- Shipped
- August 19, 2026 at 2:27 AM UTC
- Author
- Kamo
- Commit
- 6d045d1
DomainVerificationWatcher gated on **************** but **************** only ever answers ok/pending/error/na — it has never returned "verified". allVerified was therefore false on every sweep, so the watcher could only write dnsLastChecked: it never upgraded is_dns_verified, never reached the HTTPS probe (gated on dnsVerified), and never published dnsDomainChanged. A domain whose CNAMEs had all landed stayed AWAITING_DNS until someone opened /setup/dns and drove verify-dns by hand, which is exactly the browser-side polling this sweep exists to replace. Read isVerified() instead, so the check cannot drift from the status vocabulary again. DomainVerificationWatcherTest covers the upgrade path, READY publication, the hold on a single pending alias, the never-downgrade rule for web-alias orgs created is_dns_verified=true, and full KnownAliases coverage. Three of the five fail against the old comparison.