@wtfalch/foundry 0.7.1 → 0.8.0

package/dist/bootstrap/bootstrap.d.ts

@@ -1,4 +1,3 @@
-import type { MigrateSql } from '../migrate.js';
 import type { PlatformLiveReaders, PlatformStepExecutor } from '../plan/index.js';
 import type { FoundryPlatformStepExecutorOptions } from '../plan/platform-providers.js';
 import type { FoundryStoreDb } from '../store/postgres.js';
@@ -27,7 +26,7 @@ export interface RootCredentials {
 }
 /** What Archon's onboarding screen shows: one event per phase or round. */
 export interface BootstrapProgress {
-    phase: 'migrate' | 'declare' | 'plan' | 'apply' | 'done';
+    phase: 'declare' | 'plan' | 'apply' | 'done';
     round?: number;
     message: string;
     steps?: string[];
@@ -35,10 +34,8 @@ export interface BootstrapProgress {
 /** Everything foundry's per-step executors take besides the two clients and `deliverSecret`. */
 export type BootstrapExecutorDeps = Omit<FoundryPlatformStepExecutorOptions, 'coolify' | 'deliverSecret'>;
 export interface BootstrapPlatformDeps {
-    /** Foundry's tables live here; the store, the audit log and the plan all use it. */
+    /** Foundry's tables live here, already migrated by the host; the store, the audit log and the plan all use it. */
     db: FoundryStoreDb;
-    /** The same database, for the migration runner. */
-    migrateSql: MigrateSql;
     rootCredentials: () => Promise<RootCredentials>;
     deliverSecret: (ref: string, secret: string) => Promise<void>;
     /**
@@ -52,6 +49,13 @@ export interface BootstrapPlatformDeps {
     };
     /** Per-step dependencies (auth, mail, files, ai, integrations, archon, sfu). A step without its own is reported blocked. */
     executor?: BootstrapExecutorDeps;
+    /**
+     * Passed to `createPostgresAuditLog`. Omit it in a real deployment: `db` is
+     * the runtime role the host made with `ensureRuntimeRole`, and the default
+     * (on) checks that. Only a fixture without that role (PGlite, whose one user
+     * is a superuser) needs `false`.
+     */
+    checkRuntimeRole?: boolean;
     onProgress?: (event: BootstrapProgress) => void;
     /** Rounds before the run gives up. Default 20. */
     maxRounds?: number;
@@ -97,9 +101,9 @@ export declare class Redactor {
 /** Wraps the secret-carrying ports inside one step's deps so what they deliver or resolve is redacted. */
 export declare function guardStepDeps(executor: BootstrapExecutorDeps | undefined, redactor: Redactor, deliverSecret: (ref: string, secret: string) => Promise<void>, heldKeys: BootstrapPlatformDeps['heldKeys']): BootstrapExecutorDeps;
 /**
- * The platform's first apply, run from Archon's onboarding flow: migrates
- * foundry's tables, declares Company Included and the platform (never
- * overwriting a row already there), then plans and applies round by round
+ * The platform's first apply, run from Archon's onboarding flow, against a
+ * database the host has already migrated: declares Company Included and the
+ * platform (never overwriting a row already there), then plans and applies round by round
  * until every step is applied or reported blocked. Reads no env and no file:
  * the database, root credentials, held keys and every per-step dependency
  * come in through `deps`.

package/dist/bootstrap/bootstrap.js

@@ -1,6 +1,5 @@
 import { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import { CoolifyClient } from '@wtfalch/providers/coolify';
-import { migrate } from '../migrate.js';
 import { FoundryPlanApply, FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, } from '../plan/index.js';
 import { createPostgresAuditLog } from '../store/audit.js';
 import { createPostgresDeclaredOrgStore, createPostgresPlatformStore } from '../store/postgres.js';
@@ -140,9 +139,9 @@ function archonMasterKeys(guarded, credentials) {
     };
 }
 /**
- * The platform's first apply, run from Archon's onboarding flow: migrates
- * foundry's tables, declares Company Included and the platform (never
- * overwriting a row already there), then plans and applies round by round
+ * The platform's first apply, run from Archon's onboarding flow, against a
+ * database the host has already migrated: declares Company Included and the
+ * platform (never overwriting a row already there), then plans and applies round by round
  * until every step is applied or reported blocked. Reads no env and no file:
  * the database, root credentials, held keys and every per-step dependency
  * come in through `deps`.
@@ -187,13 +186,6 @@ export async function bootstrapPlatform(input, deps) {
                 }
                 : {}),
         };
-        const migrated = await migrate(deps.migrateSql);
-        emit({
-            phase: 'migrate',
-            message: migrated.applied.length === 0
-                ? 'foundry tables already up to date'
-                : `migrated: ${migrated.applied.join(', ')}`,
-        });
         const orgStore = createPostgresDeclaredOrgStore(deps.db);
         const platformStore = createPostgresPlatformStore(deps.db);
         if (await orgStore.get(COMPANY_INCLUDED_ORG_ID)) {
@@ -264,7 +256,7 @@ export async function bootstrapPlatform(input, deps) {
             },
             executor: unusedOrgExecutor,
             destroyer: unusedOrgExecutor,
-            audit: redactingAudit(createPostgresAuditLog(deps.db), redactor),
+            audit: redactingAudit(createPostgresAuditLog(deps.db, { checkRuntimeRole: deps.checkRuntimeRole }), redactor),
             authz: allowPlatformApply,
             actor: { id: 'bootstrap-platform', display: 'bootstrapPlatform' },
             platform: { store: platformStore, readers: runtime.readers, executor },

package/dist/bootstrap/versions.d.ts

@@ -15,3 +15,11 @@ export interface PinnedVersions {
 }
 export declare function loadVersions(): PinnedVersions;
 export declare const VERSIONS: PinnedVersions;
+/**
+ * Why an image tag cannot be used, or `null`. #248: generalised out of what
+ * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard
+ * `versions.json` had before -- `livekit/livekit-server:latest` was the live
+ * case with none. `label` names the image in the message (`"Stalwart"`,
+ * `"ZITADEL"`, `"LiveKit"`, ...); `example` is a real pinned tag to suggest.
+ */
+export declare function floatingTagBlocked(label: string, tag: string, example: string): string | null;

package/dist/bootstrap/versions.js

@@ -10,3 +10,34 @@ export function loadVersions() {
     return JSON.parse(readFileSync(VERSIONS_PATH, 'utf8'));
 }
 export const VERSIONS = loadVersions();
+/**
+ * Tag spellings that resolve to whatever the registry currently has, not a
+ * fixed image -- a re-apply of the same declaration can silently run a
+ * different version with no diff shown anywhere (#248). `main`/`master` are
+ * default-branch Docker Hub aliases some of these images publish alongside
+ * their release tags, not git refs.
+ */
+const FLOATING_TAGS = new Set([
+    'latest',
+    'main',
+    'master',
+    'stable',
+    'dev',
+    'edge',
+    'nightly',
+    'head',
+]);
+/**
+ * Why an image tag cannot be used, or `null`. #248: generalised out of what
+ * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard
+ * `versions.json` had before -- `livekit/livekit-server:latest` was the live
+ * case with none. `label` names the image in the message (`"Stalwart"`,
+ * `"ZITADEL"`, `"LiveKit"`, ...); `example` is a real pinned tag to suggest.
+ */
+export function floatingTagBlocked(label, tag, example) {
+    const trimmed = tag.trim();
+    if (trimmed === '' || FLOATING_TAGS.has(trimmed.toLowerCase())) {
+        return `the ${label} image tag "${tag}" floats; declare a pinned release (for example ${example})`;
+    }
+    return null;
+}

package/dist/calls-sfu-deploy-support.d.ts

@@ -7,7 +7,7 @@
  * -- the one place both `scripts/calls-sfu-deploy.mjs` (#122) and the
  * platform `sfu` step (`plan/platform-sfu.ts`, #170) use it. The real SSH
  * session -- `ssh2`'s `Client`/`sftp`/`exec` wiring -- stays untested, same
- * as `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
+ * as `foundry-db-provision.mjs`: real I/O, no branch
  * logic worth a fake session over.
  *
  * Each export here answers one finding from PR #125's review (#122):

package/dist/calls-sfu-deploy-support.js

@@ -7,7 +7,7 @@
  * -- the one place both `scripts/calls-sfu-deploy.mjs` (#122) and the
  * platform `sfu` step (`plan/platform-sfu.ts`, #170) use it. The real SSH
  * session -- `ssh2`'s `Client`/`sftp`/`exec` wiring -- stays untested, same
- * as `foundry-db-provision.mjs`/`foundry-db-migrate.mjs`: real I/O, no branch
+ * as `foundry-db-provision.mjs`: real I/O, no branch
  * logic worth a fake session over.
  *
  * Each export here answers one finding from PR #125's review (#122):

package/dist/calls-sfu-ssh-adapter.d.ts

@@ -11,7 +11,7 @@
  * host-key refusal and the 0600 file mode without ever opening a socket.
  * `calls-sfu-ssh-client.ts`'s `connectCallsSfuSsh` is the one real
  * implementation, over `ssh2`, and stays untested for the same reason
- * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs` do: real I/O, no
+ * `foundry-db-provision.mjs` does: real I/O, no
  * branch logic worth a fake session over.
  */
 import { type CallsSfuConfig, type CallsSfuHostPort } from './calls-sfu.js';

package/dist/calls-sfu-ssh-adapter.js

@@ -11,7 +11,7 @@
  * host-key refusal and the 0600 file mode without ever opening a socket.
  * `calls-sfu-ssh-client.ts`'s `connectCallsSfuSsh` is the one real
  * implementation, over `ssh2`, and stays untested for the same reason
- * `foundry-db-provision.mjs`/`foundry-db-migrate.mjs` do: real I/O, no
+ * `foundry-db-provision.mjs` does: real I/O, no
  * branch logic worth a fake session over.
  */
 import { dirname } from 'node:path';

package/dist/calls-sfu.d.ts

@@ -114,10 +114,11 @@ export declare const LIVEKIT_CONFIG_PATH = "/opt/livekit/livekit.yaml";
 /** Holds `TUNNEL_TOKEN=...` -- the one secret the `cloudflared` compose service reads (`env_file:`, below). */
 export declare const CLOUDFLARED_ENV_PATH = "/opt/livekit/cloudflared.env";
 /**
- * `:latest`, matching this codebase's one other pinned-by-tag-only image
- * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet. Pinned in
- * `versions.json` (#247).
+ * Pinned to a release tag (#248) -- `versions.json`'s `livekit` entry ran
+ * `:latest` until then, the one live case `floatingTagBlocked`
+ * (`bootstrap/versions.ts`) exists for: a re-apply of the same declaration
+ * silently running a different version, with no diff shown anywhere.
+ * Pinned in `versions.json` (#247).
  */
 export declare const LIVEKIT_IMAGE_REF: string;
 /** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */

package/dist/calls-sfu.js

@@ -104,10 +104,11 @@ export const LIVEKIT_CONFIG_PATH = '/opt/livekit/livekit.yaml';
 /** Holds `TUNNEL_TOKEN=...` -- the one secret the `cloudflared` compose service reads (`env_file:`, below). */
 export const CLOUDFLARED_ENV_PATH = '/opt/livekit/cloudflared.env';
 /**
- * `:latest`, matching this codebase's one other pinned-by-tag-only image
- * (`scripts/shared-ingress.mjs`'s `CLOUDFLARED_IMAGE_REF`) -- neither runs
- * anywhere a supply-chain review has asked for a digest pin yet. Pinned in
- * `versions.json` (#247).
+ * Pinned to a release tag (#248) -- `versions.json`'s `livekit` entry ran
+ * `:latest` until then, the one live case `floatingTagBlocked`
+ * (`bootstrap/versions.ts`) exists for: a re-apply of the same declaration
+ * silently running a different version, with no diff shown anywhere.
+ * Pinned in `versions.json` (#247).
  */
 export const LIVEKIT_IMAGE_REF = `livekit/livekit-server:${VERSIONS.livekit}`;
 /** Pinned to a release tag; equals `scripts/shared-ingress.mjs`'s own `CLOUDFLARED_IMAGE_REF` constant (duplicated, not imported -- this package and that top-level script sit in separate places in the tree). Pinned in `versions.json` (#247). */

package/dist/index.d.ts

@@ -43,8 +43,7 @@ export type { LivekitCredentials } from './calls-sfu-keys.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './plan/index.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
-export type { MigrateSql, MigrationResult } from './migrate.js';
-export { MIGRATIONS_DIR, migrate } from './migrate.js';
+export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export type { BootstrapCompany, BootstrapExecutorDeps, BootstrapOwner, BootstrapPlatformDeps, BootstrapPlatformInput, BootstrapProgress, BootstrapResult, RootCredentials, } from './bootstrap/index.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export type { RunnerDb } from './runner/db.js';

package/dist/index.js

@@ -20,7 +20,10 @@ export { connectCallsSfuSsh } from './calls-sfu-ssh-client.js';
 export { UnknownCallsSfuHostKeyError, toCallsSfuHostPort, applyCallsSfuOverSession, } from './calls-sfu-ssh-adapter.js';
 export { mintLivekitCredentials } from './calls-sfu-keys.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './plan/index.js';
-export { MIGRATIONS_DIR, migrate } from './migrate.js';
+// The shipped migrations' directory; hosts apply them with `@wtfalch/db`'s
+// `runMigrationSources`. Also at `@wtfalch/foundry/migrations-dir`, which
+// imports nothing else.
+export { migrationsDir as MIGRATIONS_DIR } from './migrations-dir.js';
 export { bootstrapPlatform } from './bootstrap/index.js';
 export { AlreadyRunningError, RunNotFoundError, StepFailedError, StepMismatchError, } from './runner/errors.js';
 export { createJobRunner } from './runner/runner.js';

package/dist/migrations/0024_audit_events.sql

@@ -164,7 +164,7 @@ create or replace function audit_erase_person(subject text, pseudonym text, subj
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   touched integer;

package/dist/migrations/0025_audit_display.sql

@@ -102,7 +102,7 @@ create or replace function audit_erase_person(subject text, pseudonym text, subj
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   touched integer;

package/dist/migrations/0026_audit_erase_email_guard.sql

@@ -29,7 +29,7 @@ create or replace function audit_erase_person(subject text, pseudonym text, subj
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   touched integer;

package/dist/migrations/0027_audit_chain.sql

@@ -145,7 +145,7 @@ create or replace function audit_seal_erasure(row_id bigint, erasure_hash_value
 returns void
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 begin
   update audit_events

package/dist/migrations/0028_audit_rls.sql

@@ -74,7 +74,7 @@ returns text
 language sql
 stable
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
   select row_hash from audit_events order by id desc limit 1
 $$;
@@ -88,7 +88,7 @@ returns table (id bigint, row_hash text, erased_at timestamptz)
 language sql
 stable
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
   select e.id, e.row_hash, e.erased_at
     from audit_events e

package/dist/migrations-dir.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'foundry', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/foundry/migrations-dir`) and no other imports: a
+ * migration image imports this without the rest of the package.
+ */
+export declare const migrationsDir: string;

package/dist/migrations-dir.js

@@ -0,0 +1,10 @@
+import { fileURLToPath } from 'node:url';
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'foundry', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/foundry/migrations-dir`) and no other imports: a
+ * migration image imports this without the rest of the package.
+ */
+export const migrationsDir = fileURLToPath(new URL('./migrations/', import.meta.url));

package/dist/plan/calls-matrix.d.ts

@@ -47,6 +47,8 @@
 export declare const SYNAPSE_IMAGE = "ghcr.io/element-hq/synapse";
 export declare const SYNAPSE_TAG: string;
 export declare const MAS_IMAGE: string;
+/** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
+export declare const MAS_TAG: string;
 /**
  * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
  * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and

package/dist/plan/calls-matrix.js

@@ -49,6 +49,8 @@ import { VERSIONS } from '../bootstrap/versions.js';
 export const SYNAPSE_IMAGE = 'ghcr.io/element-hq/synapse';
 export const SYNAPSE_TAG = VERSIONS.synapse;
 export const MAS_IMAGE = `ghcr.io/element-hq/matrix-authentication-service:${VERSIONS.mas}`;
+/** #251: the version baked into {@link MAS_IMAGE}'s `FROM` line, named on its own so a version-change line can read it without re-parsing the image string. */
+export const MAS_TAG = VERSIONS.mas;
 /**
  * Never resolved by DNS and never federates (`callsSynapseHomeserverYaml`'s
  * `federation_domain_whitelist: []`) -- purely a logical identifier MAS and

package/dist/plan/diff.d.ts

@@ -1,5 +1,5 @@
 import type { DeclaredOrg, OrgId } from '../org.js';
-import type { Plan, PlanStep, UnmanagedItem } from '../plan.js';
+import type { Plan, PlanStep, UnmanagedItem, VersionChangeItem } from '../plan.js';
 import { type AgoraHostReading } from './agora.js';
 import type { LiveResource } from './live.js';
 import { type OrgPlatformReadiness } from './platform-org.js';
@@ -39,6 +39,8 @@ export interface PlanDetail {
     orgId: OrgId;
     plannedSteps: PlannedStep[];
     unmanaged: UnmanagedItem[];
+    /** #251: see `VersionChangeItem` (`../plan.ts`). Never folded into `plannedSteps`. */
+    versionChanges: VersionChangeItem[];
 }
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export declare function toPlan(detail: PlanDetail): Plan;

package/dist/plan/diff.js

@@ -1,7 +1,8 @@
+import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, desiredAgoraEnv, } from './agora.js';
-import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, loginHostnameFor, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { APP_ENV_APPLIED_SCOPE_KEY, DB_ENV_APPLIED_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, resolveAppEnv, } from './platform-diff.js';
+import { APP_ENV_APPLIED_SCOPE_KEY, CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, DB_ENV_APPLIED_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, resolveAppEnv, versionNotAppliedLine, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS } from './platform-org.js';
 /** The `Plan` (#19's public contract) a `PlanDetail` carries. */
 export function toPlan(detail) {
@@ -9,6 +10,7 @@ export function toPlan(detail) {
         orgId: detail.orgId,
         steps: detail.plannedSteps.map((p) => p.step),
         unmanaged: detail.unmanaged,
+        versionChanges: detail.versionChanges,
     };
 }
 function resourceKey(system, kind, key) {
@@ -115,6 +117,22 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const callsService = planCallsService(org, byKey, claimed, platformReadiness.callsReady);
     if (callsService.step)
         plannedSteps.push(callsService.step);
+    // #251: same mechanism as the platform's own version-change lines -- see
+    // `planPlatform`'s own block in `platform-diff.ts`. Synapse and MAS never
+    // patch a running app's image tag once created, so this is
+    // `versionNotAppliedLine`, the same honest wording zitadel's own line
+    // uses, never `versionChangeLine`'s "X -> Y (redeploy)" -- nothing here
+    // ever performs that redeploy.
+    const versionChanges = [];
+    if (org.calls.enabled && !calls.blocked) {
+        const callsAppLive = Boolean(byKey.get(resourceKey('coolify', 'calls', org.id)));
+        const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], VERSIONS.synapse);
+        if (synapseChange)
+            versionChanges.push(synapseChange);
+        const masChange = versionNotAppliedLine('mas', callsAppLive, recordedIds[CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY], VERSIONS.mas);
+        if (masChange)
+            versionChanges.push(masChange);
+    }
     const filesOrganisation = planFilesOrganisation(org, byKey, claimed, platformReadiness.filesReady, platformReadiness.missingKeys.files, platformReadiness.noKeyReader);
     if (filesOrganisation.step)
         plannedSteps.push(filesOrganisation.step);
@@ -269,7 +287,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     unmanaged.push(...zoneBlocked);
     // #243: an appEnv source nothing will record is reported, not silently skipped.
     unmanaged.push(...app.blocked);
-    return { orgId: org.id, plannedSteps, unmanaged };
+    return { orgId: org.id, plannedSteps, unmanaged, versionChanges };
 }
 /**
  * The org's own ZITADEL org (issuer), a per-org singleton like every other
@@ -420,8 +438,12 @@ function planOwner(org, recordedIds, authReady) {
  * for *this* apply, so an org moving from tier 1 onto its own domain (or
  * losing one) replans this step rather than staying silent forever once
  * first applied -- `executor.ts`'s `zitadelLoginHost` then also moves every
- * already-live app onto the new base URI. Mints nothing either way: adding
- * a trusted domain is not a one-time secret, so there is no "undelivered"
+ * already-live app onto the new base URI, and (#274) removes the *old* host
+ * from ZITADEL's trusted domains and zitadel-login's binding, reading it
+ * back from this same recorded value before overwriting it -- no separate
+ * action field or planning step of its own needed for that half. Mints
+ * nothing either way: adding a trusted domain is not a one-time secret, so
+ * there is no "undelivered"
  * guard to check the way `planJobsRegistration`'s own does.
  *
  * Ordered right after `planOwner` (not after mail, chat, or any hosting
@@ -437,11 +459,16 @@ function planLoginHost(org, recordedIds, authReady, issuerPlanned, bindingsWired
     const none = { step: null, blocked: null };
     const key = resourceKey('zitadel', 'login-host', org.id);
     const host = loginHostnameFor(org);
-    // Already applied -- a re-run plans nothing unless the host changed or an app
-    // client id appeared since the binding was last written (#267, rule 4).
+    // Already applied -- a re-run plans nothing unless the host changed, an app
+    // client id appeared since the binding was last written (#267, rule 4), or
+    // an earlier host change still has a removal owed (#274 fix round 2):
+    // `zitadelLoginHost` always advances the recorded host to the current one,
+    // so a pending removal is the only way to know one is still owed, and
+    // nothing else here would replan the step to retry it.
     if (recordedIds[key] === host &&
         recordedIds[LOGIN_BINDING_SCOPE_KEY] ===
-            loginBindingState(host, loginHostClientIds(recordedIds))) {
+            loginBindingState(host, loginHostClientIds(recordedIds)) &&
+        pendingRemovalHosts(recordedIds).length === 0) {
         return none;
     }
     // #177: nothing to add a trusted domain to yet -- `planIssuer` already
@@ -494,6 +521,8 @@ const MAIL_OWNER_MAILBOX_SCOPE_KEY = 'mail_owner_mailbox';
 const MAIL_ROLE_MAILBOXES_SCOPE_KEY = 'mail_role_mailboxes';
 /** Restated from `executor.ts`, the same rule: the app id of the org tunnel's cloudflared connector. */
 const CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY = 'cloudflare_tunnel_connector_app';
+/** #236: restated from `executor.ts`, the same rule: the domain the org tunnel's DNS was last published under. */
+const CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY = 'cloudflare_tunnel_dns_domain';
 /** Restated from `executor.ts`, the same rule: the mail domain the last apply resolved. */
 const MAIL_DOMAIN_SCOPE_KEY = 'mail_domain';
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
@@ -754,6 +783,26 @@ function planCalls(org, byKey, claimed, callsReady) {
             blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: the platform's shared calls SFU is off`,
         };
     }
+    // #248: the two images this stack's own apply would run, checked the same
+    // way the platform's SFU checks LiveKit/cloudflared and ZITADEL checks its
+    // own tag -- a re-apply of the same declaration must not silently run a
+    // different version with no diff shown anywhere.
+    if (org.calls.enabled && !byKey.get(key)) {
+        const synapseBlocked = floatingTagBlocked('Synapse', VERSIONS.synapse, 'v1.161.0');
+        if (synapseBlocked) {
+            return {
+                step: null,
+                blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: ${synapseBlocked}`,
+            };
+        }
+        const masBlocked = floatingTagBlocked('matrix-authentication-service', VERSIONS.mas, '1.24.0');
+        if (masBlocked) {
+            return {
+                step: null,
+                blocked: `${org.slug}'s calls Matrix stack is blocked, not planned: ${masBlocked}`,
+            };
+        }
+    }
     return {
         step: planHostingToggle('coolify', 'calls', org.calls.enabled, org, byKey, claimed, () => `provision ${org.slug}'s calls Matrix stack (Synapse + matrix-authentication-service)`, () => `park ${org.slug}'s calls Matrix stack (stops serving; data is retained, not deleted -- #7 corrections 1)`),
         blocked: null,
@@ -1549,17 +1598,30 @@ function planTunnel(org, byKey, claimed, recordedIds) {
     const toggled = planHostingToggle('cloudflare', 'tunnel', desired, org, byKey, claimed, () => `provision a Cloudflare tunnel for ${org.slug}'s app`, () => `park ${org.slug}'s Cloudflare tunnel (configuration is retained, not deleted -- #7 corrections 1)`);
     if (toggled || !desired)
         return toggled;
-    // #235: a live, enabled tunnel with no connector recorded -- a first
-    // connector create that failed, or a tunnel that predates connectors --
-    // plans the same step again. The step finds or creates the connector by
-    // name, so it never makes a second one.
+    // A live, enabled tunnel re-plans the same step again when either:
+    // #235, no connector recorded -- a first connector create that failed, or
+    // a tunnel that predates connectors; or #236, its DNS was last published
+    // under a domain other than the one now declared -- never published at
+    // all (unset), or the org's domain has since changed. `org.domain` is set
+    // whenever `desired` is true above, in every branch. The step itself
+    // (`executor.ts`'s `cloudflareTunnel`) finds or creates the connector by
+    // name and upserts DNS idempotently (and, on a domain change, cleans up
+    // the old one once the new one is published -- round 3: publishing first
+    // means a conflict on the new domain leaves the old one still live rather
+    // than taking the org dark), so re-running it never duplicates either.
     const live = byKey.get(resourceKey('cloudflare', 'tunnel', org.id));
-    if (!live || recordedIds[CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY])
+    if (!live)
+        return null;
+    const connectorMissing = !recordedIds[CLOUDFLARE_TUNNEL_CONNECTOR_APP_SCOPE_KEY];
+    const dnsStale = recordedIds[CLOUDFLARE_TUNNEL_DNS_DOMAIN_SCOPE_KEY] !== org.domain;
+    if (!connectorMissing && !dnsStale)
         return null;
     return {
         action: { system: 'cloudflare', kind: 'tunnel', key: org.id, desired: { enabled: true } },
         step: {
-            description: `run a cloudflared connector for ${org.slug}'s Cloudflare tunnel`,
+            description: connectorMissing
+                ? `run a cloudflared connector for ${org.slug}'s Cloudflare tunnel`
+                : `point ${org.slug}'s hostnames at its Cloudflare tunnel`,
             destroys: false,
             migrates: false,
         },