2026-07-22 -- G12 [V] leg: dc1 apex write + substrate build step A (session changelog)

Session scope: continue the G12 [V] leg from the reconciled tree (predecessor delivery landed as changelog-20260721-g12-dc1-authoring.md items 3-4, commit d2bf743): the one owed apex write, tfvars, and the gated outer build. Branch: dc-dc-g12-dc1-substrate. One changelog for the session (GA-R2/D1); every item carries its revert.

Item 1 -- apex `--commit` EXECUTED (the one owed dc1 apex write; operator-gated)

Same-session read-only preflight FIRST (verify-before-mutate): dry-run re-run against the live apex = would-create exactly 2, already-present 0 -- docs/audit/dc1-rack-import-dryrun-20260722.txt, identical to the 07-21 preflight. Then the gated write (piped to office1-netbox over ssh; token sourced on-host from /root/netbox-secrets/api.token per creds-manifests/vr1-office1.manifest, value never printed or brought into context):

CREATED 172.31.0.4/30 (prefix id=139) role=transit scope=dcim.site:vr1-dc1
CREATED 10.12.68.2/22 (ip id=4) dns=vvr1-dc1

Post-commit idempotency read-back: would-create 0 / already-present 2. Both runs captured in docs/audit/dc1-rack-import-commit-20260722.txt. Values verbatim from the D-124 amendment (ruled 2026-07-21); exactly the two objects the dc0 precedent registered.

Revert: delete the two apex objects by id (prefix 139, ip-address 4) via the NetBox UI/API on office1-netbox; delete the capture files.

Item 2 -- vr1-dc1 service keypair MINTED (manifest-prescribed at-deploy step)

~/vr1-dc1-creds/vr1-dc1_svc_ed25519{,.pub} generated on vcloud (ed25519, modes 600/644) per creds-manifests/vr1-dc1.manifest ("MINTED AT DC DEPLOY"). bash scripts/creds-audit.sh vr1-dc1 = CLEAN. D-126 option (a) per-env key; pubkey feeds vvr1-dc1 cloud-init (item 3), private half jumphost-local.

Revert: remove both key files (couples to item 4 -- vvr1-dc1's cloud-init authorizes this pubkey; re-mint requires a seed rebuild).

Item 3 -- dc1 tfvars authored (LOCAL, gitignored -- recorded here, not committed)

opentofu/d124-rack.auto.tfvars gained the five vr1dc1* values, verbatim from the D-124 amendment's own tfvars line (rack_metal_admin_ip=10.12.68.2, rack_transit_ip=172.31.0.6, rack_transit_prefix=30, rack_transit_peer_ip=172.31.0.5) + vr1_dc1_ssh_pubkey_path to the item-2 pubkey. Stale "dc1 DEFERRED" header comment replaced. tofu fmt applied; scripts/opentofu-validate.sh PASS (all roots).

Revert: remove the vr1dc1* block from the local file.

Item 4 -- outer apply: dc1 substrate step A (operator-gated, logged, saved-plan exact)

Preconditions measured in-session: host RAM 1007 GiB with 450 GiB committed (voffice1 32 + edge 2 + vvr1-dc0 416) -> +416 GiB fits with ~140 GiB headroom; vCPU 234/256 post-apply; dc-dc-whole-host-budget 13/13 PASS.

Saved plan tfplan-dc1-20260722 = 5/0/0 exact (vr1-dc1-uplink network + vvr1-dc1 domain/disk/seed/cloudinit; ZERO touches to live resources) -- capture docs/audit/outer-plan-20260722-dc1-substrate.txt. Applied via the saved plan under a per-command as-executed wrap (~/as-executed/2026-07-22-dc1-deploy.log; index row added): 5 added, 0 changed, 0 destroyed. Convergence re-plan = zero diff (docs/audit/outer-plan-20260722-postdc1-converged.txt). Live verify: vvr1-dc1 RUNNING (Id 8), voffice1/office1-opnsense/vvr1-dc0 untouched and running; vr1-dc1-uplink + both dc1 mesh legs active.

Revert: runbooks/dc-dc-teardown-rollback.md decision tree; the targeted destroy set is the five applied resources (module.vvr1_dc1. + module.vr1_dc1_uplink.); delete the plan/capture files and the tfplan.

CORRECTION (same session): commit 0bd6342 accidentally included the spent binary saved plan (repo-lint L1 x2 -- the lint's exit code was masked by a pipeline; owned). The file deviated from the .gitignore naming convention (opentofu/**/*.tfplan) -- saved plans must be named *.tfplan. Removed in the follow-up commit; lint back to 0-fail. The applied-plan record remains the two dated captures.

Next (gated, not run here)