The root cause of the zone_not_found hunt: the old DNS API is gone. It answers
301 to the web console, and the owner's token already returns 200 against
api.hetzner.cloud — so this is code work, not a credential problem.
The note holds what the next session needs and would otherwise have to rediscover:
the endpoints, taken from cloud.spec.json rather than guessed, the fact that
records are now RRSets addressed by name and type, that a zone can be addressed
by NAME directly, and two traps in the name field — it must not end with the zone
name, which is exactly what the current client sends, and PUT on an rrset sets
labels rather than records.
Recorded rather than started, deliberately. HttpHetznerDnsClient writes the A
record for every customer instance; rewriting it is not something to begin
without room left to test it properly, and a half-migrated DNS client is worse
than a documented broken one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
a91e8525d2