changelog 2026-08-07 -- dc1-region standup sequence ("sequence and continue")

Session scope: sequence and execute the enumerated NEXT threads (dc1 region buildout, NetBox recording, hygiene). Status lives ONLY in docs/CURRENT-STATE.md; this file is the per-session body (GA-R2). Each item states what / why (evidence) / how to revert.

Item 1 -- NetBox tool GAP closed + as-built utility hosts LANDED into office1-netbox

What. New tested importer netbox/dc-util-hosts-import.py (+ harness tests/dc-util-hosts-import/ 19/19) that records a D-134 utility-band HOST's ip-addresses (both planes) into the apex, then landed the four as-built hosts:

host	metal-admin	provider-public	ids
vr1-dc0-juju-01 (.5)	10.12.8.5	10.12.4.5	187, 188
vr1-dc0-maas-01 (.6)	10.12.8.6	10.12.4.6	189, 190
vr1-dc0-tailscale-01 (.7)	10.12.8.7	10.12.4.7	191, 192
vr1-dc1-maas-01 (.6)	10.12.68.6	10.12.64.6	193, 194

Fidelity: apex ipam/ip-addresses 186 -> 194 (+8); idempotent re-run reports EXISTS / created: 0. Target office1-netbox (10.10.1.10, DOCFIX-195 sandbox apex).

Why. Landing the operator-flagged NetBox-pending list (changelog-20260807 Item 11) hit a tool gap: dc-plane-apex-import.py had loaded the D-134 utility RANGES (.4-.49) and the VIP addresses (.50-.62), but NO importer recorded the individual utility-HOST assignments within the band -- all 16 candidate host IPs measured absent. Per CLAUDE.md hard rule 4 the gap was declared (operator ruled "Build importer, then land") and NOT improvised as raw API POSTs.

Design (advisor-reviewed). DERIVED, never hardcoded: plane CIDRs from lib-net.sh, host octet from lib-hosts.sh (an empty/missing octet is a hard die -- the clean-zero failure class). ONE host per invocation (liveness is operator-asserted; no L3 path apex->DC plane, SEC-010). Whole-plan preflight (both planes) before any create; the D-134 utility RANGE is the precondition (a missing range dies). dns_name collision guard; SANDBOX_HOSTS + --yes-write-upstream gate; WAF-safe UA. dns_name carries each ruled vr1-dc<N>-<role>-NN name -> the dc0 RENAMES are recorded by construction (there were no stale old-name records to rename).

Scope boundary / deferred (queued findings).

The .4 ARTIFACT host (dc0 apt mirror / dc1 caching proxy, D-135) is OUT of this importer: it is not a lib-hosts host, is metal-admin-ONLY (10.12.8.4 / 10.12.68.4, no provider-public leg -- measured from dc-mirror.sh/dc-cache-proxy.sh LISTEN_CIDR), per-DC divergent, and has no host NAME anywhere in the repo. Recording it needs an operator naming ruling -- a separate finding, not this tool.
dc1 .5 juju-01 + .7 tailscale-01: record WHEN LIVE (juju not yet bootstrapped; tailscale planned, rebuilt in step E). The vr1-dc1-region MAAS region needs no separate NetBox object -- the apex dcim/regions are geographic (US-West / VR0 / VR1), not MAAS regions; the region VM is represented by its .6 ip-addresses.

How to revert. This is a NetBox state change, not a git revert. Delete the 8 ip-addresses by address from office1-netbox (ids 187-194, or by the four host dns_names), e.g. DELETE /api/ipam/ip-addresses/<id>/. The importer itself and its harness are removable with git rm netbox/dc-util-hosts-import.py tests/dc-util-hosts-import/

bash scripts/run-tests-all.sh --record-manifest.