.deliverSecret, target.refs.keysVerifyKeys, answer.verifyKeys, attempts, sleep, `the verify keys of credential ${answer.credentialId}`, label);
+    return { keys, guardId: answer.credentialId };
+}
+/**
+ * The body of {@link provisionPlatformFiles} for any files host: the
+ * platform's, or an own org's. Every name, the internal name and the two
+ * held-key refs come from `target`; the project, sign-in and ZITADEL home
+ * come from `input`. See {@link provisionPlatformFiles} for what the step does.
+ */
+export async function provisionFilesHost(scope, deps, target, input) {
+    const { gitRef, shareDomains } = input;
+    const own = target.kind === 'org';
+    const label = own ? `own step coolify:own-files for ${target.id}` : 'platform:files';
+    const recorded = scope.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
     const attempts = runtime.deliverAttempts ?? 3;
     const keys = filesKeys(deps);
     if (!keys) {
-        throw new Error('platform:files needs the keys worker URL, credential and verify keys in its files dependencies (KEYS_WORKER_URL, KEYS_CREDENTIAL, KEYS_VERIFY_KEYS); files never becomes healthy without them');
-    }
+        throw new Error(`${label} needs the keys worker URL, credential and verify keys in its files dependencies (KEYS_WORKER_URL, KEYS_CREDENTIAL, KEYS_VERIFY_KEYS); files never becomes healthy without them`);
+    }
+    runtime.onSecret?.(keys.credential);
+    // The platform's audit token and jobs secrets never go to a company's host (SC4).
+    const auditToken = own ? undefined : deps.keys?.auditToken;
+    const jobsSigningSecrets = own ? undefined : deps.jobsSigningSecrets;
+    if (auditToken)
+        runtime.onSecret?.(auditToken);
     // #380: R2_BUCKET/R2_ENDPOINT, the same "block the whole step" treatment
     // as a missing `keys` above -- the runner's `ensureStarted()` requires
     // both, and only this function's caller (`blockedSteps`, `planFiles`) ever
     // has anything useful to report while they are unset.
     const r2 = filesR2(deps);
     if (!r2) {
-        throw new Error('platform:files needs the R2 bucket and endpoint in its files dependencies (R2_BUCKET, R2_ENDPOINT); files never becomes healthy without them');
+        throw new Error(`${label} needs the R2 bucket and endpoint in its files dependencies (R2_BUCKET, R2_ENDPOINT); files never becomes healthy without them`);
     }
     // Never plan-and-throw: the planner reports a lost secret and plans
     // nothing; this is the same rule for a caller that reaches the step anyway.
@@ -5706,28 +6484,21 @@ shareDomains) {
     ]) {
         const lost = recorded[undeliveredKey];
         if (lost && !recorded[guardKey]) {
-            throw new Error(`platform:files: a secret (${lost}) was minted but never delivered; remove the recorded key ${undeliveredKey} to mint a new one`);
+            throw new Error(`${label}: a secret (${lost}) was minted but never delivered; remove the recorded key ${undeliveredKey} to mint a new one`);
         }
     }
     const record = async (key, id) => {
-        context.recordScopeId(key, id);
-        await context.persist?.();
+        scope.recordScopeId(key, id);
+        await scope.persist();
     };
-    let projectUuid = recorded[PLATFORM_FILES_PROJECT_SCOPE_KEY];
-    if (!projectUuid) {
-        const found = await deps.coolify.findProjectByName(PLATFORM_FILES_PROJECT);
-        projectUuid = found
-            ? found.uuid
-            : (await deps.coolify.createProject(PLATFORM_FILES_PROJECT)).uuid;
-        await record(PLATFORM_FILES_PROJECT_SCOPE_KEY, projectUuid);
-    }
+    const projectUuid = await input.project.ensure(deps.coolify, scope);
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
     // ---- database ----------------------------------------------------------
     let dbId = recorded[PLATFORM_FILES_DB_SCOPE_KEY];
     if (!dbId) {
         // Found by name first, so a crash between create and record never makes
         // a second one (`coolifyJobs` does the same).
-        const found = (await deps.coolify.listDatabases()).find((db) => db.name === PLATFORM_FILES_DB_NAME && db.environment_id === environment.id);
+        const found = (await deps.coolify.listDatabases()).find((db) => db.name === target.names.filesDb && db.environment_id === environment.id);
         if (found) {
             dbId = found.uuid;
         }
@@ -5738,7 +6509,7 @@ shareDomains) {
                 server_uuid: server.uuid,
                 environment_name: environment.name,
                 environment_uuid: environment.uuid,
-                name: PLATFORM_FILES_DB_NAME,
+                name: target.names.filesDb,
                 postgres_db: FILES_DB,
                 postgres_user: FILES_DB,
             });
@@ -5748,7 +6519,7 @@ shareDomains) {
     }
     const db = await getDatabaseStarted(deps.coolify, dbId);
     if (!db.internal_db_url) {
-        throw new Error('coolify:app for the platform (files): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
+        throw new Error(`${own ? label : 'coolify:app for the platform (files)'}: the database has no internal_db_url yet -- retry this apply once Coolify reports one`);
     }
     // ---- the two apps --------------------------------------------------------
     const createFilesApp = (name) => async () => {
@@ -5766,7 +6537,7 @@ shareDomains) {
             name,
         });
     };
-    const migrateApp = await findOrCreatePlatformApp(deps.coolify, FILES_MIGRATE_APP_NAME, environment, createFilesApp(FILES_MIGRATE_APP_NAME));
+    const migrateApp = await findOrCreatePlatformApp(deps.coolify, target.names.filesMigrate, environment, createFilesApp(target.names.filesMigrate));
     await record(PLATFORM_FILES_MIGRATE_SCOPE_KEY, migrateApp.appId);
     // Set on every run, like `platform:auth`'s `custom_internal_name`: a throw
     // right after a create must not leave the app on the wrong target.
@@ -5775,11 +6546,11 @@ shareDomains) {
         dockerfile_target_build: 'migration',
         git_branch: gitRef,
     });
-    const runnerApp = await findOrCreatePlatformApp(deps.coolify, FILES_RUNNER_APP_NAME, environment, createFilesApp(FILES_RUNNER_APP_NAME));
+    const runnerApp = await findOrCreatePlatformApp(deps.coolify, target.names.filesRunner, environment, createFilesApp(target.names.filesRunner));
     await record(PLATFORM_FILES_RUNNER_SCOPE_KEY, runnerApp.appId);
     await deps.coolify.updateApplication(runnerApp.appId, {
         dockerfile_target_build: 'runner',
-        custom_internal_name: FILES_RUNNER_INTERNAL_NAME,
+        custom_internal_name: target.internal.files,
         git_branch: gitRef,
         // #543: the health-check quartet, same reason Archon's doc comment
         // gives. The migrate app gets none -- it idles rather than serves
@@ -5791,13 +6562,14 @@ shareDomains) {
         // nobody gave a share host keeps no `domains`.
         ...filesShareDomainsPatch(recorded, shareDomains),
     });
-    context.recordScopeId(PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, normalHosts(shareDomains).join(','));
+    scope.recordScopeId(PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, normalHosts(shareDomains).join(','));
     // ---- database env ----------------------------------------------------------
     // The migrate app sets `files_rt`'s password from DATABASE_URL on every
     // boot (files' `scripts/db-runtime-role.sh`), and the runner connects with
     // the same URL, so both apps carry one value, minted once and never
     // rotated: an existing value on either app is reused.
     const runtimeUrl = await ensureFilesRuntimeUrl(deps.coolify, [migrateApp.appId, runnerApp.appId], db.internal_db_url);
+    runtime.onSecret?.(runtimeUrl);
     // The keys worker the migrate app needs to become healthy (files' README:
     // `DATABASE_URL_OWNER`, `DATABASE_URL`, `KEYS_WORKER_URL`, `KEYS_CREDENTIAL`).
     // `files-migrate` never runs `ensureStarted()`, so it needs neither
@@ -5812,11 +6584,13 @@ shareDomains) {
         ...migrateKeysEnvs,
     ]);
     // ---- the files ZITADEL project, in the platform's sign-in ----------------
-    const issuer = `https://${platform.auth.hostname}`;
+    const { issuer } = input;
     const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
-    const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
-    const { project } = await zitadel.findOrCreateProject(org.id, FILES_ZITADEL_PROJECT_NAME);
-    await record(PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, project.id);
+    const zitadelOrgId = 'id' in input.zitadelOrg
+        ? input.zitadelOrg.id
+        : (await zitadel.findOrCreateOrg(input.zitadelOrg.name)).org.id;
+    const { project } = await zitadel.findOrCreateProject(zitadelOrgId, input.zitadelProject.name);
+    await record(input.zitadelProject.scopeKey, project.id);
     // #380: the runner's own required settings -- `KEYS_VERIFY_KEYS` and
     // `R2_BUCKET`/`R2_ENDPOINT` -- plus whatever optional ones the host
     // supplies. `files-migrate` needs none of these (see `migrateKeysEnvs`
@@ -5825,10 +6599,10 @@ shareDomains) {
         ...migrateKeysEnvs,
         { key: 'KEYS_VERIFY_KEYS', value: keys.verifyKeys },
     ];
-    if (deps.keys?.auditToken)
+    if (auditToken)
         runnerKeysEnvs.push({
             key: 'KEYS_AUDIT_TOKEN',
-            value: deps.keys.auditToken,
+            value: auditToken,
         });
     const runnerOptionalEnvs = [];
     if (deps.clamd?.host) {
@@ -5843,13 +6617,16 @@ shareDomains) {
             });
     }
     runnerOptionalEnvs.push(...filesPublicHostsEnvs(recorded, deps.publicHosts, shareDomains));
-    if (deps.jobsSigningSecrets)
+    if (jobsSigningSecrets)
         runnerOptionalEnvs.push({
             key: 'JOBS_SIGNING_SECRETS',
-            value: deps.jobsSigningSecrets,
+            value: jobsSigningSecrets,
         });
     // #501: the same person platform:archon names; Files has no sign-in page.
-    const ownerInviteUserId = recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    // An own org's files host gets the platform's owner too, carried in by the planner: its own scope holds none.
+    const ownerInviteUserId = own
+        ? input.bootstrapOperator
+        : recorded[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
     if (ownerInviteUserId && ownerInviteUserId !== 'none') {
         runnerOptionalEnvs.push({ key: 'AUTHZ_BOOTSTRAP_OPERATOR', value: ownerInviteUserId });
     }
@@ -5857,7 +6634,7 @@ shareDomains) {
         { key: 'DATABASE_URL', value: runtimeUrl },
         // The management verifier's audience, which must be an HTTPS origin. The
         // host has no public address, so this is a name, not a route.
-        { key: 'APP_URL', value: `https://${platform.files.hostname}` },
+        { key: 'APP_URL', value: `https://${input.hostname}` },
         { key: 'AUTH_ISSUER', value: issuer },
         { key: 'AUTH_PERSON_TOKEN_AUDIENCE', value: project.id },
         ...runnerKeysEnvs,
@@ -5872,28 +6649,32 @@ shareDomains) {
     // Base env first, so a secret's own write below cannot be the only one
     // that lands, and a re-run with a changed hostname updates `APP_URL`.
     await deps.coolify.bulkUpsertEnvs(runnerApp.appId, runnerEnvs);
+    // Both apps now carry the company's own keyring: the delivery is confirmed.
+    if (own && input.keysGuardId)
+        await record(OWN_FILES_KEYS_SCOPE_KEY, input.keysGuardId);
     // ---- the introspection client, once --------------------------------------
     if (!recorded[PLATFORM_FILES_INTROSPECTION_SCOPE_KEY]) {
         // An app by this name here has no recorded secret (no undelivered id, or
         // the throw above would have fired): a crash between the create and the
         // record. Nothing was delivered, so it is deleted and made again.
-        const stale = (await zitadel.listApps(org.id, project.id)).apps.filter((app) => app.name === FILES_INTROSPECTION_APP_NAME && app.state !== 'APP_STATE_REMOVED');
+        const stale = (await zitadel.listApps(zitadelOrgId, project.id)).apps.filter((app) => app.name === FILES_INTROSPECTION_APP_NAME && app.state !== 'APP_STATE_REMOVED');
         for (const app of stale) {
             try {
-                await zitadel.deleteApp(org.id, project.id, app.id);
+                await zitadel.deleteApp(zitadelOrgId, project.id, app.id);
             }
             catch (error) {
                 if (!isNotFoundError(error))
                     throw error;
             }
         }
-        const client = await zitadel.createApiApp(org.id, project.id, {
+        const client = await zitadel.createApiApp(zitadelOrgId, project.id, {
             name: FILES_INTROSPECTION_APP_NAME,
         });
+        runtime.onSecret?.(client.clientSecret);
         // Recorded and persisted before the secret leaves this function: a failed
         // delivery or env write is then reported by the planner, not remade.
         await record(PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, client.appId);
-        await deliverWithRetry(deps.deliverSecret, FILES_INTROSPECTION_SECRET_REF, client.clientSecret, attempts, sleep, `the introspection client secret (ZITADEL app ${client.appId})`);
+        await deliverWithRetry(deps.deliverSecret, target.refs.filesIntrospection, client.clientSecret, attempts, sleep, `the introspection client secret (ZITADEL app ${client.appId})`, label);
         await deps.coolify.bulkUpsertEnvs(runnerApp.appId, [
             {
                 key: 'AUTH_PERSON_TOKEN_INTROSPECTION_CLIENT_ID',
@@ -5912,8 +6693,9 @@ shareDomains) {
             publicKeyEncoding: { type: 'spki', format: 'pem' },
             privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
         });
+        runtime.onSecret?.(privateKey);
         await record(PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, FILES_MANAGEMENT_KEY_ID);
-        await deliverWithRetry(deps.deliverSecret, FILES_MANAGEMENT_KEY_REF, privateKey, attempts, sleep, 'the files management key');
+        await deliverWithRetry(deps.deliverSecret, target.refs.filesManagement, privateKey, attempts, sleep, 'the files management key', label);
         await deps.coolify.bulkUpsertEnvs(runnerApp.appId, [
             { key: 'MANAGEMENT_ISSUER', value: FILES_MANAGEMENT_ISSUER },
             {
@@ -5929,12 +6711,12 @@ shareDomains) {
     // container before the new migration has run.
     await stopIfRunning(deps.coolify, migrateApp.appId);
     const migrateDeployed = await deps.coolify.deploy(migrateApp.appId);
-    await waitForMigration(deps.coolify, migrateApp.appId, runtime, sleep);
+    await waitForMigration(deps.coolify, migrateApp.appId, runtime, sleep, label, target.names.filesMigrate);
     // #399: files-migrate idles rather than exits once it has migrated, so it
     // reads healthy well before Coolify's own deployment does; stopping it on
     // that signal alone can find the container already gone and make Coolify
     // mark a deployment that actually migrated as `failed`.
-    await waitForMigrateDeployment(deps.coolify, migrateApp.appId, queuedDeploymentUuid(migrateDeployed) ?? 'untracked', 'platform:files', 'files-migrate', runtime.now ?? Date.now, runtime.migrateTimeoutMs ?? 900_000, runtime.migrateIntervalMs ?? 10_000, sleep);
+    await waitForMigrateDeployment(deps.coolify, migrateApp.appId, queuedDeploymentUuid(migrateDeployed) ?? 'untracked', label, target.names.filesMigrate, runtime.now ?? Date.now, runtime.migrateTimeoutMs ?? 900_000, runtime.migrateIntervalMs ?? 10_000, sleep);
     await deps.coolify.raw('POST', `/applications/${migrateApp.appId}/stop`);
     // #252/#543: no public `domains`, tunnel or DNS record is wired to the
     // runner (its own doc comment: "Nothing public is wired"), but it does
@@ -5945,11 +6727,12 @@ shareDomains) {
     // container); `coolify.deployAndWait` reaching Coolify's own deployment
     // record first is still what rules out the old container staying healthy
     // through a failed deploy.
-    const internalUrl = `http://${FILES_RUNNER_INTERNAL_NAME}:${FILES_PORT}`;
-    await waitForNewDeployment(deps.coolify, runnerApp.appId, { kind: 'ready', url: `${internalUrl}${FILES_HEALTH_CHECK_PATH}` }, runtime, sleep, 'platform:files', `the runner stays at ${recorded[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    const internalUrl = `http://${target.internal.files}:${FILES_PORT}`;
+    const built = await waitForNewDeployment(deps.coolify, runnerApp.appId, { kind: 'ready', url: `${internalUrl}${FILES_HEALTH_CHECK_PATH}` }, runtime, sleep, label, `the runner stays at ${recorded[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    await recordBuiltCommit(deps.coolify, { appId: runnerApp.appId, deploymentUuid: built.deploymentUuid, name: 'files' }, record);
     await record(PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, internalUrl);
     // Last: a run that failed anywhere above is planned again.
-    context.recordScopeId(PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, platform.files.hostname);
+    scope.recordScopeId(PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, input.hostname);
     await record(PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: runnerApp.appId };
 }
@@ -6272,7 +7055,6 @@ const PLATFORM_ACCESS_PROVIDER_NAME = 'foundry';
  * again.
  */
 async function provisionPlatformAccessProvider(context, deps) {
-    const { platform } = context;
     const recorded = context.recordedIds();
     const sleep = deps.runtime?.sleep ?? defaultSleep;
     const attempts = deps.runtime?.deliverAttempts ?? 3;
@@ -6291,10 +7073,19 @@ async function provisionPlatformAccessProvider(context, deps) {
     catch {
         throw new Error(`${label}: edge could not confirm that Cloudflare Access is ready`);
     }
-    const issuer = `https://${platform.auth.hostname}`;
-    const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
-    const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
+    // The client lives in the owner company's own ZITADEL, never a platform one.
+    const ownerSignIn = context.owner?.signIn ?? null;
+    if (!ownerSignIn) {
+        throw new Error(`${label}: the owner company's sign-in has not been applied yet`);
+    }
+    if (!deps.zitadelForInstance) {
+        throw new Error(`${label}: the host built the Access provider dependencies without zitadelForInstance, so it cannot reach the owner company's ZITADEL`);
+    }
+    const issuer = ownerSignIn.issuerUrl;
+    const zitadel = deps.zitadelForInstance(issuer, ownerSignIn.bearerRef);
+    const org = { id: ownerSignIn.organisationId };
     const { project } = await zitadel.findOrCreateProject(org.id, PLATFORM_ACCESS_ZITADEL_PROJECT);
+    context.recordScopeId(PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, project.id);
     const orphan = (await zitadel.listApps(org.id, project.id)).apps.find((a) => a.name === PLATFORM_ACCESS_ZITADEL_APP && a.state !== 'APP_STATE_REMOVED');
     if (orphan) {
         try {
@@ -6311,6 +7102,7 @@ async function provisionPlatformAccessProvider(context, deps) {
         postLogoutRedirectUris: [`https://${authDomain}/`],
     });
     context.recordScopeId(PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, client.appId);
+    context.recordScopeId(PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, client.appId);
     await context.persist?.();
     let providerId = '';
     await deliverWithRetry(async (_ref, secret) => {
@@ -6326,7 +7118,7 @@ async function provisionPlatformAccessProvider(context, deps) {
         })).id;
     }, ACCESS_PROVIDER_RECORD_KEY, client.clientSecret, attempts, sleep, `the ZITADEL client ${client.appId}'s secret`, label);
     // Last: the guard says the secret reached edge.
-    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, platform.auth.hostname);
+    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, ownerSignIn.hostname);
     context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, authDomain);
     context.recordScopeId(ACCESS_PROVIDER_RECORD_KEY, providerId);
     await context.persist?.();
@@ -6350,6 +7142,17 @@ const HC_PORT = '8000';
 const HC_HEALTH_CHECK_PATH = '/';
 const PLATFORM_HC_DB = 'hc';
 const PLATFORM_HC_DB_USER = 'hc';
+/** The tunnel that carries the AI host's public hostname, and the app that runs its connector. */
+const AI_TUNNEL_NAME = 'platform-ai-tunnel';
+/**
+ * The only paths the AI host's public route serves; everything else answers 404 at the tunnel. A company entry's key
+ * holds `ai.runs:create` and `ai.offerings:invoke` (`AI_ENTRY_PERMISSIONS`), and `@wtfalch/ai`'s client reaches them
+ * through `POST /v1/runs` (also `?wait=`), `POST /v1/runs/batch`, `GET /v1/runs`, `GET /v1/runs/:id` and
+ * `GET /v1/offerings`. The management routes (`/v1/organisations`, `/v1/keys`, `/v1/budgets`, `/v1/webhooks`,
+ * `/v1/connections`, `/v1/platform/keys`, ...) and `/api/health` are not on the internet.
+ */
+export const AI_ENTRY_PATH_PATTERN = '^/v1/(runs(/|$)|offerings$)';
+const AI_CLOUDFLARED_APP_NAME = 'platform-ai-cloudflared';
 const HC_TUNNEL_NAME = 'platform-hc-tunnel';
 /** #197: the one Coolify app that runs `cloudflared` for {@link HC_TUNNEL_NAME}. */
 const HC_CLOUDFLARED_APP_NAME = 'platform-hc-cloudflared';
@@ -6443,7 +7246,7 @@ async function provisionPlatformHc(context, deps) {
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             docker_registry_image_name: HC_IMAGE,
-            docker_registry_image_tag: gitRef,
+            docker_registry_image_tag: pinnedTagFor('hc', gitRef),
             ports_exposes: HC_PORT,
             name: PLATFORM_HC_APP_NAME,
             description: `Healthchecks for the platform's own heartbeats (#540, ${HC_IMAGE}:${gitRef})`,
@@ -6456,7 +7259,7 @@ async function provisionPlatformHc(context, deps) {
     // own rule. The image tag too, so a declared release change reaches the app.
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: HC_INTERNAL_NAME,
-        docker_registry_image_tag: gitRef,
+        docker_registry_image_tag: pinnedTagFor('hc', gitRef),
         ...healthCheckSettings(HC_HEALTH_CHECK_PATH, Number(HC_PORT)),
     });
     // ---- env, parsed off the database's own owner credentials -----------------
@@ -6577,7 +7380,7 @@ function aiKeys(deps) {
     const keys = deps?.keys;
     return keys?.workerUrl && keys.credential && keys.verifyKeys ? keys : null;
 }
-function filesKeys(deps) {
+export function filesKeys(deps) {
     const keys = deps?.keys;
     return keys?.workerUrl && keys.credential && keys.verifyKeys
         ? {
@@ -6600,7 +7403,7 @@ function filesR2(deps) {
  * naming the field instead of deploying a host that never turns healthy.
  * Never echoes the value.
  */
-function filesDepsInvalid(deps) {
+export function filesDepsInvalid(deps) {
     const r2 = filesR2(deps);
     if (r2) {
         let ok = false;
@@ -6727,7 +7530,7 @@ async function ensureFilesRuntimeUrl(coolify, appIds, dbInternalUrl) {
  * stands in for the log line). Throws once `migrateTimeoutMs` has passed; the
  * runner is then never deployed against an unmigrated database.
  */
-async function waitForMigration(coolify, appId, runtime, sleep) {
+async function waitForMigration(coolify, appId, runtime, sleep, label = 'platform:files', appName = 'files-migrate') {
     const now = runtime.now ?? Date.now;
     const timeout = runtime.migrateTimeoutMs ?? 900_000;
     const interval = runtime.migrateIntervalMs ?? 10_000;
@@ -6740,7 +7543,7 @@ async function waitForMigration(coolify, appId, runtime, sleep) {
         if (status !== 'running:healthy')
             left = true;
         if (now() >= deadline) {
-            throw new Error(`platform:files: files-migrate (${appId}) did not report healthy within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'}); the files app was not deployed. Check its logs for "files-migrate: done" and retry this apply`);
+            throw new Error(`${label}: ${appName} (${appId}) did not report healthy within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'}); the files app was not deployed. Check its logs for "files-migrate: done" and retry this apply`);
         }
         await sleep(interval);
     }
@@ -6950,6 +7753,8 @@ async function provisionPlatformIntegrations(action, context, deps) {
     await coolify.updateApplication(runnerApp.appId, {
         dockerfile_target_build: INTEGRATIONS_RUNNER_APP.target,
         ports_exposes: INTEGRATIONS_RUNNER_PORT,
+        // The runner's Dockerfile HEALTHCHECK (curl on /api/health) is the live check.
+        ...IMAGE_HEALTHCHECK_SETTINGS,
         git_branch: gitRef,
         domains: coolifyDomains([hostname]),
     });
@@ -7163,7 +7968,8 @@ async function provisionPlatformIntegrations(action, context, deps) {
         keyJustSet ||
         runnerKeyStale ||
         configChanged) {
-        await waitForNewDeployment(coolify, runnerApp.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:integrations', `the runner stays at ${recorded[PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        const built = await waitForNewDeployment(coolify, runnerApp.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:integrations', `the runner stays at ${recorded[PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        await recordBuiltCommit(coolify, { appId: runnerApp.appId, deploymentUuid: built.deploymentUuid, name: 'integrations' }, record);
     }
     // #398: the runner is up with the keyring that holds the active id; only
     // now may Archon move to it.
@@ -7294,7 +8100,7 @@ async function waitForIntegrationsMigration(coolify, appId, runtime, sleep) {
 /** The name every platform database's backup is registered against -- one shared R2 bucket, one storage entry. */
 const PLATFORM_BACKUP_S3_STORAGE_NAME = 'platform-backups';
 /** The uuid `provisionPlatformBackup` records once {@link PLATFORM_BACKUP_S3_STORAGE_NAME} is registered on Coolify, so a later apply never re-registers it. */
-const PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY = 'coolify_platform_backup_s3_storage';
+export const PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY = 'coolify_platform_backup_s3_storage';
 /**
  * #257 fix round: a sha256 of the exact `endpoint|bucket|key|secret` the
  * storage was last pushed with -- never the values themselves, the same
@@ -7342,8 +8148,11 @@ const PLATFORM_BACKUP_DATABASE_NAMES = {
  * {@link repointPlatformBackupSchedules} uses for `s3_storage_uuid`.
  */
 async function findPlatformBackupSchedule(coolify, service, databaseId) {
+    return findDatabaseBackupSchedule(coolify, PLATFORM_BACKUP_DATABASE_NAMES[service], databaseId);
+}
+/** {@link findPlatformBackupSchedule} for any database; `database` undefined means the resource's first database. */
+async function findDatabaseBackupSchedule(coolify, database, databaseId) {
     const schedules = (await coolify.listDatabaseBackups(databaseId)).filter((backup) => backup.enabled && backup.save_s3);
-    const database = PLATFORM_BACKUP_DATABASE_NAMES[service];
     if (!database)
         return { schedule: schedules[0], named: true };
     for (const schedule of schedules) {
@@ -7719,23 +8528,58 @@ async function provisionPlatformBackup(action, context, deps) {
     const recorded = context.recordedIds();
     const storageUuid = await ensurePlatformBackupStorage(coolify, r2, recorded, context);
     const service = action.key;
-    const { schedule, named } = await findPlatformBackupSchedule(coolify, service, databaseId);
-    const scheduleUuid = schedule?.uuid ??
-        (await coolify.createDatabaseBackup(databaseId, {
-            frequency: deps.frequency ?? PLATFORM_BACKUP_DEFAULT_FREQUENCY,
+    await provisionDatabaseBackup(coolify, {
+        databaseUuid: databaseId,
+        label: `platform ${service}`,
+        storageUuid,
+        frequency: deps.frequency,
+        databaseName: PLATFORM_BACKUP_DATABASE_NAMES[service],
+    });
+    return undefined;
+}
+/**
+ * F6: one nightly schedule of one database to a registered S3 storage, the
+ * body `provisionPlatformBackup` had and every company database now shares.
+ * An existing enabled, `save_s3` schedule is reused, never doubled: the lookup
+ * runs before the create, so a run that created a schedule and died before
+ * the caller recorded its uuid finds it again on the next apply. The
+ * `PATCH` names the database to dump, because `createDatabaseBackup` takes no
+ * database name; it also repairs an existing schedule that dumps the wrong
+ * one. Returns the schedule's uuid.
+ */
+export async function provisionDatabaseBackup(coolify, input) {
+    const { databaseUuid, label } = input;
+    const { schedule, named } = await backupCall(label, () => findDatabaseBackupSchedule(coolify, input.databaseName, databaseUuid));
+    const uuid = schedule?.uuid ??
+        (await backupCall(label, () => coolify.createDatabaseBackup(databaseUuid, {
+            frequency: input.frequency ?? PLATFORM_BACKUP_DEFAULT_FREQUENCY,
             enabled: true,
             save_s3: true,
-            s3_storage_uuid: storageUuid,
-        })).uuid;
-    // `CoolifyPort.createDatabaseBackup` takes no database name, so a new
-    // schedule is named here too, by the same PATCH that repairs an existing
-    // one dumping the wrong database.
+            s3_storage_uuid: input.storageUuid,
+        }))).uuid;
     if (!named) {
-        await coolify.raw('PATCH', `/databases/${databaseId}/backups/${scheduleUuid}`, {
-            databases_to_backup: PLATFORM_BACKUP_DATABASE_NAMES[service],
-        });
+        await backupCall(label, () => coolify.raw('PATCH', `/databases/${databaseUuid}/backups/${uuid}`, {
+            databases_to_backup: input.databaseName,
+        }));
+    }
+    return { uuid };
+}
+/** How long one Coolify call of a database backup may take. */
+const BACKUP_CALL_TIMEOUT_MS = 30_000;
+/** Runs one Coolify call with a timeout; a timeout names the database, not the call's arguments. */
+async function backupCall(label, call) {
+    let timer;
+    try {
+        return await Promise.race([
+            call(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`backup of ${label}: Coolify did not answer within ${BACKUP_CALL_TIMEOUT_MS / 1000} seconds`)), BACKUP_CALL_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
     }
-    return undefined;
 }
 /**
  * #540: reconciles the live Healthchecks checks against the ones foundry
@@ -7818,7 +8662,10 @@ async function provisionPlatformHeartbeats(context, deps) {
     // Last: so a run that failed anywhere above (an unreconciled create or
     // delete) leaves this unset and `planHeartbeats` plans the step again --
     // the same "record markers last" rule `provisionPlatformHc` follows.
-    context.recordScopeId(PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, [...desiredNames].sort().join(','));
+    // foundry#544: the provider is folded in, matching `planHeartbeats`'s own
+    // `desired` -- a provider switch with the same check names otherwise
+    // desired is still a change from this marker.
+    context.recordScopeId(PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, `${context.platform.heartbeatsProvider}:${[...desiredNames].sort().join(',')}`);
     return undefined;
 }
 /**
@@ -7964,7 +8811,7 @@ export class ProvidersPlatformCoolifyReader {
  * answers with the parent zone. The platform's zone is its apex exactly;
  * any other zone is never adopted or reported as the platform's.
  */
-async function exactZone(client, apex) {
+export async function exactZone(client, apex) {
     const zone = await client.findZoneByApex(apex);
     return zone && zone.name === apex ? zone : undefined;
 }