# 2026-07-21 -- G12 [V] leg: vr1-dc1 substrate authoring (session changelog)

Session scope: the G12 remaining [V] leg per the D-124 AMENDMENT (2026-07-21):
apex confirm-free -> vr1_dc1 vars -> dc1 substrate authoring -> gated build.
Branch: `dc-dc-g12-dc1-substrate` (off post-Stage-3-merge `main`, per the
stage-close rule). One changelog for the session (GA-R2/D1); every item
carries its revert.

## Item 1 -- dc1 apex confirm-free capture (read-only; the [V] leg's first step)

Read-only GETs on office1-netbox (token used on-host, never printed), captured
to `docs/audit/dc1-apex-confirm-20260721.txt`. Findings:

- The six dc1 plane /22s ALREADY EXIST in the apex, scoped `vr1-dc1`, exactly
  matching the ratified D-124-amendment scheme (provider-public 10.12.64.0/22
  ... replication 10.12.84.0/22, roles per D-101). Confirm-CONSISTENT: the
  assignment landed at the original D-101/D-115 import; the ruled derivation
  matches it.
- Transit 172.31.0.4/30 FREE (container 172.31.0.0/24 + dc0's /30 are its only
  occupants; zero ip-addresses in the /30).
- Uplink 172.30.3.0/24 already registered to vr1-dc1 (D-115 edge import,
  2026-07-17). Rack IP 10.12.68.2 + forwarder .3 free (zero ip-addresses in
  10.12.68.0/22). Site `vr1-dc1` and role `transit` exist.

Consequence: the ONLY apex write still owed for dc1 is the transit /30 + rack
metal-admin IP -- exactly the dc-rack-mgmt-import.py surface (dc0 precedent:
those are the only two objects dc0 registered either; transit endpoint IPs and
the D-131 forwarder alias are NOT apex objects for dc0 and dc1 mirrors that).

Revert: delete the capture file (no state touched).

## Item 2 -- dc-rack-mgmt-import.py: per-site support (vr1-dc0 + vr1-dc1)

What: the importer was dc0-hardcoded (SITE_SLUG/METAL_ADMIN/RACK_DNS/desc
constants). Replaced with a `SITES` map (dc0: 10.12.8.0/22 / vvr1-dc0, ratified
2026-07-16; dc1: 10.12.68.0/22 / vvr1-dc1, D-124 amendment 2026-07-21) selected
by a new REQUIRED `--site {vr1-dc0,vr1-dc1}` flag (env: RACK_SITE). Explicit by
design: one DC's values can never land scoped to another site. An env-supplied
site is validated against SITES in code (argparse `choices` does not validate
env-default values). ROLE_SLUG / CONTAINER / D-120 band offsets stay global
(convention-wide). Also generalized dc0-specific error/usage text and fixed two
stale "(Cloud)" labels on the container messages (the container has been
172.31.0.0/24, not Cloud, since 2026-07-16).

Why: unblocks the one owed dc1 apex write; the D-124 scheme "generalizes
per-leg" and the tool now encodes that instead of forking a dc1 copy.

Harness: `tests/dc-rack-mgmt-import/` extended in the same change -- all CLI
cases pass `--site`, new cases: missing `--site` dies; bogus RACK_SITE env
dies; dc1 happy path (site id binding, /22 mask, dns vvr1-dc1); cross-site
guard (dc0 rack IP under --site vr1-dc1 rejected, zero writes); dc1 band edges
.2/.49 accepted, .1 gateway rejected; missing vr1-dc1 site precondition dies.
Structural pins moved from the retired globals to the SITES map.
**117/117 PASS** (was 96).

Live dry-run vs the real apex (read-only, on office1-netbox):
`docs/audit/dc1-rack-import-dryrun-20260721.txt` -- whole preflight PASS,
plan = would-create exactly 172.31.0.4/30 (role transit, scope vr1-dc1) +
10.12.68.2/22 (dns vvr1-dc1). The `--commit` is a GATED operator step (apex
mutation), not run here.

Revert: `git checkout main -- netbox/dc-rack-mgmt-import.py tests/dc-rack-mgmt-import/`
(restores the dc0-only tool); delete the two capture files. No apex state
touched (dry-run only).

## Item 3 -- IN FLIGHT AT DISCONNECT (drop-state record, landed 2026-07-22 by the successor session; NOT a delivery)

The session DISCONNECTED mid-item, before its bookend. This item records what
exists so the next session resumes without re-derivation; nothing here claims
delivery. Authored and sitting UNCOMMITTED in the tree at the drop:

- `opentofu/variables.tf`: `vr1_dc1_planes` (apex-verified D-124-amendment
  /22s), `vvr1_dc1_{vcpu,memory_mib,disk_bytes}` sizing, `vr1_dc1_ssh_pubkey_path`,
  and the deliberately NO-DEFAULT rack/transit vars (tfvars-only after the
  gated apex `--commit` -- hard rule 2).
- `opentofu/main.tf`: `module "vr1_dc1_uplink"` (172.30.3.0/24) +
  `module "vvr1_dc1"` containment VM (dc0 pattern of record, dedicated dc1 key).
- `opentofu/vr1-dc1-substrate/` (NEW): full inner root mirroring dc0's
  (same file set + variable shape); all 54 node MACs PRE-PINNED from first
  apply, scheme `52:54:01:d1:NN:PP` (locally-administered, outside libvirt's
  52:54:00 auto space).
- `scripts/lib-net.sh`: vr1-dc1 arm (literals land; unruled OpenStack-layer
  values UNSET) + a one-selection-per-shell guard.
- `tests/dc-selector/run-tests.sh`: reconciled, 40/40 PASS.

DROP POINT: after the dc-selector harness went green, BEFORE the full
gauntlet. Successor-run gauntlet = **6/76 FAILED** (capture
`docs/audit/gauntlet-20260722-g12-dropstate.txt`): carve-host-interfaces,
dc-dc-dr-drill, dc-dc-radosgw-multisite, dc-dc-rbd-mirror,
phase-00-maas-standup, reenroll-hosts -- all still assert the retired
"vr1-dc1 fails loud (NetBox gap)" selector behavior that the new dc1 arm
retires. Also sighted for the reconcile sweep: `tests/dc-dc-prefixes-import/
test_logic.py` greps the old message (currently passing); dc-dc-rbd-mirror's
reminder text prints dc0's replication CIDR under `dc=vr1-dc1` (cross-DC
value surfacing). repo-lint 0-fail; `tofu fmt -check` clean on all touched tf.

OWED to finish the item: reconcile the six harnesses (+ the two sighted
surfaces) -> gauntlet ALL GREEN -> delivery entry here -> commit + push.
THEN G12's next gated step is unchanged: operator-gated apex `--commit`
(transit /30 + rack IP), tfvars, build.

Revert (drops the in-flight work, NOT items 1-2): `git checkout --
opentofu/main.tf opentofu/variables.tf scripts/lib-net.sh
tests/dc-selector/run-tests.sh && rm -rf opentofu/vr1-dc1-substrate/`;
delete the gauntlet capture file.