@wtfalch/foundry 0.61.0 → 0.63.0

package/dist/plan/index.d.ts

@@ -49,6 +49,8 @@ export { StageRestoreError, StageRestoreRefusedError, createStageCopyPort, execR
 export type { Runner, StageCopyPortDeps } from './stage-copy-port.js';
 export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, CallsSfuSshConnector, CallsSfuPlatformDeps, } from './platform-sfu.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
+export type { PlatformRegistryDeps, PlatformRegistryRuntime } from './platform-registry.js';
+export { PLATFORM_REGISTRY_PULL_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_USER, platformRegistryPushCredential, } from './platform-registry-keys.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './providers-readers.js';

package/dist/plan/index.js

@@ -30,6 +30,7 @@ export { STAGE_SINK_APPLIED_SCOPE_KEY, STAGE_SINK_IMAGE_REF, STAGE_SINK_SMTP_POR
 export { STAGE_COPY_EXCLUDED_TABLES, StageCopyFailedError, StageCopyRefusedError, stageCopy, tableExcluded, undoStageCopy, } from './stage-copy.js';
 export { StageRestoreError, StageRestoreRefusedError, createStageCopyPort, execRunner, } from './stage-copy-port.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
+export { PLATFORM_REGISTRY_PULL_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_PASSWORD_REF, PLATFORM_REGISTRY_PUSH_USER, platformRegistryPushCredential, } from './platform-registry-keys.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeLoginHostResolver, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';

package/dist/plan/jobs-scheduler-http.d.ts

@@ -26,4 +26,6 @@ export declare class HttpJobsSchedulerClient implements JobsSchedulerPort {
         secret?: string;
         syncKey?: string;
     }>;
+    /** `DELETE /admin/projects/<name>`. A refusal throws with the status only. */
+    deleteProject(name: string): Promise<void>;
 }

package/dist/plan/jobs-scheduler-http.js

@@ -50,4 +50,15 @@ export class HttpJobsSchedulerClient {
             syncKey: typeof fields.syncKey === 'string' ? fields.syncKey : undefined,
         };
     }
+    /** `DELETE /admin/projects/<name>`. A refusal throws with the status only. */
+    async deleteProject(name) {
+        const response = await this.fetchImpl(`${this.baseUrl}/admin/projects/${encodeURIComponent(name)}`, {
+            method: 'DELETE',
+            headers: { authorization: `Bearer ${this.adminToken}` },
+            signal: AbortSignal.timeout(ADMIN_CALL_TIMEOUT_MS),
+        });
+        if (response.status === 200 || response.status === 204)
+            return;
+        throw Object.assign(new Error(`jobs scheduler: DELETE /admin/projects/<name> answered ${response.status}`), { status: response.status });
+    }
 }

package/dist/plan/kosmos.d.ts

@@ -0,0 +1,56 @@
+import type { DeclaredOrg } from '../org.js';
+/**
+ * foundry#949: what both the planner (`diff.ts`) and the executor
+ * (`executor.ts`) need to agree on for an org's kosmos -- the hostname, the
+ * recorded ids and the env vars those produce -- so the plan can compare the
+ * live app with exactly what the executor would write. The same split
+ * `boule.ts` and `agora.ts` already follow, trimmed to what kosmos needs for
+ * its first release: a ZITADEL client, a database and sign-in env. Kosmos has
+ * no mail, no owner seeding and no Archon credential -- it is not Boule.
+ */
+/**
+ * The fixed `kosmos` ZITADEL web client's `clientId`, recorded by
+ * `executor.ts`'s `zitadelApp` and read by `coolifyKosmos` for
+ * `AUTH_CLIENT_ID`. Public, not a secret, so a flat scope id like
+ * `boule_client_id`.
+ */
+export declare const KOSMOS_CLIENT_ID_SCOPE_KEY = "kosmos_client_id";
+/**
+ * The kosmos database's Coolify uuid. It has no `system:kind:key` slot of its
+ * own (the step's one auto-recorded `resourceId` is the app), so it is a flat
+ * scope id, like the Boule and cms databases.
+ */
+export declare const KOSMOS_DATABASE_SCOPE_KEY = "coolify_kosmos_database";
+/**
+ * Recorded once `coolifyKosmos` has actually called `deploy` on this org's
+ * kosmos app -- the same marker {@link BOULE_DEPLOYED_SCOPE_KEY} (`boule.ts`)
+ * and {@link AGORA_DEPLOYED_SCOPE_KEY} (`agora.ts`) are, and for the same
+ * reason: Coolify defaults `instant_deploy` to false, so a freshly created
+ * app sat built but never started.
+ */
+export declare const KOSMOS_DEPLOYED_SCOPE_KEY = "coolify_kosmos_deployed";
+/**
+ * `kosmos.<domain>` when the org has a domain, `<slug>-kosmos.oikos.host`
+ * otherwise -- the same tier rule `bouleHostnameFor`/`agoraHostnameFor`
+ * follow; `../slug.ts`'s `KOSMOS_SUFFIX` reserves the collision.
+ */
+export declare function kosmosHostnameFor(org: DeclaredOrg): string;
+/** The env names `desiredKosmosEnv` can write, so the live reader knows which to read back. */
+export declare const KOSMOS_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID"];
+/**
+ * The env vars an org's kosmos app should carry, and every input still missing
+ * to build them. Callers that write must refuse on a non-empty `missing`: an
+ * kosmos with a blank client id fails every sign-in. `issuer` is the host's
+ * issuer address (`AgoraHostValues.issuer`), the same one Agora and Boule sign
+ * in at.
+ *
+ * Not here, and written by the executor instead: the database URLs
+ * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
+ * (generated once, never rotated) -- the same split `desiredBouleEnv` keeps.
+ */
+export declare function desiredKosmosEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, issuer: string | null): {
+    env: Record<string, string>;
+    missing: string[];
+};
+/** The desired env keys the live app lacks or holds a different value for. */
+export declare function kosmosEnvDrift(desired: Readonly<Record<string, string>>, live: Readonly<Record<string, string>>): string[];

package/dist/plan/kosmos.js

@@ -0,0 +1,84 @@
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+/**
+ * foundry#949: what both the planner (`diff.ts`) and the executor
+ * (`executor.ts`) need to agree on for an org's kosmos -- the hostname, the
+ * recorded ids and the env vars those produce -- so the plan can compare the
+ * live app with exactly what the executor would write. The same split
+ * `boule.ts` and `agora.ts` already follow, trimmed to what kosmos needs for
+ * its first release: a ZITADEL client, a database and sign-in env. Kosmos has
+ * no mail, no owner seeding and no Archon credential -- it is not Boule.
+ */
+/**
+ * The fixed `kosmos` ZITADEL web client's `clientId`, recorded by
+ * `executor.ts`'s `zitadelApp` and read by `coolifyKosmos` for
+ * `AUTH_CLIENT_ID`. Public, not a secret, so a flat scope id like
+ * `boule_client_id`.
+ */
+export const KOSMOS_CLIENT_ID_SCOPE_KEY = 'kosmos_client_id';
+/**
+ * The kosmos database's Coolify uuid. It has no `system:kind:key` slot of its
+ * own (the step's one auto-recorded `resourceId` is the app), so it is a flat
+ * scope id, like the Boule and cms databases.
+ */
+export const KOSMOS_DATABASE_SCOPE_KEY = 'coolify_kosmos_database';
+/**
+ * Recorded once `coolifyKosmos` has actually called `deploy` on this org's
+ * kosmos app -- the same marker {@link BOULE_DEPLOYED_SCOPE_KEY} (`boule.ts`)
+ * and {@link AGORA_DEPLOYED_SCOPE_KEY} (`agora.ts`) are, and for the same
+ * reason: Coolify defaults `instant_deploy` to false, so a freshly created
+ * app sat built but never started.
+ */
+export const KOSMOS_DEPLOYED_SCOPE_KEY = 'coolify_kosmos_deployed';
+/**
+ * `kosmos.<domain>` when the org has a domain, `<slug>-kosmos.oikos.host`
+ * otherwise -- the same tier rule `bouleHostnameFor`/`agoraHostnameFor`
+ * follow; `../slug.ts`'s `KOSMOS_SUFFIX` reserves the collision.
+ */
+export function kosmosHostnameFor(org) {
+    return org.domain ? `kosmos.${org.domain}` : `${org.slug}-kosmos.oikos.host`;
+}
+/** The env names `desiredKosmosEnv` can write, so the live reader knows which to read back. */
+export const KOSMOS_MANAGED_ENV_KEYS = [
+    'APP_URL',
+    'AUTH_ISSUER',
+    'AUTH_ORGANIZATION_ID',
+    'AUTH_CLIENT_ID',
+];
+/**
+ * The env vars an org's kosmos app should carry, and every input still missing
+ * to build them. Callers that write must refuse on a non-empty `missing`: an
+ * kosmos with a blank client id fails every sign-in. `issuer` is the host's
+ * issuer address (`AgoraHostValues.issuer`), the same one Agora and Boule sign
+ * in at.
+ *
+ * Not here, and written by the executor instead: the database URLs
+ * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
+ * (generated once, never rotated) -- the same split `desiredBouleEnv` keeps.
+ */
+export function desiredKosmosEnv(org, recorded, issuer) {
+    const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+    const clientId = recorded[KOSMOS_CLIENT_ID_SCOPE_KEY];
+    const missing = [];
+    if (!issuer)
+        missing.push('issuer');
+    if (!zitadelOrgId)
+        missing.push('zitadelOrgId');
+    if (!clientId)
+        missing.push('clientId');
+    const env = {
+        APP_URL: `https://${kosmosHostnameFor(org)}`,
+    };
+    if (issuer)
+        env.AUTH_ISSUER = issuer;
+    if (zitadelOrgId)
+        env.AUTH_ORGANIZATION_ID = zitadelOrgId;
+    if (clientId)
+        env.AUTH_CLIENT_ID = clientId;
+    return { env, missing };
+}
+/** The desired env keys the live app lacks or holds a different value for. */
+export function kosmosEnvDrift(desired, live) {
+    return Object.entries(desired)
+        .filter(([key, value]) => live[key] !== value)
+        .map(([key]) => key);
+}

package/dist/plan/locked-hostnames.js

@@ -1,8 +1,9 @@
-import { ownsServices } from '../org.js';
+import { kosmosOn, ownsServices } from '../org.js';
 import { OWN_SERVICE_LABELS } from '../service-labels.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { cmsStudioHostnameFor, siteHostnameFor } from './hostnames.js';
+import { kosmosHostnameFor } from './kosmos.js';
 import { loginHostnameFor } from './login-host.js';
 import { ownHostnames } from './own-hostnames.js';
 export { OWN_SERVICE_LABELS };
@@ -31,6 +32,8 @@ export function lockedHostnames(org, platformHostnames) {
     }
     locked.add(agoraHostnameFor(org));
     locked.add(bouleHostnameFor(org));
+    if (kosmosOn(org))
+        locked.add(kosmosHostnameFor(org));
     if (org.site.enabled)
         locked.add(cmsStudioHostnameFor(org));
     if (org.calls.enabled && org.calls.usesDomain)
@@ -58,6 +61,6 @@ export function hostingNames(org, platformHostnames) {
         locked: lockedHostnames(org, platformHostnames),
         slug: org.slug,
         siteOwnsApex: org.site.enabled && org.site.usesDomain && org.domain !== null,
-        builtinBlueGreen: org.boule?.blueGreen !== undefined || org.agora?.blueGreen !== undefined,
+        builtinBlueGreen: org.boule?.blueGreen !== undefined || org.agora?.blueGreen !== undefined || kosmosOn(org),
     };
 }

package/dist/plan/org-names.d.ts

@@ -6,13 +6,13 @@ export type OrgNameSource = 'own' | 'hosting';
  * hosting entries: Agora, Boule, the tunnel and its connector, and chat,
  * calls and the cms site while they are on.
  */
-export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site'>): string[];
+export declare function companyServiceNames(org: Pick<DeclaredOrg, 'slug' | 'chat' | 'calls' | 'site' | 'kosmos'>): string[];
 /**
  * Every container name, network alias, database, tunnel and bucket name that
  * foundry derives for an org: its own-service names when it owns services,
  * and its hosting-entry and database names.
  */
-export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>): {
+export declare function orgDerivedNames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>): {
     name: string;
     source: OrgNameSource;
 }[];
@@ -26,5 +26,5 @@ export interface NameClash {
     source: OrgNameSource;
 }
 /** Every name `org` derives that another org or the platform also derives. */
-export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site'>[]): NameClash[];
+export declare function findNameClashes(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>, others: readonly Pick<DeclaredOrg, 'slug' | 'domain' | 'services' | 'hosting' | 'chat' | 'calls' | 'site' | 'kosmos'>[]): NameClash[];
 export declare function nameClashMessage(slug: string, clash: NameClash): string;

package/dist/plan/org-names.js

@@ -1,4 +1,4 @@
-import { ownsServices } from '../org.js';
+import { kosmosOn, ownsServices } from '../org.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { chatInternalNames, chatRekeyedInternalNames } from './chat-matrix.js';
 import { workerAppHostname, workspaceHost, workspaceInboxHost } from './hostnames.js';
@@ -20,6 +20,8 @@ export function companyServiceNames(org) {
         `${s}-tunnel`,
         `${s}-cloudflared`,
     ];
+    if (kosmosOn(org))
+        names.push(`${s}-kosmos`, `${s}-kosmos-db`);
     if (org.chat?.enabled) {
         names.push(...Object.values(chatInternalNames(s)), ...Object.values(chatRekeyedInternalNames(s)));
     }

package/dist/plan/org-postgres-migrate.js

@@ -64,6 +64,7 @@ export function parseMigrationConfirmation(raw) {
 const MIGRATION_ORDER = [
     'app',
     'cms',
+    'kosmos',
     'boule',
     'chat_service',
     'calls_service',

package/dist/plan/own-limits.d.ts

@@ -107,6 +107,12 @@ export declare const LIMITS: {
         autoDeploy: false | "declared";
         capabilities: CapabilityTier;
     };
+    readonly kosmos: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
     readonly companyOther: {
         memory: string;
         dbMemory: string;
@@ -167,6 +173,12 @@ export declare const LIMITS: {
         autoDeploy: false | "declared";
         capabilities: CapabilityTier;
     };
+    readonly platformRegistry: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
     readonly platformMail: {
         memory: string;
         dbMemory: string;

package/dist/plan/own-limits.js

@@ -29,6 +29,7 @@ export const LIMITS = {
     calls: profile('1g', '512m'),
     agora: profile('1g', '512m'),
     boule: profile('512m'),
+    kosmos: profile('512m'),
     companyOther: profile('1g', '512m'),
     platformArchon: profile('1g'),
     platformAi: profile('1g'),
@@ -39,6 +40,7 @@ export const LIMITS = {
     platformFiles: profile('1g'),
     platformEdge: profile('512m'),
     platformHc: profile('512m'),
+    platformRegistry: profile('256m'),
     platformMail: profile('1g'),
     platformAuth: profile('1g'),
     platformJobs: profile('1g'),

package/dist/plan/plan-apply.d.ts

@@ -4,7 +4,7 @@ import { type AuditSealingOptions } from '../audit/tick.js';
 import type { DeclaredOrg, HostingEntry, OrgId } from '../org.js';
 import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
-import type { ReleaseStore } from '../release/state.js';
+import { type ReleaseStore } from '../release/state.js';
 import type { JobRunner } from '../runner/types.js';
 import type { AppliedState } from '../state.js';
 import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore } from '../store.js';
@@ -224,11 +224,21 @@ export interface StepExecutor {
     }>>;
     /** Whether the company's stage mail sink app (by Coolify id) is stopped or gone, read live. Optional: an executor without it reads the sink as up. */
     stageSinkDown?(appId: string): Promise<boolean>;
+    /** Which stage-guard ports the host has; they decide the guard names in the applied structure hash. Optional: neither. */
+    stageGuardPorts?(): {
+        probes: boolean;
+        access: boolean;
+    };
     /**
      * The release runner's outside calls for one blue/green entry (`plan/release-host.ts`); `null` while its blue
      * copy is not recorded. Optional: an executor without it runs no release.
      */
     releaseHost?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /**
+     * One release tick for one subject: the recorded stage gate's list follows the people holding `releases:preview`,
+     * owners staying. Never throws. Optional: an executor without it leaves every gate as it is.
+     */
+    syncStageGateMembers?(org: DeclaredOrg, subject: BlueGreenSubject, context: ReleaseContext): Promise<void>;
     /** Whether the executor's held keys can store a Worker app database's CA and certificate. Absent: true. */
     workerAppDbKeysPuttable?(): boolean;
     /** Whether the host supplies the backup bucket a Worker app database dumps into. Absent: true. */
@@ -305,6 +315,8 @@ export interface PlatformDriftedSteps {
     authApps?: boolean;
     /** The host sets it. */
     edge?: boolean;
+    /** A usable, reachable Coolify server has no registry login for the current host and passwords. */
+    registryLogins?: boolean;
     /** #380 */
     files?: boolean;
     backupStorage?: boolean;
@@ -340,6 +352,8 @@ export interface PlatformStepExecutor {
         backupExecutorMissing?: boolean;
         /** #540: see `PlanPlatformOptions.blocked.hc` (`platform-diff.ts`). */
         hc?: string;
+        /** See `PlanPlatformOptions.blocked.registry` (`platform-diff.ts`). */
+        registry?: string;
         /** #540: see `PlanPlatformOptions.blocked.heartbeatsExecutorMissing` (`platform-diff.ts`). */
         heartbeatsExecutorMissing?: boolean;
         /** foundry#542: see `PlanPlatformOptions.blocked.uptime` (`platform-diff.ts`). */
@@ -373,8 +387,12 @@ export interface PlatformStepExecutor {
         servers?: BlueGreenServer[];
         blocked?: string;
     }>;
+    /** The stage guards platform-archon can make now, by name; they go into its applied structure hash. */
+    archonStageGuardNames?(platform: DeclaredPlatform, recorded: Readonly<Record<string, string>>, owner: PlatformOwnerInput): string[];
     /** The release runner's outside calls for platform-archon (`plan/release-host.ts`); `null` while its app is not recorded. */
     releaseHost?(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext, renew: () => Promise<void>): ReleaseHost | null;
+    /** As {@link FoundryStepExecutor.syncStageGateMembers}, for platform-archon's own stage gate (orgId `platform`). */
+    syncStageGateMembers?(platform: DeclaredPlatform, subject: BlueGreenSubject, context: ReleaseContext): Promise<void>;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
@@ -633,6 +651,14 @@ export interface FoundryPlanApplyOptions {
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
     leaseTtlMs?: number;
+    /**
+     * A stage copy runs without the org's lease and takes it for a moment each time it records something. When an
+     * apply or a tick holds the lease it waits `waitMs` and tries again, up to `tries` times. Defaults to 30 s and 10.
+     */
+    copyLeaseRetry?: {
+        tries: number;
+        waitMs: number;
+    };
     /**
      * #441 (part b): a durable, DB-row-backed record of `apply`, `destroy`,
      * `adopt` and `release` for one org, held under the same mutation lease
@@ -730,6 +756,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly onlySteps;
     private readonly now;
     private readonly leaseTtlMs;
+    private readonly copyLeaseRetry;
     private readonly appliedVersions;
     private readonly backupGate;
     private readonly platformDeps;
@@ -900,6 +927,25 @@ export declare class FoundryPlanApply implements PlanApply {
         target: string;
         error?: string;
     }>>;
+    /**
+     * Phase 2 for one org: takes the copy lock of each stage copy request under the org's lease, then runs the
+     * copies after the lease is released. While a copy runs, every other tick and apply for the org goes on, a
+     * hard-fail rollback included; the copy records through short leases ({@link copyContext}).
+     */
+    private runOrgStageCopies;
+    /** Phase 2 for platform-archon; see {@link runOrgStageCopies}. */
+    private runPlatformStageCopies;
+    /**
+     * Runs one claimed copy with no lease held, then records its outcome and consumes the request. A lost lock
+     * throws (`StaleLeaseError`) and leaves the request open.
+     */
+    private runClaimedCopy;
+    /**
+     * The recorded ids a copy reads and writes, without the org's lease. It reads a snapshot taken when the lock was
+     * claimed; each `persist` takes the lease for a moment, re-reads the stored ids and writes only the keys the
+     * copy changed, so a tick that ran in between loses nothing. The lease may be busy: it waits and tries again.
+     */
+    private copyContext;
     /**
      * The recurring audit sealing run (foundry#929): seals every ledger registered by an `audit:ledger` step with the
      * platform signer and has the timestamp authority stamp the new checkpoints. Foundry has no scheduler, so the host
@@ -907,6 +953,10 @@ export declare class FoundryPlanApply implements PlanApply {
      * log line say what happened and why when nothing did. It writes nothing to the org's records.
      */
     runAuditSealTick(): Promise<SealResult[]>;
+    /**
+     * One org's release run. `defer`: stage copy requests stay open and `deferred` says whether there were any.
+     * `claim`: the copies this run decided on, each with its lock taken, for {@link runClaimedCopy}.
+     */
     private runOrgReleaseTick;
     /** An own org with calls on: the host's answer about its slot's ports. A failure or a slow answer is "not open". */
     private readSfuPortsOpen;