# changelog 2026-08-07 -- dc1-region standup sequence ("sequence and continue")

Session scope: sequence and execute the enumerated NEXT threads (dc1 region buildout,
NetBox recording, hygiene). Status lives ONLY in `docs/CURRENT-STATE.md`; this file is
the per-session body (GA-R2). Each item states what / why (evidence) / how to revert.

---

## Item 1 -- NetBox tool GAP closed + as-built utility hosts LANDED into office1-netbox

**What.** New tested importer `netbox/dc-util-hosts-import.py` (+ harness
`tests/dc-util-hosts-import/` 19/19) that records a D-134 utility-band HOST's
ip-addresses (both planes) into the apex, then landed the four as-built hosts:

| host | metal-admin | provider-public | ids |
|---|---|---|---|
| vr1-dc0-juju-01 (.5)      | 10.12.8.5  | 10.12.4.5  | 187, 188 |
| vr1-dc0-maas-01 (.6)      | 10.12.8.6  | 10.12.4.6  | 189, 190 |
| vr1-dc0-tailscale-01 (.7) | 10.12.8.7  | 10.12.4.7  | 191, 192 |
| vr1-dc1-maas-01 (.6)      | 10.12.68.6 | 10.12.64.6 | 193, 194 |

Fidelity: apex `ipam/ip-addresses` 186 -> 194 (+8); idempotent re-run reports
`EXISTS / created: 0`. Target `office1-netbox` (10.10.1.10, DOCFIX-195 sandbox apex).

**Why.** Landing the operator-flagged NetBox-pending list (changelog-20260807
Item 11) hit a tool gap: `dc-plane-apex-import.py` had loaded the D-134 utility
RANGES (.4-.49) and the VIP addresses (.50-.62), but NO importer recorded the
individual utility-HOST assignments within the band -- all 16 candidate host IPs
measured absent. Per CLAUDE.md hard rule 4 the gap was declared (operator ruled
"Build importer, then land") and NOT improvised as raw API POSTs.

**Design (advisor-reviewed).** DERIVED, never hardcoded: plane CIDRs from
`lib-net.sh`, host octet from `lib-hosts.sh` (an empty/missing octet is a hard die --
the clean-zero failure class). ONE host per invocation (liveness is operator-asserted;
no L3 path apex->DC plane, SEC-010). Whole-plan preflight (both planes) before any
create; the D-134 utility RANGE is the precondition (a missing range dies). dns_name
collision guard; SANDBOX_HOSTS + `--yes-write-upstream` gate; WAF-safe UA. dns_name
carries each ruled `vr1-dc<N>-<role>-NN` name -> the dc0 RENAMES are recorded by
construction (there were no stale old-name records to rename).

**Scope boundary / deferred (queued findings).**
- The `.4` ARTIFACT host (dc0 apt mirror / dc1 caching proxy, D-135) is OUT of this
  importer: it is not a `lib-hosts` host, is metal-admin-ONLY (`10.12.8.4` /
  `10.12.68.4`, no provider-public leg -- measured from `dc-mirror.sh`/`dc-cache-proxy.sh`
  LISTEN_CIDR), per-DC divergent, and has no host NAME anywhere in the repo. Recording
  it needs an operator naming ruling -- a separate finding, not this tool.
- dc1 `.5` juju-01 + `.7` tailscale-01: record WHEN LIVE (juju not yet bootstrapped;
  tailscale planned, rebuilt in step E). The `vr1-dc1-region` MAAS region needs no
  separate NetBox object -- the apex `dcim/regions` are geographic (US-West / VR0 / VR1),
  not MAAS regions; the region VM is represented by its `.6` ip-addresses.

**How to revert.** This is a NetBox state change, not a git revert. Delete the 8
ip-addresses by address from `office1-netbox` (ids 187-194, or by the four host
dns_names), e.g. `DELETE /api/ipam/ip-addresses/<id>/`. The importer itself and its
harness are removable with `git rm netbox/dc-util-hosts-import.py tests/dc-util-hosts-import/`
+ `bash scripts/run-tests-all.sh --record-manifest`.