docs(runbooks): correct the reverse-DNS claim, having now run this

[Gerrrt]

Recovers a commit that was written, committed and pushed, but never merged.

How it went missing

#169 merged at 03:01:01Z. Commit 3e723d6 was made on the same branch at 03:10:23Z — nine minutes later — and pushed, but no second PR was ever opened for it. It has been sitting on origin/docs/runbook-host-overrides ever since, reachable from nothing else.

Found while auditing local branches after enabling delete_branch_on_merge. Cherry-picked onto current main rather than reopening the old branch, which is 20 commits behind and whose name is already tied to the merged #169.

Why it matters

main currently tells you the opposite of what is true:

It does not create reverse DNS. A host override answers name → address only. dig -x 10.0.99.30 will still return nothing.

pfSense does write a local-data-ptr alongside the forward record. What it does not do is give every name one — only the first override claiming a given address gets the PTR:

local-data-ptr: "10.0.99.30 lemmiwinks.matrix.elysium"
local-data: "lemmiwinks.matrix.elysium. A 10.0.99.30"
local-data: "oracle.matrix.elysium. A 10.0.99.30"

oracle and lemmiwinks are one machine on 10.0.99.30, so the order they were added silently decided that reverse lookups of that address answer lemmiwinks and never oracle. Same for prometheus over grafana on .20. Anything logging by PTR inherits that choice, and changing it later means deleting both and re-adding in the other order — editing the second does not promote it.

The stale version is worse than merely incomplete: someone reading it would conclude reverse lookups are unavailable and go build something else, when the real constraint is that they exist and are first-come.

Also in this commit

• Records that morpheus answers with two addresses, 10.0.99.1 and 10.7.7.1, because pfSense registers the firewall's hostname on each interface. That looked like drift when a dig returned the unexpected one mid-verification; it is round-robin over a pre-existing pair.
• Marks the four overrides as applied and verified on 2026-08-30, rather than reading as outstanding work.

Checks

Cherry-picked cleanly onto main — no conflicts; nothing has touched add-a-host-override.md since #169. make lint and make validate both pass, including check_docs.py.

Once this merges, docs/runbook-host-overrides holds nothing unique and can be deleted.

🤖 Generated with Claude Code