@wtfalch/foundry 0.34.0 → 0.35.1

package/dist/plan/platform-providers.js

@@ -1,22 +1,26 @@
 import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, randomUUID, sign, } from 'node:crypto';
 import { isIPv4 } from 'node:net';
 import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalch/email/postmaster';
-import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
+import { VERSIONS, floatingTagBlocked, pinnedRef, pinnedTagFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ownerMailboxes } from '../org.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
+import { recordBuiltCommit } from './build-record.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
+import { placedOnPlatform } from './destinations.js';
 import { ACCESS_POLICY_NAME, coolifyProjectMark, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, tcpProbe, } from './health-check-settings.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
+import { LIMITS, limited } from './own-limits.js';
 export { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
 import { MAIL_RELAY_BLOCKED, provisionMailRelay } from './mail-relay.js';
+import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonAuthOrganizationId, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
@@ -90,70 +94,6 @@ const PLATFORM_COOLIFY_PROJECT_NAME = 'platform';
 const JOBS_SCHEDULER_REPO = 'wtfalch/jobs';
 /** The port the scheduler listens on (jobs' `PORT`, default 8080). */
 const JOBS_PORT = '8080';
-/**
- * The real {@link PlatformStepExecutor} for the two steps built so far:
- * `cloudflare:zone` for the platform's apex (#167) and `coolify:jobs` for the
- * jobs scheduler (#173). `coolify` is optional so every #167-era caller --
- * anything that only ever plans the apex zone -- keeps constructing this with
- * two arguments; a `coolify:jobs` step reaching this executor with no
- * `coolify` port configured throws, naming what is missing, rather than
- * silently doing nothing.
- *
- * `cloudflareZone` mirrors `executor.ts`'s `cloudflareZone`: find the zone by
- * apex and adopt it, create it only when absent. companyincluded.com already
- * exists on Cloudflare, empty, so the first apply adopts it. The owner org
- * (Company Included, whose own domain is the apex) may record the same zone
- * under its own applied state, so that owner is allowed. Any other org that
- * recorded it makes this refuse to adopt. There is no delete here and
- * `PlatformStepExecutor` has none: neither path ever removes the zone.
- *
- * `coolifyJobs` mirrors `executor.ts`'s `coolifyApp`/`coolifyDatabase`,
- * simplified for one platform-level singleton rather than one per org: find
- * or create a dedicated `platform` Coolify project, find or create the
- * scheduler's own database, find or create the scheduler app itself (from
- * https://github.com/wtfalch/jobs, one Dockerfile at its repo root, on the
- * declared `gitRef`), then push the database's `internal_db_url` in as
- * `DATABASE_URL`. There is no park branch yet, matching `planJobs`'s own
- * scope note -- `platform.jobs.enabled` going from true to false plans
- * nothing, so this method is never asked to stop or delete anything.
- *
- * #170 adds `sfu:livekit`, the platform's shared calls SFU. `sfu` is
- * optional: an existing host that constructs this executor for the zone step
- * alone keeps compiling, and a plan that includes an `sfu:livekit` step
- * without it configured refuses clearly rather than silently doing nothing.
- * #152: the step mints one LiveKit key per org with calls enabled rather
- * than one shared pair, so it also needs `declaredOrgStore.list()` -- the
- * same store this class already takes for `findOrgIdForZone`.
- *
- * #168 adds `coolify:app` keyed {@link PLATFORM_AUTH_KEY}, the platform's own
- * sign-in ({@link provisionPlatformAuth}), once a host passes
- * {@link PlatformAuthDeps}.
- *
- * #169 adds `coolify:app` keyed {@link PLATFORM_MAIL_KEY}, the platform's own
- * mail server ({@link provisionPlatformMail}), once a host passes
- * {@link PlatformMailDeps}.
- *
- * #174 adds `coolify:app` keyed {@link PLATFORM_INTEGRATIONS_KEY},
- * the integrations host ({@link provisionPlatformIntegrations}), once a host
- * passes {@link PlatformIntegrationsDeps}.
- *
- * #171 adds `coolify:app` keyed {@link PLATFORM_FILES_KEY}, the files host
- * ({@link provisionPlatformFiles}), once a host passes {@link PlatformFilesDeps}.
- *
- * #172 adds `coolify:app` keyed {@link PLATFORM_AI_KEY}, the platform's AI
- * host ({@link provisionPlatformAi}), once a host passes {@link PlatformAiDeps}.
- *
- * #478 adds `coolify:app` keyed {@link PLATFORM_EDGE_KEY}, the edge host
- * ({@link provisionPlatformEdge}), once a host passes {@link PlatformEdgeDeps}.
- *
- * #175 adds `coolify:app` keyed {@link PLATFORM_ARCHON_KEY}, Archon itself
- * ({@link provisionPlatformArchon}), once a host passes
- * {@link PlatformArchonDeps}.
- *
- * #257 adds `coolify:backup:<service>`, a nightly R2 backup of each
- * platform database ({@link provisionPlatformBackup}), once a host passes
- * {@link PlatformBackupDeps}.
- */
 export class FoundryPlatformStepExecutor {
     cloudflare;
     declaredOrgStore;
@@ -173,6 +113,7 @@ export class FoundryPlatformStepExecutor {
     heartbeats;
     uptime;
     accessProvider;
+    oikosIngress;
     constructor(cloudflare, declaredOrgStore, options = {}) {
         this.cloudflare = cloudflare;
         this.declaredOrgStore = declaredOrgStore;
@@ -192,8 +133,23 @@ export class FoundryPlatformStepExecutor {
         this.heartbeats = options.heartbeats;
         this.uptime = options.uptime;
         this.accessProvider = options.accessProvider;
+        this.oikosIngress = options.oikosIngress;
     }
-    async blockedSteps(platform, recordedIds = {}) {
+    platformPorts = new WeakMap();
+    /** The port placed on the platform's destination, made once per port so a server is listed once. */
+    onPlatform(coolify) {
+        let made = this.platformPorts.get(coolify);
+        if (!made) {
+            made = placedOnPlatform(coolify);
+            this.platformPorts.set(coolify, made);
+        }
+        return made;
+    }
+    /** `deps` with its Coolify port placed on the platform destination, then limited by `profile`. */
+    limitedOnPlatform(deps, profile) {
+        return { ...deps, coolify: limited(this.onPlatform(deps.coolify), profile) };
+    }
+    async blockedSteps(platform, recordedIds = {}, owner = {}) {
         const blocked = {};
         if (platform.auth.enabled && !this.auth) {
             blocked.auth =
@@ -235,7 +191,8 @@ export class FoundryPlatformStepExecutor {
         }
         if (platform.mail.relay === true) {
             const relayBlocked = this.mail
-                ? mailRelayBlockedReason()
+                ? (mailRelayBlockedReason() ??
+                    (await relayServerBlockedReason(platform, this.mail, recordedIds)))
                 : MAIL_RELAY_BLOCKED.executorMissing;
             if (relayBlocked)
                 blocked.relay = relayBlocked;
@@ -298,6 +255,23 @@ export class FoundryPlatformStepExecutor {
             if (edgeBlocked)
                 blocked.edge = edgeBlocked;
         }
+        if (platform.edge.enabled && !oikosIngressApplied(recordedIds)) {
+            const edgeUrl = recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+            if (!this.oikosIngress) {
+                blocked.oikosIngress = OIKOS_INGRESS_BLOCKED.executorMissing;
+            }
+            else if (edgeUrl) {
+                let zoneBlocked;
+                try {
+                    zoneBlocked = await oikosIngressZoneBlocked(await this.oikosIngress.zones(edgeUrl), this.oikosIngress.callTimeoutMs);
+                }
+                catch {
+                    zoneBlocked = OIKOS_INGRESS_BLOCKED.zoneUnchecked;
+                }
+                if (zoneBlocked)
+                    blocked.oikosIngress = zoneBlocked;
+            }
+        }
         if (platform.archon.enabled) {
             if (!this.archon) {
                 blocked.archon =
@@ -308,7 +282,7 @@ export class FoundryPlatformStepExecutor {
                     'Archon is blocked, not planned: the host names no email the Cloudflare Access app in front of it may let through';
             }
             else {
-                const inputs = await collectArchonServiceInputs(platform, this.archon, recordedIds);
+                const inputs = await collectArchonServiceInputs(platform, this.archon, recordedIds, owner.files ?? null);
                 if ('blocked' in inputs) {
                     blocked.archon = inputs.blocked;
                 }
@@ -321,6 +295,22 @@ export class FoundryPlatformStepExecutor {
                 }
             }
         }
+        // Archon's own sign-in organisation lives in the owner company's ZITADEL, reached through the sign-in dependencies.
+        if (platform.archon.enabled) {
+            if (!this.auth) {
+                blocked.archonOrg =
+                    "Archon's sign-in organisation is blocked, not planned: the host built the platform executor without its auth dependencies";
+            }
+            else if (!this.auth.zitadelForInstance) {
+                blocked.archonOrg =
+                    "Archon's sign-in organisation is blocked, not planned: the host built the platform's auth dependencies without zitadelForInstance, so it cannot reach the owner company's ZITADEL";
+            }
+            const ownerCompany = await this.declaredOrgStore.get(platform.ownerOrgId);
+            const inviteBlocked = ownerInviteBlockedReason(ownerCompany, Boolean(this.auth?.ownerInviteMail));
+            if (inviteBlocked) {
+                blocked.archonOrgInvite = inviteBlocked.replace("the platform owner's invite", "the first person's invite into Archon's sign-in organisation");
+            }
+        }
         // Only once a database actually exists to back up -- the same
         // "nothing to report yet" rule `planBackups` (`platform-diff.ts`)
         // itself follows for "no database", so an otherwise-unrelated platform
@@ -338,21 +328,30 @@ export class FoundryPlatformStepExecutor {
             if (hcTagBlocked)
                 blocked.hc = hcTagBlocked;
         }
-        // Only once `hc` is actually applied -- `planHeartbeats` itself already
-        // withholds the step while `hc` is not, so a host with no heartbeats
+        // foundry#544: `'hosted'` needs none of `hc`'s own applied state -- only
+        // the self-hosted provider's standing note depends on `hc` being
+        // recorded applied at all. `planHeartbeats` itself already withholds the
+        // step while neither provider is ready, so a host with no heartbeats
         // deps wired carries no standing blocked note before there is anything
         // for it to reconcile.
-        if (!this.heartbeats && Boolean(recordedIds[`coolify:app:${PLATFORM_HC_KEY}`])) {
+        const heartbeatsHosted = platform.heartbeatsProvider === 'hosted';
+        if (!this.heartbeats &&
+            (heartbeatsHosted || Boolean(recordedIds[`coolify:app:${PLATFORM_HC_KEY}`]))) {
             blocked.heartbeatsExecutorMissing = true;
         }
-        else if (platform.hc.enabled && this.heartbeats) {
+        else if ((heartbeatsHosted || platform.hc.enabled) && this.heartbeats) {
             // #540 round 2: checked whether or not `hc` is recorded applied yet --
             // `hcReady` (`planPlatform`) goes true the same round `hc` is merely
             // *planned*, so this has to hold the heartbeats step back from the
             // very first round, before `coolify:app:platform:hc` is ever recorded.
             // See `PLATFORM_HC_API_KEY_REF`'s own doc comment (`platform-diff.ts`)
-            // for why nothing here can mint this key itself.
-            const apiKey = await this.heartbeats.heldKeys?.resolve?.(PLATFORM_HC_API_KEY_REF);
+            // for why nothing here can mint this key itself; foundry#544's
+            // `PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF` is the same rule for the
+            // outside provider's own key.
+            const apiKeyRef = heartbeatsHosted
+                ? PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF
+                : PLATFORM_HC_API_KEY_REF;
+            const apiKey = await this.heartbeats.heldKeys?.resolve?.(apiKeyRef);
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
@@ -360,7 +359,7 @@ export class FoundryPlatformStepExecutor {
         // #604: only once edge and sign-in are applied (the planner reports
         // that case itself) and no provider is recorded yet.
         if (platform.edge.enabled &&
-            platform.auth.enabled &&
+            owner.signIn &&
             !recordedIds[ACCESS_PROVIDER_RECORD_KEY] &&
             recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]) {
             if (!this.accessProvider?.zitadel.createOidcAppWithSecret) {
@@ -382,9 +381,10 @@ export class FoundryPlatformStepExecutor {
             platform.archon.enabled &&
             recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY]) {
             try {
-                const zitadel = this.archon.zitadelForInstance?.(`https://${platform.auth.hostname}`) ??
-                    this.archon.zitadel;
-                if (zitadel.updateOidcAppIdTokenUserinfoAssertion)
+                const zitadel = owner.signIn
+                    ? this.archon.zitadelForInstance?.(owner.signIn.issuerUrl, owner.signIn.bearerRef)
+                    : undefined;
+                if (zitadel?.updateOidcAppIdTokenUserinfoAssertion)
                     blocked.archonIdTokenUserinfo = true;
             }
             catch (e) {
@@ -486,18 +486,25 @@ export class FoundryPlatformStepExecutor {
      * login-client token is no longer the sole live PAT on its ZITADEL machine
      * user.
      */
-    async driftedSteps(platform, recordedIds = {}) {
+    async driftedSteps(platform, recordedIds = {}, owner = {}) {
         const result = {};
         if (platform.archon.enabled &&
             this.archon &&
             recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]) {
-            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, this.archon.accessEmails, platform.uptime.enabled
+            const ownerCompany = await this.declaredOrgStore.get(platform.ownerOrgId);
+            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, archonAccessEmails(this.archon.accessEmails, ownerCompany), platform.uptime.enabled
                 ? recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
                 : undefined);
-            const brokerDrifted = !accessDrifted && (await archonBrokerRegistrationDrifted(this.archon.coolify, recordedIds));
+            const archonOrgId = recordedIds[PLATFORM_ARCHON_ORG_SCOPE_KEY];
+            const brokerDrifted = !accessDrifted &&
+                (await archonBrokerRegistrationDrifted(this.archon.coolify, owner.signIn ?? null, archonOrgId, recordedIds));
             const authOrgDrifted = !accessDrifted &&
                 !brokerDrifted &&
-                (await archonAuthOrgDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], recordedIds));
+                (await archonAuthOrgDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], {
+                    AUTH_ORGANIZATION_ID: archonOrgId,
+                    CI_ORGANIZATION_ID: owner.signIn?.organisationId,
+                    ARCHON_FIRST_OWNER_LINK: archonFirstOwnerLink(recordedIds, owner.signIn ?? null),
+                }));
             const authzDrifted = !accessDrifted &&
                 !brokerDrifted &&
                 !authOrgDrifted &&
@@ -602,13 +609,13 @@ export class FoundryPlatformStepExecutor {
                 throw new Error('platform:auth needs FoundryPlatformStepExecutor to be constructed with its auth dependencies (#168)');
             }
             const company = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformAuth(context, this.auth, company);
+            return provisionPlatformAuth(context, this.limitedOnPlatform(this.auth, LIMITS.platformAuth), company);
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_FILES_KEY) {
             if (!this.files) {
                 throw new Error('platform:files needs FoundryPlatformStepExecutor to be constructed with its files dependencies (#171)');
             }
-            return provisionPlatformFiles(context, this.files, filesShareDomains(await this.declaredOrgStore.list()));
+            return provisionPlatformFiles(context, this.limitedOnPlatform(this.files, LIMITS.platformFiles), filesShareDomains(await this.declaredOrgStore.list()));
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -616,19 +623,19 @@ export class FoundryPlatformStepExecutor {
             if (!this.integrations) {
                 throw new Error('platform:integrations needs FoundryPlatformStepExecutor to be constructed with its integrations dependencies (#174)');
             }
-            return provisionPlatformIntegrations(action, context, this.integrations);
+            return provisionPlatformIntegrations(action, context, this.limitedOnPlatform(this.integrations, LIMITS.platformIntegrations));
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_AI_KEY) {
             if (!this.ai) {
                 throw new Error('platform:ai needs FoundryPlatformStepExecutor to be constructed with its ai dependencies (#172)');
             }
-            return provisionPlatformAi(context, this.ai);
+            return provisionPlatformAi(context, this.limitedOnPlatform(this.ai, LIMITS.platformAi));
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_EDGE_KEY) {
             if (!this.edge) {
                 throw new Error('platform:edge needs FoundryPlatformStepExecutor to be constructed with its edge dependencies (#478)');
             }
-            return provisionPlatformEdge(context, this.edge);
+            return provisionPlatformEdge(context, this.limitedOnPlatform(this.edge, LIMITS.platformEdge));
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -637,13 +644,13 @@ export class FoundryPlatformStepExecutor {
                 throw new Error('platform:archon needs FoundryPlatformStepExecutor to be constructed with its archon dependencies (#175)');
             }
             const ownerCompany = await this.declaredOrgStore.get(context.platform.ownerOrgId);
-            return provisionPlatformArchon(context, this.archon, ownerCompany);
+            return provisionPlatformArchon(context, this.limitedOnPlatform(this.archon, LIMITS.platformArchon), ownerCompany);
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_MAIL_KEY) {
             if (!this.mail) {
                 throw new Error('platform:mail needs FoundryPlatformStepExecutor to be constructed with its mail dependencies (#169)');
             }
-            return provisionPlatformMail(context, this.mail);
+            return provisionPlatformMail(context, this.limitedOnPlatform(this.mail, LIMITS.platformMail));
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -651,13 +658,22 @@ export class FoundryPlatformStepExecutor {
             if (!this.mail) {
                 throw new Error('platform:mail-relay needs FoundryPlatformStepExecutor to be constructed with its mail dependencies');
             }
-            return provisionPlatformMailRelay(action, context, this.mail);
+            return provisionPlatformMailRelay(action, context, this.limitedOnPlatform(this.mail, LIMITS.platformMailRelay));
         }
         if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_HC_KEY) {
             if (!this.hc) {
                 throw new Error('platform:hc needs FoundryPlatformStepExecutor to be constructed with its hc dependencies (#540)');
             }
-            return provisionPlatformHc(context, this.hc);
+            return provisionPlatformHc(context, this.limitedOnPlatform(this.hc, LIMITS.platformHc));
+        }
+        if (action.system === 'zitadel' &&
+            action.kind === 'archon-org' &&
+            action.key === PLATFORM_ARCHON_KEY) {
+            if (!this.auth) {
+                throw new Error("platform:archon-org needs FoundryPlatformStepExecutor to be constructed with its auth dependencies: Archon's sign-in organisation is made through them");
+            }
+            const ownerCompany = await this.declaredOrgStore.get(context.platform.ownerOrgId);
+            return provisionPlatformArchonOrg(context, this.auth, ownerCompany);
         }
         if (action.system === 'zitadel' &&
             action.kind === 'id-token-userinfo' &&
@@ -695,6 +711,14 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformUptime(context, this.uptime);
         }
+        if (action.system === 'coolify' &&
+            action.kind === 'app' &&
+            action.key === PLATFORM_OIKOS_INGRESS_KEY) {
+            if (!this.oikosIngress) {
+                throw new Error('platform:oikos-ingress needs FoundryPlatformStepExecutor to be constructed with its oikos ingress dependencies');
+            }
+            return provisionPlatformOikosIngress(context, this.limitedOnPlatform(this.oikosIngress, LIMITS.platformIngress));
+        }
         if (action.system === 'cloudflare' && action.kind === 'zone') {
             return this.cloudflareZone(action, context);
         }
@@ -768,7 +792,11 @@ export class FoundryPlatformStepExecutor {
         if (!deliverSecret) {
             throw new Error('platform step coolify:jobs needs a deliverSecret -- construct FoundryPlatformStepExecutor with one, to hand the scheduler admin token to the host (#173)');
         }
-        return provisionJobsHost(scopeFromPlatform(context), { coolify, deliverSecret, runtime: this.runtime }, platformTarget(), {
+        return provisionJobsHost(scopeFromPlatform(context), {
+            coolify: limited(this.onPlatform(coolify), LIMITS.platformJobs),
+            deliverSecret,
+            runtime: this.runtime,
+        }, platformTarget(), {
             hostname: action.desired.hostname,
             gitRef: action.desired.gitRef,
             project: platformJobsProject,
@@ -944,7 +972,8 @@ export async function provisionJobsHost(scope, deps, target, input) {
     // the AI worker. A deploy that fails or times out throws here, records
     // nothing and leaves the step planned.
     if (!existingApp || tokenJustSet || pending || !running || addressNew) {
-        await waitForNewDeployment(coolify, appId, { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, label, 'the scheduler keeps its old address');
+        const built = await waitForNewDeployment(coolify, appId, { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, label, 'the scheduler keeps its old address');
+        await recordBuiltCommit(coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: 'jobs' }, (key, value) => scope.recordScopeId(key, value));
     }
     if (pending) {
         scope.recordScopeId(JOBS_DEPLOY_PENDING_SCOPE_KEY, '');
@@ -991,7 +1020,7 @@ const AUTH_ZITADEL_PORT = '8080';
  */
 export function zitadelDockerfile() {
     return [
-        `FROM ${AUTH_ZITADEL_IMAGE}:${AUTH_ZITADEL_IMAGE_TAG}`,
+        `FROM ${AUTH_ZITADEL_IMAGE}:${pinnedRef('zitadel')}`,
         `EXPOSE ${AUTH_ZITADEL_PORT}`,
         'CMD ["start-from-init", "--masterkeyFromEnv", "--tlsMode", "external"]',
         'HEALTHCHECK --interval=15s --timeout=5s --start-period=180s --retries=5 CMD ["/app/zitadel", "ready"]',
@@ -1505,6 +1534,10 @@ export async function provisionAuthStack(scope, deps, target, input) {
         { key: 'ZITADEL_DATABASE_POSTGRES_DSN', value: db.internal_db_url },
         { key: 'ZITADEL_FIRSTINSTANCE_SKIP', value: 'true' },
         { key: 'ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED', value: 'true' },
+        // A username is unique per organisation, and the login name is `name@<org domain>`. Without it a
+        // name is unique across the instance, so the owner's account in Archon's own organisation
+        // collides with the same owner's account in the company's organisation.
+        { key: 'ZITADEL_DEFAULTINSTANCE_DOMAINPOLICY_USERLOGINMUSTBEDOMAIN', value: 'true' },
         {
             key: 'ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_BASEURI',
             value: `https://${hostname}/`,
@@ -1766,6 +1799,16 @@ export async function provisionAuthStack(scope, deps, target, input) {
         if (recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY] !== org.id) {
             await record(PLATFORM_ZITADEL_ORG_SCOPE_KEY, org.id);
         }
+        // The new instance starts with open self-registration and its host is
+        // already public: close it in the people organisation before anything
+        // else runs. The sign-in policy step records the close and repeats it;
+        // closing twice changes nothing.
+        try {
+            await zitadel.closeSelfRegistration(org.id);
+        }
+        catch {
+            throw new Error(`${label}: closing self-registration failed in ZITADEL org ${org.id}`);
+        }
         const { userId, token } = await zitadel.mintAdminMachineUser(org.id, {
             userName: PLATFORM_AUTH_ADMIN_USER_NAME,
             name: 'Foundry (platform admin)',
@@ -2064,6 +2107,109 @@ async function provisionPlatformAuth(context, deps, ownerCompany = null) {
         ownerCompany,
     });
 }
+/**
+ * Archon's own sign-in organisation (`zitadel:archon-org` keyed
+ * {@link PLATFORM_ARCHON_KEY}), in the owner company's ZITADEL and apart from
+ * the organisation that holds the company's people: the org, its primary
+ * domain, closed self-registration, a login policy that forces a second
+ * factor, and the first person's invite (a link mailed to their personal
+ * address). Each call records its key right after it succeeded, so a failure
+ * leaves the earlier keys recorded and the next plan names the step again; a
+ * repeat converges because every call looks before it writes. The errors name
+ * the org only, never the cause: the cause can carry an address or the invite.
+ * The invite code reaches only the mail port (30 second timeout, see
+ * `inviteOwnerWithLink`) and is never recorded or logged.
+ */
+async function provisionPlatformArchonOrg(context, deps, ownerCompany) {
+    const ownerSignIn = context.owner?.signIn ?? null;
+    if (!ownerSignIn || !ownerCompany) {
+        throw new Error("platform:archon-org: the owner company's sign-in has not been applied yet; Archon's organisation is made in its ZITADEL");
+    }
+    if (!deps.zitadelForInstance) {
+        throw new Error("platform:archon-org: the host built the platform's auth dependencies without zitadelForInstance, so it cannot reach the owner company's ZITADEL");
+    }
+    const zitadel = deps.zitadelForInstance(ownerSignIn.issuerUrl, ownerSignIn.bearerRef);
+    const record = async (key, value) => {
+        context.recordScopeId(key, value);
+        await context.persist?.();
+    };
+    const name = archonOrgName(ownerCompany.slug);
+    let orgId;
+    try {
+        ({ orgId } = await ensureSignInOrg({
+            zitadel,
+            name,
+            domain: archonOrgDomain(signInOrgDomain(ownerCompany)),
+            recordScopeId: (key, id) => context.recordScopeId(key, id),
+            persistScopeIds: async () => {
+                await context.persist?.();
+            },
+            orgScopeKey: PLATFORM_ARCHON_ORG_SCOPE_KEY,
+            domainScopeKey: PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY,
+            domainBlockedScopeKey: PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY,
+            registrationClosedScopeKey: PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY,
+        }));
+    }
+    catch {
+        throw new Error(`platform:archon-org: making the sign-in organisation ${name} (its domain and closed registration) failed in ZITADEL`);
+    }
+    await context.persist?.();
+    try {
+        await zitadel.enforceSecondFactor(orgId);
+    }
+    catch {
+        throw new Error(`platform:archon-org: forcing a second factor failed in ZITADEL org ${orgId}`);
+    }
+    await record(PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, orgId);
+    const recorded = context.recordedIds();
+    const inviteRecorded = recorded[PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY];
+    // An invite made in another org (an earlier Archon org) is made again.
+    if (!inviteRecorded ||
+        (inviteRecorded !== 'none' && recorded[PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY] !== orgId)) {
+        const owner = ownerCompany.owners[0];
+        if (!owner) {
+            await record(PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, 'none');
+        }
+        else {
+            const mailboxAddress = ownerMailboxes(ownerCompany)[0]?.address;
+            // `ownerInviteBlockedReason` reports these two as blocked; the step goes on without the invite.
+            if (mailboxAddress && deps.ownerInviteMail) {
+                let invitedUserId;
+                try {
+                    ({ userId: invitedUserId } = await inviteOwnerWithLink({
+                        zitadel,
+                        mail: deps.ownerInviteMail,
+                        orgId,
+                        authIssuer: ownerSignIn.issuerUrl,
+                        owner: {
+                            givenName: owner.givenName,
+                            familyName: owner.familyName,
+                            mailboxAddress,
+                            personalEmail: owner.email,
+                        },
+                        label: 'platform:archon-org',
+                        ...(deps.runtime?.onSecret ? { onSecret: deps.runtime.onSecret } : {}),
+                        ...(inviteRecorded && inviteRecorded !== 'none'
+                            ? { invitedUserId: inviteRecorded }
+                            : {}),
+                    }));
+                }
+                catch (error) {
+                    const cause = redactSecrets(error instanceof Error ? error.message : String(error), [
+                        owner.email,
+                        owner.email.toLowerCase(),
+                        mailboxAddress,
+                    ]);
+                    throw new Error(`platform:archon-org: could not invite the first person into ZITADEL org ${orgId}: ${cause}`);
+                }
+                // The user id first: a crash between the two replans the invite, never skips it.
+                await record(PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, invitedUserId);
+                await record(PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, orgId);
+            }
+        }
+    }
+    return {};
+}
 /**
  * Reserves the username `admin` and switches self-registration off in the
  * platform's sign-in org (`zitadel:sign-in-policy` keyed {@link PLATFORM_AUTH_KEY}).
@@ -2138,7 +2284,7 @@ const PLATFORM_AUTH_MAIL_SENDER_NAME = 'Company Included';
 // #169: the platform's own mail server (Stalwart)
 // ---------------------------------------------------------------------------
 const PLATFORM_MAIL_PROJECT = 'platform';
-const PLATFORM_MAIL_INTERNAL_NAME = 'platform-mail-stalwart';
+export const PLATFORM_MAIL_INTERNAL_NAME = 'platform-mail-stalwart';
 /**
  * `stalw.art/docs/install/docker`: the official image. `platform.mail.gitRef`
  * carries its tag -- `platform.ts`'s `PlatformService.gitRef` doc comment
@@ -2184,7 +2330,7 @@ const STALWART_RECOVERY_USER = 'admin';
  */
 const STALWART_READY_PATH = '/healthz/ready';
 /** Where the server the app was created on is recorded, so the MX record follows the app, not a later pick. */
-const PLATFORM_MAIL_SERVER_SCOPE_KEY = 'coolify_platform_mail_server';
+export const PLATFORM_MAIL_SERVER_SCOPE_KEY = 'coolify_platform_mail_server';
 const PLATFORM_MAIL_PROJECT_SCOPE_KEY = 'coolify_project_platform_mail';
 const PLATFORM_MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
 const PLATFORM_MAIL_RELAY_APP_SCOPE_KEY = 'coolify_platform_mail_relay_app';
@@ -2357,6 +2503,7 @@ const PLATFORM_MAIL_ZITADEL_PROJECT_NAME = 'mail';
  */
 export async function provisionMailServer(scope, deps, target, input) {
     const { hostname, apex, mailHost, imageTag, hostPorts, issuerUrl, mxRecord, network } = input;
+    const zone = input.zone ?? apex;
     const label = target.kind === 'org' ? `own step coolify:own-mail for ${target.id}` : 'platform:mail';
     const keyDescription = target.kind === 'org' ? `foundry:org:${target.id}:admin` : PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION;
     const recorded = scope.recordedIds();
@@ -2393,7 +2540,7 @@ export async function provisionMailServer(scope, deps, target, input) {
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             docker_registry_image_name: STALWART_IMAGE,
-            docker_registry_image_tag: imageTag,
+            docker_registry_image_tag: pinnedTagFor('stalwart', imageTag),
             ports_exposes: STALWART_PORTS_EXPOSES,
             ...(hostPorts ? { ports_mappings: hostPorts } : {}),
             name: target.names.mailApp,
@@ -2413,7 +2560,7 @@ export async function provisionMailServer(scope, deps, target, input) {
     // `'ready'` probe below. Stalwart's own readiness route and HTTP port.
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: target.internal.mail,
-        docker_registry_image_tag: imageTag,
+        docker_registry_image_tag: pinnedTagFor('stalwart', imageTag),
         ...healthCheckSettings(STALWART_READY_PATH, Number(STALWART_HTTP_PORT)),
         // Only a platform that uses the shared relay, or one that did, changes a published port.
         ...(portsChanged ? { ports_mappings: hostPorts } : {}),
@@ -2513,15 +2660,15 @@ export async function provisionMailServer(scope, deps, target, input) {
         recordedConnectorAppId: recorded[PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY] ?? null,
         recordAppId: (appId) => record(PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, appId),
     });
-    const zoneId = await network.zoneId(apex);
+    const zoneId = await network.zoneId(zone);
     if (!zoneId) {
-        throw new Error(`${label}: no Cloudflare zone for ${apex} to put ${hostname} in`);
+        throw new Error(`${label}: no Cloudflare zone for ${zone} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
     const dns = await network.dns();
-    const [dnsRecord] = await dns.findDnsRecord(apex, hostname, 'CNAME');
+    const [dnsRecord] = await dns.findDnsRecord(zone, hostname, 'CNAME');
     if (!dnsRecord) {
-        await dns.createDnsRecord(apex, {
+        await dns.createDnsRecord(zone, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -2529,7 +2676,7 @@ export async function provisionMailServer(scope, deps, target, input) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await dns.updateDnsRecord(apex, dnsRecord.id, {
+        await dns.updateDnsRecord(zone, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -2541,9 +2688,9 @@ export async function provisionMailServer(scope, deps, target, input) {
     // ---- the MX hostname: a direct, unproxied A record --------------------------
     if (mxRecord) {
         const serverIp = (mxRecord.serverIpv4 ?? server.ip); // checked by mailServerIpBlocked above
-        const [existingMx] = await dns.findDnsRecord(apex, mailHost, 'A');
+        const [existingMx] = await dns.findDnsRecord(zone, mailHost, 'A');
         if (!existingMx) {
-            await dns.createDnsRecord(apex, {
+            await dns.createDnsRecord(zone, {
                 type: 'A',
                 name: mailHost,
                 content: serverIp,
@@ -2551,7 +2698,7 @@ export async function provisionMailServer(scope, deps, target, input) {
             });
         }
         else if (existingMx.content !== serverIp) {
-            await dns.updateDnsRecord(apex, existingMx.id, {
+            await dns.updateDnsRecord(zone, existingMx.id, {
                 type: 'A',
                 name: mailHost,
                 content: serverIp,
@@ -2797,28 +2944,87 @@ async function mailBlockedReason(platform, mail, recordedIds) {
         return "the platform's mail server is blocked, not planned: no usable Coolify server could be resolved for it";
     }
 }
+async function provisionPlatformOikosIngress(context, deps) {
+    const recorded = context.recordedIds();
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl)
+        throw new Error(OIKOS_INGRESS_BLOCKED.edgeNotApplied);
+    return provisionOikosIngress(context, {
+        coolify: deps.coolify,
+        tunnels: await platformTunnels(deps, recorded, 'platform:oikos-ingress'),
+        dns: await platformDns(deps, recorded, 'platform:oikos-ingress'),
+        ratelimits: await deps.ratelimits(edgeUrl),
+        zones: await deps.zones(edgeUrl),
+        resolveServer: () => resolvePlatformServer(deps.coolify),
+        callTimeoutMs: deps.callTimeoutMs,
+    });
+}
 /** Why the shared mail relay cannot be built from its pinned base image, or `null`. */
 function mailRelayBlockedReason() {
     const tagBlocked = floatingTagBlocked('mail relay base', VERSIONS.alpine, '3.22.1');
     return tagBlocked ? `the platform's mail relay is blocked, not planned: ${tagBlocked}` : null;
 }
+/** Why `mx.<apex>` has no address to point at, or `null`. Skipped once the relay is applied, as the mail step's own check was. */
+async function relayServerBlockedReason(platform, mail, recordedIds) {
+    if (platform.serverIpv4 || recordedIds[`coolify:app:${PLATFORM_MAIL_RELAY_KEY}`])
+        return null;
+    try {
+        const server = await resolveMailServer(mail.coolify, recordedIds[PLATFORM_MAIL_SERVER_SCOPE_KEY]);
+        return mailServerIpBlocked(server.ip, platform.serverIpv4);
+    }
+    catch {
+        return "the platform's mail relay is blocked, not planned: no usable Coolify server could be resolved for it";
+    }
+}
 /**
- * Runs the shared mail relay step against the project and server the platform
- * mail step recorded, so the relay sits on the Docker network and the server
- * address of the Stalwart it forwards to.
+ * Runs the shared mail relay step in the platform mail project and on the
+ * platform server (recorded by the mail step when one ran, else found or made).
  */
 async function provisionPlatformMailRelay(action, context, deps) {
     const recorded = context.recordedIds();
-    const projectUuid = recorded[PLATFORM_MAIL_PROJECT_SCOPE_KEY];
-    const serverUuid = recorded[PLATFORM_MAIL_SERVER_SCOPE_KEY];
-    if (!projectUuid || !serverUuid) {
-        throw new Error('platform:mail-relay: the platform mail server has not recorded its project and server yet; apply the mail server first');
+    // No platform mail step runs any more (the owner company runs its own mail), so
+    // the relay finds or makes its project and server itself, as the mail step did.
+    let projectUuid = recorded[PLATFORM_MAIL_PROJECT_SCOPE_KEY];
+    if (!projectUuid) {
+        const found = await deps.coolify.findProjectByName(PLATFORM_MAIL_PROJECT);
+        projectUuid = found
+            ? found.uuid
+            : (await deps.coolify.createProject(PLATFORM_MAIL_PROJECT)).uuid;
+        context.recordScopeId(PLATFORM_MAIL_PROJECT_SCOPE_KEY, projectUuid);
+        await context.persist?.();
+    }
+    let serverUuid = recorded[PLATFORM_MAIL_SERVER_SCOPE_KEY];
+    if (!serverUuid) {
+        serverUuid = (await resolveMailServer(deps.coolify, undefined)).uuid;
+        context.recordScopeId(PLATFORM_MAIL_SERVER_SCOPE_KEY, serverUuid);
+        await context.persist?.();
+    }
+    // The relay answers port 25 on `mx.<apex>`, and no mail step writes that name any more: the relay does,
+    // first, so a failed write leaves the step planned (the routes are recorded last).
+    const mxHost = platformMailMxHost(context.platform.apex);
+    const server = await resolveMailServer(deps.coolify, serverUuid);
+    const serverIpBlocked = mailServerIpBlocked(server.ip, context.platform.serverIpv4);
+    if (serverIpBlocked)
+        throw new Error(serverIpBlocked);
+    const serverIp = (context.platform.serverIpv4 ?? server.ip);
+    const network = platformNetwork(deps, scopeFromPlatform(context), 'platform:mail-relay');
+    const zoneId = await network.zoneId(context.platform.apex);
+    if (!zoneId) {
+        throw new Error(`platform:mail-relay: no Cloudflare zone for ${context.platform.apex} to put ${mxHost} in`);
+    }
+    const dns = await network.dns();
+    const [existingMx] = await dns.findDnsRecord(context.platform.apex, mxHost, 'A');
+    const mxRecord = { type: 'A', name: mxHost, content: serverIp, proxied: false };
+    if (!existingMx) {
+        await dns.createDnsRecord(context.platform.apex, mxRecord);
+    }
+    else if (existingMx.content !== serverIp) {
+        await dns.updateDnsRecord(context.platform.apex, existingMx.id, mxRecord);
     }
     return provisionMailRelay(action, context, deps, {
         projectUuid,
         serverUuid,
-        hostname: platformMailMxHost(context.platform.apex),
-        defaultTarget: `${PLATFORM_MAIL_INTERNAL_NAME}:25`,
+        hostname: mxHost,
         appScopeKey: PLATFORM_MAIL_RELAY_APP_SCOPE_KEY,
     });
 }
@@ -3052,9 +3258,75 @@ const PLATFORM_ARCHON_PROJECT_SCOPE_KEY = 'coolify_project_platform_archon';
 const PLATFORM_ARCHON_DB_SCOPE_KEY = 'coolify_platform_archon_database';
 const PLATFORM_ARCHON_TUNNEL_SCOPE_KEY = 'cloudflare_platform_archon_tunnel';
 const PLATFORM_ARCHON_ACCESS_SCOPE_KEY = 'cloudflare_platform_archon_access_app';
-const PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_platform_archon_project';
+/**
+ * Archon paths a machine calls and Archon authenticates itself (its `proxy.ts`:
+ * `PUBLIC_EXACT` and `ORG_CHANGES_PATH_RE`). Each gets its own Access app with
+ * one bypass policy, because the hostname app would otherwise ask a machine for
+ * an emailed code. `/api/uptime/targets` and `/api/uptime/results` are left out
+ * on purpose: they pass the hostname app through the uptime service-token
+ * policy, and a bypass would make that token meaningless. `*` is one path
+ * segment (the organisation id).
+ */
+export const PLATFORM_ARCHON_PUBLIC_PATHS = [
+    { name: 'prices', path: '/api/prices' },
+    { name: 'vipps-webhook', path: '/vipps/webhook' },
+    { name: 'vipps-agreement', path: '/vipps/agreement' },
+    { name: 'usage-tick', path: '/api/usage/tick' },
+    { name: 'reporting-collect', path: '/api/reporting/collect' },
+    { name: 'org-changes', path: '/api/orgs/*/changes' },
+];
+const PLATFORM_ARCHON_PUBLIC_POLICY_NAME = 'foundry: public path';
+const archonPublicAppName = (name) => `${PLATFORM_ARCHON_ACCESS_APP_NAME}:public:${name}`;
+/** The scope key one bypass app's id is recorded under. */
+export const archonPublicAccessScopeKey = (name) => `cloudflare_platform_archon_access_public_${name.replace(/-/g, '_')}`;
+/** Whether a policy list is exactly the one bypass-for-everyone policy. */
+function onlyBypassEveryone(policies) {
+    const only = policies[0];
+    return (policies.length === 1 &&
+        only?.name === PLATFORM_ARCHON_PUBLIC_POLICY_NAME &&
+        only.decision === 'bypass' &&
+        Array.isArray(only.include) &&
+        only.include.length === 1 &&
+        JSON.stringify(only.include[0]) === '{"everyone":{}}');
+}
+/**
+ * One Access app per public path, each with the one policy bypass/everyone and
+ * no identity provider. Adopts only an app of its own name on the exact domain,
+ * refuses another name there, and rebuilds one whose policies are not exactly
+ * the bypass. A rebuild needs no closed gate: the hostname app covers the path
+ * meanwhile, which only asks for more.
+ */
+async function ensureArchonPublicAccess(cf, hostname, recorded, record) {
+    for (const { name, path } of PLATFORM_ARCHON_PUBLIC_PATHS) {
+        const domain = `${hostname}${path}`;
+        const appName = archonPublicAppName(name);
+        const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
+        const foreign = onDomain.find((a) => a.name !== appName);
+        if (foreign) {
+            throw new Error(`platform:archon: Access app '${foreign.name}' already holds ${domain}; foundry does not adopt it`);
+        }
+        let id = onDomain[0]?.id;
+        if (id && !onlyBypassEveryone(await cf.listAccessPolicies(id))) {
+            await cf.deleteAccessApp(id);
+            id = undefined;
+        }
+        if (!id) {
+            id = (await cf.createAccessApp({ name: appName, domain, type: 'self_hosted' })).id;
+            await cf.createAccessPolicy(id, {
+                name: PLATFORM_ARCHON_PUBLIC_POLICY_NAME,
+                decision: 'bypass',
+                include: [{ everyone: {} }],
+            });
+        }
+        const key = archonPublicAccessScopeKey(name);
+        if (recorded[key] !== id)
+            await record(key, id);
+    }
+}
 /** The hostname the sign-in client's redirect URIs were made for; a change makes a new client. */
 const PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY = 'zitadel_platform_archon_client_hostname';
+/** The owner's ZITADEL organisation the sign-in client was made in; a change makes a new client. */
+const PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY = 'zitadel_platform_archon_client_org';
 /** Archon's OIDC client id: public, not a secret, so a plain scope id. */
 export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_client_id';
 /**
@@ -3065,13 +3337,16 @@ export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_clie
  * names the ids only, never the cause.
  */
 async function switchOnArchonIdTokenUserinfo(context, deps) {
-    const { platform } = context;
     const recorded = context.recordedIds();
-    const zitadel = deps.zitadelForInstance?.(`https://${platform.auth.hostname}`) ?? deps.zitadel;
+    // The client lives in the owner company's ZITADEL; without its sign-in there is nothing to switch on.
+    const ownerSignIn = context.owner?.signIn ?? null;
+    const zitadel = ownerSignIn
+        ? deps.zitadelForInstance?.(ownerSignIn.issuerUrl, ownerSignIn.bearerRef)
+        : undefined;
     // The planner plans nothing without the method; a stale plan does nothing.
-    if (!zitadel.updateOidcAppIdTokenUserinfoAssertion)
+    if (!ownerSignIn || !zitadel?.updateOidcAppIdTokenUserinfoAssertion)
         return {};
-    const orgId = recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    const orgId = ownerSignIn.organisationId;
     const projectId = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
     const appId = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
     if (!orgId || !projectId || !appId) {
@@ -3197,7 +3472,25 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const hostname = platform.archon.hostname;
     const gitRef = platform.archon.gitRef;
     const recorded = context.recordedIds();
-    const issuer = `https://${platform.auth.hostname}`;
+    // Operators sign in through the owner company's own sign-in, never a platform one.
+    const ownerSignIn = context.owner?.signIn ?? null;
+    const ownerFiles = context.owner?.files ?? null;
+    if (!ownerSignIn) {
+        throw new Error("platform:archon: the owner company's sign-in has not been applied yet; Archon's sign-in client lives in it");
+    }
+    const issuer = ownerSignIn.issuerUrl;
+    // Archon signs people in from its own organisation; the company's is only handed on as CI_ORGANIZATION_ID.
+    const authOrgId = recorded[PLATFORM_ARCHON_ORG_SCOPE_KEY];
+    const ciOrgId = ownerSignIn.organisationId;
+    if (!authOrgId) {
+        throw new Error("platform:archon: Archon's own sign-in organisation is not recorded yet; zitadel:archon-org runs first");
+    }
+    // Archon accepts sign-ins from that organisation only once it forces a second factor and keeps registration closed.
+    if (recorded[PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY] !== authOrgId ||
+        recorded[PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY] !== authOrgId) {
+        throw new Error("platform:archon: Archon's sign-in organisation does not force a second factor and keep registration closed yet; zitadel:archon-org runs first");
+    }
+    const firstOwnerLink = archonFirstOwnerLink(recorded, ownerSignIn);
     const appliedGitRef = recorded[PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY];
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
@@ -3205,13 +3498,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (deps.accessEmails.length === 0) {
         throw new Error('platform:archon: no Access emails given; refusing to put Archon behind an Access app nobody can pass');
     }
-    // The sign-in client below is created inside the platform's own ZITADEL,
-    // which `platform:auth` builds. The planner orders that step first and
-    // blocks this one while auth is off; this is the same rule for a caller
-    // that reaches the step anyway.
-    if (!platform.auth.enabled || !recorded[`coolify:app:${PLATFORM_AUTH_KEY}`]) {
-        throw new Error("platform:archon: the platform's own sign-in (platform:auth) has not been applied yet; Archon's sign-in client lives in it");
-    }
+    const accessEmails = archonAccessEmails(deps.accessEmails, ownerCompany);
     const record = async (key, id) => {
         context.recordScopeId(key, id);
         await context.persist?.();
@@ -3219,7 +3506,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // Every service the platform declares must have delivered what Archon reads.
     // The planner blocks first; this is the same rule for a caller that reaches
     // the step anyway, and it is where the values are read for the env below.
-    const inputs = await collectArchonServiceInputs(platform, deps, recorded);
+    const inputs = await collectArchonServiceInputs(platform, deps, recorded, ownerFiles);
     if ('blocked' in inputs)
         throw new Error(`platform:archon: ${inputs.blocked}`);
     // #213: Archon's own onboarding reads these back as held keys before it
@@ -3324,11 +3611,25 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         ...healthCheckSettings(ARCHON_HEALTH_CHECK_PATH, Number(ARCHON_PORT), ARCHON_HEALTH_CHECK_START_PERIOD_SECONDS),
         git_branch: gitRef,
     });
-    // ---- sign-in client in the platform's own ZITADEL -------------------------
-    const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
-    const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
-    if (recorded[PLATFORM_ZITADEL_ORG_SCOPE_KEY] !== org.id) {
-        await record(PLATFORM_ZITADEL_ORG_SCOPE_KEY, org.id);
+    // ---- sign-in client in the owner company's own ZITADEL --------------------
+    // Only the owner's own instance, by its issuer and bearer reference: the
+    // platform's `deps.zitadel` is never used, so a missing factory is an error.
+    if (!deps.zitadelForInstance) {
+        throw new Error("platform:archon: the host built the platform executor without zitadelForInstance, so it cannot reach the owner company's ZITADEL");
+    }
+    const zitadel = deps.zitadelForInstance(issuer, ownerSignIn.bearerRef);
+    const org = { id: authOrgId };
+    // The client made in another organisation (the company's, before Archon had its own) is deleted
+    // once the new one serves: its ids are kept here before the recorded ones are overwritten.
+    const oldClientOrg = recorded[PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY];
+    const oldProject = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
+    const oldApp = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (oldClientOrg &&
+        oldClientOrg !== authOrgId &&
+        oldProject &&
+        oldApp &&
+        !recorded[PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY]) {
+        await record(PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, `${oldClientOrg}|${oldProject}|${oldApp}`);
     }
     const { project } = await zitadel.findOrCreateProject(org.id, PLATFORM_ARCHON_ZITADEL_PROJECT);
     if (recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY] !== project.id) {
@@ -3337,7 +3638,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // The client's redirect URIs name the hostname, and no call updates them, so
     // a client made for another hostname is deleted and made again. Its id is
     // public and there is no secret to lose.
-    let clientId = recorded[PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY] === hostname
+    let clientId = recorded[PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY] === hostname &&
+        recorded[PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY] === org.id
         ? recorded[PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY]
         : undefined;
     if (!clientId) {
@@ -3369,18 +3671,18 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         // Made with the setting on (providers 0.9.0): nothing to repair on this id.
         context.recordScopeId(PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, created.appId);
         context.recordScopeId(PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY, hostname);
+        context.recordScopeId(PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY, org.id);
         await record(PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY, created.clientId);
         clientId = created.clientId;
     }
     // ---- env ------------------------------------------------------------------
-    // People sign in from the owner company's sign-in org. The project, client
-    // and Access app above stay in the `foundry` org, which holds no people.
-    const authOrgId = archonAuthOrganizationId(context.recordedIds()) ?? org.id;
     const envs = [
         { key: 'APP_URL', value: `https://${hostname}` },
         { key: 'AUTH_ISSUER', value: issuer },
         { key: 'AUTH_ORGANIZATION_ID', value: authOrgId },
+        { key: 'CI_ORGANIZATION_ID', value: ciOrgId },
         { key: 'AUTH_CLIENT_ID', value: clientId },
+        ...(firstOwnerLink ? [{ key: 'ARCHON_FIRST_OWNER_LINK', value: firstOwnerLink }] : []),
     ];
     // #265: an owner URL or reporting site already on the app is kept as it is.
     // The owner URL must name the adopted database's host, or the app's two
@@ -3453,7 +3755,12 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // empty, and `readBrokerApps`/`validateBrokerAppEntry` would refuse it the
     // moment this step tried to register it. See `ensureGeneratedEnv`'s own
     // doc comment for why no other call site gets this argument.
-    const appKey = (await ensureGeneratedEnv(deps.coolify, appId, 'AUTH_APP_KEY', () => randomBytes(32).toString('base64url'), 32)) ?? (await currentEnvValue(deps.coolify, appId, 'AUTH_APP_KEY'));
+    // A key minted for another organisation (the company's) is never kept: Archon's new
+    // entry gets a fresh one, so the key the old entry held stops being Archon's.
+    const freshKey = recorded[PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY] !== authOrgId;
+    const appKey = freshKey
+        ? randomBytes(32).toString('base64url')
+        : ((await ensureGeneratedEnv(deps.coolify, appId, 'AUTH_APP_KEY', () => randomBytes(32).toString('base64url'), 32)) ?? (await currentEnvValue(deps.coolify, appId, 'AUTH_APP_KEY')));
     if (!appKey) {
         throw new Error(`platform:archon: app ${appId} lost its AUTH_APP_KEY between two reads`);
     }
@@ -3462,7 +3769,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // rule above), and hashed as the live value so it never reads as a changed
     // env.
     const keepLiveFilesEnv = new Set();
-    for (const key of ['FILES_URL', 'FILES_AUDIENCE']) {
+    // The owner's own files host, once applied, replaces whatever is live.
+    for (const key of ownerFiles ? [] : ['FILES_URL', 'FILES_AUDIENCE']) {
         const live = await currentEnvValue(deps.coolify, appId, key);
         if (live) {
             keepLiveFilesEnv.add(key);
@@ -3520,6 +3828,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
             throw error;
         throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), carried));
     }
+    // The fresh key is in Archon's env now: from here a repeat keeps it. Recorded before the broker write,
+    // so a failure there is repaired by writing the same key, not by minting another.
+    if (freshKey)
+        await record(PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, authOrgId);
     // #436 round 2: `bulkUpsertEnvs` only adds or updates, so the
     // `FILES_MANAGEMENT_KEY` this step used to write before the fix above
     // would otherwise survive on an Archon already deployed with it --
@@ -3543,7 +3855,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         const staleUptime = !platform.uptime.enabled && stale.key === 'UPTIME_TOKEN';
         // People now come from the owner company's store, so a first operator set by an older apply goes.
         const staleOperator = stale.key === 'AUTHZ_BOOTSTRAP_OPERATOR';
-        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime || staleOperator) && stale.uuid) {
+        // The link is written only while both ids are known; one that is no longer wanted goes.
+        const staleLink = !firstOwnerLink && stale.key === 'ARCHON_FIRST_OWNER_LINK';
+        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime || staleOperator || staleLink) &&
+            stale.uuid) {
             await deps.coolify.deleteEnv(appId, stale.uuid);
             staleKeyDeleted = true;
         }
@@ -3556,10 +3871,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // returns), and this step is unreachable until that resourceId is recorded
     // (the guard at the top of this function) -- so a missing id here means a
     // caller reached this step some other way.
-    const brokerAppId = recorded[PLATFORM_AUTH_BROKER_SCOPE_KEY];
-    if (!brokerAppId) {
-        throw new Error('platform:archon: platform:auth has not recorded its broker app id yet; apply platform:auth again');
-    }
+    const brokerAppId = ownerSignIn.brokerAppId;
     const brokerApps = await readBrokerApps(deps.coolify, brokerAppId);
     // #211 round 2: merged into the matching entry, not replacing it -- the
     // broker's own `App` (`broker/src/apps.ts`) carries fields this step never
@@ -3573,14 +3885,22 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // first -- a previous bug, or a hand-edited AUTH_APPS, can leave more than
     // one. The first is kept (and updated below); the rest are dropped, so no
     // duplicate carries a stale key a broker client could still present.
+    // No other entry may sign in Archon's organisation: its key would reach Archon's people.
+    const conflicts = archonOrgConflicts(brokerApps, authOrgId);
+    if (conflicts.length > 0) {
+        throw new Error(`platform:archon: broker entry ${conflicts.map((n) => `'${n}'`).join(', ')} signs in Archon's own organisation; no other entry may`);
+    }
     const archonMatchIndices = brokerApps
-        .map((a, i) => (a.organizationId === authOrgId || a.organizationId === org.id) &&
-        a.name === PLATFORM_ARCHON_ZITADEL_APP
-        ? i
-        : -1)
+        .map((a, i) => a.organizationId === authOrgId && a.name === PLATFORM_ARCHON_ZITADEL_APP ? i : -1)
         .filter((i) => i >= 0);
     const archonEntryIndex = archonMatchIndices[0] ?? -1;
-    const duplicateIndices = new Set(archonMatchIndices.slice(1));
+    // Archon's entry in an organisation it used to sign in from (the company's, before Archon had its
+    // own) goes, key and all. An entry of that name in any other organisation is not Archon's to touch.
+    const oldOrgs = archonOldOrgIds(recorded, ciOrgId, authOrgId);
+    const oldEntryIndices = new Set(brokerApps
+        .map((a, i) => a.name === PLATFORM_ARCHON_ZITADEL_APP && oldOrgs.has(a.organizationId) ? i : -1)
+        .filter((i) => i >= 0));
+    const duplicateIndices = new Set([...archonMatchIndices.slice(1), ...oldEntryIndices]);
     const archonEntry = {
         ...(archonEntryIndex >= 0 ? brokerApps[archonEntryIndex] : {}),
         organizationId: authOrgId,
@@ -3595,11 +3915,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         // the wrong platform or not at all.
         from: `Company Included <noreply@${platform.apex}>`,
     };
-    const desiredBrokerApps = archonEntryIndex >= 0
-        ? brokerApps
-            .map((a, i) => (i === archonEntryIndex ? archonEntry : a))
-            .filter((_, i) => !duplicateIndices.has(i))
-        : [...brokerApps, archonEntry];
+    const keptBrokerApps = brokerApps
+        .map((a, i) => (i === archonEntryIndex ? archonEntry : a))
+        .filter((_, i) => !duplicateIndices.has(i));
+    const desiredBrokerApps = archonEntryIndex >= 0 ? keptBrokerApps : [...keptBrokerApps, archonEntry];
     const desiredAuthApps = [{ key: 'AUTH_APPS', value: JSON.stringify(desiredBrokerApps) }];
     // Rebuilt and compared every run (not gated on a freshly minted key), so a
     // clientId or hostname change reaches the broker too, and so a previous
@@ -3634,6 +3953,23 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         await deps.coolify.deploy(brokerAppId);
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, desiredAuthAppsRaw));
     }
+    // ---- the old sign-in client ------------------------------------------------
+    // The broker no longer knows it, and Archon's env names the new one: delete the old client, so
+    // no account of the company's organisation can still sign in to it. A repeat deletes nothing twice.
+    const retiredClient = context.recordedIds()[PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY];
+    if (retiredClient) {
+        const [oldOrgId, oldProjectId, oldAppId] = retiredClient.split('|');
+        if (oldOrgId && oldProjectId && oldAppId) {
+            try {
+                await zitadel.deleteApp(oldOrgId, oldProjectId, oldAppId);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        await record(PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, '');
+    }
     // ---- Cloudflare Access, before the hostname resolves ----------------------
     const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:archon');
     const access = await platformAccess(deps, context.recordedIds(), 'platform:archon');
@@ -3641,7 +3977,7 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const uptimeAccessTokenId = platform.uptime.enabled
         ? recorded[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
         : undefined;
-    const accessAppId = await ensureArchonAccess(access, hostname, deps.accessEmails, uptimeAccessTokenId, async () => {
+    const { id: accessAppId, pinId } = await ensureArchonAccess(access, hostname, accessEmails, uptimeAccessTokenId, async () => {
         // The Access app is about to be rebuilt: answer 404 for every hostname
         // meanwhile, so it is never served without the gate. The marker is
         // persisted first: a failure before the real ingress is written back
@@ -3657,6 +3993,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (recorded[PLATFORM_ARCHON_ACCESS_SCOPE_KEY] !== accessAppId) {
         await record(PLATFORM_ARCHON_ACCESS_SCOPE_KEY, accessAppId);
     }
+    if (recorded[PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY] !== pinId) {
+        await record(PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, pinId);
+    }
+    await ensureArchonPublicAccess(access, hostname, context.recordedIds(), record);
     // ---- deploy ---------------------------------------------------------------
     // #252: phase 1 of the shared deploy-health helper only -- Coolify's own
     // deployment record reaching `'finished'`, which is enough on its own to
@@ -3709,7 +4049,8 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
         // retry intends is identical to what a successful one intends, so
         // leaving the old confirmation in place would read as still correct.
         await record(PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, '');
-        await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
+        const built = await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
+        await recordBuiltCommit(deps.coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: 'archon' }, record);
     }
     // ---- tunnel and DNS ---------------------------------------------------------
     const existingTunnel = await tunnels.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
@@ -3815,6 +4156,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // it.
     await record(PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, brokerAppId);
     await record(PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, authOrgId);
+    await record(PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, ciOrgId);
+    await record(PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, firstOwnerLink);
+    await record(PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, ownerSignIn.hostname);
+    await record(PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, archonFilesMarker(ownerFiles));
     // The host runs inside this app: every marker is recorded above, so the
     // deploy goes last and is not waited for -- the old container stops during
     // it, and the response, the lease and the audit row must be done first.
@@ -4126,6 +4471,9 @@ const PLATFORM_ARCHON_UPTIME_POLICY_NAME = 'foundry: uptime service token';
  * is added in place, one for another token rebuilds the app.
  */
 async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate) {
+    // The app accepts the one-time PIN and nothing else, so a person is mailed a code
+    // instead of being offered the company's own sign-in provider.
+    const { id: pinId } = await cf.ensureOneTimePinProvider();
     const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
     const foreign = onDomain.find((a) => a.name !== PLATFORM_ARCHON_ACCESS_APP_NAME);
     if (foreign) {
@@ -4136,6 +4484,8 @@ async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate)
             name: PLATFORM_ARCHON_ACCESS_APP_NAME,
             domain,
             type: 'self_hosted',
+            allowedIdps: [pinId],
+            autoRedirectToIdentity: true,
         });
         await cf.createAccessPolicy(created.id, archonAccessPolicy(emails));
         if (uptimeTokenId) {
@@ -4145,7 +4495,7 @@ async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate)
     };
     const existing = onDomain[0];
     if (!existing)
-        return (await create()).id;
+        return { id: (await create()).id, pinId };
     const policies = await cf.listAccessPolicies(existing.id);
     const other = policies.find((p) => p.name !== ACCESS_POLICY_NAME && p.name !== PLATFORM_ARCHON_UPTIME_POLICY_NAME);
     if (other) {
@@ -4154,19 +4504,52 @@ async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate)
     const emailPolicies = policies.filter((p) => p.name === ACCESS_POLICY_NAME);
     const tokenPolicies = policies.filter((p) => p.name === PLATFORM_ARCHON_UPTIME_POLICY_NAME);
     const staleToken = tokenPolicies.some((p) => !uptimePolicyIntact(p, uptimeTokenId));
-    if (emailPolicies.every((p) => sameEmails(p.include, emails)) && !staleToken) {
+    if (emailPolicies.every((p) => sameEmails(p.include, emails)) &&
+        !staleToken &&
+        accessAppPinned(existing, pinId)) {
         if (emailPolicies.length === 0) {
             await cf.createAccessPolicy(existing.id, archonAccessPolicy(emails));
         }
         if (uptimeTokenId && tokenPolicies.length === 0) {
             await cf.createAccessPolicy(existing.id, archonUptimePolicy(uptimeTokenId));
         }
-        return existing.id;
+        return { id: existing.id, pinId };
     }
-    // No call updates an app's policy: rebuild the app, hostname closed meanwhile.
+    // No call updates an app's policy or its providers (edge keeps an existing app's
+    // `allowedIdps`): rebuild the app, hostname closed meanwhile.
     await closeGate();
     await cf.deleteAccessApp(existing.id);
-    return (await create()).id;
+    return { id: (await create()).id, pinId };
+}
+/** Whether the Access app accepts the one-time PIN provider alone and sends a visitor straight to it. */
+function accessAppPinned(app, pinId) {
+    return (Array.isArray(app.allowedIdps) &&
+        app.allowedIdps.length === 1 &&
+        app.allowedIdps[0] === pinId &&
+        app.autoRedirectToIdentity === true);
+}
+/**
+ * Who Archon's Access app lets through. Each person is let in on the personal
+ * address their invite was mailed to, never on a work address: the work
+ * mailbox is on the platform's own mail, which the platform's own sign-in
+ * reaches. So the owner company's first owner's work addresses leave the host's
+ * list and their personal address joins it; every other address stays as the
+ * host gave it. Case-insensitive, de-duplicated, order kept.
+ */
+export function archonAccessEmails(hostEmails, ownerCompany) {
+    const first = ownerCompany?.owners[0];
+    // The first owner's work address: the one their Archon invite is made for.
+    const firstWork = ownerCompany && first ? ownerMailboxes(ownerCompany)[0]?.address : null;
+    const work = new Set(firstWork ? [firstWork.toLowerCase()] : []);
+    const out = [];
+    const seen = new Set();
+    for (const email of [...hostEmails.filter((e) => !work.has(e.toLowerCase())), first?.email]) {
+        if (!email || seen.has(email.toLowerCase()))
+            continue;
+        seen.add(email.toLowerCase());
+        out.push(email);
+    }
+    return out;
 }
 function archonAccessPolicy(emails) {
     return {
@@ -4224,6 +4607,10 @@ async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId
         const app = (await cf.listAccessApps()).find((a) => a.domain === domain && a.name === PLATFORM_ARCHON_ACCESS_APP_NAME);
         if (!app)
             return true;
+        // Read against the provider id the app was last made with: a plan asks edge to make nothing.
+        const pinId = recorded[PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY];
+        if (!pinId || !accessAppPinned(app, pinId))
+            return true;
         const policies = await cf.listAccessPolicies(app.id);
         const emailPolicies = policies.filter((p) => p.name === ACCESS_POLICY_NAME);
         const tokenPolicies = policies.filter((p) => p.name === PLATFORM_ARCHON_UPTIME_POLICY_NAME);
@@ -4234,7 +4621,15 @@ async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId
         }
         if (!tokenPolicies.every((p) => uptimePolicyIntact(p, uptimeTokenId)))
             return true;
-        return uptimeTokenId !== undefined && tokenPolicies.length === 0;
+        if (uptimeTokenId !== undefined && tokenPolicies.length === 0)
+            return true;
+        const apps = await cf.listAccessApps();
+        for (const { name, path } of PLATFORM_ARCHON_PUBLIC_PATHS) {
+            const bypass = apps.find((a) => a.domain === `${domain}${path}` && a.name === archonPublicAppName(name));
+            if (!bypass || !onlyBypassEveryone(await cf.listAccessPolicies(bypass.id)))
+                return true;
+        }
+        return false;
     }
     catch {
         return false;
@@ -4254,19 +4649,43 @@ async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId
  * recorded) is not drift either -- `planArchon`'s other checks already cover
  * a step that has never applied.
  */
-async function archonBrokerRegistrationDrifted(coolify, recordedIds) {
-    const brokerAppId = recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY];
-    const orgId = archonAuthOrganizationId(recordedIds);
-    if (!brokerAppId || !orgId)
+async function archonBrokerRegistrationDrifted(coolify, signIn, archonOrgId, recorded = {}) {
+    if (!signIn || !archonOrgId)
         return false;
     try {
-        const apps = await readBrokerApps(coolify, brokerAppId);
-        return !apps.some((a) => a.organizationId === orgId && a.name === PLATFORM_ARCHON_ZITADEL_APP);
+        const apps = await readBrokerApps(coolify, signIn.brokerAppId);
+        const own = apps.some((a) => a.organizationId === archonOrgId && a.name === PLATFORM_ARCHON_ZITADEL_APP);
+        // The company's old entry for Archon must be gone, and no other entry may sign in Archon's org.
+        const oldOrgs = archonOldOrgIds(recorded, signIn.organisationId, archonOrgId);
+        const stale = apps.some((a) => a.name === PLATFORM_ARCHON_ZITADEL_APP && oldOrgs.has(a.organizationId));
+        return !own || stale || archonOrgConflicts(apps, archonOrgId).length > 0;
     }
     catch {
         return false;
     }
 }
+/** The organisations Archon signed in from before its own: the company's, and the one its last apply recorded. */
+function archonOldOrgIds(recorded, ciOrgId, archonOrgId) {
+    const old = new Set([ciOrgId]);
+    const applied = recorded[PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY];
+    if (applied)
+        old.add(applied);
+    if (archonOrgId)
+        old.delete(archonOrgId);
+    return old;
+}
+/**
+ * The names of the broker entries that sign in Archon's organisation without
+ * being Archon's own. There must be none: a key of another app would then
+ * reach Archon's people (passkeys, password reset, deactivation).
+ */
+export function archonOrgConflicts(entries, archonOrgId) {
+    if (!archonOrgId)
+        return [];
+    return entries
+        .filter((e) => e.organizationId === archonOrgId && e.name !== PLATFORM_ARCHON_ZITADEL_APP)
+        .map((e) => e.name.slice(0, 100));
+}
 /** The decoded password of a connection URL, or `undefined` when it has none or cannot be parsed. */
 function passwordOf(url) {
     try {
@@ -4399,17 +4818,31 @@ async function archonAuthzDatabaseDrifted(coolify, appId, owner) {
     }
 }
 /**
- * Whether Archon's live `AUTH_ORGANIZATION_ID` is not the sign-in org it
- * should accept ({@link archonAuthOrganizationId}). Without this nothing
- * replans Archon when the owner company's org changes, since the step plans
- * only on hostname, `gitRef` and the Access list. A failed read is not drift.
+ * Whether one of Archon's live sign-in envs is not what it should be:
+ * `AUTH_ORGANIZATION_ID` (Archon's own organisation), `CI_ORGANIZATION_ID` (the
+ * company's) and `ARCHON_FIRST_OWNER_LINK` (absent when no link is wanted).
+ * A name with no expected value is not checked, except the link. Without this
+ * nothing replans Archon when an org changes behind its back. A failed read is
+ * not drift.
  */
-async function archonAuthOrgDrifted(coolify, appId, recordedIds) {
-    const expected = archonAuthOrganizationId(recordedIds);
-    if (!appId || !expected)
+async function archonAuthOrgDrifted(coolify, appId, expected) {
+    if (!appId)
         return false;
     try {
-        return (await currentEnvValue(coolify, appId, 'AUTH_ORGANIZATION_ID')) !== expected;
+        for (const [key, want] of Object.entries(expected)) {
+            // A value expected as absent (an empty link) must be absent too; the key itself is never named in a value.
+            if (key === 'ARCHON_FIRST_OWNER_LINK') {
+                if (((await currentEnvValue(coolify, appId, key)) || undefined) !== (want || undefined)) {
+                    return true;
+                }
+                continue;
+            }
+            if (!want)
+                continue;
+            if ((await currentEnvValue(coolify, appId, key)) !== want)
+                return true;
+        }
+        return false;
     }
     catch {
         return false;
@@ -4492,13 +4925,15 @@ async function archonRollingUpdateDrifted(coolify, appId) {
  * held-key ref, never a value. Also read at plan time, so the text must not
  * vary between calls.
  */
-async function collectArchonServiceInputs(platform, deps, recorded) {
+async function collectArchonServiceInputs(platform, deps, recorded, ownerFiles = null) {
     const block = (why) => ({
         blocked: `Archon is blocked, not planned: ${why}`,
     });
     const envs = [];
     const heldByRef = new Map();
-    const services = ['files', 'ai', 'integrations', 'jobs'].filter((s) => platform[s].enabled);
+    // Files is the owner company's own host, not a platform service: its env is
+    // added once that step has applied, and Archon starts without it until then.
+    const services = ['ai', 'integrations', 'jobs'].filter((s) => platform[s].enabled);
     if (services.length > 0 && !deps.heldKeys) {
         return block(`the host built the platform executor without a held-key reader, and ${services.join(', ')} ${services.length === 1 ? 'is' : 'are'} enabled`);
     }
@@ -4551,31 +4986,7 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
     }
     const held = (ref) => heldByRef.get(ref);
     for (const service of services) {
-        if (service === 'files') {
-            envs.push(
-            // #501: Files is private and has no DNS, so FILES_URL is the recorded
-            // internal address; FILES_AUDIENCE is the exact HTTPS origin the
-            // signature is made for, equal to Files' own `APP_URL`.
-            { key: 'FILES_URL', value: recorded[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY] }, { key: 'FILES_AUDIENCE', value: `https://${platform.files.hostname}` }, 
-            // #436: Company Included's own Files organisation, provisioned by
-            // the ordinary per-org `planFilesOrganisation` step under its own
-            // org id -- `executor.ts`'s `filesOrganisation` calls
-            // `provisionOrganisation({ organisationId: org.id, ... })`, so
-            // `platform.ownerOrgId` is already that organisation's id, with no
-            // separate platform-level mint needed.
-            { key: 'FILES_ORGANISATION_ID', value: platform.ownerOrgId }, 
-            // #436: the signed-assertion identity `filesSigner()` reads
-            // (`archon`'s `src/lib/authz/files-management.ts`), not the bearer
-            // token `FILES_MANAGEMENT_KEY` used to name here -- that name made
-            // Archon take the issued-key branch of `filesManagementFetch`,
-            // which then failed on the `FILES_MANAGEMENT_SCOPE` this step never
-            // set, surfacing as "Files is not configured" (foundry#436).
-            { key: 'FILES_MANAGEMENT_ISSUER', value: FILES_MANAGEMENT_ISSUER }, { key: 'FILES_MANAGEMENT_KEY_ID', value: FILES_MANAGEMENT_KEY_ID }, {
-                key: 'FILES_MANAGEMENT_PRIVATE_KEY',
-                value: held(ARCHON_SERVICE_INPUTS.files.refs[0]),
-            });
-        }
-        else if (service === 'ai') {
+        if (service === 'ai') {
             envs.push({
                 key: 'AI_URL',
                 value: recorded[PLATFORM_AI_INTERNAL_URL_SCOPE_KEY],
@@ -4611,6 +5022,22 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
             { key: 'JOBS_URL', value: recorded[JOBS_INTERNAL_URL_SCOPE_KEY] }, { key: 'JOBS_ADMIN_TOKEN', value: held(JOBS_ADMIN_TOKEN_REF) });
         }
     }
+    if (ownerFiles) {
+        let key = null;
+        try {
+            key = (await deps.heldKeys?.resolve(ownerFiles.managementKeyRef)) ?? null;
+        }
+        catch {
+            // The cause is dropped in case it echoes a secret.
+            return block(`the held key ${ownerFiles.managementKeyRef} could not be read`);
+        }
+        if (!key)
+            return block(`the held key ${ownerFiles.managementKeyRef} is not held yet`);
+        envs.push(
+        // Files is private and has no DNS, so FILES_URL is the recorded internal
+        // address; FILES_AUDIENCE is the exact HTTPS origin the signature is for.
+        { key: 'FILES_URL', value: ownerFiles.internalUrl }, { key: 'FILES_AUDIENCE', value: ownerFiles.audience }, { key: 'FILES_ORGANISATION_ID', value: ownerFiles.organisationId }, { key: 'FILES_MANAGEMENT_ISSUER', value: FILES_MANAGEMENT_ISSUER }, { key: 'FILES_MANAGEMENT_KEY_ID', value: FILES_MANAGEMENT_KEY_ID }, { key: 'FILES_MANAGEMENT_PRIVATE_KEY', value: key });
+    }
     return { envs };
 }
 /**
@@ -5209,7 +5636,8 @@ async function provisionPlatformAi(context, deps) {
     // nothing public is wired to either app.
     const internalUrl = `http://${PLATFORM_AI_RUNNER.internalName}:${PLATFORM_AI_PORT}`;
     if (deployRunner) {
-        await waitForNewDeployment(coolify, runner.appId, { kind: 'ready', url: `${internalUrl}/api/health` }, runtime, sleep, 'platform:ai', `the runner stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        const built = await waitForNewDeployment(coolify, runner.appId, { kind: 'ready', url: `${internalUrl}/api/health` }, runtime, sleep, 'platform:ai', `the runner stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        await recordBuiltCommit(coolify, { appId: runner.appId, deploymentUuid: built.deploymentUuid, name: 'ai' }, record);
     }
     if (deployWorker) {
         await waitForNewDeployment(coolify, worker.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:ai', `the worker stays at ${recorded[PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
@@ -5295,6 +5723,54 @@ async function provisionPlatformAi(context, deps) {
         }
         await record(PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, credentialId);
     }
+    // ---- the public route ------------------------------------------------------
+    // A company's entries run on their own network and cannot dial `platform-ai`, so they call
+    // `https://<hostname>`. The route is the heartbeat server's (`platform:hc`): a tunnel that dials the
+    // runner by its internal name, a connector app, and a proxied CNAME. No Coolify `domains`, no Access
+    // app: ai authenticates every caller by its bearer key, and a gate in front would stop that.
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:ai');
+    const tunnel = (await tunnels.findTunnelByName(AI_TUNNEL_NAME)) ??
+        (await tunnels.createTunnel(AI_TUNNEL_NAME));
+    // Recorded last, once the DNS record is written: planAi and aiUrl read it as "the route is complete",
+    // so a failure below is planned again and no entry is given a dead AI_URL. The tunnel is found by name on the rerun.
+    await tunnels.putTunnelConfig(tunnel.id, {
+        ingress: [
+            { hostname, path: AI_ENTRY_PATH_PATTERN, service: internalUrl },
+            { service: 'http_status:404' },
+        ],
+    });
+    const server = await resolvePlatformServer(coolify);
+    await ensureCloudflaredConnector({
+        coolify,
+        tunnels,
+        tunnelId: tunnel.id,
+        appName: AI_CLOUDFLARED_APP_NAME,
+        projectUuid,
+        environment,
+        resolveServer: async () => server,
+        recordedConnectorAppId: context.recordedIds()[PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (connectorAppId) => record(PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, connectorAppId),
+    });
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:ai');
+    const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
+    if (!dnsRecord) {
+        await dns.createDnsRecord(platform.apex, {
+            type: 'CNAME',
+            name: hostname,
+            content: dnsTarget,
+            proxied: true,
+        });
+    }
+    else if (dnsRecord.content !== dnsTarget) {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
+            type: 'CNAME',
+            name: hostname,
+            content: dnsTarget,
+            proxied: true,
+        });
+    }
+    await record(PLATFORM_AI_TUNNEL_SCOPE_KEY, tunnel.id);
     return { resourceId: runner.appId };
 }
 /**
@@ -6252,7 +6728,8 @@ export async function provisionFilesHost(scope, deps, target, input) {
     // record first is still what rules out the old container staying healthy
     // through a failed deploy.
     const internalUrl = `http://${target.internal.files}:${FILES_PORT}`;
-    await waitForNewDeployment(deps.coolify, runnerApp.appId, { kind: 'ready', url: `${internalUrl}${FILES_HEALTH_CHECK_PATH}` }, runtime, sleep, label, `the runner stays at ${recorded[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    const built = await waitForNewDeployment(deps.coolify, runnerApp.appId, { kind: 'ready', url: `${internalUrl}${FILES_HEALTH_CHECK_PATH}` }, runtime, sleep, label, `the runner stays at ${recorded[PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    await recordBuiltCommit(deps.coolify, { appId: runnerApp.appId, deploymentUuid: built.deploymentUuid, name: 'files' }, record);
     await record(PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, internalUrl);
     // Last: a run that failed anywhere above is planned again.
     scope.recordScopeId(PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, input.hostname);
@@ -6578,7 +7055,6 @@ const PLATFORM_ACCESS_PROVIDER_NAME = 'foundry';
  * again.
  */
 async function provisionPlatformAccessProvider(context, deps) {
-    const { platform } = context;
     const recorded = context.recordedIds();
     const sleep = deps.runtime?.sleep ?? defaultSleep;
     const attempts = deps.runtime?.deliverAttempts ?? 3;
@@ -6597,10 +7073,19 @@ async function provisionPlatformAccessProvider(context, deps) {
     catch {
         throw new Error(`${label}: edge could not confirm that Cloudflare Access is ready`);
     }
-    const issuer = `https://${platform.auth.hostname}`;
-    const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
-    const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
+    // The client lives in the owner company's own ZITADEL, never a platform one.
+    const ownerSignIn = context.owner?.signIn ?? null;
+    if (!ownerSignIn) {
+        throw new Error(`${label}: the owner company's sign-in has not been applied yet`);
+    }
+    if (!deps.zitadelForInstance) {
+        throw new Error(`${label}: the host built the Access provider dependencies without zitadelForInstance, so it cannot reach the owner company's ZITADEL`);
+    }
+    const issuer = ownerSignIn.issuerUrl;
+    const zitadel = deps.zitadelForInstance(issuer, ownerSignIn.bearerRef);
+    const org = { id: ownerSignIn.organisationId };
     const { project } = await zitadel.findOrCreateProject(org.id, PLATFORM_ACCESS_ZITADEL_PROJECT);
+    context.recordScopeId(PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, project.id);
     const orphan = (await zitadel.listApps(org.id, project.id)).apps.find((a) => a.name === PLATFORM_ACCESS_ZITADEL_APP && a.state !== 'APP_STATE_REMOVED');
     if (orphan) {
         try {
@@ -6617,6 +7102,7 @@ async function provisionPlatformAccessProvider(context, deps) {
         postLogoutRedirectUris: [`https://${authDomain}/`],
     });
     context.recordScopeId(PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, client.appId);
+    context.recordScopeId(PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, client.appId);
     await context.persist?.();
     let providerId = '';
     await deliverWithRetry(async (_ref, secret) => {
@@ -6632,7 +7118,7 @@ async function provisionPlatformAccessProvider(context, deps) {
         })).id;
     }, ACCESS_PROVIDER_RECORD_KEY, client.clientSecret, attempts, sleep, `the ZITADEL client ${client.appId}'s secret`, label);
     // Last: the guard says the secret reached edge.
-    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, platform.auth.hostname);
+    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, ownerSignIn.hostname);
     context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, authDomain);
     context.recordScopeId(ACCESS_PROVIDER_RECORD_KEY, providerId);
     await context.persist?.();
@@ -6656,6 +7142,17 @@ const HC_PORT = '8000';
 const HC_HEALTH_CHECK_PATH = '/';
 const PLATFORM_HC_DB = 'hc';
 const PLATFORM_HC_DB_USER = 'hc';
+/** The tunnel that carries the AI host's public hostname, and the app that runs its connector. */
+const AI_TUNNEL_NAME = 'platform-ai-tunnel';
+/**
+ * The only paths the AI host's public route serves; everything else answers 404 at the tunnel. A company entry's key
+ * holds `ai.runs:create` and `ai.offerings:invoke` (`AI_ENTRY_PERMISSIONS`), and `@wtfalch/ai`'s client reaches them
+ * through `POST /v1/runs` (also `?wait=`), `POST /v1/runs/batch`, `GET /v1/runs`, `GET /v1/runs/:id` and
+ * `GET /v1/offerings`. The management routes (`/v1/organisations`, `/v1/keys`, `/v1/budgets`, `/v1/webhooks`,
+ * `/v1/connections`, `/v1/platform/keys`, ...) and `/api/health` are not on the internet.
+ */
+export const AI_ENTRY_PATH_PATTERN = '^/v1/(runs(/|$)|offerings$)';
+const AI_CLOUDFLARED_APP_NAME = 'platform-ai-cloudflared';
 const HC_TUNNEL_NAME = 'platform-hc-tunnel';
 /** #197: the one Coolify app that runs `cloudflared` for {@link HC_TUNNEL_NAME}. */
 const HC_CLOUDFLARED_APP_NAME = 'platform-hc-cloudflared';
@@ -6749,7 +7246,7 @@ async function provisionPlatformHc(context, deps) {
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             docker_registry_image_name: HC_IMAGE,
-            docker_registry_image_tag: gitRef,
+            docker_registry_image_tag: pinnedTagFor('hc', gitRef),
             ports_exposes: HC_PORT,
             name: PLATFORM_HC_APP_NAME,
             description: `Healthchecks for the platform's own heartbeats (#540, ${HC_IMAGE}:${gitRef})`,
@@ -6762,7 +7259,7 @@ async function provisionPlatformHc(context, deps) {
     // own rule. The image tag too, so a declared release change reaches the app.
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: HC_INTERNAL_NAME,
-        docker_registry_image_tag: gitRef,
+        docker_registry_image_tag: pinnedTagFor('hc', gitRef),
         ...healthCheckSettings(HC_HEALTH_CHECK_PATH, Number(HC_PORT)),
     });
     // ---- env, parsed off the database's own owner credentials -----------------
@@ -7471,7 +7968,8 @@ async function provisionPlatformIntegrations(action, context, deps) {
         keyJustSet ||
         runnerKeyStale ||
         configChanged) {
-        await waitForNewDeployment(coolify, runnerApp.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:integrations', `the runner stays at ${recorded[PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        const built = await waitForNewDeployment(coolify, runnerApp.appId, { kind: 'deployment-only' }, runtime, sleep, 'platform:integrations', `the runner stays at ${recorded[PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY] ?? 'no recorded ref'}`);
+        await recordBuiltCommit(coolify, { appId: runnerApp.appId, deploymentUuid: built.deploymentUuid, name: 'integrations' }, record);
     }
     // #398: the runner is up with the keyring that holds the active id; only
     // now may Archon move to it.
@@ -7602,7 +8100,7 @@ async function waitForIntegrationsMigration(coolify, appId, runtime, sleep) {
 /** The name every platform database's backup is registered against -- one shared R2 bucket, one storage entry. */
 const PLATFORM_BACKUP_S3_STORAGE_NAME = 'platform-backups';
 /** The uuid `provisionPlatformBackup` records once {@link PLATFORM_BACKUP_S3_STORAGE_NAME} is registered on Coolify, so a later apply never re-registers it. */
-const PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY = 'coolify_platform_backup_s3_storage';
+export const PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY = 'coolify_platform_backup_s3_storage';
 /**
  * #257 fix round: a sha256 of the exact `endpoint|bucket|key|secret` the
  * storage was last pushed with -- never the values themselves, the same
@@ -7650,8 +8148,11 @@ const PLATFORM_BACKUP_DATABASE_NAMES = {
  * {@link repointPlatformBackupSchedules} uses for `s3_storage_uuid`.
  */
 async function findPlatformBackupSchedule(coolify, service, databaseId) {
+    return findDatabaseBackupSchedule(coolify, PLATFORM_BACKUP_DATABASE_NAMES[service], databaseId);
+}
+/** {@link findPlatformBackupSchedule} for any database; `database` undefined means the resource's first database. */
+async function findDatabaseBackupSchedule(coolify, database, databaseId) {
     const schedules = (await coolify.listDatabaseBackups(databaseId)).filter((backup) => backup.enabled && backup.save_s3);
-    const database = PLATFORM_BACKUP_DATABASE_NAMES[service];
     if (!database)
         return { schedule: schedules[0], named: true };
     for (const schedule of schedules) {
@@ -8027,23 +8528,58 @@ async function provisionPlatformBackup(action, context, deps) {
     const recorded = context.recordedIds();
     const storageUuid = await ensurePlatformBackupStorage(coolify, r2, recorded, context);
     const service = action.key;
-    const { schedule, named } = await findPlatformBackupSchedule(coolify, service, databaseId);
-    const scheduleUuid = schedule?.uuid ??
-        (await coolify.createDatabaseBackup(databaseId, {
-            frequency: deps.frequency ?? PLATFORM_BACKUP_DEFAULT_FREQUENCY,
+    await provisionDatabaseBackup(coolify, {
+        databaseUuid: databaseId,
+        label: `platform ${service}`,
+        storageUuid,
+        frequency: deps.frequency,
+        databaseName: PLATFORM_BACKUP_DATABASE_NAMES[service],
+    });
+    return undefined;
+}
+/**
+ * F6: one nightly schedule of one database to a registered S3 storage, the
+ * body `provisionPlatformBackup` had and every company database now shares.
+ * An existing enabled, `save_s3` schedule is reused, never doubled: the lookup
+ * runs before the create, so a run that created a schedule and died before
+ * the caller recorded its uuid finds it again on the next apply. The
+ * `PATCH` names the database to dump, because `createDatabaseBackup` takes no
+ * database name; it also repairs an existing schedule that dumps the wrong
+ * one. Returns the schedule's uuid.
+ */
+export async function provisionDatabaseBackup(coolify, input) {
+    const { databaseUuid, label } = input;
+    const { schedule, named } = await backupCall(label, () => findDatabaseBackupSchedule(coolify, input.databaseName, databaseUuid));
+    const uuid = schedule?.uuid ??
+        (await backupCall(label, () => coolify.createDatabaseBackup(databaseUuid, {
+            frequency: input.frequency ?? PLATFORM_BACKUP_DEFAULT_FREQUENCY,
             enabled: true,
             save_s3: true,
-            s3_storage_uuid: storageUuid,
-        })).uuid;
-    // `CoolifyPort.createDatabaseBackup` takes no database name, so a new
-    // schedule is named here too, by the same PATCH that repairs an existing
-    // one dumping the wrong database.
+            s3_storage_uuid: input.storageUuid,
+        }))).uuid;
     if (!named) {
-        await coolify.raw('PATCH', `/databases/${databaseId}/backups/${scheduleUuid}`, {
-            databases_to_backup: PLATFORM_BACKUP_DATABASE_NAMES[service],
-        });
+        await backupCall(label, () => coolify.raw('PATCH', `/databases/${databaseUuid}/backups/${uuid}`, {
+            databases_to_backup: input.databaseName,
+        }));
+    }
+    return { uuid };
+}
+/** How long one Coolify call of a database backup may take. */
+const BACKUP_CALL_TIMEOUT_MS = 30_000;
+/** Runs one Coolify call with a timeout; a timeout names the database, not the call's arguments. */
+async function backupCall(label, call) {
+    let timer;
+    try {
+        return await Promise.race([
+            call(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`backup of ${label}: Coolify did not answer within ${BACKUP_CALL_TIMEOUT_MS / 1000} seconds`)), BACKUP_CALL_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
     }
-    return undefined;
 }
 /**
  * #540: reconciles the live Healthchecks checks against the ones foundry
@@ -8126,7 +8662,10 @@ async function provisionPlatformHeartbeats(context, deps) {
     // Last: so a run that failed anywhere above (an unreconciled create or
     // delete) leaves this unset and `planHeartbeats` plans the step again --
     // the same "record markers last" rule `provisionPlatformHc` follows.
-    context.recordScopeId(PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, [...desiredNames].sort().join(','));
+    // foundry#544: the provider is folded in, matching `planHeartbeats`'s own
+    // `desired` -- a provider switch with the same check names otherwise
+    // desired is still a change from this marker.
+    context.recordScopeId(PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, `${context.platform.heartbeatsProvider}:${[...desiredNames].sort().join(',')}`);
     return undefined;
 }
 /**