@wtfalch/foundry 0.34.0 → 0.35.2

package/dist/plan/executor.js

@@ -1,16 +1,22 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
+import { pinnedTagFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
+import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
+import { recordBuiltCommit } from './build-record.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
+import { BACKUP_SCOPE_PREFIX, backupScopeKey } from './company-backups.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
+import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
 import { createEdgeAccess, isNotFound as isEdgeNotFound, } from './edge-access.js';
 import { EDGE_DNS_WRITE_CONCURRENCY, createEdgeDns, limiter, } from './edge-dns.js';
@@ -22,18 +28,21 @@ import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate } from './gates.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, wgetProbe, } from './health-check-settings.js';
-import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
+import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
+import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY } from './mail-relay.js';
+import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
+import { NETWORK_APPLIED_SCOPE_KEY } from './network-move.js';
 import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
-import { limited } from './own-limits.js';
+import { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
+import { LIMITS, limited } from './own-limits.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, scopeFromOrg, } from './own-services.js';
 import { ownSfuUrls, provisionSfuApp } from './own-sfu.js';
 import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
-import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
-import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
+import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
+import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { ZITADEL_ORG_DOMAIN_SCOPE_KEY, ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY, closeSignInOrgRegistration, ensureSignInOrg, inviteOwnerWithLink, registerSignInDomainOrBlock, signInOrgDomain, } from './sign-in-org.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
@@ -119,14 +128,13 @@ function normalizedLoginBaseUri(uri) {
  * `cms.<domain>` -- the cms studio's own hostname (`cmsSite` below), apart
  * from the public site itself at `org.domain` (used directly there). Called
  * from `cmsSite` and from `zitadelApp` for the fixed `cms` client (#139),
- * both of which only run once `org.site.enabled` is true, so `org.domain`
- * is non-null by the same `validateSite` guarantee
- * {@link tunnelIngressHostnames}'s own doc comment cites.
+ * both of which only run once `org.site.enabled` is true. A company without
+ * a domain has its studio at `<slug>-cms.oikos.host` (`cmsStudioHostnameFor`).
  */
 // #541: exported so `health-targets.ts` reuses this hostname rule rather
 // than restating it; nothing else about this function changes.
 export function cmsHostnameFor(org) {
-    return `cms.${org.domain}`;
+    return cmsStudioHostnameFor(org);
 }
 /**
  * #145's "Decided" (2026-09-27): the calls service's own public hostname.
@@ -164,8 +172,11 @@ export function healthUrls(org) {
             ];
         });
     }
-    if (org.site.enabled && org.domain) {
-        return [`https://${org.domain}/api/health`, `https://${cmsHostnameFor(org)}/api/health`];
+    if (org.site.enabled) {
+        return [
+            `https://${siteHostnameFor(org)}/api/health`,
+            `https://${cmsHostnameFor(org)}/api/health`,
+        ];
     }
     return [];
 }
@@ -192,7 +203,7 @@ function mailOrgFor(org, usesDomain, mode) {
  * https://github.com/wtfalch/foundry/issues/71) names this same constant and
  * value.
  */
-const COOLIFY_PROXY_ORIGIN = 'http://coolify-proxy:80';
+export const COOLIFY_PROXY_ORIGIN = 'http://coolify-proxy:80';
 /** The one Access policy foundry puts on a platform Access app (#84). */
 export const ACCESS_POLICY_NAME = 'foundry: allowed emails';
 /**
@@ -306,7 +317,13 @@ const BOULE_PORT = 3000;
  * it from this file, the same way `hostnameFor`'s hostname rule is
  * restated rather than shared across the two files.
  */
-const LOG_DIR = '/app/logs';
+/** Four dotted decimal numbers from 0 to 255, nothing else (the value goes into `ports_mappings`). */
+function isIpv4Address(value) {
+    const parts = value.split('.');
+    return (parts.length === 4 &&
+        parts.every((part) => /^(0|[1-9][0-9]{0,2})$/.test(part) && Number(part) <= 255));
+}
+export const LOG_DIR = '/app/logs';
 /**
  * `cmsSite` provisions two applications from one `cms:site` step, but
  * `execute`'s own return value auto-records only one `resourceId`, under
@@ -324,6 +341,8 @@ const CMS_APP_SCOPE_KEY = 'coolify_cms_app';
 const SITE_APP_SCOPE_KEY = 'coolify_site_app';
 /** #445: the one Coolify server every resource of this org lands on, chosen once and recorded. */
 const COOLIFY_SERVER_SCOPE_KEY = 'coolify_server';
+/** The company's Coolify destination (its Docker network `co-<slug>`), recorded when its first resource is created. */
+export const COOLIFY_DESTINATION_SCOPE_KEY = 'coolify_destination';
 /**
  * #117: the cms app's own Postgres database (`<org.slug>-cms-db`), found or
  * created inside `cmsSite` the same way `coolifyDatabase` does for the org's
@@ -606,8 +625,8 @@ const CHAT_SERVICE_DB_SCOPE_KEY = 'coolify_chat_service_database';
  */
 const CHAT_REKEY_SYNAPSE_SCOPE_KEY = 'coolify_chat_rekey_synapse';
 const CHAT_REKEY_MAS_SCOPE_KEY = 'coolify_chat_rekey_mas';
-const CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY = 'coolify_chat_rekey_synapse_database';
-const CHAT_REKEY_MAS_DB_SCOPE_KEY = 'coolify_chat_rekey_mas_database';
+export const CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY = 'coolify_chat_rekey_synapse_database';
+export const CHAT_REKEY_MAS_DB_SCOPE_KEY = 'coolify_chat_rekey_mas_database';
 /**
  * Set once {@link ChatRekeyPort.copyHomeserver} returns, so a retried or
  * repeated apply never copies the same history twice -- the copy itself is
@@ -800,8 +819,47 @@ function blockedPort(service, ref) {
         },
     });
 }
+/** The network a company's resources are made on: the platform's for its owner, `co-<slug>` for the rest. */
+function appliedNetworkOf(org, context) {
+    return onPlatformNetwork(context.ownerCompany) ? PLATFORM_NETWORK : companyNetworkName(org.slug);
+}
+/** The limit profile of the step now running; `limited` reads it on every Coolify call. */
+const limitScope = new AsyncLocalStorage();
+/** The company and run of the step now running; `placedByScope` reads it on every create. */
+const companyScope = new AsyncLocalStorage();
+/**
+ * The limit profile of a step on `this.ports.coolify`. Own-services steps
+ * (`coolify:own-*`) wrap their own ports with their own row of `LIMITS`.
+ */
+function limitProfileOf(action) {
+    if (action.kind.startsWith('own-'))
+        return undefined;
+    switch (`${action.system}:${action.kind}`) {
+        case 'coolify:app':
+        case 'coolify:database':
+            return LIMITS.companyApp;
+        case 'coolify:broker-entry':
+            return LIMITS.brokerEntry;
+        case 'cms:site':
+            return LIMITS.cms;
+        case 'coolify:chat':
+            return LIMITS.chat;
+        case 'coolify:calls':
+        case 'coolify:calls-service':
+        case 'coolify:calls-chat':
+            return LIMITS.calls;
+        case 'coolify:agora':
+            return LIMITS.agora;
+        case 'coolify:boule':
+        case 'coolify:boule-broker-entry':
+            return LIMITS.boule;
+        case 'cloudflare:tunnel':
+            return LIMITS.connector;
+        default:
+            return action.system === 'coolify' ? LIMITS.companyOther : undefined;
+    }
+}
 export class FoundryStepExecutor {
-    ports;
     edgeDns;
     edgeTunnels;
     edgeAccess;
@@ -810,8 +868,37 @@ export class FoundryStepExecutor {
     edgeWriteSlot;
     /** Secrets this executor minted or was handed; see `StepExecutor.secretsHandled`. */
     handledSecrets = new Set();
+    ports;
+    get rawCoolify() {
+        return this.ports.coolify;
+    }
     constructor(ports) {
-        this.ports = ports;
+        const destinationOf = (coolify, step, serverUuid) => this.companyDestination(coolify, step.org, step.context, serverUuid);
+        // A live view of `ports` whose Coolify port is the limited one; a port set later is seen.
+        const limitedPort = new WeakMap();
+        this.ports = new Proxy(ports, {
+            get(target, prop) {
+                const value = Reflect.get(target, prop, target);
+                if (prop !== 'coolify' || !value)
+                    return value;
+                const coolify = value;
+                let made = limitedPort.get(coolify);
+                if (!made) {
+                    const placedPort = placedByScope(coolify, () => {
+                        const step = companyScope.getStore();
+                        if (!step)
+                            return undefined;
+                        return {
+                            key: step.org.slug,
+                            resolve: (serverUuid) => destinationOf(coolify, step, serverUuid),
+                        };
+                    });
+                    made = limited(placedPort, () => limitScope.getStore());
+                    limitedPort.set(coolify, made);
+                }
+                return made;
+            },
+        });
     }
     secretsHandled() {
         return [...this.handledSecrets];
@@ -895,6 +982,18 @@ export class FoundryStepExecutor {
             throw e;
         }
     }
+    /** Whether the host's scoped ports for this own org include a broker port: the company's own broker, which its broker entries are written to. */
+    async ownBrokerPort(org, recordedIds) {
+        try {
+            const scoped = await this.ports.ownServices?.portsFor(org, recordedIds);
+            return Boolean(scoped?.broker);
+        }
+        catch (e) {
+            if (e instanceof OwnServicesBlockedError)
+                return false;
+            throw e;
+        }
+    }
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts() {
         return {
@@ -913,6 +1012,42 @@ export class FoundryStepExecutor {
         return this.run(action, context);
     }
     async run(action, context) {
+        let profile = limitProfileOf(action);
+        // An entry that declares `capabilities: 'standard'` is the fallback from tier B to tier A.
+        if (profile === LIMITS.companyApp && action.kind === 'app') {
+            const entry = context.org.hosting.entries.find((e) => appStepKey(context.org, e.key) === action.key);
+            if (entry?.capabilities === 'standard')
+                profile = LIMITS.companyAppStandard;
+        }
+        const dispatch = () => this.dispatch(action, context);
+        return companyScope.run({ org: context.org, context }, () => profile ? limitScope.run(profile, dispatch) : dispatch());
+    }
+    /**
+     * The company's destination on `serverUuid`: its Docker network `co-<slug>`, made when absent and
+     * recorded as {@link COOLIFY_DESTINATION_SCOPE_KEY}. Called before the first create of a step;
+     * a server that already holds too many networks fails here (`DestinationCapacityError`), before
+     * the destination or the resource exists. A crash after the destination is made and before it is
+     * recorded leaves a destination the next run finds by its network name, so a re-run converges.
+     * Each Coolify call has a 60 second timeout (`destinations.ts`).
+     */
+    async companyDestination(coolify, org, context, serverUuid) {
+        // The platform's own company stays on the platform network: Archon reads its database by name.
+        if (onPlatformNetwork(context.ownerCompany)) {
+            return findDestination(coolify, serverUuid, PLATFORM_NETWORK);
+        }
+        const uuid = await ensureDestination(coolify, serverUuid, companyNetworkName(org.slug));
+        if (context.recordedIds()[COOLIFY_DESTINATION_SCOPE_KEY] !== uuid) {
+            context.recordScopeId(COOLIFY_DESTINATION_SCOPE_KEY, uuid);
+        }
+        return uuid;
+    }
+    /** `coolify` for an own-services step: its creates go to the company's destination. */
+    placedForCompany(coolify, org, context) {
+        const own = coolify;
+        const listing = typeof own.raw === 'function' ? own : this.rawCoolify;
+        return placed(coolify, (serverUuid) => this.companyDestination(listing, org, context, serverUuid));
+    }
+    async dispatch(action, context) {
         const { org } = context;
         switch (`${action.system}:${action.kind}`) {
             case 'zitadel:issuer':
@@ -933,10 +1068,14 @@ export class FoundryStepExecutor {
                 return this.zitadelCustomers(org, context);
             case 'coolify:app':
                 return this.coolifyApp(action, org, context);
+            case 'coolify:network':
+                return this.coolifyNetwork(action, org, context);
             case 'coolify:broker-entry':
                 return this.coolifyBrokerEntry(action, org, context);
             case 'coolify:database':
                 return this.coolifyDatabase(action, org, context);
+            case 'coolify:backup':
+                return this.coolifyBackup(action, org, context);
             case 'coolify:calls':
                 return this.coolifyCalls(action, org, context);
             case 'coolify:calls-service':
@@ -1922,10 +2061,9 @@ export class FoundryStepExecutor {
             return { resourceId: created.appId };
         }
         // #139: the fixed `cms` client (`diff.ts`'s `planCmsClient`) signs
-        // people into the cms studio at `cms.<domain>`, not the org's own app
-        // hostname -- `org.site.enabled` guarantees `org.domain` is set
-        // (`org.ts`'s `validateSite`), the same guarantee `cmsHostnameFor`'s own
-        // doc comment relies on. #164: the fixed `agora` client (`diff.ts`'s
+        // people into the cms studio at `cmsHostnameFor(org)` -- `cms.<domain>`,
+        // or `<slug>-cms.oikos.host` for a company without a domain -- not the
+        // org's own app hostname. #164: the fixed `agora` client (`diff.ts`'s
         // `planAgoraClient`) is the same shape, always -- there is no
         // `org.site.enabled`-style guard to check, since Agora is always on.
         // The Agora client stays `appType: 'web'`: providers' `createOidcApp`
@@ -2024,12 +2162,110 @@ export class FoundryStepExecutor {
                 throw new Error(`coolify project ${org.slug} (${found.uuid}) was not created by foundry for this org and may hold other resources: rename or delete it, then apply again`);
             }
         }
-        const projectUuid = found
-            ? found.uuid
-            : (await this.ports.coolify.createProject(org.slug, coolifyProjectMark(org))).uuid;
+        if (!found) {
+            // A project foundry makes now is empty and on the company's own network. Record both, and persist
+            // them, before any resource is made in it: a crash later must never leave a project with
+            // resources and no marker, which the next plan would move (delete) over what was just built.
+            const created = await this.ports.coolify.createProject(org.slug, coolifyProjectMark(org));
+            context.recordScopeId(NETWORK_APPLIED_SCOPE_KEY, appliedNetworkOf(org, context));
+            context.recordScopeId('coolify_project', created.uuid);
+            await context.persistScopeIds();
+            return created.uuid;
+        }
+        const projectUuid = found.uuid;
+        // A project that holds nothing but its environment starts on the company's own network; one that
+        // holds resources was built on the shared network and is moved by `coolify:network`
+        // (`plan/network-move.ts`).
+        const holds = await this.ports.coolify.listResources?.(found.uuid);
+        if (holds?.every((r) => r.kind === 'environment')) {
+            context.recordScopeId(NETWORK_APPLIED_SCOPE_KEY, appliedNetworkOf(org, context));
+        }
         context.recordScopeId('coolify_project', projectUuid);
         return projectUuid;
     }
+    /**
+     * `plan/network-move.ts`'s `planNetworkMove`: a company built on the shared network is moved to its
+     * own. Coolify cannot move a resource in production, so every application and database in the
+     * company's project that foundry did not adopt is deleted, applications first, and the ids recorded
+     * for them are forgotten; the next apply builds them again on `co-<slug>`. Apply has already asked
+     * for the typed company name and checked a fresh backup of every database. A failure part way
+     * leaves what is left recorded and the marker unset, so the same step is planned again and goes on
+     * from there (a 404 counts as deleted). The marker is recorded last. No new timeout: each delete
+     * has the Coolify port's own.
+     */
+    async coolifyNetwork(action, org, context) {
+        const at = `coolify:network for ${org.slug}`;
+        const projectUuid = context.recordedIds().coolify_project;
+        if (!projectUuid)
+            throw new Error(`${at}: no Coolify project is recorded, nothing to move`);
+        const network = companyNetworkName(org.slug);
+        if (action.desired.network !== network) {
+            throw new Error(`${at}: the plan names another network; plan this org again`);
+        }
+        const list = this.ports.coolify.listResources;
+        if (!list) {
+            throw new Error(`${at}: this Coolify port cannot list a project's resources, so the move cannot tell what to delete`);
+        }
+        // Fail closed: an adopted record that cannot be read could name a resource foundry must keep.
+        const unreadable = adoptedKeysUnreadable(context.recordedIds());
+        if (unreadable.length > 0) {
+            throw new Error(`${at}: an adopted record cannot be read, so the move cannot tell what to keep`);
+        }
+        const kept = new Set();
+        for (const [key, raw] of Object.entries(context.recordedIds())) {
+            if (!key.startsWith('adopted.'))
+                continue;
+            const snapshot = parseAdoptSnapshot(raw);
+            if (snapshot)
+                kept.add(snapshot.application.uuid).add(snapshot.database.uuid);
+        }
+        const resources = await list.call(this.ports.coolify, projectUuid);
+        // Delete only what foundry recorded. Anything else in the project (a resource a person made there)
+        // stops the move before the first delete; it is moved by hand.
+        const recorded = new Set(Object.entries(context.recordedIds())
+            .filter(([key]) => !key.startsWith('adopted.'))
+            .map(([, id]) => id));
+        const candidates = resources.filter((r) => (r.kind === 'application' || r.kind === 'database') &&
+            typeof r.key === 'string' &&
+            !kept.has(r.key));
+        const stranger = candidates.find((r) => !recorded.has(r.key));
+        if (stranger) {
+            const name = typeof stranger.config?.name === 'string' ? stranger.config.name : stranger.key;
+            throw new Error(`${at}: the project holds the ${stranger.kind} "${name}", which foundry did not create; move this company by hand (docs/runbooks/network-move.md)`);
+        }
+        const doomed = candidates.sort((a, b) => a.kind === b.kind ? 0 : a.kind === 'application' ? -1 : 1);
+        for (const resource of doomed) {
+            try {
+                if (resource.kind === 'application') {
+                    await this.ports.coolify.deleteApplication(resource.key);
+                }
+                else {
+                    await this.ports.coolify.deleteDatabase(resource.key);
+                }
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+            for (const [key, id] of Object.entries(context.recordedIds())) {
+                if (id === resource.key)
+                    context.forgetId?.(key);
+            }
+            await context.persistScopeIds();
+        }
+        // Every database is gone, so every recorded backup schedule is too. A kept marker would stop
+        // `planCompanyBackups` from scheduling the rebuilt databases, and the upgrade gate would look for
+        // executions of a schedule that no longer exists.
+        for (const key of Object.keys(context.recordedIds())) {
+            if (key.startsWith(BACKUP_SCOPE_PREFIX))
+                context.forgetId?.(key);
+        }
+        // The company's connector is gone, so the tunnel's ingress is written again after the move.
+        context.forgetId?.(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY);
+        context.recordScopeId(NETWORK_APPLIED_SCOPE_KEY, network);
+        await context.persistScopeIds();
+        return {};
+    }
     /**
      * #445: one company lands on one Coolify server. The first call for an
      * org picks a usable, reachable server and records it
@@ -2093,6 +2329,11 @@ export class FoundryStepExecutor {
             throw new Error(`coolify:app for ${org.slug}: entry '${entry.key}' has no repo`);
         }
         const appRepo = entry.repo;
+        // A compose file can set `privileged`, host networking or a Docker socket mount, and its labels
+        // are its own: refused for every company until compose files are checked (`diff.ts` blocks it).
+        if (entry.buildPack === 'dockercompose') {
+            throw new Error(`coolify:app for ${org.slug}: entry '${entry.key}' is compose-built, which is refused`);
+        }
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         // The recorded id first; the name when nothing is recorded, or when the
@@ -2114,10 +2355,12 @@ export class FoundryStepExecutor {
                 environmentIds: [environment.id],
             });
         }
-        // An entry with no names is internal: the other entries reach it as
-        // `<slug>-<key>`, and it gets no domain, route or DNS record.
+        // No entry gets Coolify `domains`: Coolify would add a Traefik router for them. The company's
+        // tunnel routes an entry's names straight to its container (also `<slug>.oikos.host`, through a
+        // record in the platform's oikos.host zone), which every entry reaches as `<slug>-<key>` (its
+        // internal name) on the company network.
         const names = entryHostnames(org, entry);
-        const wantDomains = tunnelDomainList(names);
+        const wantDomains = [];
         const isStatic = entry.buildPack === 'static';
         const settingsKey = appSettingsAppliedScopeKey(entry.key);
         const domainsKey = appDomainsAppliedScopeKey(entry.key);
@@ -2157,8 +2400,7 @@ export class FoundryStepExecutor {
                 git_branch: entry.branch,
                 build_pack: entry.buildPack,
                 name: appNameFor(org, entry),
-                domains: names.length > 0 ? coolifyTunnelDomains(names) : undefined,
-                autogenerate_domain: names.length > 0 ? undefined : false,
+                autogenerate_domain: false,
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
                 is_auto_deploy_enabled: entry.autoDeploy,
@@ -2203,9 +2445,9 @@ export class FoundryStepExecutor {
         // redirect loops behind the tunnel. The internal name is set after
         // create, as the calls stack's apps do.
         if (JSON.stringify(wantDomains) !== JSON.stringify(haveDomains)) {
-            patch.domains = coolifyTunnelDomains(names);
+            patch.domains = '';
         }
-        if (names.length === 0 && (!existing || patch.domains !== undefined)) {
+        if (!existing || patch.domains !== undefined) {
             patch.custom_internal_name = appNameFor(org, entry);
         }
         // A `*` entry's proxy labels: Coolify takes `custom_labels` base64 encoded
@@ -2217,16 +2459,16 @@ export class FoundryStepExecutor {
         // below, after the redeploy, so a failed run repeats this.
         const labelsKey = appLabelsAppliedScopeKey(entry.key);
         const haveLabelsHash = context.recordedIds()[labelsKey];
-        const labelSpec = entryLabelSpec(org, entry, haveLabelsHash !== undefined);
-        const wantLabelsHash = labelSpec ? entryLabelHash(labelSpec) : undefined;
-        const wantLabels = labelSpec ? entryProxyLabels(appId, labelSpec) : undefined;
+        // Every entry container carries `traefik.enable=false` (a run label overrides the image's own), so
+        // Traefik never routes it, whatever its image declares.
+        const wantLabelsHash = entryLabelHash(entryLabelSpec(org, entry));
+        const wantLabels = ENTRY_CONTAINER_LABELS;
         const liveLabels = existing ? live?.custom_labels : undefined;
-        const labelsDiffer = wantLabels !== undefined &&
-            (!existing ||
-                (liveLabels !== undefined
-                    ? !sameLabelSets(Buffer.from(liveLabels ?? '', 'base64').toString('utf8'), wantLabels)
-                    : wantLabelsHash !== haveLabelsHash));
-        if (wantLabels !== undefined && labelsDiffer) {
+        const labelsDiffer = !existing ||
+            (liveLabels !== undefined
+                ? !sameLabelSets(Buffer.from(liveLabels ?? '', 'base64').toString('utf8'), wantLabels)
+                : wantLabelsHash !== haveLabelsHash);
+        if (labelsDiffer) {
             patch.custom_labels = Buffer.from(wantLabels).toString('base64');
         }
         if (Object.keys(patch).length > 0)
@@ -2268,7 +2510,6 @@ export class FoundryStepExecutor {
         // What the plan decided is available (diff.ts `planApps`), so the marker
         // recorded below is the one the plan compares against. Absent: none.
         action.desired.secretSources ?? {
-            platformMailKey: false,
             sharedSecret: false,
         });
         // Rule 4 (#239, #243): a container reads its env only at start, so an app
@@ -2288,9 +2529,15 @@ export class FoundryStepExecutor {
             const [hostname] = names;
             const healthPath = entry.healthPath ?? (isStatic ? '/' : '/api/health');
             const runtime = this.ports.runtime ?? {};
-            await waitForNewDeployment(this.ports.coolify, appId, hostname
+            const built = await waitForNewDeployment(this.ports.coolify, appId, 
+            // The public name answers from the container only once the tunnel step has written the
+            // direct route; before that (a first apply, or the one that moves it) the deployment is the check.
+            hostname &&
+                (context.recordedIds()[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY] ?? '[]') ===
+                    entryRoutesMarker(org)
                 ? publicHealthCheck(org, context.recordedIds(), hostname, healthPath)
                 : { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, `coolify:app:${entry.key}`, `${org.slug}'s ${entry.key === APP_ENTRY_KEY ? 'app' : `${entry.key} app`} stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: appId, deploymentUuid: built.deploymentUuid, name: entry.key }, (key, value) => context.recordScopeId(key, value));
         }
         else if ((appEnv.changed || dbNeedsRestart) && existing) {
             await this.ports.coolify.restart(appId);
@@ -2301,8 +2548,7 @@ export class FoundryStepExecutor {
         // one and `planApp` reports it instead of planning it.
         context.recordScopeId(settingsKey, JSON.stringify({ ...want, port: want.port ?? have.port }));
         context.recordScopeId(domainsKey, JSON.stringify(wantDomains));
-        if (wantLabelsHash)
-            context.recordScopeId(labelsKey, wantLabelsHash);
+        context.recordScopeId(labelsKey, wantLabelsHash);
         context.recordScopeId(appEnvAppliedScopeKey(entry.key), appEnv.applied);
         if (entry.uses?.auth) {
             context.recordScopeId(entryAuthEnvAppliedScopeKey(entry.key), appEnv.authApplied);
@@ -2366,6 +2612,31 @@ export class FoundryStepExecutor {
             await this.ports.coolify.restart(appId);
         }
     }
+    /**
+     * F6: a nightly dump of one of the company's databases to the platform's
+     * backup bucket. The schedule is found before it is created
+     * (`provisionDatabaseBackup`), so a run that died after the create and
+     * before `backup_<db>` was recorded reuses the schedule on the next apply
+     * instead of adding a second. The error carries the database's name, never
+     * the connection URL or a response body.
+     */
+    async coolifyBackup(action, org, context) {
+        const { databaseId, database, storageUuid } = action.desired;
+        if (typeof databaseId !== 'string' ||
+            typeof database !== 'string' ||
+            typeof storageUuid !== 'string' ||
+            !databaseId ||
+            !storageUuid) {
+            throw new Error(`coolify:backup for ${org.slug}: the plan named no database or no storage`);
+        }
+        const { uuid } = await provisionDatabaseBackup(this.ports.coolify, {
+            databaseUuid: databaseId,
+            label: `${org.slug} ${database}`,
+            storageUuid,
+        });
+        context.recordScopeId(backupScopeKey(database), uuid);
+        return undefined;
+    }
     async coolifyDatabase(action, org, context) {
         if (action.desired.enabled === false) {
             const dbId = context.recordedIds()[`coolify:database:${action.key}`];
@@ -2563,24 +2834,12 @@ export class FoundryStepExecutor {
         // minted here; a source with no value yet (its own step has not run,
         // or has not run for this apply) is simply omitted, the same way every
         // other optional entry above is.
-        // The secret sources (`sharedSecret`, `platformMailKey`) are filled here
+        // The secret source (`sharedSecret`) is filled here
         // only, straight into `envs`: never recorded, returned or logged.
         const heldKeys = this.ports.heldKeys;
-        // Availability is the plan's (`secretSources`). If the plan said a key is
-        // held and this port cannot read it, the host wired the two differently:
-        // fail by ref, never push a marker for an env that was not written.
-        let mailKey = null;
-        if (secretSources.platformMailKey) {
-            try {
-                mailKey = (await heldKeys?.resolve(PLATFORM_AUTH_BROKER_MAIL_KEY_REF)) || null;
-            }
-            catch {
-                // reported below, by ref
-            }
-            if (mailKey === null) {
-                throw new Error(`coolify:app for ${org.slug}: the plan found ${PLATFORM_AUTH_BROKER_MAIL_KEY_REF} held but the executor's heldKeys cannot read it`);
-            }
-        }
+        // Availability is the plan's (`secretSources`). If the plan said secrets
+        // can be held and this port cannot put, the host wired the two differently:
+        // never push a marker for an env that was not written.
         if (secretSources.sharedSecret && typeof heldKeys?.put !== 'function') {
             throw new Error(`coolify:app for ${org.slug}: the plan found held keys that can put but the executor's heldKeys cannot`);
         }
@@ -2591,9 +2850,7 @@ export class FoundryStepExecutor {
         for (const { name, source } of resolved.secrets) {
             envs.push({
                 key: name,
-                value: source === 'platformMailKey'
-                    ? mailKey
-                    : await this.ensureSharedSecret(org, source.name, recorded),
+                value: await this.ensureSharedSecret(org, source.name, recorded),
             });
         }
         await this.ports.coolify.bulkUpsertEnvs(appId, envs);
@@ -2612,6 +2869,40 @@ export class FoundryStepExecutor {
             authApplied,
         };
     }
+    /**
+     * The install's edge label token: read from the held keys, else minted and held first, so a crash
+     * after the `put` hands the same value out on the next apply. Read once more after the `put`, so two
+     * runs that mint at the same moment end on the value that was held last. An error names the ref,
+     * never a value.
+     */
+    async edgeLabelToken() {
+        const heldKeys = this.ports.heldKeys;
+        const held = await heldKeys?.resolve(PROXY_LABEL_TOKEN_REF);
+        if (held)
+            return held;
+        if (typeof heldKeys?.put !== 'function') {
+            throw new Error(`proxy labels: the edge label token (${PROXY_LABEL_TOKEN_REF}) is not held and the executor's heldKeys cannot put one`);
+        }
+        const minted = randomBytes(32).toString('base64url');
+        this.handledSecrets.add(minted);
+        await heldKeys.put(PROXY_LABEL_TOKEN_REF, minted);
+        const final = (await heldKeys.resolve(PROXY_LABEL_TOKEN_REF)) ?? minted;
+        this.handledSecrets.add(final);
+        return final;
+    }
+    /**
+     * The `custom_labels` patch of an app foundry routes through Traefik at `hostname`: the same http
+     * router a `domains` entry gets, plus the edge token. Coolify uses these instead of the labels it
+     * generates from `domains`. The router names use the app's own name, which is unique per company.
+     */
+    async routedLabels(name, hostname, port) {
+        const token = await this.edgeLabelToken();
+        const labels = entryProxyLabels(name, { names: [hostname], wildcardDomain: null, port }, token);
+        if (routesWithoutToken(labels, token)) {
+            throw new Error('proxy labels: a routed app would be sent without the edge token');
+        }
+        return { custom_labels: Buffer.from(labels).toString('base64') };
+    }
     /**
      * The org's shared secret `name`: read from the held keys, else generated
      * and held first, so a crash after the `put` and before the env write
@@ -3247,14 +3538,8 @@ export class FoundryStepExecutor {
                 await this.ports.coolify.raw('POST', `/applications/${siteAppId}/stop`);
             return { resourceId: cmsAppId ?? siteAppId };
         }
-        // `validateSite` ("site.enabled requires domain") guarantees this
-        // whenever this step runs -- checked anyway, the same way
-        // `cloudflareRateLimit` above guards its own `org.domain` read, since
-        // TypeScript's `string | null` gives no static guarantee of it.
-        if (!org.domain) {
-            throw new Error(`cms:site for ${org.slug}: site.enabled is set but domain is null`);
-        }
-        const domain = org.domain;
+        // The site's address: the org's domain, or `<slug>.oikos.host` without one.
+        const domain = siteHostnameFor(org);
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const site = await this.findOrCreateCmsApp({
@@ -3288,9 +3573,11 @@ export class FoundryStepExecutor {
         // deploys, it does not add a deploy where none exists).
         await this.ports.coolify.updateApplication(site.appId, {
             ...healthCheckSettings('/api/health', CMS_APP_PORT),
+            ...(await this.routedLabels(`${org.slug}-site`, domain, CMS_APP_PORT)),
         });
         await this.ports.coolify.updateApplication(cms.appId, {
             ...healthCheckSettings('/api/health', CMS_APP_PORT),
+            ...(await this.routedLabels(`${org.slug}-cms`, cmsHostnameFor(org), CMS_APP_PORT)),
         });
         // Every app foundry deploys keeps its own logs (#75) -- reused as-is for
         // both of these two, the same unconditional call `coolifyApp` makes for
@@ -3577,16 +3864,17 @@ export class FoundryStepExecutor {
             // yet.
             throw new Error(`coolify:calls for ${org.slug}: a database has no internal_db_url yet -- retry this apply once Coolify reports one`);
         }
+        const synapseTag = typeof action.desired.synapseTag === 'string' ? action.desired.synapseTag : SYNAPSE_TAG;
         const synapse = await this.findOrCreateCallsApp(names.synapse, environment.id, () => this.ports.coolify.createDockerImageApplication({
             project_uuid: projectUuid,
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             docker_registry_image_name: SYNAPSE_IMAGE,
-            docker_registry_image_tag: SYNAPSE_TAG,
+            docker_registry_image_tag: pinnedTagFor('synapse', synapseTag),
             ports_exposes: '8008',
             name: names.synapse,
-            description: `Synapse for ${org.slug}'s calls stack (${SYNAPSE_IMAGE}:${SYNAPSE_TAG})`,
+            description: `Synapse for ${org.slug}'s calls stack (${SYNAPSE_IMAGE}:${synapseTag})`,
             instant_deploy: false,
         }));
         // The check goes on every run, so a Synapse made without one gets it. Synapse
@@ -3604,7 +3892,7 @@ export class FoundryStepExecutor {
         // the app id above is, would make `versionNotAppliedLine` compare a
         // bumped `VERSIONS.synapse` against a value never actually applied.
         if (!synapse.existed) {
-            context.recordScopeId(CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, SYNAPSE_TAG);
+            context.recordScopeId(CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, synapseTag);
         }
         const mas = await this.findOrCreateCallsApp(names.mas, environment.id, () => this.ports.coolify.createDockerfileApplication({
             project_uuid: projectUuid,
@@ -4485,6 +4773,7 @@ export class FoundryStepExecutor {
             custom_internal_name: name,
             ...commandHealthCheckSettings(wgetProbe(CALLS_SERVICE_PORT, CALLS_HEALTH_CHECK_PATH)),
             ...(portDiffers ? { ports_exposes: CALLS_SERVICE_PORT } : {}),
+            ...(await this.routedLabels(name, callsHostnameFor(org), Number(CALLS_SERVICE_PORT))),
         });
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
@@ -4865,6 +5154,7 @@ export class FoundryStepExecutor {
         await this.ports.coolify.updateApplication(app.appId, {
             ...(portDiffers ? { ports_exposes: AGORA_APP_PORTS_EXPOSES } : {}),
             ...healthCheckSettings('/', Number(AGORA_APP_PORTS_EXPOSES)),
+            ...(await this.routedLabels(name, agoraHostnameFor(org), Number(AGORA_APP_PORTS_EXPOSES))),
         });
         // #442: read before overwriting -- `bulkUpsertEnvs` below always leaves
         // Coolify's own env store matching `env`, which is why that store alone
@@ -4891,7 +5181,8 @@ export class FoundryStepExecutor {
             // in the branch below, and this deploy already carries this run's env,
             // pushed above, so the two never both run).
             const runtime = this.ports.runtime ?? {};
-            await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), agoraHostnameFor(org), '/'), runtime, runtime.sleep ?? defaultSleep, 'coolify:agora', `${org.slug}'s Agora stays at its previous deploy`);
+            const built = await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), agoraHostnameFor(org), '/'), runtime, runtime.sleep ?? defaultSleep, 'coolify:agora', `${org.slug}'s Agora stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: app.appId, deploymentUuid: built.deploymentUuid, name: 'agora' }, (key, value) => context.recordScopeId(key, value));
             context.recordScopeId(AGORA_DEPLOYED_SCOPE_KEY, '1');
         }
         else if (app.existed && (envChanged || !alreadyActivated)) {
@@ -4972,6 +5263,7 @@ export class FoundryStepExecutor {
         // `EXPOSE 3000` ({@link BOULE_PORT}'s own doc comment).
         await this.ports.coolify.updateApplication(app.appId, {
             ...healthCheckSettings('/api/health', BOULE_PORT),
+            ...(await this.routedLabels(name, bouleHostnameFor(org), BOULE_PORT)),
         });
         const liveEnv = new Map((await this.ports.coolify.listEnvs(app.appId))
             .filter((e) => !e.is_preview)
@@ -5029,7 +5321,8 @@ export class FoundryStepExecutor {
         if (!context.recordedIds()[BOULE_DEPLOYED_SCOPE_KEY]) {
             // #543: every deploy waits for health -- Boule's own public hostname.
             const runtime = this.ports.runtime ?? {};
-            await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), bouleHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:boule', `${org.slug}'s Boule stays at its previous deploy`);
+            const built = await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), bouleHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:boule', `${org.slug}'s Boule stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: app.appId, deploymentUuid: built.deploymentUuid, name: 'boule' }, (key, value) => context.recordScopeId(key, value));
             context.recordScopeId(BOULE_DEPLOYED_SCOPE_KEY, '1');
         }
         else if (app.existed &&
@@ -5220,7 +5513,7 @@ export class FoundryStepExecutor {
         if (!own)
             throw new Error(OWN_SERVICES_PORT_ABSENT);
         return provisionJobsHost(scopeFromOrg(context, {}), {
-            coolify: limited(own.provision.jobs),
+            coolify: limited(this.placedForCompany(own.provision.jobs, org, context), LIMITS.ownJobs),
             deliverSecret: this.ports.deliverSecret,
             readSecret: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null,
             runtime: this.ports.runtime ?? {},
@@ -5245,14 +5538,14 @@ export class FoundryStepExecutor {
         if (!own)
             throw new Error(OWN_SERVICES_PORT_ABSENT);
         const at = `coolify:own-files for ${org.slug}`;
-        const domain = org.domain;
-        if (!domain)
-            throw new Error(`${at}: the org declares no domain`);
         const zitadelOrgId = context.recordedIds()[ZITADEL_ORG_SCOPE_KEY];
         if (!zitadelOrgId)
             throw new Error(`${at}: the org's ZITADEL organisation is not recorded yet`);
         const { r2Buckets, r2Keys: _r2Keys, keysMint, readSecret, ...ownFiles } = own.provision.files;
-        const files = { ...ownFiles, coolify: limited(ownFiles.coolify) };
+        const files = {
+            ...ownFiles,
+            coolify: limited(this.placedForCompany(ownFiles.coolify, org, context), LIMITS.ownFiles),
+        };
         // Never the platform's credential in its place.
         if (!keysMint)
             throw new OwnServicesBlockedError('files', 'keysMint');
@@ -5267,7 +5560,7 @@ export class FoundryStepExecutor {
             // The cause is dropped: a host port's message is not ours to repeat.
             throw new Error(`${at}: the bucket ${target.names.filesBucket} could not be ensured`);
         }
-        const issuer = `https://auth.${domain}`;
+        const issuer = ownHostnames(org).issuerUrl;
         const deps = {
             ...files,
             // The platform's keys settings stay out of a company's containers; the minted keyring replaces them.
@@ -5422,9 +5715,7 @@ export class FoundryStepExecutor {
             throw new Error(OWN_SERVICES_PORT_ABSENT);
         const hostname = action.desired.hostname;
         const gitRef = action.desired.gitRef;
-        const domain = org.domain;
-        if (!domain)
-            throw new Error(`coolify:own-auth for ${org.slug}: the org declares no domain`);
+        const hn = ownHostnames(org);
         const scope = scopeFromOrg(context, {});
         // The target (host, port, tls, user) is not secret; the platform's SMTP
         // password is, so the company's own token is the password instead.
@@ -5434,7 +5725,7 @@ export class FoundryStepExecutor {
             ...(smtp
                 ? { smtp: { host: smtp.host, port: smtp.port, tls: smtp.tls, user: smtp.user } }
                 : {}),
-            coolify: limited(own.provision.auth.coolify),
+            coolify: limited(this.placedForCompany(own.provision.auth.coolify, org, context), LIMITS.ownAuth),
             runtime: {
                 ...own.provision.auth.runtime,
                 onSecret: (value) => {
@@ -5453,15 +5744,15 @@ export class FoundryStepExecutor {
             for (const id of gitApps)
                 await deps.coolify.updateApplication(id, { git_branch: gitRef });
         }
-        await this.ensureOwnAuthMailToken(org, domain, deps);
+        await this.ensureOwnAuthMailToken(org, hn.mailDomain, deps);
         const result = await provisionAuthStack(scope, deps, orgTarget(org), {
             hostname,
-            apex: domain,
+            apex: hn.zone,
             gitRef,
             project: { ensure: () => this.ensureCoolifyProject(org, context) },
             network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:auth`),
-            smtpSender: `noreply@${domain}`,
-            defaultRedirectUri: `https://agora.${domain}`,
+            smtpSender: `noreply@${hn.mailDomain}`,
+            defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
             ownerCompany: null,
         });
         if (refChanged) {
@@ -5482,8 +5773,9 @@ export class FoundryStepExecutor {
     }
     /**
      * `plan/own-diff.ts`'s `planOwnMail`: the org's own Stalwart in the org's own
-     * project, with no host port (the shared relay reaches it by internal name)
-     * and a directory that trusts the org's own sign-in. The admin key goes to
+     * project, publishing its port 25 on one host port of the server (the shared
+     * relay is on another network and dials the server's address) and a directory
+     * that trusts the org's own sign-in. The admin key goes to
      * `orgTarget(org).refs.mailAdminKey` and nowhere else. The address the relay
      * routes to is recorded last, and the step's marker after it.
      */
@@ -5491,14 +5783,22 @@ export class FoundryStepExecutor {
         const own = this.ports.ownServices;
         if (!own)
             throw new Error(OWN_SERVICES_PORT_ABSENT);
-        if (!org.domain)
-            throw new Error(`own step coolify:own-mail for ${org.slug}: the org has no domain`);
+        const hn = ownHostnames(org);
         const target = orgTarget(org);
         const scope = scopeFromOrg(context, {});
-        const issuerUrl = `https://auth.${org.domain}`;
+        const issuerUrl = hn.issuerUrl;
+        const smtpPort = action.desired.smtpPort;
+        if (!isOwnMailSmtpPort(smtpPort)) {
+            throw new Error(`coolify:own-mail for ${org.slug}: the plan gives no valid mail port`);
+        }
+        const bind = this.ports.mailBindAddress;
+        if (bind !== undefined && !isIpv4Address(bind)) {
+            throw new Error(`coolify:own-mail for ${org.slug}: the mail bind address is not an IPv4 address`);
+        }
+        const coolify = this.placedForCompany(own.provision.mail.coolify, org, context);
         const result = await provisionMailServer(scope, {
             ...own.provision.mail,
-            coolify: limited(own.provision.mail.coolify),
+            coolify: limited(coolify, LIMITS.ownMail),
             deliverSecret: (ref, secret) => {
                 this.handledSecrets.add(secret);
                 return this.ports.deliverSecret(ref, secret);
@@ -5511,16 +5811,27 @@ export class FoundryStepExecutor {
             zitadelForInstance: undefined,
         }, target, {
             hostname: action.desired.hostname,
-            apex: org.domain,
+            apex: hn.mailDomain,
+            zone: hn.zone,
             mailHost: action.desired.mailHost,
             imageTag: action.desired.gitRef,
-            hostPorts: '',
+            hostPorts: bind ? `${bind}:${smtpPort}:25` : `${smtpPort}:25`,
             issuerUrl,
             mxRecord: null,
             project: { ensure: () => this.ensureCoolifyProject(org, context) },
             network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:mail`),
         });
-        scope.recordScopeId(OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, `${target.internal.mail}:25`);
+        // The relay is on the platform's network, so it reaches the company's Stalwart through the server's
+        // address and the port published above. The port is recorded first, then the address the relay is given.
+        const mailServer = (await coolify.listServers()).find((s) => s.uuid === context.recordedIds()[PLATFORM_MAIL_SERVER_SCOPE_KEY]);
+        const wanted = this.ports.mailRelayTarget?.({ serverAddress: mailServer?.ip, port: smtpPort }) ??
+            (bind ? `${bind}:${smtpPort}` : mailServer?.ip ? `${mailServer.ip}:${smtpPort}` : null);
+        const relayTarget = wanted ? normalizeMailTarget(wanted) : null;
+        if (!relayTarget) {
+            throw new Error(`coolify:own-mail for ${org.slug}: the mail server has no address the relay can dial`);
+        }
+        scope.recordScopeId(OWN_MAIL_SMTP_PORT_SCOPE_KEY, String(smtpPort));
+        scope.recordScopeId(OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, relayTarget);
         await scope.persist();
         return result;
     }
@@ -5536,7 +5847,7 @@ export class FoundryStepExecutor {
         const scope = scopeFromOrg(context, {});
         const { sfu } = own.provision;
         return provisionSfuApp(scope, {
-            coolify: limited(sfu.coolify),
+            coolify: limited(this.placedForCompany(sfu.coolify, org, context), LIMITS.ownSfu),
             network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:sfu`),
             deliverSecret: sfu.deliverSecret,
             readSecret: async (ref) => (await this.ports.heldKeys?.resolve(ref)) ?? null,
@@ -5548,7 +5859,7 @@ export class FoundryStepExecutor {
         }, orgTarget(org), {
             slot: action.desired.slot,
             hostname: action.desired.hostname,
-            apex: org.domain,
+            apex: ownHostnames(org).zone,
             version: action.desired.version,
             project: { ensure: () => this.ensureCoolifyProject(org, context) },
         });
@@ -5669,15 +5980,19 @@ export class FoundryStepExecutor {
         // login app (the same container the platform auth tunnel routes to), not
         // through Coolify's proxy, which has no route for it.
         const loginHost = action.desired.loginHost ?? null;
+        // A hosting entry's names (and its wildcard) go straight to its container on the company network:
+        // the container carries `traefik.enable=false`, so the proxy has no route for it.
+        const entryOrigins = new Map(entryRoutes(org).map((r) => [r.hostname, r.service]));
         const ingress = tunnelIngressHostnames(org, loginHost).map((hostname) => ({
             hostname,
             service: hostname === loginHost
                 ? `http://${PLATFORM_AUTH_LOGIN_INTERNAL_NAME}:${AUTH_LOGIN_PORT}`
-                : COOLIFY_PROXY_ORIGIN,
+                : (entryOrigins.get(hostname) ?? COOLIFY_PROXY_ORIGIN),
         }));
         await this.tunnelPort().putTunnelConfig(tunnel.id, {
             ingress: [...ingress, { service: 'http_status:404' }],
         });
+        context.recordScopeId(CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, entryRoutesMarker(org));
         // #235: a connector for this org's own tunnel, the same call every
         // platform tunnel step already makes (Decided, William, 2026-10-01:
         // one connector per org tunnel, never a shared tunnel with appended
@@ -5776,8 +6091,77 @@ export class FoundryStepExecutor {
                 context.recordScopeId(CLOUDFLARE_TUNNEL_PREVIOUS_IDS_SCOPE_KEY, '');
             }
         }
+        await this.publishOikosEntryRecords(org, tunnel.id, previousIds, context);
         return { resourceId: tunnel.id };
     }
+    /**
+     * The entry names a company has in the platform's `oikos.host` zone (a company with no domain of its own):
+     * one proxied CNAME each, to this company's tunnel, which routes them straight to the entry container. A
+     * specific record beats the shared `*.oikos.host` wildcard, so the shared ingress stops carrying the name
+     * without being edited. The company writes only its own `<slug>.oikos.host` ({@link ownsOikosName}); an
+     * A or AAAA record, or a CNAME that points anywhere but this tunnel, an earlier id of it or the shared
+     * wildcard's target, blocks the step. A name the company no longer declares has its record deleted when
+     * it still points at this tunnel. The names are recorded only after every record is in place, so a failure
+     * halfway is planned again.
+     */
+    async publishOikosEntryRecords(org, tunnelId, previousIds, context) {
+        const wanted = entryOikosHostnames(org);
+        const recorded = context.recordedIds()[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY];
+        const previous = recorded ? recorded.split(',') : [];
+        if (wanted.length === 0 && previous.length === 0)
+            return;
+        for (const name of wanted) {
+            if (!ownsOikosName(org, name)) {
+                throw new Error(`cloudflare:tunnel for ${org.slug}: ${name} is not a name this company may write in the ${NO_DOMAIN_ZONE} zone`);
+            }
+        }
+        const zone = await this.zonePort().findZoneByApex(NO_DOMAIN_ZONE);
+        if (!zone) {
+            throw new Error(`cloudflare:tunnel for ${org.slug}: no Cloudflare zone found for ${NO_DOMAIN_ZONE} to point its entry names at`);
+        }
+        const dns = this.dnsPort();
+        const dnsTarget = `${tunnelId}.cfargotunnel.com`;
+        const ownTargets = new Set([
+            dnsTarget,
+            ...[...previousIds].map((id) => `${id}.cfargotunnel.com`),
+        ]);
+        const [shared] = await dns.findDnsRecord(zone.name, `*.${NO_DOMAIN_ZONE}`, 'CNAME');
+        const writes = [];
+        const conflicts = [];
+        for (const name of wanted) {
+            const [a] = await dns.findDnsRecord(zone.name, name, 'A');
+            const [aaaa] = await dns.findDnsRecord(zone.name, name, 'AAAA');
+            if (a ?? aaaa) {
+                conflicts.push(`${name} already has an ${(a ?? aaaa)?.type} record`);
+                continue;
+            }
+            const [cname] = await dns.findDnsRecord(zone.name, name, 'CNAME');
+            const record = { type: 'CNAME', name, content: dnsTarget, proxied: true };
+            if (!cname)
+                writes.push(() => dns.createDnsRecord(zone.name, record));
+            else if (cname.content === dnsTarget)
+                continue;
+            else if (ownTargets.has(cname.content) || cname.content === shared?.content) {
+                writes.push(() => dns.updateDnsRecord(zone.name, cname.id, record));
+            }
+            else
+                conflicts.push(`${name} is already a CNAME to ${cname.content}`);
+        }
+        if (conflicts.length > 0) {
+            throw new Error(`cloudflare:tunnel for ${org.slug}: will not point its tunnel at every entry name -- ${conflicts.join('; ')}; remove the conflicting record first`);
+        }
+        for (const write of writes)
+            await write();
+        for (const name of previous.filter((n) => !wanted.includes(n))) {
+            if (!ownsOikosName(org, name))
+                continue;
+            for (const record of await dns.findDnsRecord(zone.name, name, 'CNAME')) {
+                if (ownTargets.has(record.content))
+                    await dns.deleteDnsRecord(zone.name, record.id);
+            }
+        }
+        context.recordScopeId(CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, wanted.join(','));
+    }
     /**
      * #236: when this tunnel's DNS was last published under a domain that
      * differs from the one `org` now declares, deletes every CNAME in the
@@ -6094,7 +6478,7 @@ export class FoundryStepExecutor {
         }
         const mailOrg = mailOrgFor(org, usesDomain, mode);
         const result = await this.ports.mail.applyOrgMail(mailOrg, options);
-        await this.publishMailDnsRecords(org, result);
+        await this.publishMailDnsRecords(org, result, context);
         await this.deleteStaleLettermintDomain(context, result.domain, platformApex);
         context.recordScopeId(MAIL_DOMAIN_SCOPE_KEY, result.domain);
         await this.ensureOwnerMailbox(org, mailOrg, options, context);
@@ -6225,15 +6609,49 @@ export class FoundryStepExecutor {
      * call, since Stalwart mints the key on a background task; the next apply
      * publishes it.
      */
-    async publishMailDnsRecords(org, result) {
+    async publishMailDnsRecords(org, result, context) {
         const zone = await this.zonePort().findZoneByApex(result.domain);
         if (!zone) {
             throw new Error(`coolify:mail for ${org.slug}: no Cloudflare zone found for ${result.domain}`);
         }
+        if (ownsServices(org) && result.domain.toLowerCase() === `${org.slug}.${NO_DOMAIN_ZONE}`) {
+            await this.ensureOwnWebAddressRecord(org, zone.name, context);
+        }
         for (const record of result.records) {
             await this.upsertMailDnsRecord(zone.name, record);
         }
     }
+    /**
+     * A company without a domain keeps its web address at `<slug>.oikos.host`,
+     * which only the shared `*.oikos.host` wildcard answers. A wildcard applies
+     * only to a name that holds no record of its own, so the MX and TXT records
+     * of the company's mail domain on that same name would take the web address
+     * away. This writes the name's own proxied CNAME, to wherever the wildcard
+     * points, before any mail record. Found by name and type, so a rerun after a
+     * half-finished apply never doubles it. Cloudflare lists only A, AAAA and
+     * CNAME as clashing with a CNAME, so MX and TXT sit beside it.
+     * https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/
+     * https://developers.cloudflare.com/dns/manage-dns-records/troubleshooting/records-with-same-name/
+     */
+    async ensureOwnWebAddressRecord(org, zone, context) {
+        const dns = this.dnsPort();
+        const name = `${org.slug}.${NO_DOMAIN_ZONE}`;
+        // The company's own tunnel already carries this name (an entry is served at it): that record is ours.
+        const own = context.recordedIds()[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY];
+        if (own?.split(',').includes(name))
+            return;
+        const [wildcard] = await dns.findDnsRecord(zone, `*.${NO_DOMAIN_ZONE}`, 'CNAME');
+        if (!wildcard) {
+            throw new Error(`coolify:mail for ${org.slug}: the zone ${zone} has no *.${NO_DOMAIN_ZONE} record to copy, so ${name} would stop answering once its mail records exist`);
+        }
+        const record = { type: 'CNAME', name, content: wildcard.content, proxied: true };
+        const [existing] = await dns.findDnsRecord(zone, name, 'CNAME');
+        if (!existing)
+            await dns.createDnsRecord(zone, record);
+        else if (existing.content !== wildcard.content) {
+            await dns.updateDnsRecord(zone, existing.id, record);
+        }
+    }
     /**
      * Creates or updates one mail record (Stalwart's or Lettermint's).
      *
@@ -6307,7 +6725,7 @@ export class FoundryStepExecutor {
         // An own org's sign-in sends its mail through `<slug>-auth` and the domain it
         // applied at; parking the org's mail leaves both, or the sign-in can no
         // longer send (its held token would still resolve, so nothing re-mints it).
-        const ownSignIn = ownsServices(org) && Boolean(org.domain) && ownAuthApplied(org, context.recordedIds());
+        const ownSignIn = ownsServices(org) && ownAuthApplied(org, context.recordedIds());
         const names = new Set([`${org.slug}-app`, `${org.slug}-relay`]);
         if (!ownSignIn)
             names.add(`${org.slug}-auth`);
@@ -6319,7 +6737,7 @@ export class FoundryStepExecutor {
         }
         if (isPlatformApexOrg)
             return;
-        if (ownSignIn && mailDomain.toLowerCase() === org.domain?.toLowerCase())
+        if (ownSignIn && mailDomain.toLowerCase() === ownHostnames(org).mailDomain.toLowerCase())
             return;
         const domain = await this.findExactLettermintDomain(mailDomain);
         if (domain)
@@ -7255,6 +7673,29 @@ export class FoundryStepExecutor {
                                 throw error;
                         }
                     }
+                    // The entry names it has in the platform's oikos.host zone (its own `<slug>.oikos.host` only).
+                    const oikosNames = (recordedIds[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY] ?? '')
+                        .split(',')
+                        .filter((name) => name !== '' && ownsOikosName(org, name));
+                    if (oikosNames.length > 0) {
+                        try {
+                            const zone = await this.zonePort().findZoneByApex(NO_DOMAIN_ZONE);
+                            if (zone) {
+                                const dns = this.dnsPort();
+                                for (const name of oikosNames) {
+                                    for (const record of await dns.findDnsRecord(zone.name, name, 'CNAME')) {
+                                        if (dnsTargets.has(record.content)) {
+                                            await dns.deleteDnsRecord(zone.name, record.id);
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        catch (error) {
+                            if (!isNotFoundError(error))
+                                throw error;
+                        }
+                    }
                     await this.tunnelPort().deleteTunnel(target.id);
                     return;
                 }