Repointing nameservers closes the window where old and new DNS can be compared

Only HTTP 429 gets a second chance in the sample runner. Every other unsuccessful status raises RuntimeError on the first response, so a 503 from the registrar ends the run wherever it happens to be ^[23]. Rate limiting gets five attempts, honoring Retry-After when the header is present and sleeping 2**attempt plus a random fraction of a second when it is not ^[16].

Add the fallback delays: 1, 2, 4, 8 and 16 seconds, which is 31 seconds of sleep before the error reaches the caller ^[1]. The last sleep lands after the fifth attempt, which the loop has already decided not to repeat. Each request also carries a 30 second timeout ^[18], so one badly behaved call can hold the runner for 150 seconds of requests on top of the backoff ^[2].

Idempotency is opt-in at the transport layer. call() attaches an Idempotency-Key header only when the caller passes one ^[17]. The snippet imports hashlib and defines stable_json, which serializes with sorted keys and compact separators ^[19]. Sorted-key serialization is what makes a content hash stable across runs. The excerpt stops inside main()'s argument parsing, at the default for --snapshot ^[22].

The diff runs on normalized records, and the post normalizes only the properties that define intended record identity and value, then reviews additions, changes and source-only entries ^[7]. The identity choice decides what the reviewer sees: put a mutable property in the identity and an edited record arrives as an addition plus a source-only entry; leave it out and the same edit arrives as one change.

Ownership changes who signs off, and the post keeps the machinery identical. Customer-owned zones get an import-and-approval boundary, platform-owned zones can start from a versioned template, and the template path is still told to enumerate first ^[4][11]. For a customer zone the approval artifact holds the saved source, the intended set, the computed changes and the verification result ^[10].

The legacy storefront is Node.js, and the post argues the migration runner does not have to inherit its registrar SDK ^[13]. "I prefer a small Python control plane because the input and output files drop directly into an eval harness," the author wrote ^[14]. The request payloads are JSON files built against the live discovery schema, so the runner does not guess vendor fields outside the contract ^[15]. Domain verification and account-side evidence sit in the surrounding onboarding workflow, on the same key and base URL, and the completed verification result feeds the final receipt instead of a timed poll against a registrar API ^[21].

The post argues this ordering from how the tool works, and it does not report how often a forgotten record causes an incident, or on how many zones the runner has been used ^[24].