- Shipped
- August 19, 2026 at 2:22 AM UTC
- Author
- Kamo
- Commit
- 28e6099
media.<domain> backs MediaService realtime websockets and is live in Traefik, auto-cert and the /setup/dns studio catalog, but it was dropped from KnownAliases in 76e968f and listed as deprecated in verifyDns. Both loops therefore skipped it: the required loop never saw it, and the optional loop skipped it as deprecated. verify-dns emitted no status with alias "media", and DnsSetupStudio renders a missing status as "pending" — so every org's media card sat at "awaiting DNS" no matter what the customer's zone actually said. Add media back to KnownAliases (which also restores it to DnsProvisioningService, createStandardAliases and DomainVerificationWatcher for new orgs), drop it from the deprecated set, and promote that set plus SSL_PROBE_LABELS to constants. DomainAliasContractTest pins KnownAliases against the kamo-internal studio catalog, asserts required and deprecated stay disjoint, and asserts the SSL probe covers every required alias — the three drifts that produced this silent failure.