@bongos/core 1.20.82 → 1.21.1

package/modules/provisioning/birth.js

@@ -0,0 +1,64 @@
+'use strict';
+
+// modules/provisioning/birth.js — the BIRTH MARKER: this project was made through the
+// startup flow, so it is born into genesis (task 1004506 / BV2.PS18; spec
+// docs/specs/bongos-v2-project-startup.md step 5 + D8).
+//
+// Founding mode lives in the NEW INSTANCE's own project_settings, and this process (the
+// hub's web tier) has no way into that database — the one rule of this module. So the
+// hub only says so, and the instance acts on it (modules/onboarding/founding-birth.js):
+//
+//   * the create route stamps `founding_birth` (a reserved settings-jsonb key, like
+//     push_owed and look_accent: platform bookkeeping, out of SETTINGS_VOCAB, so the
+//     settings PATCH cannot write it and effectiveSettings never projects it) on the
+//     row it JUST created — never on one that already existed, so a project made before
+//     this shipped is never born into anything (D8);
+//   * the companions below carry it, and a demo's time box, into the instance's
+//     web.env beside the other settings, at standup and on every settings-apply push.
+//
+// Always emitted, empty meaning "not born through the flow" / "not a demo", for the
+// same reason as every companion: the runner patches these lines in place, and a key
+// that came and went would leave a stale line behind.
+
+const BIRTH_KEY = 'founding_birth';
+const ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+
+const storedOf = (row) => (row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings) ? row.settings : {});
+
+// bornAt(row) — PURE. The birth stamp, or '' for a row that has none (or a mangled one).
+function bornAt(row) {
+  const v = String(storedOf(row)[BIRTH_KEY] || '');
+  return ISO.test(v) && Number.isFinite(new Date(v).getTime()) ? v : '';
+}
+
+// demoBox(row) — PURE. A born demo's { people, hours_each }, or null. Only a row that is
+// both born and a demo carries one: an older demo has no marker and founds nothing.
+function demoBox(row) {
+  if (!bornAt(row)) return null;
+  const d = row && row.demo;
+  if (!d || typeof d !== 'object') return null;
+  const people = Number(d.people);
+  const hours = Number(d.hours_each);
+  if (!Number.isInteger(people) || !Number.isInteger(hours) || people < 1 || hours < 1) return null;
+  return { people, hours_each: hours };
+}
+
+// The companion env (SETTINGS_COMPANION_ENV). src/branding.js maps them onto founding.*.
+const BIRTH_COMPANION_ENV = Object.freeze({
+  FOUNDING_BIRTH: bornAt,
+  DEMO_PEOPLE: (row) => { const d = demoBox(row); return d ? String(d.people) : ''; },
+  DEMO_HOURS: (row) => { const d = demoBox(row); return d ? String(d.hours_each) : ''; },
+});
+
+// stampBirth(db, instanceId, now) — the create route's one write, on the row it just
+// made. Write-once: a stamp already there is kept (the WHERE says so).
+async function stampBirth(db, instanceId, now = new Date()) {
+  await db.query(
+    `UPDATE provisioning_instances
+        SET settings = COALESCE(settings, '{}'::jsonb) || jsonb_build_object($2::text, $3::text)
+      WHERE id = $1 AND NOT (COALESCE(settings, '{}'::jsonb) ? $2::text)`,
+    [instanceId, BIRTH_KEY, now.toISOString()],
+  );
+}
+
+module.exports = { BIRTH_KEY, BIRTH_COMPANION_ENV, stampBirth };

package/modules/provisioning/dns-resolves.js

@@ -0,0 +1,54 @@
+'use strict';
+
+// modules/provisioning/dns-resolves.js — has the platform's own lookup seen this
+// project's address answer? (task 1004505, BV2.PS17; migration provisioning_036)
+//
+// WHY. A visitor's resolver caches a "not found" answer for the zone's negative TTL
+// (cloudbongos.com's SOA minimum is 1800s). The hub used to link an address as soon as
+// the row read 'active', so a founder who clicked before the name answered anywhere
+// could not reach their own project from their home network for up to half an hour.
+// The fix has two halves: the runner creates the DNS record FIRST (scripts/gds/
+// provision.js), and the hub holds every link to the address until `dns_resolves` is
+// true — a fact only a lookup the PLATFORM made can establish, never the status alone.
+//
+// Who writes it: the runner, at the end of a standup (minutes after the record was
+// created, so its own lookup cannot race the record into a cached miss), and the
+// liveness sweep, whose SSRF gate already resolves every active address. Sticky once
+// seen; a changed domain clears it (updateInstanceDomain in ./provisioning.js).
+// Its own file because ./provisioning.js sits at the 1500-line size ratchet.
+
+const dns = require('node:dns').promises;
+
+// The projection publicInstance carries. PURE. No domain ⇒ nothing to resolve.
+function dnsResolves(row) {
+  return !!(row && row.domain && row.dns_resolved_at);
+}
+
+// Record that a lookup answered. Narrow like recordDnsNote: no `status`, no
+// `updated_at`, and only the FIRST sighting writes, so a sweep never rewrites it.
+async function recordDnsResolved(db, id) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET dns_resolved_at = now()
+      WHERE id = $1 AND dns_resolved_at IS NULL RETURNING id, dns_resolved_at`,
+    [id]
+  );
+  return rows[0] || null;
+}
+
+// One bounded lookup: true when the name resolves to at least one address, false on
+// any failure or after `timeoutMs`. Never throws. `lookup` is injectable for tests.
+async function lookupAnswers(host, { lookup, timeoutMs = 5000 } = {}) {
+  if (!host) return false;
+  let timer = null;
+  const timeout = new Promise((resolve) => { timer = setTimeout(() => resolve(false), timeoutMs); });
+  try {
+    const ask = Promise.resolve((lookup || dns.lookup)(host, { all: true }))
+      .then((addrs) => Array.isArray(addrs) ? addrs.some((a) => a && a.address) : !!(addrs && addrs.address))
+      .catch(() => false);
+    return await Promise.race([ask, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+module.exports = { dnsResolves, recordDnsResolved, lookupAnswers };

package/modules/provisioning/migrations/provisioning_036_dns_resolved.sql

@@ -0,0 +1,30 @@
+-- provisioning_036_dns_resolved.sql — when the platform's own lookup first saw a
+-- project's address answer (task 1004505, BV2.PS17).
+--
+-- WHY THIS EXISTS. A visitor's resolver caches a "not found" answer for the zone's
+-- negative TTL (30 minutes on cloudbongos.com). The hub used to link a project's
+-- address as soon as the row said 'active', and the founder's first click, made
+-- before the name answered anywhere, poisoned their own home network for half an
+-- hour. The hub now holds every link to the address until this column is set.
+--
+-- WHAT IT ADDS.
+--   provisioning_instances.dns_resolved_at — NULL until a lookup made by the
+--   platform (the runner at the end of a standup, or the liveness sweep's gate)
+--   returned an address for the row's domain. Projected as `dns_resolves`.
+--   A changed domain clears it (updateInstanceDomain), like the liveness overlay.
+--
+-- OVERLAY, NOT A STATE (the provisioning_006 rule): nullable, no default, never
+-- written by the lifecycle. The backfill marks every address the sweep has
+-- already seen answer, so no live project loses its link when this lands.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS dns_resolved_at timestamptz;
+
+UPDATE provisioning_instances
+   SET dns_resolved_at = last_verified_at
+ WHERE dns_resolved_at IS NULL AND last_verified_up IS TRUE AND domain IS NOT NULL;
+
+COMMIT;

package/modules/provisioning/pollers/liveness-sweep.js

@@ -224,6 +224,11 @@ async function sweepOnce(deps = {}) {
     }
     const probe = await probeHealthz(url, { timeoutMs: deps.timeoutMs, fetchImpl: deps.fetchImpl, pin });
     const rec = await provisioning.recordLivenessProbe(db, row.id, probe.up);
+    // The gate's lookup IS the platform's own lookup (task 1004505): an address it
+    // resolved, or one that answered, may now be linked on the hub. First sighting only.
+    if (row.domain && !row.dns_resolved_at && (pin || probe.up)) {
+      await provisioning.recordDnsResolved(db, row.id).catch((e) => log(`[liveness] dns record failed (non-blocking): ${e && e.message ? e.message : e}`));
+    }
     return { row, probed: true, prevUp: rec ? rec.prev_up : null, ...probe };
   }));
 

package/modules/provisioning/provisioning.js

@@ -24,7 +24,8 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // projection both have to read them.
 const { PLANET_PHYSICS_QUESTIONS, canonicalAnswer } = require('./planet-physics');
 const { softLimitsFor } = require('./soft-limits'); const { demoView } = require('./demo');   // the demo marker's owner view (task 1004420)
-const { LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV } = require('./look');
+const { dnsResolves, recordDnsResolved, lookupAnswers } = require('./dns-resolves');   // has the platform's lookup seen the address answer (task 1004505)
+const { LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV } = require('./look'); const { BIRTH_COMPANION_ENV } = require('./birth'); // born into genesis (task 1004506)
 
 // ---------------------------------------------------------------------------
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
@@ -466,7 +467,7 @@ function publicInstance(row) {
     last_verified_up: row.last_verified_up == null ? null : !!row.last_verified_up,
     // The outstanding manual-DNS step, if the runner had no hook to point the
     // A record (task 1002720 / F16). null = nothing outstanding.
-    dns_note: row.dns_note || null,
+    dns_note: row.dns_note || null, dns_resolves: dnsResolves(row),   // the platform's lookup saw it answer; the hub links it only then (task 1004505)
     cost_estimate_usd: Number(row.cost_estimate_usd || 0),
     error_note: row.error_note || null,
     created_at: row.created_at,
@@ -518,7 +519,7 @@ function settingsEnvVars(row, prefix) {
 // cutoff and every unresolved review counts, which is the right answer for a
 // project that has been strict since it stood up.
 const SETTINGS_COMPANION_ENV = Object.freeze({
-  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, // + accent, logo (look.js)
+  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, ...BIRTH_COMPANION_ENV, // + accent, logo (look.js); birth, demo box (birth.js)
 });
 
 // The web.env block the runner writes at STANDUP (task 1003139): a comment that
@@ -974,7 +975,7 @@ async function updateInstanceDomain(db, id, domain, releasing = null) {
               ELSE array_append(released_domains, $3)
             END,
             last_verified_at = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_at END,
-            last_verified_up = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_up END,
+            last_verified_up = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_up END, dns_resolved_at = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE dns_resolved_at END,
             updated_at = now()
       WHERE id = $1 RETURNING *`,
     [id, domain, host, MAX_RELEASED_DOMAINS]
@@ -1004,7 +1005,7 @@ async function clearReleasedDomains(db, id) {
 // against it would only ever record a false "down". `limit` is a runaway guard.
 async function listActiveInstancesForLiveness(db, { limit = 500 } = {}) {
   const { rows } = await db.query(
-    `SELECT id, slug, domain, port, settings FROM provisioning_instances
+    `SELECT id, slug, domain, port, settings, dns_resolved_at FROM provisioning_instances
       WHERE status = 'active'
       ORDER BY id
       LIMIT $1`,
@@ -1486,7 +1487,7 @@ module.exports = {
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
-  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote, ownsErrorNote,
+  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote, ownsErrorNote, dnsResolves, recordDnsResolved, lookupAnswers,
   // data access — the owed-push marker (task 1003524)
   recordSettingsPushOwed,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,

package/modules/provisioning/routes/provisioning.js

@@ -64,7 +64,7 @@ const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
-const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo');
+const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 const { settingsPush, failPushConflict } = require('../settings-push');   // a settings save's push + receipt, shared with routes/look.js (task 1004421)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
@@ -471,6 +471,11 @@ module.exports = function provisioningRoutes() {
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
         return res.fail('slug_taken', { status: 409, message: 'That instance slug is already in use.' });
       }
+      // Born into genesis (task 1004506, ../birth.js): only the row this request MADE, and before the
+      // provision intent exists, so the runner's web.env already carries the marker and the demo's box.
+      // Best-effort: a project that misses its marker opens as an ordinary hall; the create still stands.
+      if (created) await birth.stampBirth(pool, instance.id).catch((err) => log.error('[provisioning] birth marker not stamped', err));
+      const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;
       // Enqueue the provision intent (idempotent: an already-open intent is returned)
       // — but ONLY when the instance actually needs standing up. Blindly enqueueing on
       // a re-request of an ACTIVE instance left a stale open provision intent that then
@@ -493,7 +498,6 @@ module.exports = function provisioningRoutes() {
       // description exists — the publish gate alone decides that — but the row has to be
       // there for the gate to have anything to decide about, and for the wizard's invite
       // step to have a project to invite into while standup is still running.
-      const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;
       await catalogBridge.publishInstanceToCatalog(pool, demoRow || instance).catch(() => {});
       // A re-request cannot change an existing instance's domain — SAY so instead of
       // silently dropping it (task 1002692); the domain route is the real path.

package/modules/provisioning/tests/liveness.mjs

@@ -234,6 +234,54 @@ await ta('an unresolvable domain still probes and records an honest DOWN (the qa
   assert.deepEqual({ blocked: out.blocked, down: out.down }, { blocked: 0, down: 1 });
   assert.deepEqual(out.reasons, ['ghostly:ENOTFOUND']);
   assert.deepEqual(db.updates.map((u) => u.up), [false], 'DNS-less domain = honest down, not a silent skip');
+  assert.ok(!db.updates.some((u) => /dns_resolved_at/.test(u.sql)), 'an address that did not resolve is never marked as resolving');
+});
+
+console.log('\ndns_resolves (task 1004505 — the hub links an address only once the platform saw it answer):');
+
+const isDnsWrite = (u) => /SET dns_resolved_at = now\(\)/.test(u.sql);
+
+await ta('a domain the gate RESOLVED is recorded as resolving — once, even when the probe itself is down', async () => {
+  const db = fakeDb([{ id: 9, slug: 'fresh', domain: 'fresh.example.com', port: null, dns_resolved_at: null }]);
+  await liveness.sweepOnce({
+    pool: db, log: () => {},
+    lookup: async () => [{ address: '93.184.216.34', family: 4 }],
+    fetchImpl: async () => { throw Object.assign(new TypeError('fetch failed'), { cause: { code: 'ECONNREFUSED' } }); },
+  });
+  const writes = db.updates.filter(isDnsWrite);
+  assert.equal(writes.length, 1, 'the lookup answered, so the address may be linked');
+  assert.equal(writes[0].id, 9);
+  assert.match(writes[0].sql, /dns_resolved_at IS NULL/, 'only the first sighting writes');
+  assert.ok(!/status|updated_at/.test(writes[0].sql), 'an overlay: no status, no updated_at');
+});
+
+await ta('an address already marked is not written again', async () => {
+  const db = fakeDb([{ id: 10, slug: 'old', domain: 'old.example.com', port: null, dns_resolved_at: '2026-10-01T10:00:00Z' }]);
+  await liveness.sweepOnce({
+    pool: db, log: () => {},
+    lookup: async () => [{ address: '93.184.216.34', family: 4 }],
+    fetchImpl: async () => new Response('ok', { status: 200 }),
+  });
+  assert.equal(db.updates.filter(isDnsWrite).length, 0);
+});
+
+t('publicInstance projects dns_resolves: false without a sighting or a domain, true with both', () => {
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: 'a.example.com' }).dns_resolves, false);
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: 'a.example.com', dns_resolved_at: '2026-10-01T10:00:00Z' }).dns_resolves, true);
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: null, dns_resolved_at: '2026-10-01T10:00:00Z' }).dns_resolves, false);
+});
+
+await ta('lookupAnswers: an address is an answer; a miss, a throw or a hang is not', async () => {
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => [{ address: '1.2.3.4', family: 4 }] }), true);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => [] }), false);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => { throw new Error('ENOTFOUND'); } }), false);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: () => new Promise(() => {}), timeoutMs: 20 }), false);
+  assert.equal(await provisioning.lookupAnswers('', {}), false);
+});
+
+t('a changed domain clears the sighting with the rest of the overlay', () => {
+  const src = provisioning.updateInstanceDomain.toString();
+  assert.match(src, /dns_resolved_at = CASE WHEN domain IS DISTINCT FROM \$2 THEN NULL ELSE dns_resolved_at END/);
 });
 
 await ta('the gate hands back the address it vetted, so the probe can pin to it (no re-resolution)', async () => {

package/modules/public-landing/public/projects-dns-pending.states.json

@@ -0,0 +1,85 @@
+{
+  "_": "Projects whose address does not resolve yet (task 1004505): the same page, the same stub, the instance list aliased to two projects the platform's own lookup has not seen answer. The mine rows and the manage page say the address is being set up and carry no link to it — a click before the name exists is cached as not found for up to half an hour. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-dns-pending.states.json",
+  "page": "/projects",
+  "surface": "public-landing",
+  "modes": [
+    "dark"
+  ],
+  "modeQuery": false,
+  "stub": {
+    "fixtures": {
+      "provisioning-instances": "provisioning-instances-dns-pending"
+    }
+  },
+  "ignoreRequests": [
+    "/api/(gds|bongos)/me$",
+    "/my-projects",
+    "/provisioning/onboard-plan",
+    "/env-manifest$"
+  ],
+  "ignoreConsole": [
+    "/api/(gds|bongos)/me",
+    "\\b401\\b",
+    "\\b404\\b",
+    "Unauthorized"
+  ],
+  "ignoreControls": [
+    ".skip",
+    ".vh"
+  ],
+  "states": {
+    "in-mine-dns-pending": {
+      "auth": true,
+      "url": "/projects?view=mine",
+      "expect": {
+        "visible": [
+          "#projectsList .proj .addr"
+        ],
+        "count": [
+          [
+            "#projectsList .proj",
+            2
+          ],
+          [
+            "#projectsList .proj .actions a",
+            2
+          ],
+          [
+            "#projectsList a[href^=\"https://\"]",
+            0
+          ],
+          [
+            "#projectsList a.worldOrb",
+            0
+          ]
+        ]
+      }
+    },
+    "in-manage-dns-pending": {
+      "auth": true,
+      "url": "/projects?view=manage&id=106",
+      "expect": {
+        "visible": [
+          "#mMain",
+          "#mAddr"
+        ],
+        "count": [
+          [
+            "#mAddr a",
+            0
+          ],
+          [
+            "#mActs a[href^=\"https://\"]",
+            0
+          ]
+        ],
+        "text": [
+          [
+            "#mName",
+            "beacon"
+          ]
+        ]
+      }
+    }
+  }
+}

package/modules/public-landing/public/projects.html

@@ -3193,8 +3193,8 @@ summary{min-height:24px;padding:3px 0;}
         '<div class="runs"><span class="rLbl">runs</span>' + tagsHtml(p.tags) + '</div>' +
         /* at most two doors (task 1003356): the site, and the hall where the
            viewer builds there and the hall answers at a different address */
-        '<div class="rowDoors">' + (safeHttpUrl(p.origin)
-          ? '<a class="rowGo" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">view</a>'
+        '<div class="rowDoors">' + (siteHref(p)
+          ? '<a class="rowGo" href="' + esc(siteHref(p)) + '" target="_blank" rel="noopener">view</a>'
           : '') + hallGlyphHtml(p, rel) + '</div>' +
         '</li>';
     }).join(''));
@@ -3413,8 +3413,12 @@ summary{min-height:24px;padding:3px 0;}
   var HALL_GLYPH = '<svg viewBox="0 0 20 20" aria-hidden="true"><path d="M2.8 7.4 10 3.5l7.2 3.9"/><path d="M5.2 8.8v5.6M10 8.8v5.6M14.8 8.8v5.6"/><path d="M3.4 16.3h13.2"/></svg>';
   function isMember(rel) { return rel === 'owner' || rel === 'builder'; }
   /* the row's hall glyph: a member's door, only where the hall is elsewhere */
+  /* the site door for a map entry: one of the viewer's own projects gets none until
+     its address answers (task 1004505, addressReady) */
+  function siteHref(p) { return p._inst && !addressReady(p._inst) ? '' : safeHttpUrl(p.origin); }
   function hallGlyphHtml(p, rel) {
     var hall = isMember(rel) ? hallUrlOf(p) : '';
+    if (p._inst && !addressReady(p._inst)) hall = '';   /* your own project's hall waits for its name too (task 1004505) */
     return hall
       ? '<a class="rowHall" href="' + esc(hall) + '" target="_blank" rel="noopener" aria-label="Builders\' hall" title="Builders\' hall">' + HALL_GLYPH + '</a>'
       : '';
@@ -3472,7 +3476,7 @@ summary{min-height:24px;padding:3px 0;}
   }
 
   function openCard(p, rel, returnTo) {
-    var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
+    var href = p.isSelf ? '/' : siteHref(p);
     /* the art: catalog text an Archon typed, scheme-checked server-side and
        again here before it becomes a src */
     cardArt(p.isSelf ? '' : (backdropPlate(p.card_backdrop) || safeHttpUrl(p.art_url)));
@@ -6937,7 +6941,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -7083,7 +7087,7 @@ summary{min-height:24px;padding:3px 0;}
       /* the door opens only when the project ANSWERS and sign-in is wired: a
          link to an address that does not resolve yet is the worst first
          impression a founder can get of their own project (task 1003232) */
-      if (live.instStatus !== 'active' || live.manifest !== 'done') {
+      if (live.instStatus !== 'active' || !live.addrReady || live.manifest !== 'done') {
         return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks once your project is answering and sign-in above is wired. Then you’ll open <code style="font-family:var(--font-mono)">' + esc(domain) + '</code>, sign in with GitHub once, and be seated as the owner — the founding Archon.</p></li>';
       }
       return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
@@ -7091,7 +7095,7 @@ summary{min-height:24px;padding:3px 0;}
 
     function renderStepEnterHall() {
       var domain = resolvedDomain();
-      if (domain && (live.instStatus !== 'active' || live.manifest !== 'done')) {
+      if (domain && (live.instStatus !== 'active' || !live.addrReady || live.manifest !== 'done')) {
         return '<li class="slocked" data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Unlocks with the first sign-in — your project’s home will be <code style="font-family:var(--font-mono)">' + esc(domain) + '/builders</code>.</p></li>';
       }
       return domain
@@ -7383,6 +7387,14 @@ summary{min-height:24px;padding:3px 0;}
             projectPageLink('its own page') + '; the steps below that need one unlock then.', '', flow));
           return true;
         }
+        /* task 1004505: no link until the platform's own lookup has seen the name
+           answer. A founder's first click on a name that does not resolve yet is
+           cached as "not found" by their resolver for up to half an hour. */
+        if (!addressReady(inst)) {
+          setProgress(progressMarkup(2, 2,
+            'The build finished — your address is being set up. This panel links it the moment it answers.', '', flow));
+          return false;
+        }
         if (inst.last_verified_up === false) {
           setProgress(progressMarkup(2, 2,
             'The build finished, but ' + link + ' isn’t answering right now — this panel keeps checking.', '', flow));
@@ -7471,8 +7483,8 @@ summary{min-height:24px;padding:3px 0;}
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
-            if (inst && inst.status !== live.instStatus) {
-              live.instStatus = inst.status; renderSteps();
+            if (inst && (inst.status !== live.instStatus || addressReady(inst) !== live.addrReady)) {
+              live.instStatus = inst.status; live.addrReady = addressReady(inst); renderSteps();
               if (state.step === 13) paintRail(13);   /* the rail finishes only when the project answers */
             }
             var terminal = renderProgress(inst);
@@ -7505,7 +7517,7 @@ summary{min-height:24px;padding:3px 0;}
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
       manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
       lastStepsHtml = '';
       lastProgHtml = '';
       try { sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
@@ -7797,6 +7809,11 @@ summary{min-height:24px;padding:3px 0;}
      so the page can never say "Answering at …" beside a chip that says "live?". */
   function verifiedAt(inst) { return inst.last_verified_at ? new Date(inst.last_verified_at).getTime() : 0; }
   function freshUp(inst) { var at = verifiedAt(inst); return !!(inst.last_verified_up && at && (Date.now() - at) <= FRESH_MS); }
+  /* an address is LINKED only once the platform's own lookup has seen it answer (task
+     1004505): a click made before the name exists is cached as "not found" by the
+     visitor's resolver for up to half an hour, so the provision status alone is never
+     enough. dns_resolves is the server's sighting; an up probe is the same proof. */
+  function addressReady(inst) { return !!(inst && inst.domain && (inst.dns_resolves || inst.last_verified_up)); }
   /* the landing moment (task 1003243): a standup or revive that VERIFIABLY came
      up, still recent enough to be news. Two gates, both already on the card —
      freshUp() so "live" stays ONE rule (a lit third stage beside a "live?" chip
@@ -7933,7 +7950,7 @@ summary{min-height:24px;padding:3px 0;}
     else if (inst.status === 'error' || (inst.status === 'active' && inst.last_verified_up === false)) cls += ' ashen';
     else if (inst.status === 'active' && !freshUp(inst)) cls += ' dim';
     var attrs = planetAttrs(pl) + ' style="--acc:' + pl.acc + ';--d:64px"';
-    if (inst.status === 'active' && inst.domain) {
+    if (inst.status === 'active' && addressReady(inst)) {
       return '<a class="' + cls + '"' + attrs + ' href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener" title="Open ' + esc(inst.slug) + '" aria-label="Open ' + esc(inst.slug) + '"><span class="disc"></span></a>';
     }
     return '<span class="' + cls + '"' + attrs + ' aria-hidden="true"><span class="disc"></span></span>';
@@ -8085,6 +8102,7 @@ summary{min-height:24px;padding:3px 0;}
      has. Since task 1003355 the list row acts on nothing, so a row's sentence
      sends the owner to the project's own page and the manage page's says
      "below" — the ADR 0199 §8 rule that a refusal must name a reachable door. */
+  var ADDRESS_SETTING_UP = 'Your address is being set up — it shows here, with a link, as soon as it answers.';
   function addressRow(inst, onManage) {
     /* state FIRST, then domain: a torn-down or snagged project still holds its
        domain (ADR 0181 keeps port + address), and the standup promise below
@@ -8099,6 +8117,13 @@ summary{min-height:24px;padding:3px 0;}
         /* "answering" is a VERIFIED claim (direction §3 / F16): only a FRESH up
            probe earns it — never the runner finishing its script, and never a
            probe the chip has already aged into "live?" */
+        /* task 1004505: no link — and no name to type — until the platform's own
+           lookup has seen it answer; the manual-DNS note still names the address,
+           because pointing it is the owner's own step */
+        if (!addressReady(inst)) {
+          return inst.dns_note ? 'Its address is <code>' + esc(inst.domain) + '</code>. ' + esc(inst.dns_note)
+            : ADDRESS_SETTING_UP;
+        }
         var link = '<a href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>';
         if (freshUp(inst)) return 'Answering at ' + link;
         /* the runner had no DNS hook (F16): the CAUSE beats the bare symptom —
@@ -8119,7 +8144,7 @@ summary{min-height:24px;padding:3px 0;}
         return 'Its address is ' + link + ' — confirming it answers.';
       }
       if (inst.status === 'error') return 'Address <code>' + esc(inst.domain) + '</code> — held for this project, but nothing is answering there yet.';
-      return 'Address: <code>' + esc(inst.domain) + '</code> — it answers there once the instance is live.';
+      return inst.dns_note ? 'Its address is <code>' + esc(inst.domain) + '</code>. ' + esc(inst.dns_note) : ADDRESS_SETTING_UP;
     }
     /* the HONEST no-address state: sign-in on the instance needs a real domain */
     return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one. ' +
@@ -8191,7 +8216,7 @@ summary{min-height:24px;padding:3px 0;}
        links, so middle/ctrl-click works; the delegated handler upgrades a plain
        click on Manage (task 1003041). */
     var acts = [];
-    if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">View</a>');
+    if (inst.status === 'active' && addressReady(inst)) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">View</a>');
     acts.push('<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>');
     body += '<div class="actions">' + acts.join('') + '</div>';
     /* sig() buckets recency per minute, so a live row re-renders on the
@@ -8514,7 +8539,7 @@ summary{min-height:24px;padding:3px 0;}
     $('mErr').innerHTML = snag ? errMarkup(inst) : '';
     $('mErr').hidden = !snag;
     var acts = [];
-    if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
+    if (inst.status === 'active' && addressReady(inst)) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-m-retry>Try again</button>');
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-m-revive>Bring it back</button>');
     if (canRestart(inst)) acts.push('<button type="button" class="btn small" data-m-restart>Restart it</button>');
@@ -9319,7 +9344,7 @@ summary{min-height:24px;padding:3px 0;}
   /* what the project RUNS: its own public manifest, read cross-origin (the
      same GET /instance the platform's runner reads after a restart) */
   function loadVisRuns(inst) {
-    if (!inst || inst.status !== 'active' || !inst.domain) { visRuns(''); return; }
+    if (!inst || inst.status !== 'active' || !addressReady(inst)) { visRuns(''); return; }   /* the browser's own lookup waits for the name too (task 1004505) */
     var asked = manageId;
     visRuns('Checking what the project is running…');
     ensureManifest(inst.domain).then(function (ans) {
@@ -9772,7 +9797,7 @@ summary{min-height:24px;padding:3px 0;}
   /* what the project RUNS: the SAME shared manifest read the reach card uses
      (task 1003554) — a different key out of one answer, not a second GET */
   function loadJoinRuns(inst) {
-    if (!inst || inst.status !== 'active' || !inst.domain) { joinRuns(''); return; }
+    if (!inst || inst.status !== 'active' || !addressReady(inst)) { joinRuns(''); return; }   /* the browser's own lookup waits for the name too (task 1004505) */
     var asked = manageId;
     joinRuns('Checking what the project is running…');
     ensureManifest(inst.domain).then(function (ans) {