@bongos/core 1.20.83 → 1.21.2

package/modules/onboarding/genesis-home.js

@@ -75,7 +75,65 @@ function parsePlan(body = {}) {
   if (government !== null && !/^[a-z][a-z-]{1,39}$/.test(government)) return { ok: false, reason: 'bad_government' };
   const expected = b.expected_builders == null || b.expected_builders === '' ? null : Number(b.expected_builders);
   if (expected !== null && !intIn(expected, 1, 100000)) return { ok: false, reason: 'bad_expected_builders' };
-  return { ok: true, plan: { days, passes, advisors, government, expected_builders: expected, existing: b.existing === true } };
+  const plan = { days, passes, advisors, government, expected_builders: expected, existing: b.existing === true };
+  // A DEMO's plan (task 1004506) also carries its time box and each stage's length in
+  // minutes. Only the birth path writes these (demoPlan below): the plan route's schema
+  // does not name them, so a client cannot send one.
+  if (b.demo != null) {
+    const d = b.demo;
+    if (!d || !intIn(d.people, DEMO_PEOPLE[0], DEMO_PEOPLE[1]) || !intIn(d.hours_each, DEMO_HOURS[0], DEMO_HOURS[1])) return { ok: false, reason: 'bad_demo' };
+    plan.demo = { people: d.people, hours_each: d.hours_each };
+  }
+  if (b.minutes != null) {
+    plan.minutes = {};
+    for (const s of PROPER) {
+      const m = b.minutes[s];
+      if (!intIn(m, 1, MAX_DEMO_MINUTES)) return { ok: false, reason: 'bad_minutes', stage: s };
+      plan.minutes[s] = m;
+    }
+  }
+  return { ok: true, plan };
+}
+
+// ── the demo's expedited genesis (task 1004506) ──────────────────────────────
+// Owner ruling, 2026-10-01: a demo DOES go through genesis, but expedited, because the
+// point of a demo is that the whole thing is fast. So a demo's plan is settled before
+// the founder ever sees it, from what the demo already picked: Monarchy / BDFL (the
+// founder's one yes closes each stage, spec D4's fast-track), one pass, no advisors,
+// the demo's people as the headcount. Its stages are minutes, not days: genesis gets a
+// fifth of the hours each person has (at least ten minutes, at most two hours), split
+// by how much each stage asks, so a small team reaches "come alive" with most of the
+// time box left for building.
+const DEMO_PEOPLE = Object.freeze([1, 12]); // modules/provisioning/demo.js DEMO_LIMITS
+const DEMO_HOURS = Object.freeze([1, 40]);
+const MAX_DEMO_MINUTES = 240;
+const DEMO_SHARE = 0.2;
+const DEMO_GENESIS_MINUTES = Object.freeze([10, 120]);
+const DEMO_WEIGHTS = Object.freeze({ scope: 3, strategize: 2, charter: 2, legalize: 1, legislation: 2 });
+
+// demoMinutes(hoursEach) — PURE. Each stage's length in minutes, from the time box.
+function demoMinutes(hoursEach) {
+  const [lo, hi] = DEMO_GENESIS_MINUTES;
+  const budget = Math.min(hi, Math.max(lo, Math.round(hoursEach * 60 * DEMO_SHARE)));
+  const total = Object.values(DEMO_WEIGHTS).reduce((a, b) => a + b, 0);
+  const out = {};
+  for (const s of PROPER) out[s] = Math.max(1, Math.round((budget * DEMO_WEIGHTS[s]) / total));
+  return out;
+}
+
+// demoPlan({ people, hours_each }) — PURE. The plan body a demo is born with; it goes
+// through parsePlan like any other, so it is held to the same ranges.
+function demoPlan({ people, hours_each: hoursEach }) {
+  return {
+    days: Object.fromEntries(PROPER.map((s) => [s, 1])),
+    minutes: demoMinutes(hoursEach),
+    passes: 1,
+    advisors: 'none',
+    government: 'monarchy',
+    expected_builders: people,
+    existing: false,
+    demo: { people, hours_each: hoursEach },
+  };
 }
 
 function readPlanValue(raw) {
@@ -99,8 +157,11 @@ function shapeGenesis({ mode, plan, tasks = {}, board = {}, stageAt = {} }) {
     const list = (tasks[key] || []).map((t) => ({ ...t, finished: FINISHED.includes(t.status) }));
     const b = board[key] || null;
     const days = plan && plan.days && plan.days[key] ? plan.days[key] : info.days;
+    // A demo's stage is minutes long (task 1004506); its due time is counted in them.
+    const minutes = plan && plan.minutes && plan.minutes[key] ? plan.minutes[key] : null;
     const began = stageAt[key] ? new Date(stageAt[key]) : null;
-    const due = began && Number.isFinite(began.getTime()) ? new Date(began.getTime() + days * 86400000).toISOString() : null;
+    const span = minutes ? minutes * 60000 : days * 86400000;
+    const due = began && Number.isFinite(began.getTime()) ? new Date(began.getTime() + span).toISOString() : null;
     return {
       key,
       number: idx,
@@ -110,6 +171,7 @@ function shapeGenesis({ mode, plan, tasks = {}, board = {}, stageAt = {} }) {
       done_when: info.done_when,
       wakes: fm.WAKES[key] || [],
       days,
+      minutes,
       due,
       state: idx < at ? 'done' : idx === at ? 'now' : 'later',
       tasks: list,
@@ -131,6 +193,8 @@ function shapeGenesis({ mode, plan, tasks = {}, board = {}, stageAt = {} }) {
     day: mode.day,
     deciding: mode.stage === 'decide',
     plan: plan || null,
+    // The demo's time box when this genesis is a demo's (task 1004506), else null.
+    demo: plan && plan.demo ? plan.demo : null,
     stages,
     // The close door: every task of the current stage finished, and not already sitting.
     can_close: !!(now && now.total > 0 && now.finished === now.total && !sitting && !passed),
@@ -193,8 +257,9 @@ async function readGenesis(deps = {}) {
   return shapeGenesis({ mode, plan, tasks, board, stageAt });
 }
 
-// startFounding — a brand-new project enters genesis (the create flow's birth calls
-// this). Refused once the project has come alive: genesis happens once (spec D8).
+// startFounding — a brand-new project enters genesis (founding-birth.js calls this once
+// on a project born through the startup flow, task 1004506). Refused once the project
+// has come alive: genesis happens once (spec D8).
 async function startFounding(builderId, deps = {}) {
   const s = seams(deps);
   const ended = await s.get(fm.KEYS.ENDED_AT);
@@ -269,6 +334,8 @@ async function onStagePassed(deps = {}) {
 }
 
 module.exports = {
-  PLAN_KEY, STAGE_INFO, PROPER, parsePlan, shapeGenesis,
+  PLAN_KEY, STAGE_INFO, PROPER, DEMO_PEOPLE, DEMO_HOURS, intIn, parsePlan, shapeGenesis, demoMinutes, demoPlan,
   readGenesis, startFounding, savePlan, closeStage, comeAlive, onStagePassed,
+  // the founding-mode deps this file reads the mode with, for founding-birth.js (task 1004506)
+  modeDepsFor: (deps) => modeDeps(seams(deps)),
 };

package/modules/onboarding/port.js

@@ -41,6 +41,7 @@
 const onboardingState = require('./onboarding-state');
 const newcomerRestock = require('./newcomer-restock');
 const foundingMode = require('./founding-mode');
+const foundingBirth = require('./founding-birth');
 
 module.exports = {
   // --- the newcomer onboarding state machine (onboarding-state.js) ---------
@@ -56,8 +57,14 @@ module.exports = {
 
   // --- project founding mode (founding-mode.js, task 1004422) ---------------
   // me.js reads it for the hall shell (null = not founding = the hall as today);
-  // the genesis home (task 1004423) drives the write.
-  foundingModeFor: (...a) => foundingMode.foundingModeFor(...a),
+  // the genesis home (task 1004423) drives the write. A project born through the
+  // startup flow enters genesis on this, its first read (founding-birth.js, task
+  // 1004506): once, guarded, and a no-op without the birth marker. A caller passing
+  // its own deps (a test) skips the birth.
+  foundingModeFor: async (...a) => {
+    if (!a.length) await foundingBirth.ensureBirth();
+    return foundingMode.foundingModeFor(...a);
+  },
   setFoundingMode: (...a) => foundingMode.setFoundingMode(...a),
 
   // --- the evergreen newcomer-chore restock (newcomer-restock.js) ----------

package/modules/onboarding/routes/onboarding.js

@@ -36,6 +36,7 @@ const onboardingPort = require('../port');
 const buildAccessRequestsRouter = require('./access-requests');
 const foundingBuilders = require('../founding-builders');
 const genesis = require('../genesis-home');
+const foundingBirth = require('../founding-birth');
 
 // Register the `onboarding` kernel PORT. See the header + port.js for the full
 // consumer list and the graceful-degradation contract.
@@ -76,6 +77,7 @@ const GENESIS_REFUSALS = {
   not_at_legislation: 409, legislation_not_passed: 409, stage_tasks_unfinished: 409,
   no_stage_tasks: 409, unknown_stage: 400, no_board: 503,
   bad_days: 400, bad_passes: 400, bad_advisors: 400, bad_government: 400, bad_expected_builders: 400,
+  bad_demo: 400, bad_minutes: 400,
 };
 let genesisListening = false;
 
@@ -101,7 +103,12 @@ function mountGenesisRoutes(router) {
       res.status(500).json({ error: { code: 'genesis_failed', message: 'internal error' } });
     }
   };
-  router.get('/founding/genesis', api.requireBuilder, handle(async (req) => ({ genesis: await genesis.readGenesis(), viewer_id: String(req.builder.id) })));
+  // A project born through the startup flow enters genesis on its first founding read
+  // (founding-birth.js, task 1004506) — here and on GET /me through the port.
+  router.get('/founding/genesis', api.requireBuilder, handle(async (req) => {
+    await foundingBirth.ensureBirth();
+    return { genesis: await genesis.readGenesis(), viewer_id: String(req.builder.id) };
+  }));
   router.post('/founding/start', api.requireBuilder, owns, handle((req) => genesis.startFounding(req.builder.id)));
   // The plan's ranges and vocabularies are genesis-home.js parsePlan's (one source);
   // this schema only names the fields so an unknown one is refused.

package/modules/provisioning/birth.js

@@ -0,0 +1,64 @@
+'use strict';
+
+// modules/provisioning/birth.js — the BIRTH MARKER: this project was made through the
+// startup flow, so it is born into genesis (task 1004506 / BV2.PS18; spec
+// docs/specs/bongos-v2-project-startup.md step 5 + D8).
+//
+// Founding mode lives in the NEW INSTANCE's own project_settings, and this process (the
+// hub's web tier) has no way into that database — the one rule of this module. So the
+// hub only says so, and the instance acts on it (modules/onboarding/founding-birth.js):
+//
+//   * the create route stamps `founding_birth` (a reserved settings-jsonb key, like
+//     push_owed and look_accent: platform bookkeeping, out of SETTINGS_VOCAB, so the
+//     settings PATCH cannot write it and effectiveSettings never projects it) on the
+//     row it JUST created — never on one that already existed, so a project made before
+//     this shipped is never born into anything (D8);
+//   * the companions below carry it, and a demo's time box, into the instance's
+//     web.env beside the other settings, at standup and on every settings-apply push.
+//
+// Always emitted, empty meaning "not born through the flow" / "not a demo", for the
+// same reason as every companion: the runner patches these lines in place, and a key
+// that came and went would leave a stale line behind.
+
+const BIRTH_KEY = 'founding_birth';
+const ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+
+const storedOf = (row) => (row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings) ? row.settings : {});
+
+// bornAt(row) — PURE. The birth stamp, or '' for a row that has none (or a mangled one).
+function bornAt(row) {
+  const v = String(storedOf(row)[BIRTH_KEY] || '');
+  return ISO.test(v) && Number.isFinite(new Date(v).getTime()) ? v : '';
+}
+
+// demoBox(row) — PURE. A born demo's { people, hours_each }, or null. Only a row that is
+// both born and a demo carries one: an older demo has no marker and founds nothing.
+function demoBox(row) {
+  if (!bornAt(row)) return null;
+  const d = row && row.demo;
+  if (!d || typeof d !== 'object') return null;
+  const people = Number(d.people);
+  const hours = Number(d.hours_each);
+  if (!Number.isInteger(people) || !Number.isInteger(hours) || people < 1 || hours < 1) return null;
+  return { people, hours_each: hours };
+}
+
+// The companion env (SETTINGS_COMPANION_ENV). src/branding.js maps them onto founding.*.
+const BIRTH_COMPANION_ENV = Object.freeze({
+  FOUNDING_BIRTH: bornAt,
+  DEMO_PEOPLE: (row) => { const d = demoBox(row); return d ? String(d.people) : ''; },
+  DEMO_HOURS: (row) => { const d = demoBox(row); return d ? String(d.hours_each) : ''; },
+});
+
+// stampBirth(db, instanceId, now) — the create route's one write, on the row it just
+// made. Write-once: a stamp already there is kept (the WHERE says so).
+async function stampBirth(db, instanceId, now = new Date()) {
+  await db.query(
+    `UPDATE provisioning_instances
+        SET settings = COALESCE(settings, '{}'::jsonb) || jsonb_build_object($2::text, $3::text)
+      WHERE id = $1 AND NOT (COALESCE(settings, '{}'::jsonb) ? $2::text)`,
+    [instanceId, BIRTH_KEY, now.toISOString()],
+  );
+}
+
+module.exports = { BIRTH_KEY, BIRTH_COMPANION_ENV, stampBirth };

package/modules/provisioning/dns-resolves.js

@@ -0,0 +1,54 @@
+'use strict';
+
+// modules/provisioning/dns-resolves.js — has the platform's own lookup seen this
+// project's address answer? (task 1004505, BV2.PS17; migration provisioning_036)
+//
+// WHY. A visitor's resolver caches a "not found" answer for the zone's negative TTL
+// (cloudbongos.com's SOA minimum is 1800s). The hub used to link an address as soon as
+// the row read 'active', so a founder who clicked before the name answered anywhere
+// could not reach their own project from their home network for up to half an hour.
+// The fix has two halves: the runner creates the DNS record FIRST (scripts/gds/
+// provision.js), and the hub holds every link to the address until `dns_resolves` is
+// true — a fact only a lookup the PLATFORM made can establish, never the status alone.
+//
+// Who writes it: the runner, at the end of a standup (minutes after the record was
+// created, so its own lookup cannot race the record into a cached miss), and the
+// liveness sweep, whose SSRF gate already resolves every active address. Sticky once
+// seen; a changed domain clears it (updateInstanceDomain in ./provisioning.js).
+// Its own file because ./provisioning.js sits at the 1500-line size ratchet.
+
+const dns = require('node:dns').promises;
+
+// The projection publicInstance carries. PURE. No domain ⇒ nothing to resolve.
+function dnsResolves(row) {
+  return !!(row && row.domain && row.dns_resolved_at);
+}
+
+// Record that a lookup answered. Narrow like recordDnsNote: no `status`, no
+// `updated_at`, and only the FIRST sighting writes, so a sweep never rewrites it.
+async function recordDnsResolved(db, id) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET dns_resolved_at = now()
+      WHERE id = $1 AND dns_resolved_at IS NULL RETURNING id, dns_resolved_at`,
+    [id]
+  );
+  return rows[0] || null;
+}
+
+// One bounded lookup: true when the name resolves to at least one address, false on
+// any failure or after `timeoutMs`. Never throws. `lookup` is injectable for tests.
+async function lookupAnswers(host, { lookup, timeoutMs = 5000 } = {}) {
+  if (!host) return false;
+  let timer = null;
+  const timeout = new Promise((resolve) => { timer = setTimeout(() => resolve(false), timeoutMs); });
+  try {
+    const ask = Promise.resolve((lookup || dns.lookup)(host, { all: true }))
+      .then((addrs) => Array.isArray(addrs) ? addrs.some((a) => a && a.address) : !!(addrs && addrs.address))
+      .catch(() => false);
+    return await Promise.race([ask, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+module.exports = { dnsResolves, recordDnsResolved, lookupAnswers };

package/modules/provisioning/migrations/provisioning_036_dns_resolved.sql

@@ -0,0 +1,30 @@
+-- provisioning_036_dns_resolved.sql — when the platform's own lookup first saw a
+-- project's address answer (task 1004505, BV2.PS17).
+--
+-- WHY THIS EXISTS. A visitor's resolver caches a "not found" answer for the zone's
+-- negative TTL (30 minutes on cloudbongos.com). The hub used to link a project's
+-- address as soon as the row said 'active', and the founder's first click, made
+-- before the name answered anywhere, poisoned their own home network for half an
+-- hour. The hub now holds every link to the address until this column is set.
+--
+-- WHAT IT ADDS.
+--   provisioning_instances.dns_resolved_at — NULL until a lookup made by the
+--   platform (the runner at the end of a standup, or the liveness sweep's gate)
+--   returned an address for the row's domain. Projected as `dns_resolves`.
+--   A changed domain clears it (updateInstanceDomain), like the liveness overlay.
+--
+-- OVERLAY, NOT A STATE (the provisioning_006 rule): nullable, no default, never
+-- written by the lifecycle. The backfill marks every address the sweep has
+-- already seen answer, so no live project loses its link when this lands.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS dns_resolved_at timestamptz;
+
+UPDATE provisioning_instances
+   SET dns_resolved_at = last_verified_at
+ WHERE dns_resolved_at IS NULL AND last_verified_up IS TRUE AND domain IS NOT NULL;
+
+COMMIT;

package/modules/provisioning/pollers/liveness-sweep.js

@@ -224,6 +224,11 @@ async function sweepOnce(deps = {}) {
     }
     const probe = await probeHealthz(url, { timeoutMs: deps.timeoutMs, fetchImpl: deps.fetchImpl, pin });
     const rec = await provisioning.recordLivenessProbe(db, row.id, probe.up);
+    // The gate's lookup IS the platform's own lookup (task 1004505): an address it
+    // resolved, or one that answered, may now be linked on the hub. First sighting only.
+    if (row.domain && !row.dns_resolved_at && (pin || probe.up)) {
+      await provisioning.recordDnsResolved(db, row.id).catch((e) => log(`[liveness] dns record failed (non-blocking): ${e && e.message ? e.message : e}`));
+    }
     return { row, probed: true, prevUp: rec ? rec.prev_up : null, ...probe };
   }));
 

package/modules/provisioning/provisioning.js

@@ -24,7 +24,8 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // projection both have to read them.
 const { PLANET_PHYSICS_QUESTIONS, canonicalAnswer } = require('./planet-physics');
 const { softLimitsFor } = require('./soft-limits'); const { demoView } = require('./demo');   // the demo marker's owner view (task 1004420)
-const { LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV } = require('./look');
+const { dnsResolves, recordDnsResolved, lookupAnswers } = require('./dns-resolves');   // has the platform's lookup seen the address answer (task 1004505)
+const { LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV } = require('./look'); const { BIRTH_COMPANION_ENV } = require('./birth'); // born into genesis (task 1004506)
 
 // ---------------------------------------------------------------------------
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
@@ -466,7 +467,7 @@ function publicInstance(row) {
     last_verified_up: row.last_verified_up == null ? null : !!row.last_verified_up,
     // The outstanding manual-DNS step, if the runner had no hook to point the
     // A record (task 1002720 / F16). null = nothing outstanding.
-    dns_note: row.dns_note || null,
+    dns_note: row.dns_note || null, dns_resolves: dnsResolves(row),   // the platform's lookup saw it answer; the hub links it only then (task 1004505)
     cost_estimate_usd: Number(row.cost_estimate_usd || 0),
     error_note: row.error_note || null,
     created_at: row.created_at,
@@ -518,7 +519,7 @@ function settingsEnvVars(row, prefix) {
 // cutoff and every unresolved review counts, which is the right answer for a
 // project that has been strict since it stood up.
 const SETTINGS_COMPANION_ENV = Object.freeze({
-  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, // + accent, logo (look.js)
+  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '', ...LOOK_COMPANION_ENV, ...BIRTH_COMPANION_ENV, // + accent, logo (look.js); birth, demo box (birth.js)
 });
 
 // The web.env block the runner writes at STANDUP (task 1003139): a comment that
@@ -974,7 +975,7 @@ async function updateInstanceDomain(db, id, domain, releasing = null) {
               ELSE array_append(released_domains, $3)
             END,
             last_verified_at = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_at END,
-            last_verified_up = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_up END,
+            last_verified_up = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_up END, dns_resolved_at = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE dns_resolved_at END,
             updated_at = now()
       WHERE id = $1 RETURNING *`,
     [id, domain, host, MAX_RELEASED_DOMAINS]
@@ -1004,7 +1005,7 @@ async function clearReleasedDomains(db, id) {
 // against it would only ever record a false "down". `limit` is a runaway guard.
 async function listActiveInstancesForLiveness(db, { limit = 500 } = {}) {
   const { rows } = await db.query(
-    `SELECT id, slug, domain, port, settings FROM provisioning_instances
+    `SELECT id, slug, domain, port, settings, dns_resolved_at FROM provisioning_instances
       WHERE status = 'active'
       ORDER BY id
       LIMIT $1`,
@@ -1486,7 +1487,7 @@ module.exports = {
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
-  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote, ownsErrorNote,
+  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote, ownsErrorNote, dnsResolves, recordDnsResolved, lookupAnswers,
   // data access — the owed-push marker (task 1003524)
   recordSettingsPushOwed,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,

package/modules/provisioning/routes/provisioning.js

@@ -64,7 +64,7 @@ const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
-const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo');
+const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 const { settingsPush, failPushConflict } = require('../settings-push');   // a settings save's push + receipt, shared with routes/look.js (task 1004421)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
@@ -471,6 +471,11 @@ module.exports = function provisioningRoutes() {
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
         return res.fail('slug_taken', { status: 409, message: 'That instance slug is already in use.' });
       }
+      // Born into genesis (task 1004506, ../birth.js): only the row this request MADE, and before the
+      // provision intent exists, so the runner's web.env already carries the marker and the demo's box.
+      // Best-effort: a project that misses its marker opens as an ordinary hall; the create still stands.
+      if (created) await birth.stampBirth(pool, instance.id).catch((err) => log.error('[provisioning] birth marker not stamped', err));
+      const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;
       // Enqueue the provision intent (idempotent: an already-open intent is returned)
       // — but ONLY when the instance actually needs standing up. Blindly enqueueing on
       // a re-request of an ACTIVE instance left a stale open provision intent that then
@@ -493,7 +498,6 @@ module.exports = function provisioningRoutes() {
       // description exists — the publish gate alone decides that — but the row has to be
       // there for the gate to have anything to decide about, and for the wizard's invite
       // step to have a project to invite into while standup is still running.
-      const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;
       await catalogBridge.publishInstanceToCatalog(pool, demoRow || instance).catch(() => {});
       // A re-request cannot change an existing instance's domain — SAY so instead of
       // silently dropping it (task 1002692); the domain route is the real path.

package/modules/provisioning/tests/liveness.mjs

@@ -234,6 +234,54 @@ await ta('an unresolvable domain still probes and records an honest DOWN (the qa
   assert.deepEqual({ blocked: out.blocked, down: out.down }, { blocked: 0, down: 1 });
   assert.deepEqual(out.reasons, ['ghostly:ENOTFOUND']);
   assert.deepEqual(db.updates.map((u) => u.up), [false], 'DNS-less domain = honest down, not a silent skip');
+  assert.ok(!db.updates.some((u) => /dns_resolved_at/.test(u.sql)), 'an address that did not resolve is never marked as resolving');
+});
+
+console.log('\ndns_resolves (task 1004505 — the hub links an address only once the platform saw it answer):');
+
+const isDnsWrite = (u) => /SET dns_resolved_at = now\(\)/.test(u.sql);
+
+await ta('a domain the gate RESOLVED is recorded as resolving — once, even when the probe itself is down', async () => {
+  const db = fakeDb([{ id: 9, slug: 'fresh', domain: 'fresh.example.com', port: null, dns_resolved_at: null }]);
+  await liveness.sweepOnce({
+    pool: db, log: () => {},
+    lookup: async () => [{ address: '93.184.216.34', family: 4 }],
+    fetchImpl: async () => { throw Object.assign(new TypeError('fetch failed'), { cause: { code: 'ECONNREFUSED' } }); },
+  });
+  const writes = db.updates.filter(isDnsWrite);
+  assert.equal(writes.length, 1, 'the lookup answered, so the address may be linked');
+  assert.equal(writes[0].id, 9);
+  assert.match(writes[0].sql, /dns_resolved_at IS NULL/, 'only the first sighting writes');
+  assert.ok(!/status|updated_at/.test(writes[0].sql), 'an overlay: no status, no updated_at');
+});
+
+await ta('an address already marked is not written again', async () => {
+  const db = fakeDb([{ id: 10, slug: 'old', domain: 'old.example.com', port: null, dns_resolved_at: '2026-10-01T10:00:00Z' }]);
+  await liveness.sweepOnce({
+    pool: db, log: () => {},
+    lookup: async () => [{ address: '93.184.216.34', family: 4 }],
+    fetchImpl: async () => new Response('ok', { status: 200 }),
+  });
+  assert.equal(db.updates.filter(isDnsWrite).length, 0);
+});
+
+t('publicInstance projects dns_resolves: false without a sighting or a domain, true with both', () => {
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: 'a.example.com' }).dns_resolves, false);
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: 'a.example.com', dns_resolved_at: '2026-10-01T10:00:00Z' }).dns_resolves, true);
+  assert.equal(provisioning.publicInstance({ id: 1, slug: 'a', status: 'active', domain: null, dns_resolved_at: '2026-10-01T10:00:00Z' }).dns_resolves, false);
+});
+
+await ta('lookupAnswers: an address is an answer; a miss, a throw or a hang is not', async () => {
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => [{ address: '1.2.3.4', family: 4 }] }), true);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => [] }), false);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: async () => { throw new Error('ENOTFOUND'); } }), false);
+  assert.equal(await provisioning.lookupAnswers('a.example.com', { lookup: () => new Promise(() => {}), timeoutMs: 20 }), false);
+  assert.equal(await provisioning.lookupAnswers('', {}), false);
+});
+
+t('a changed domain clears the sighting with the rest of the overlay', () => {
+  const src = provisioning.updateInstanceDomain.toString();
+  assert.match(src, /dns_resolved_at = CASE WHEN domain IS DISTINCT FROM \$2 THEN NULL ELSE dns_resolved_at END/);
 });
 
 await ta('the gate hands back the address it vetted, so the probe can pin to it (no re-resolution)', async () => {

package/modules/public-landing/public/projects-dns-pending.states.json

@@ -0,0 +1,85 @@
+{
+  "_": "Projects whose address does not resolve yet (task 1004505): the same page, the same stub, the instance list aliased to two projects the platform's own lookup has not seen answer. The mine rows and the manage page say the address is being set up and carry no link to it — a click before the name exists is cached as not found for up to half an hour. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-dns-pending.states.json",
+  "page": "/projects",
+  "surface": "public-landing",
+  "modes": [
+    "dark"
+  ],
+  "modeQuery": false,
+  "stub": {
+    "fixtures": {
+      "provisioning-instances": "provisioning-instances-dns-pending"
+    }
+  },
+  "ignoreRequests": [
+    "/api/(gds|bongos)/me$",
+    "/my-projects",
+    "/provisioning/onboard-plan",
+    "/env-manifest$"
+  ],
+  "ignoreConsole": [
+    "/api/(gds|bongos)/me",
+    "\\b401\\b",
+    "\\b404\\b",
+    "Unauthorized"
+  ],
+  "ignoreControls": [
+    ".skip",
+    ".vh"
+  ],
+  "states": {
+    "in-mine-dns-pending": {
+      "auth": true,
+      "url": "/projects?view=mine",
+      "expect": {
+        "visible": [
+          "#projectsList .proj .addr"
+        ],
+        "count": [
+          [
+            "#projectsList .proj",
+            2
+          ],
+          [
+            "#projectsList .proj .actions a",
+            2
+          ],
+          [
+            "#projectsList a[href^=\"https://\"]",
+            0
+          ],
+          [
+            "#projectsList a.worldOrb",
+            0
+          ]
+        ]
+      }
+    },
+    "in-manage-dns-pending": {
+      "auth": true,
+      "url": "/projects?view=manage&id=106",
+      "expect": {
+        "visible": [
+          "#mMain",
+          "#mAddr"
+        ],
+        "count": [
+          [
+            "#mAddr a",
+            0
+          ],
+          [
+            "#mActs a[href^=\"https://\"]",
+            0
+          ]
+        ],
+        "text": [
+          [
+            "#mName",
+            "beacon"
+          ]
+        ]
+      }
+    }
+  }
+}