@bongos/core 1.20.83 → 1.21.1

package/modules/provisioning/pollers/liveness-sweep.js

@@ -224,6 +224,11 @@ async function sweepOnce(deps = {}) {
     }
     const probe = await probeHealthz(url, { timeoutMs: deps.timeoutMs, fetchImpl: deps.fetchImpl, pin });
     const rec = await provisioning.recordLivenessProbe(db, row.id, probe.up);
+    // The gate's lookup IS the platform's own lookup (task 1004505): an address it
+    // resolved, or one that answered, may now be linked on the hub. First sighting only.
+    if (row.domain && !row.dns_resolved_at && (pin || probe.up)) {
+      await provisioning.recordDnsResolved(db, row.id).catch((e) => log(`[liveness] dns record failed (non-blocking): ${e && e.message ? e.message : e}`));
+    }
     return { row, probed: true, prevUp: rec ? rec.prev_up : null, ...probe };
   }));
 

package/modules/provisioning/provisioning.js

@@ -24,7 +24,8 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // projection both have to read them.
 const { PLANET_PHYSICS_QUESTIONS, canonicalAnswer } = require('./planet-physics');
 const { softLimitsFor } = require('./soft-limits'); const { demoView } = require('./demo');   // the demo marker's owner view (task 1004420)
-const { LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV } = require('./look');
+const { dnsResolves, recordDnsResolved, lookupAnswers } = require('./dns-resolves');   // has the platform's lookup seen the address answer (task 1004505)
+const { LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV } = require('./look'); const { BIRTH_COMPANION_ENV } = require('./birth'); // born into genesis (task 1004506)
 
 // ---------------------------------------------------------------------------
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
@@ -466,7 +467,7 @@ function publicInstance(row) {
     last_verified_up: row.last_verified_up == null ? null : !!row.last_verified_up,
     // The outstanding manual-DNS step, if the runner had no hook to point the
     // A record (task 1002720 / F16). null = nothing outstanding.
-    dns_note: row.dns_note || null,
+    dns_note: row.dns_note || null, dns_resolves: dnsResolves(row),   // the platform's lookup saw it answer; the hub links it only then (task 1004505)
     cost_estimate_usd: Number(row.cost_estimate_usd || 0),
     error_note: row.error_note || null,
     created_at: row.created_at,
@@ -518,7 +519,7 @@ function settingsEnvVars(row, prefix) {
 // cutoff and every unresolved review counts, which is the right answer for a
 // project that has been strict since it stood up.
 const SETTINGS_COMPANION_ENV = Object.freeze({
-  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, // + accent, logo (look.js)
+  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, ...BIRTH_COMPANION_ENV, // + accent, logo (look.js); birth, demo box (birth.js)
 });
 
 // The web.env block the runner writes at STANDUP (task 1003139): a comment that
@@ -974,7 +975,7 @@ async function updateInstanceDomain(db, id, domain, releasing = null) {
               ELSE array_append(released_domains, $3)
             END,
             last_verified_at = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_at END,
-            last_verified_up = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_up END,
+            last_verified_up = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_up END, dns_resolved_at = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE dns_resolved_at END,
             updated_at = now()
       WHERE id = $1 RETURNING *`,
     [id, domain, host, MAX_RELEASED_DOMAINS]
@@ -1004,7 +1005,7 @@ async function clearReleasedDomains(db, id) {
 // against it would only ever record a false "down". `limit` is a runaway guard.
 async function listActiveInstancesForLiveness(db, { limit = 500 } = {}) {
   const { rows } = await db.query(
-    `SELECT id, slug, domain, port, settings FROM provisioning_instances
+    `SELECT id, slug, domain, port, settings, dns_resolved_at FROM provisioning_instances
       WHERE status = 'active'
       ORDER BY id
       LIMIT $1`,
@@ -1486,7 +1487,7 @@ module.exports = {
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
-  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote, ownsErrorNote,
+  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote, ownsErrorNote, dnsResolves, recordDnsResolved, lookupAnswers,
   // data access — the owed-push marker (task 1003524)
   recordSettingsPushOwed,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,

package/modules/provisioning/routes/provisioning.js

@@ -64,7 +64,7 @@ const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
-const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo');
+const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 const { settingsPush, failPushConflict } = require('../settings-push');   // a settings save's push + receipt, shared with routes/look.js (task 1004421)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
@@ -471,6 +471,11 @@ module.exports = function provisioningRoutes() {
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
         return res.fail('slug_taken', { status: 409, message: 'That instance slug is already in use.' });
       }
+      // Born into genesis (task 1004506, ../birth.js): only the row this request MADE, and before the
+      // provision intent exists, so the runner's web.env already carries the marker and the demo's box.
+      // Best-effort: a project that misses its marker opens as an ordinary hall; the create still stands.
+      if (created) await birth.stampBirth(pool, instance.id).catch((err) => log.error('[provisioning] birth marker not stamped', err));
+      const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;
       // Enqueue the provision intent (idempotent: an already-open intent is returned)
       // — but ONLY when the instance actually needs standing up. Blindly enqueueing on
       // a re-request of an ACTIVE instance left a stale open provision intent that then
@@ -493,7 +498,6 @@ module.exports = function provisioningRoutes() {
       // description exists — the publish gate alone decides that — but the row has to be
       // there for the gate to have anything to decide about, and for the wizard's invite
       // step to have a project to invite into while standup is still running.
-      const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;
       await catalogBridge.publishInstanceToCatalog(pool, demoRow || instance).catch(() => {});
       // A re-request cannot change an existing instance's domain — SAY so instead of
       // silently dropping it (task 1002692); the domain route is the real path.

package/modules/provisioning/tests/liveness.mjs

@@ -234,6 +234,54 @@ await ta('an unresolvable domain still probes and records an honest DOWN (the qa
   assert.deepEqual({ blocked: out.blocked, down: out.down }, { blocked: 0, down: 1 });
   assert.deepEqual(out.reasons, ['ghostly:ENOTFOUND']);
   assert.deepEqual(db.updates.map((u) => u.up), [false], 'DNS-less domain = honest down, not a silent skip');
+  assert.ok(!db.updates.some((u) => /dns_resolved_at/.test(u.sql)), 'an address that did not resolve is never marked as resolving');
+});
+
+console.log('\ndns_resolves (task 1004505 — the hub links an address only once the platform saw it answer):');
+
+const isDnsWrite = (u) => /SET dns_resolved_at = now\(\)/.test(u.sql);
+
+await ta('a domain the gate RESOLVED is recorded as resolving — once, even when the probe itself is down', async () => {
+  const db = fakeDb([{ id: 9, slug: 'fresh', domain: 'fresh.example.com', port: null, dns_resolved_at: null }]);
+  await liveness.sweepOnce({
+    pool: db, log: () => {},
+    lookup: async () => [{ address: '93.184.216.34', family: 4 }],
+    fetchImpl: async () => { throw Object.assign(new TypeError('fetch failed'), { cause: { code: 'ECONNREFUSED' } }); },
+  });
+  const writes = db.updates.filter(isDnsWrite);
+  assert.equal(writes.length, 1, 'the lookup answered, so the address may be linked');
+  assert.equal(writes[0].id, 9);
+  assert.match(writes[0].sql, /dns_resolved_at IS NULL/, 'only the first sighting writes');
+  assert.ok(!/status|updated_at/.test(writes[0].sql), 'an overlay: no status, no updated_at');
+});
+
+await ta('an address already marked is not written again', async () => {
+  const db = fakeDb([{ id: 10, slug: 'old', domain: 'old.example.com', port: null, dns_resolved_at: '2026-10-01T10:00:00Z' }]);
+  await liveness.sweepOnce({
+    pool: db, log: () => {},
+    lookup: async () => [{ address: '93.184.216.34', family: 4 }],
+    fetchImpl: async () => new Response('ok', { status: 200 }),
+  });
+  assert.equal(db.updates.filter(isDnsWrite).length, 0);
+});
+
+t('publicInstance projects dns_resolves: false without a sighting or a domain, true with both', () => {
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: 'a.example.com' }).dns_resolves, false);
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: 'a.example.com', dns_resolved_at: '2026-10-01T10:00:00Z' }).dns_resolves, true);
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: null, dns_resolved_at: '2026-10-01T10:00:00Z' }).dns_resolves, false);
+});
+
+await ta('lookupAnswers: an address is an answer; a miss, a throw or a hang is not', async () => {
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => [{ address: '1.2.3.4', family: 4 }] }), true);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => [] }), false);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => { throw new Error('ENOTFOUND'); } }), false);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: () => new Promise(() => {}), timeoutMs: 20 }), false);
+  assert.equal(await provisioning.lookupAnswers('', {}), false);
+});
+
+t('a changed domain clears the sighting with the rest of the overlay', () => {
+  const src = provisioning.updateInstanceDomain.toString();
+  assert.match(src, /dns_resolved_at = CASE WHEN domain IS DISTINCT FROM \$2 THEN NULL ELSE dns_resolved_at END/);
 });
 
 await ta('the gate hands back the address it vetted, so the probe can pin to it (no re-resolution)', async () => {

package/modules/public-landing/public/projects-dns-pending.states.json

@@ -0,0 +1,85 @@
+{
+  "_": "Projects whose address does not resolve yet (task 1004505): the same page, the same stub, the instance list aliased to two projects the platform's own lookup has not seen answer. The mine rows and the manage page say the address is being set up and carry no link to it — a click before the name exists is cached as not found for up to half an hour. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-dns-pending.states.json",
+  "page": "/projects",
+  "surface": "public-landing",
+  "modes": [
+    "dark"
+  ],
+  "modeQuery": false,
+  "stub": {
+    "fixtures": {
+      "provisioning-instances": "provisioning-instances-dns-pending"
+    }
+  },
+  "ignoreRequests": [
+    "/api/(gds|bongos)/me$",
+    "/my-projects",
+    "/provisioning/onboard-plan",
+    "/env-manifest$"
+  ],
+  "ignoreConsole": [
+    "/api/(gds|bongos)/me",
+    "\\b401\\b",
+    "\\b404\\b",
+    "Unauthorized"
+  ],
+  "ignoreControls": [
+    ".skip",
+    ".vh"
+  ],
+  "states": {
+    "in-mine-dns-pending": {
+      "auth": true,
+      "url": "/projects?view=mine",
+      "expect": {
+        "visible": [
+          "#projectsList .proj .addr"
+        ],
+        "count": [
+          [
+            "#projectsList .proj",
+            2
+          ],
+          [
+            "#projectsList .proj .actions a",
+            2
+          ],
+          [
+            "#projectsList a[href^=\"https://\"]",
+            0
+          ],
+          [
+            "#projectsList a.worldOrb",
+            0
+          ]
+        ]
+      }
+    },
+    "in-manage-dns-pending": {
+      "auth": true,
+      "url": "/projects?view=manage&id=106",
+      "expect": {
+        "visible": [
+          "#mMain",
+          "#mAddr"
+        ],
+        "count": [
+          [
+            "#mAddr a",
+            0
+          ],
+          [
+            "#mActs a[href^=\"https://\"]",
+            0
+          ]
+        ],
+        "text": [
+          [
+            "#mName",
+            "beacon"
+          ]
+        ]
+      }
+    }
+  }
+}

package/modules/public-landing/public/projects.html

@@ -3193,8 +3193,8 @@ summary{min-height:24px;padding:3px 0;}
         '<div class="runs"><span class="rLbl">runs</span>' + tagsHtml(p.tags) + '</div>' +
         /* at most two doors (task 1003356): the site, and the hall where the
            viewer builds there and the hall answers at a different address */
-        '<div class="rowDoors">' + (safeHttpUrl(p.origin)
-          ? '<a class="rowGo" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">view</a>'
+        '<div class="rowDoors">' + (siteHref(p)
+          ? '<a class="rowGo" href="' + esc(siteHref(p)) + '" target="_blank" rel="noopener">view</a>'
           : '') + hallGlyphHtml(p, rel) + '</div>' +
         '</li>';
     }).join(''));
@@ -3413,8 +3413,12 @@ summary{min-height:24px;padding:3px 0;}
   var HALL_GLYPH = '<svg viewBox="0 0 20 20" aria-hidden="true"><path d="M2.8 7.4 10 3.5l7.2 3.9"/><path d="M5.2 8.8v5.6M10 8.8v5.6M14.8 8.8v5.6"/><path d="M3.4 16.3h13.2"/></svg>';
   function isMember(rel) { return rel === 'owner' || rel === 'builder'; }
   /* the row's hall glyph: a member's door, only where the hall is elsewhere */
+  /* the site door for a map entry: one of the viewer's own projects gets none until
+     its address answers (task 1004505, addressReady) */
+  function siteHref(p) { return p._inst && !addressReady(p._inst) ? '' : safeHttpUrl(p.origin); }
   function hallGlyphHtml(p, rel) {
     var hall = isMember(rel) ? hallUrlOf(p) : '';
+    if (p._inst && !addressReady(p._inst)) hall = '';   /* your own project's hall waits for its name too (task 1004505) */
     return hall
       ? '<a class="rowHall" href="' + esc(hall) + '" target="_blank" rel="noopener" aria-label="Builders\' hall" title="Builders\' hall">' + HALL_GLYPH + '</a>'
       : '';
@@ -3472,7 +3476,7 @@ summary{min-height:24px;padding:3px 0;}
   }
 
   function openCard(p, rel, returnTo) {
-    var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
+    var href = p.isSelf ? '/' : siteHref(p);
     /* the art: catalog text an Archon typed, scheme-checked server-side and
        again here before it becomes a src */
     cardArt(p.isSelf ? '' : (backdropPlate(p.card_backdrop) || safeHttpUrl(p.art_url)));
@@ -6937,7 +6941,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -7083,7 +7087,7 @@ summary{min-height:24px;padding:3px 0;}
       /* the door opens only when the project ANSWERS and sign-in is wired: a
          link to an address that does not resolve yet is the worst first
          impression a founder can get of their own project (task 1003232) */
-      if (live.instStatus !== 'active' || live.manifest !== 'done') {
+      if (live.instStatus !== 'active' || !live.addrReady || live.manifest !== 'done') {
         return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks once your project is answering and sign-in above is wired. Then you’ll open <code style="font-family:var(--font-mono)">' + esc(domain) + '</code>, sign in with GitHub once, and be seated as the owner — the founding Archon.</p></li>';
       }
       return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
@@ -7091,7 +7095,7 @@ summary{min-height:24px;padding:3px 0;}
 
     function renderStepEnterHall() {
       var domain = resolvedDomain();
-      if (domain && (live.instStatus !== 'active' || live.manifest !== 'done')) {
+      if (domain && (live.instStatus !== 'active' || !live.addrReady || live.manifest !== 'done')) {
         return '<li class="slocked" data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Unlocks with the first sign-in — your project’s home will be <code style="font-family:var(--font-mono)">' + esc(domain) + '/builders</code>.</p></li>';
       }
       return domain
@@ -7383,6 +7387,14 @@ summary{min-height:24px;padding:3px 0;}
             projectPageLink('its own page') + '; the steps below that need one unlock then.', '', flow));
           return true;
         }
+        /* task 1004505: no link until the platform's own lookup has seen the name
+           answer. A founder's first click on a name that does not resolve yet is
+           cached as "not found" by their resolver for up to half an hour. */
+        if (!addressReady(inst)) {
+          setProgress(progressMarkup(2, 2,
+            'The build finished — your address is being set up. This panel links it the moment it answers.', '', flow));
+          return false;
+        }
         if (inst.last_verified_up === false) {
           setProgress(progressMarkup(2, 2,
             'The build finished, but ' + link + ' isn’t answering right now — this panel keeps checking.', '', flow));
@@ -7471,8 +7483,8 @@ summary{min-height:24px;padding:3px 0;}
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
-            if (inst && inst.status !== live.instStatus) {
-              live.instStatus = inst.status; renderSteps();
+            if (inst && (inst.status !== live.instStatus || addressReady(inst) !== live.addrReady)) {
+              live.instStatus = inst.status; live.addrReady = addressReady(inst); renderSteps();
               if (state.step === 13) paintRail(13);   /* the rail finishes only when the project answers */
             }
             var terminal = renderProgress(inst);
@@ -7505,7 +7517,7 @@ summary{min-height:24px;padding:3px 0;}
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
       manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
       lastStepsHtml = '';
       lastProgHtml = '';
       try { sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
@@ -7797,6 +7809,11 @@ summary{min-height:24px;padding:3px 0;}
      so the page can never say "Answering at …" beside a chip that says "live?". */
   function verifiedAt(inst) { return inst.last_verified_at ? new Date(inst.last_verified_at).getTime() : 0; }
   function freshUp(inst) { var at = verifiedAt(inst); return !!(inst.last_verified_up && at && (Date.now() - at) <= FRESH_MS); }
+  /* an address is LINKED only once the platform's own lookup has seen it answer (task
+     1004505): a click made before the name exists is cached as "not found" by the
+     visitor's resolver for up to half an hour, so the provision status alone is never
+     enough. dns_resolves is the server's sighting; an up probe is the same proof. */
+  function addressReady(inst) { return !!(inst && inst.domain && (inst.dns_resolves || inst.last_verified_up)); }
   /* the landing moment (task 1003243): a standup or revive that VERIFIABLY came
      up, still recent enough to be news. Two gates, both already on the card —
      freshUp() so "live" stays ONE rule (a lit third stage beside a "live?" chip
@@ -7933,7 +7950,7 @@ summary{min-height:24px;padding:3px 0;}
     else if (inst.status === 'error' || (inst.status === 'active' && inst.last_verified_up === false)) cls += ' ashen';
     else if (inst.status === 'active' && !freshUp(inst)) cls += ' dim';
     var attrs = planetAttrs(pl) + ' style="--acc:' + pl.acc + ';--d:64px"';
-    if (inst.status === 'active' && inst.domain) {
+    if (inst.status === 'active' && addressReady(inst)) {
       return '<a class="' + cls + '"' + attrs + ' href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener" title="Open ' + esc(inst.slug) + '" aria-label="Open ' + esc(inst.slug) + '"><span class="disc"></span></a>';
     }
     return '<span class="' + cls + '"' + attrs + ' aria-hidden="true"><span class="disc"></span></span>';
@@ -8085,6 +8102,7 @@ summary{min-height:24px;padding:3px 0;}
      has. Since task 1003355 the list row acts on nothing, so a row's sentence
      sends the owner to the project's own page and the manage page's says
      "below" — the ADR 0199 §8 rule that a refusal must name a reachable door. */
+  var ADDRESS_SETTING_UP = 'Your address is being set up — it shows here, with a link, as soon as it answers.';
   function addressRow(inst, onManage) {
     /* state FIRST, then domain: a torn-down or snagged project still holds its
        domain (ADR 0181 keeps port + address), and the standup promise below
@@ -8099,6 +8117,13 @@ summary{min-height:24px;padding:3px 0;}
         /* "answering" is a VERIFIED claim (direction §3 / F16): only a FRESH up
            probe earns it — never the runner finishing its script, and never a
            probe the chip has already aged into "live?" */
+        /* task 1004505: no link — and no name to type — until the platform's own
+           lookup has seen it answer; the manual-DNS note still names the address,
+           because pointing it is the owner's own step */
+        if (!addressReady(inst)) {
+          return inst.dns_note ? 'Its address is <code>' + esc(inst.domain) + '</code>. ' + esc(inst.dns_note)
+            : ADDRESS_SETTING_UP;
+        }
         var link = '<a href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>';
         if (freshUp(inst)) return 'Answering at ' + link;
         /* the runner had no DNS hook (F16): the CAUSE beats the bare symptom —
@@ -8119,7 +8144,7 @@ summary{min-height:24px;padding:3px 0;}
         return 'Its address is ' + link + ' — confirming it answers.';
       }
       if (inst.status === 'error') return 'Address <code>' + esc(inst.domain) + '</code> — held for this project, but nothing is answering there yet.';
-      return 'Address: <code>' + esc(inst.domain) + '</code> — it answers there once the instance is live.';
+      return inst.dns_note ? 'Its address is <code>' + esc(inst.domain) + '</code>. ' + esc(inst.dns_note) : ADDRESS_SETTING_UP;
     }
     /* the HONEST no-address state: sign-in on the instance needs a real domain */
     return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one. ' +
@@ -8191,7 +8216,7 @@ summary{min-height:24px;padding:3px 0;}
        links, so middle/ctrl-click works; the delegated handler upgrades a plain
        click on Manage (task 1003041). */
     var acts = [];
-    if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">View</a>');
+    if (inst.status === 'active' && addressReady(inst)) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">View</a>');
     acts.push('<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>');
     body += '<div class="actions">' + acts.join('') + '</div>';
     /* sig() buckets recency per minute, so a live row re-renders on the
@@ -8514,7 +8539,7 @@ summary{min-height:24px;padding:3px 0;}
     $('mErr').innerHTML = snag ? errMarkup(inst) : '';
     $('mErr').hidden = !snag;
     var acts = [];
-    if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
+    if (inst.status === 'active' && addressReady(inst)) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-m-retry>Try again</button>');
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-m-revive>Bring it back</button>');
     if (canRestart(inst)) acts.push('<button type="button" class="btn small" data-m-restart>Restart it</button>');
@@ -9319,7 +9344,7 @@ summary{min-height:24px;padding:3px 0;}
   /* what the project RUNS: its own public manifest, read cross-origin (the
      same GET /instance the platform's runner reads after a restart) */
   function loadVisRuns(inst) {
-    if (!inst || inst.status !== 'active' || !inst.domain) { visRuns(''); return; }
+    if (!inst || inst.status !== 'active' || !addressReady(inst)) { visRuns(''); return; }   /* the browser's own lookup waits for the name too (task 1004505) */
     var asked = manageId;
     visRuns('Checking what the project is running…');
     ensureManifest(inst.domain).then(function (ans) {
@@ -9772,7 +9797,7 @@ summary{min-height:24px;padding:3px 0;}
   /* what the project RUNS: the SAME shared manifest read the reach card uses
      (task 1003554) — a different key out of one answer, not a second GET */
   function loadJoinRuns(inst) {
-    if (!inst || inst.status !== 'active' || !inst.domain) { joinRuns(''); return; }
+    if (!inst || inst.status !== 'active' || !addressReady(inst)) { joinRuns(''); return; }   /* the browser's own lookup waits for the name too (task 1004505) */
     var asked = manageId;
     joinRuns('Checking what the project is running…');
     ensureManifest(inst.domain).then(function (ans) {

package/modules/sessions/db.js

@@ -658,6 +658,62 @@ async function getSessionById(id) {
   return rows[0] || null;
 }
 
+const TRANSCRIPT_PAGE_DEFAULT = 500; // turns per read; the reader pages with offset=
+const TRANSCRIPT_PAGE_MAX = 2000;
+
+// upsertSessionTranscript — store/refresh one session's FULL scrubbed transcript
+// (ADR 0051, task 1001004). Keyed on session_id like session_records, and the same
+// ownership guard applies: a row can only be rewritten by the builder who owns it,
+// so guessing another builder's session_id cannot overwrite their transcript. The
+// content arrives already scrubbed (the uploader's box is the scrub point); this
+// layer stores it and never inspects it. `turnsJson` is the ALREADY-serialized
+// array (the route serializes once to measure it; re-stringifying 12 MB here would
+// block the event loop a second time). The row is only ever created FROM the
+// caller's own session_records row, so a transcript cannot exist for a session the
+// builder did not upload a digest for (and a stranger cannot squat a session_id
+// ahead of its owner). Returns { session_id, turn_count, byte_size, truncated } or
+// null when there is no such owned session.
+async function upsertSessionTranscript({ sessionId, builderId, turnsJson, turnCount = 0, truncated = false, byteSize = 0 }) {
+  const { rows } = await pool.query(
+    `INSERT INTO session_transcripts (session_id, builder_id, turn_count, byte_size, truncated, turns)
+     SELECT sr.session_id, sr.builder_id, $3, $4, $5, $6::jsonb
+       FROM session_records sr
+      WHERE sr.session_id = $1 AND sr.builder_id = $2
+     ON CONFLICT (session_id) DO UPDATE SET
+       turn_count  = EXCLUDED.turn_count,
+       byte_size   = EXCLUDED.byte_size,
+       truncated   = EXCLUDED.truncated,
+       turns       = EXCLUDED.turns,
+       uploaded_at = now()
+     WHERE session_transcripts.builder_id = EXCLUDED.builder_id
+     RETURNING session_id, turn_count, byte_size, truncated`,
+    [sessionId, builderId, Math.max(0, Math.trunc(Number(turnCount) || 0)), Math.max(0, Math.trunc(Number(byteSize) || 0)), !!truncated, turnsJson]
+  );
+  return rows[0] || null;
+}
+
+// getSessionTranscript — one PAGE of the full transcript for one session_records row (by its
+// numeric id, the same id /sessions/:id uses), with the owner so the route can
+// apply the own-vs-Archon rule. null when the session or its transcript is absent.
+async function getSessionTranscript(id, { offset = 0, limit = TRANSCRIPT_PAGE_DEFAULT } = {}) {
+  const off = Math.max(0, Math.trunc(Number(offset) || 0));
+  const lim = Math.min(TRANSCRIPT_PAGE_MAX, Math.max(1, Math.trunc(Number(limit) || TRANSCRIPT_PAGE_DEFAULT)));
+  // The slice happens in Postgres so a page read never ships the whole MB-scale
+  // jsonb to Node just to throw most of it away.
+  const { rows } = await pool.query(
+    `SELECT sr.id, sr.session_id, sr.builder_id, st.turn_count, st.byte_size,
+            st.truncated, st.uploaded_at,
+            COALESCE((SELECT jsonb_agg(e.v ORDER BY e.n)
+                        FROM jsonb_array_elements(st.turns) WITH ORDINALITY AS e(v, n)
+                       WHERE e.n > $2 AND e.n <= $2 + $3), '[]'::jsonb) AS turns
+       FROM session_records sr
+       JOIN session_transcripts st ON st.session_id = sr.session_id
+      WHERE sr.id = $1`,
+    [Number(id), off, lim]
+  );
+  return rows[0] ? { ...rows[0], offset: off, limit: lim } : null;
+}
+
 // listSessionsByBuilder — a builder's OWN sessions (self-serve summary list).
 async function listSessionsByBuilder(builderId, limit = 25) {
   const { rows } = await pool.query(
@@ -865,6 +921,8 @@ async function sessionTypeCounts() {
 module.exports = {
   // write side (6D.1)
   upsertSessionRecord,
+  upsertSessionTranscript, // ADR 0051 — full scrubbed transcript (separate table)
+  getSessionTranscript,
   upsertSessionRecordWithReward, // route entry point — upsert + token reward (task 1005)
   awardDeferredSessionRewardForTask, // ADR 0120 land-side trigger — task.shipped listener calls it
   reconcileUnbookedSessionRewards, // ADR 0120 state-based safety net — books rewards for out-of-band ships

package/modules/sessions/routes/sessions.js

@@ -16,6 +16,11 @@
 //                             audited (the BFG principal posture until 6C.1).
 //   GET  /sessions/:id       — one session's full detail for deep-dive. Owner
 //                             self-serve; cross-builder requires Archon + audit.
+//   PUT  /sessions/:sid/transcript
+//                           — upload the FULL scrubbed transcript of your OWN
+//                             session (ADR 0051). Own 16 MB parser.
+//   GET  /sessions/:id/transcript
+//                           — read it. Owner, or Archon + audit written first.
 //
 // Cross-builder reads are GETs, which the global audit middleware does NOT
 // instrument — so each writes its own audit_log row (fail-closed: logged BEFORE
@@ -54,6 +59,16 @@ const seams = api; // resolveOptional('reward' | 'builder-settings') — kernel-
 const { validateOrRespond, parseId } = api;
 
 const UPLOAD_BODY_LIMIT = '4mb';
+// ADR 0051 — the full transcript is MB-scale. The client's own ceiling is 12 MB of
+// content (scripts/gds/session-transcript-build.js); 16 MB leaves JSON overhead.
+const TRANSCRIPT_BODY_LIMIT = '16mb';
+const MAX_TRANSCRIPT_TURNS = 20000;
+// SR-17 for the transcript (the sibling POST bounds detail[] to 2 MB; this row is
+// deliberately ~6x that because a full transcript IS the product, but it is still
+// bounded IN the handler, not just by the parser): a per-turn ceiling stops one
+// absurd turn, and the serialized total matches the client's own ceiling.
+const MAX_TRANSCRIPT_TURN_BYTES = 256 * 1024;
+const MAX_TRANSCRIPT_TOTAL_BYTES = 12 * 1024 * 1024;
 const MAX_DETAIL_TURNS = 5000; // a hard ceiling; ship.js bounds well under this
 
 // Disk-fill defense (SR-17 / task 997). The 4 MB body limit + maxItems=5000 cap
@@ -189,6 +204,7 @@ module.exports = function buildSessionsRouter() {
   registerSeams();
   const router = express.Router();
   const uploadJson = express.json({ limit: UPLOAD_BODY_LIMIT });
+  const transcriptJson = express.json({ limit: TRANSCRIPT_BODY_LIMIT });
 
   // rank: any-builder — upload your OWN session digest. Owner is forced to the
   // authenticated caller; the body cannot attribute a record to another builder.
@@ -315,6 +331,59 @@ module.exports = function buildSessionsRouter() {
     }
   });
 
+  // rank: any-builder — upload the FULL scrubbed transcript of your OWN session
+  // (ADR 0051, task 1001004). Separate from POST /sessions on purpose: the digest
+  // is KB and carries the reward/evaluator path under a 4 MB parser; the transcript
+  // is MB and gets its own larger parser, so a transcript failure can never block a
+  // digest. The row is created only FROM the caller's own session_records row (no
+  // digest → 404, someone else's session_id → 404, never a confirmation it exists).
+  // The content is scrubbed on the uploader's box; the server bounds SHAPE, not
+  // secrets — every turn must be a plain object and the whole body is capped.
+  router.put('/sessions/:sid/transcript', auth.requireBuilder, transcriptJson, async (req, res) => {
+    const sid = String(req.params.sid || '');
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(sid)) return res.fail('bad_session_id', 400);
+    if (validateOrRespond(req, res, {
+      turns: { required: true, type: 'array', maxItems: MAX_TRANSCRIPT_TURNS },
+      truncated: { type: 'boolean' },
+    })) return;
+    const body = req.body || {};
+    const turns = body.turns;
+    // Serialize each turn ONCE: the same strings are measured, then joined into the
+    // jsonb text the db stores, so a 12 MB transcript is not stringified twice.
+    const parts = new Array(turns.length);
+    let totalBytes = 2;
+    for (let idx = 0; idx < turns.length; idx++) {
+      const t = turns[idx];
+      if (!t || typeof t !== 'object' || Array.isArray(t)) {
+        return res.fail('bad_transcript_turn', { status: 400, message: `turns[${idx}] must be an object` });
+      }
+      parts[idx] = JSON.stringify(t);
+      const turnBytes = Buffer.byteLength(parts[idx], 'utf8');
+      if (turnBytes > MAX_TRANSCRIPT_TURN_BYTES) {
+        return res.fail('transcript_turn_too_large', { status: 413, message: `turns[${idx}] is ${turnBytes} bytes; the per-turn cap is ${MAX_TRANSCRIPT_TURN_BYTES} bytes` });
+      }
+      totalBytes += turnBytes + 1;
+      if (totalBytes > MAX_TRANSCRIPT_TOTAL_BYTES) {
+        return res.fail('transcript_too_large', { status: 413, message: `transcript exceeds the ${MAX_TRANSCRIPT_TOTAL_BYTES}-byte total cap` });
+      }
+    }
+    try {
+      const stored = await db.upsertSessionTranscript({
+        sessionId: sid,
+        builderId: req.builder.id, // owner = caller, never the body
+        turnsJson: `[${parts.join(',')}]`,
+        turnCount: turns.length,
+        truncated: body.truncated === true,
+        byteSize: totalBytes,
+      });
+      if (!stored) return res.fail('not_found', 404);
+      res.status(201).json({ transcript: stored });
+    } catch (err) {
+      api.logger('sessions').error(err, 'PUT /sessions/:sid/transcript failed');
+      res.fail('upload_failed', 500);
+    }
+  });
+
   // GET /sessions/search + /sessions/mine are declared BEFORE /sessions/:id so
   // Express matches the literal paths first (the numeric :id never swallows them).
 
@@ -458,5 +527,33 @@ module.exports = function buildSessionsRouter() {
     }
   });
 
+  // rank: any-builder — the FULL transcript of one session (ADR 0051). Same rule as
+  // GET /sessions/:id: the owner reads their own; a cross-builder read is
+  // Archon-only, 404 (never 403) for everyone else, and the fail-closed audit row
+  // is written BEFORE any transcript content is served — transcripts are the most
+  // sensitive thing this module holds. Paged (?offset=&limit=, default 500 turns,
+  // max 2000): a transcript is MB-scale and the response carries turn_count so the
+  // reader knows how far to go.
+  router.get('/sessions/:id/transcript', auth.requireBuilder, readRateLimit, async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_session_id', positiveInt: true });
+    if (id === null) return;
+    try {
+      const t = await db.getSessionTranscript(id, { offset: req.query.offset, limit: req.query.limit });
+      if (!t) return res.fail('not_found', 404);
+      if (String(t.builder_id) !== String(req.builder.id)) {
+        if (req.builder.rank !== 'archon') return res.fail('not_found', 404);
+        await recordSessionRead(req, {
+          route: '/api/bongos/sessions/:id/transcript',
+          targetBuilderId: t.builder_id,
+          target: `transcript:${id}`,
+        });
+      }
+      res.json({ transcript: t });
+    } catch (err) {
+      api.logger('sessions').error(err, 'GET /sessions/:id/transcript failed');
+      res.fail('fetch_failed', 500);
+    }
+  });
+
   return router;
 };