From a6b5e72bb6854c027dfd35d2cd18e93cd6d90d1e Mon Sep 17 00:00:00 2001
From: Bretton <brettmay0212@gmail.com>
Date: Sat, 3 Oct 2026 17:48:58 -0700
Subject: [PATCH] feat(delegation): reconcile every 15 minutes and add an admin
 reconcile route

The delegation reconciler's Run loop makes a pass at startup without
waiting, then every 15 minutes, matching the community reconciler. A
failed pass is logged and the loop continues.

Passes are serialized with a context-aware slot: a Reconcile call made
during a pass waits for it, then runs its own, and a caller cancelled
while waiting returns its context error without starting a pass. This is
the only guard on the hourly budget, which each pass derives from the
created_on timestamps in the NS listing.

POST /admin/dns/reconcile sits behind the existing admin bearer and runs
one pass synchronously: 200 with the result as JSON, 500 with
{error, result} when the pass fails (so a ceiling stop still shows the
pending, deferred and ceiling figures), 501 when no reconciler is set.
The route has a 10-minute write deadline. Scheduled and forced passes
log the same LogPass summary.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 README.md                              |   3 +-
 cmd/tidepool/delegation_test.go        |  57 ++++-
 cmd/tidepool/main.go                   |  34 +--
 internal/config/config.go              |   2 +-
 internal/delegation/reconciler.go      |  97 ++++++-
 internal/delegation/reconciler_test.go |  71 +++--
 internal/delegation/run_test.go        | 219 ++++++++++++++++
 internal/ingest/dns_reconcile_test.go  | 341 +++++++++++++++++++++++++
 internal/ingest/follow.go              |  41 +++
 9 files changed, 800 insertions(+), 65 deletions(-)
 create mode 100644 internal/delegation/run_test.go
 create mode 100644 internal/ingest/dns_reconcile_test.go

diff --git a/README.md b/README.md
index 3144990..576fc97 100644
--- a/README.md
+++ b/README.md
@@ -323,7 +323,7 @@ Two classes, and the difference matters at boot:
 | `DNS_PUBLIC_IPV4` | *(unset)* | IPv4 address returned in A answers; required when `DNS_LISTEN` is set |
 | `DNS_PUBLIC_IPV6` | *(unset)* | optional IPv6 address returned in AAAA answers when DNS is enabled |
 | `DNS_NAMESERVERS` | `ns1`/`ns2` under `BRIDGE_HOSTNAME` when DNS is enabled | comma-separated nameserver hostnames returned in apex NS answers (first is the SOA primary) |
-| `CLOUDFLARE_API_TOKEN` | *(empty; disabled)* | Cloudflare API token with DNS edit on the zone; enables a startup pass creating `<label>.<BRIDGE_HOSTNAME> NS <first DNS_NAMESERVERS entry>` records, oldest qualified label first. A pass creates at most 20 records per rolling hour and stops at `DELEGATION_MAX_NS_RECORDS`; labels it skips wait for a later pass. Requires `DNS_LISTEN`, `CLOUDFLARE_ZONE_ID`, and `DELEGATION_MAX_NS_RECORDS`; empty disables delegation |
+| `CLOUDFLARE_API_TOKEN` | *(empty; disabled)* | Cloudflare API token with DNS edit on the zone; enables a pass at startup and every 15 minutes creating `<label>.<BRIDGE_HOSTNAME> NS <first DNS_NAMESERVERS entry>` records, oldest qualified label first. Creation is capped at 20 records per rolling hour across all passes (zone-wide, counted from Cloudflare `created_on`), and a pass stops at `DELEGATION_MAX_NS_RECORDS`; labels it skips wait for a later pass. Requires `DNS_LISTEN`, `CLOUDFLARE_ZONE_ID`, and `DELEGATION_MAX_NS_RECORDS`; empty disables delegation |
 | `CLOUDFLARE_ZONE_ID` | *(unset)* | zone ID of the zone holding `BRIDGE_HOSTNAME`; required when `CLOUDFLARE_API_TOKEN` is set |
 | `DELEGATION_MAX_NS_RECORDS` | *(unset)* | positive ceiling on configured-nameserver NS records in the zone; required when `CLOUDFLARE_API_TOKEN` is set. Recommended: 3,000 on Cloudflare Pro, 150 on Free |
 | `BRIDGE_SCHEME` | `https` | scheme of the bridge's own AP URLs (actor id, inbox, activity ids). `http` is dev-only — the e2e harness federates with a debug-mode Lemmy over plain HTTP |
@@ -385,6 +385,7 @@ through Caddy.
 | `POST /admin/communities/backfill` | on-demand outbox backfill | backfill unconfigured (**501**) |
 | `POST /admin/communities/refresh-profile` | force a `community.profile` re-materialization past the profile TTL (backfills new record fields into dormant communities). `{"community":…}` is synchronous; `{"all":true}` answers **202** and walks every bridged community in the background, one at a time with a pause, **409** while a walk is running; progress and the final `done`/`failed`/`skipped` summary go to the log, and shutdown stops the walk at its next community | — |
 | `POST /admin/communities/reconcile` | force one follow-list sweep | **501** — `FOLLOW_LIST_PATH` is unset. The reconciler is only built when the path is set, so this is "no follow list configured", not a broken endpoint |
+| `POST /admin/dns/reconcile` | run one delegation pass now and return its result. The call waits behind a running pass, then answers **200** with the result, or **500** with `{error, result}` when the pass fails (including a stop at `DELEGATION_MAX_NS_RECORDS`, a normal operating state). The route extends its own write deadline to 10 minutes, past the server's 30s write timeout, so a long pass still returns its result. The full result is also logged as `delegation pass finished`, including the created and pending label lists | **501** — `CLOUDFLARE_API_TOKEN` is unset |
 | `POST /admin/reemit` | re-emit a repo's records as delete+create pairs (relay cold-start gap) | repo manager unconfigured (**501**) |
 | `POST /admin/objects/sweep-deleted` | origin-verified cleanup of missed deletes | sweeper unconfigured (**501**) |
 | `GET /admin/divergence` | run one reconciliation sweep synchronously and return the report | always wired in a normal deployment |
diff --git a/cmd/tidepool/delegation_test.go b/cmd/tidepool/delegation_test.go
index 751e389..8c88e9c 100644
--- a/cmd/tidepool/delegation_test.go
+++ b/cmd/tidepool/delegation_test.go
@@ -160,6 +160,14 @@ func (startupAcceptanceChecker) AcceptanceStands(context.Context, string, string
 	return true, nil
 }
 
+type recordingDNSReconcilerSetter struct {
+	received []*delegation.Reconciler
+}
+
+func (setter *recordingDNSReconcilerSetter) SetDNSReconciler(reconciler *delegation.Reconciler) {
+	setter.received = append(setter.received, reconciler)
+}
+
 func seedStartupFollowedCommunity(t *testing.T, ctx context.Context, conn *sql.DB, groupID, did string) {
 	t.Helper()
 	communities := store.NewCommunities(conn)
@@ -214,24 +222,37 @@ func TestStartDelegationStartsBackgroundPass(t *testing.T) {
 	seedStartupComment(t, ctx, conn, "did:plc:cmddelegationstart000000001", "did:plc:cmddelegationcommunity00001", "startup", now.Add(-2*time.Hour))
 
 	fake := newStartupCloudflareAPI(t, true)
+	setter := &recordingDNSReconcilerSetter{}
+	finished := make(chan slog.Record, 1)
+	logger := slog.New(startupPassSignal{Handler: testLogger().Handler(), finished: finished})
 	type startupResult struct {
 		reconciler *delegation.Reconciler
 		err        error
 	}
 	returned := make(chan startupResult, 1)
+	startDone := make(chan struct{})
+	t.Cleanup(func() {
+		cancel()
+		select {
+		case <-startDone:
+		case <-time.After(5 * time.Second):
+			t.Error("startDelegation goroutine did not finish")
+		}
+	})
 	go func() {
+		defer close(startDone)
 		reconciler, err := startDelegation(ctx, startupDelegationConfig(true), actors, startupAcceptanceChecker{},
-			fake.server.URL+"/client/v4", testLogger())
+			setter, fake.server.URL+"/client/v4", logger)
 		returned <- startupResult{reconciler, err}
 	}()
 	// Whichever happens first, the returned value must be valid and the GET
 	// must start; the GET stays blocked until after both conditions hold.
-	returnedAlready := false
+	var reconciler *delegation.Reconciler
 	select {
 	case result := <-returned:
 		require.NoError(t, result.err)
 		require.NotNil(t, result.reconciler)
-		returnedAlready = true
+		reconciler = result.reconciler
 	case <-fake.firstGET:
 	case <-time.After(5 * time.Second):
 		t.Fatal("neither startDelegation returned nor the background GET started")
@@ -241,15 +262,19 @@ func TestStartDelegationStartsBackgroundPass(t *testing.T) {
 	case <-time.After(5 * time.Second):
 		t.Fatal("background pass never sent its first listing GET")
 	}
-	if !returnedAlready {
+	if reconciler == nil {
 		select {
 		case result := <-returned:
 			require.NoError(t, result.err)
 			require.NotNil(t, result.reconciler, "startDelegation must return before the listing GET finishes")
+			reconciler = result.reconciler
 		case <-time.After(5 * time.Second):
 			t.Fatal("startDelegation blocked on the held listing GET")
 		}
 	}
+	if assert.Len(t, setter.received, 1, "admin must receive the reconciler exactly once") {
+		assert.Same(t, reconciler, setter.received[0], "admin must receive the exact reconciler returned")
+	}
 	fake.release()
 	select {
 	case request := <-fake.post:
@@ -264,6 +289,13 @@ func TestStartDelegationStartsBackgroundPass(t *testing.T) {
 	case <-time.After(5 * time.Second):
 		t.Fatal("background pass did not create the delegation")
 	}
+	select {
+	case record := <-finished:
+		assert.Equal(t, slog.LevelInfo, record.Level)
+		assert.Equal(t, "delegation pass finished", record.Message)
+	case <-time.After(5 * time.Second):
+		t.Fatal("Run did not log a delegation pass finished summary")
+	}
 	requests, unauthorized := fake.snapshot()
 	assert.False(t, unauthorized, "every Cloudflare request must use the configured bearer token")
 	for _, request := range requests {
@@ -279,9 +311,11 @@ func TestStartDelegationDisabledWithoutToken(t *testing.T) {
 	fake := newStartupCloudflareAPI(t, false)
 	cfg := startupDelegationConfig(true)
 	cfg.CloudflareAPIToken = ""
-	reconciler, err := startDelegation(ctx, cfg, nil, startupAcceptanceChecker{}, fake.server.URL+"/client/v4", testLogger())
+	setter := &recordingDNSReconcilerSetter{}
+	reconciler, err := startDelegation(ctx, cfg, nil, startupAcceptanceChecker{}, setter, fake.server.URL+"/client/v4", testLogger())
 	require.NoError(t, err)
 	assert.Nil(t, reconciler)
+	assert.Empty(t, setter.received, "disabled delegation must not call the admin setter")
 	requests, _ := fake.snapshot()
 	assert.Empty(t, requests)
 }
@@ -306,7 +340,7 @@ type startupPassSignal struct {
 
 func (handler startupPassSignal) Handle(ctx context.Context, record slog.Record) error {
 	err := handler.Handler.Handle(ctx, record)
-	if record.Message == "startup delegation pass finished" {
+	if record.Message == "delegation pass finished" {
 		handler.finished <- record.Clone()
 	}
 	return err
@@ -348,8 +382,9 @@ func TestStartDelegationQualifiesStartupLabels(t *testing.T) {
 	fake := newStartupCloudflareAPI(t, false)
 	finished := make(chan slog.Record, 1)
 	logger := slog.New(startupPassSignal{Handler: testLogger().Handler(), finished: finished})
+	setter := &recordingDNSReconcilerSetter{}
 	reconciler, err := startDelegation(ctx, startupDelegationConfig(true), actors, startupAcceptanceChecker{},
-		fake.server.URL+"/client/v4", logger)
+		setter, fake.server.URL+"/client/v4", logger)
 	require.NoError(t, err)
 	require.NotNil(t, reconciler)
 	var record slog.Record
@@ -409,7 +444,7 @@ func (handler startupCeilingSignal) Handle(ctx context.Context, record slog.Reco
 		default:
 		}
 	}
-	if record.Message == "startup delegation pass finished" {
+	if record.Message == "delegation pass finished" {
 		handler.finished <- record.Clone()
 	}
 	return err
@@ -442,7 +477,8 @@ func TestStartDelegationHonorsConfiguredCeiling(t *testing.T) {
 	logger := slog.New(startupCeilingSignal{Handler: testLogger().Handler(), finished: finished, errors: errors})
 	cfg := startupDelegationConfig(true)
 	cfg.DelegationMaxNSRecords = 2
-	reconciler, err := startDelegation(ctx, cfg, actors, startupAcceptanceChecker{}, fake.server.URL+"/client/v4", logger)
+	setter := &recordingDNSReconcilerSetter{}
+	reconciler, err := startDelegation(ctx, cfg, actors, startupAcceptanceChecker{}, setter, fake.server.URL+"/client/v4", logger)
 	require.NoError(t, err)
 	require.NotNil(t, reconciler)
 	var summary slog.Record
@@ -486,8 +522,9 @@ func TestStartDelegationGuardsPrivateAddresses(t *testing.T) {
 	logger, _ := capturingLogger()
 	errors := make(chan slog.Record, 1)
 	logger = slog.New(startupErrorSignal{Handler: logger.Handler(), errors: errors})
+	setter := &recordingDNSReconcilerSetter{}
 	reconciler, err := startDelegation(ctx, startupDelegationConfig(false), startupLabelSource{}, startupAcceptanceChecker{},
-		fake.server.URL+"/client/v4", logger)
+		setter, fake.server.URL+"/client/v4", logger)
 	require.NoError(t, err)
 	require.NotNil(t, reconciler)
 	select {
diff --git a/cmd/tidepool/main.go b/cmd/tidepool/main.go
index ebce277..56caf37 100644
--- a/cmd/tidepool/main.go
+++ b/cmd/tidepool/main.go
@@ -300,9 +300,6 @@ func run(logger *slog.Logger) error {
 	if err != nil {
 		return err
 	}
-	if _, err := startDelegation(ctx, cfg, actors, repoAcceptanceChecker{repos: repoManager}, delegation.CloudflareAPIBaseURL, logger); err != nil {
-		return fmt.Errorf("delegation: %w", err)
-	}
 	broadcaster, err := tidepoolsync.NewBroadcaster(cfg.DatabaseURL, 0, logger)
 	if err != nil {
 		return err
@@ -595,6 +592,9 @@ func run(logger *slog.Logger) error {
 	if err != nil {
 		return err
 	}
+	if _, err := startDelegation(ctx, cfg, actors, repoAcceptanceChecker{repos: repoManager}, admin, delegation.CloudflareAPIBaseURL, logger); err != nil {
+		return fmt.Errorf("delegation: %w", err)
+	}
 	admin.Routes(router)
 
 	// Declarative follow list (FOLLOW_LIST_PATH): converge subscriptions to
@@ -1058,9 +1058,15 @@ func (checker repoAcceptanceChecker) AcceptanceStands(ctx context.Context, commu
 	return acceptrec.AcceptanceStands(ctx, checker.repos, communityDID, subjectURI)
 }
 
-// startDelegation starts one asynchronous delegation pass when a Cloudflare
-// token is configured, returning the reconciler without waiting for the pass.
-func startDelegation(ctx context.Context, cfg *config.Config, actors store.BridgedActors, acceptances delegation.AcceptanceChecker, cloudflareBaseURL string, logger *slog.Logger) (*delegation.Reconciler, error) {
+// dnsReconcilerSetter receives the delegation reconciler so the admin API can
+// run passes on demand.
+type dnsReconcilerSetter interface {
+	SetDNSReconciler(*delegation.Reconciler)
+}
+
+// startDelegation wires and starts scheduled delegation passes when a
+// Cloudflare token is configured, returning without waiting for the first pass.
+func startDelegation(ctx context.Context, cfg *config.Config, actors store.BridgedActors, acceptances delegation.AcceptanceChecker, admin dnsReconcilerSetter, cloudflareBaseURL string, logger *slog.Logger) (*delegation.Reconciler, error) {
 	if cfg.CloudflareAPIToken == "" {
 		return nil, nil
 	}
@@ -1081,19 +1087,7 @@ func startDelegation(ctx context.Context, cfg *config.Config, actors store.Bridg
 	if err != nil {
 		return nil, fmt.Errorf("create delegation reconciler: %w", err)
 	}
-	go func() {
-		result, err := reconciler.Reconcile(ctx)
-		logger.InfoContext(ctx, "startup delegation pass finished", "component", "delegation",
-			"created_count", len(result.Created), "created", result.Created,
-			"already_delegated_count", len(result.AlreadyDelegated),
-			"conflicting_count", len(result.Conflicting), "conflicting", result.Conflicting,
-			"pending_count", len(result.Pending), "pending", result.Pending,
-			"deferred_count", len(result.Deferred), "delegated_records", result.DelegatedRecords, "ceiling", result.Ceiling,
-			"failed_count", len(result.Failed), "failed", result.Failed,
-			"delegated_without_live_actors_count", len(result.DelegatedWithoutLiveActors))
-		if err != nil {
-			logger.ErrorContext(ctx, "startup delegation pass failed", "component", "delegation", "error", err)
-		}
-	}()
+	admin.SetDNSReconciler(reconciler)
+	go reconciler.Run(ctx)
 	return reconciler, nil
 }
diff --git a/internal/config/config.go b/internal/config/config.go
index 2c1477f..e351711 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -43,7 +43,7 @@ type Config struct {
 	DNSPublicIPv4  netip.Addr
 	DNSPublicIPv6  netip.Addr
 	DNSNameservers []string
-	// CloudflareAPIToken enables the startup delegation pass when set.
+	// CloudflareAPIToken enables delegation passes (at startup and every 15 minutes) when set.
 	CloudflareAPIToken string
 	// DelegationMaxNSRecords caps configured-nameserver NS records in the zone.
 	DelegationMaxNSRecords int
diff --git a/internal/delegation/reconciler.go b/internal/delegation/reconciler.go
index 1af47ed..fbb1414 100644
--- a/internal/delegation/reconciler.go
+++ b/internal/delegation/reconciler.go
@@ -50,6 +50,7 @@ type Options struct {
 	Acceptances   AcceptanceChecker
 	Now           func() time.Time
 	MaxNSRecords  int
+	Interval      time.Duration
 }
 
 // ErrCeilingReached reports that the NS record ceiling stopped a pass with qualifying labels left.
@@ -68,6 +69,53 @@ type Reconciler struct {
 	nameservers   []string
 	logger        *slog.Logger
 	maxNSRecords  int
+	interval      time.Duration
+	passSlot      chan struct{}
+}
+
+// Run reconciles immediately and at each configured interval until ctx is done.
+func (r *Reconciler) Run(ctx context.Context) {
+	pass := func() {
+		result, err := r.Reconcile(ctx)
+		r.LogPass(ctx, result, err)
+	}
+
+	if ctx.Err() != nil {
+		return
+	}
+	pass()
+	ticker := time.NewTicker(r.interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			if ctx.Err() != nil {
+				return
+			}
+			pass()
+		}
+	}
+}
+
+// LogPass logs a pass's summary and error the way Run does; a pass ended by
+// ctx's own cancellation logs nothing.
+func (r *Reconciler) LogPass(ctx context.Context, result Result, err error) {
+	if ctx.Err() != nil && errors.Is(err, ctx.Err()) {
+		return
+	}
+	r.logger.InfoContext(ctx, "delegation pass finished", "component", "delegation",
+		"created_count", len(result.Created), "created", result.Created,
+		"already_delegated_count", len(result.AlreadyDelegated),
+		"conflicting_count", len(result.Conflicting), "conflicting", result.Conflicting,
+		"pending_count", len(result.Pending), "pending", result.Pending,
+		"deferred_count", len(result.Deferred), "delegated_records", result.DelegatedRecords, "ceiling", result.Ceiling,
+		"failed_count", len(result.Failed), "failed", result.Failed,
+		"delegated_without_live_actors_count", len(result.DelegatedWithoutLiveActors))
+	if err != nil {
+		r.logger.ErrorContext(ctx, "delegation pass failed", "component", "delegation", "error", err)
+	}
 }
 
 func normalizeDNSName(name string) string {
@@ -97,10 +145,15 @@ func NewReconciler(options Options) (*Reconciler, error) {
 	if now == nil {
 		now = time.Now
 	}
+	interval := options.Interval
+	if interval == 0 {
+		interval = 15 * time.Minute
+	}
 	return &Reconciler{
 		client: options.Client, labels: options.Labels, zoneRoot: normalizeDNSName(options.ZoneRoot),
 		contributions: options.Contributions, acceptances: options.Acceptances, now: now,
 		nameservers: nameservers, logger: logger, maxNSRecords: options.MaxNSRecords,
+		interval: interval, passSlot: make(chan struct{}, 1),
 	}, nil
 }
 
@@ -108,39 +161,39 @@ func NewReconciler(options Options) (*Reconciler, error) {
 // lowercased DNS labels rather than fully qualified names.
 type Result struct {
 	// Created contains live labels for which an NS record was created.
-	Created []string
+	Created []string `json:"created"`
 	// AlreadyDelegated contains live labels with a configured NS record.
-	AlreadyDelegated []string
+	AlreadyDelegated []string `json:"already_delegated"`
 	// Conflicting contains labels with foreign NS records, including labels
 	// that also have a configured NS record.
-	Conflicting []Conflict
+	Conflicting []Conflict `json:"conflicting"`
 	// Failed contains live labels whose qualification or NS creation failed.
-	Failed []Failure
+	Failed []Failure `json:"failed"`
 	// DelegatedWithoutLiveActors contains labels with configured NS records
 	// but no live actors and no foreign NS records.
-	DelegatedWithoutLiveActors []string
+	DelegatedWithoutLiveActors []string `json:"delegated_without_live_actors"`
 	// Pending contains live labels without a standing contribution or outright qualification.
-	Pending []string
+	Pending []string `json:"pending"`
 	// Deferred contains qualifying labels left for a later pass by the ceiling or the hourly budget.
-	Deferred []string
+	Deferred []string `json:"deferred"`
 	// DelegatedRecords counts configured-nameserver NS records at any name in
 	// the zone, including names outside the bridge hostname, plus this pass's
 	// successful creates.
-	DelegatedRecords int
+	DelegatedRecords int `json:"delegated_records"`
 	// Ceiling is the configured maximum number of configured-nameserver NS records.
-	Ceiling int
+	Ceiling int `json:"ceiling"`
 }
 
 // Conflict identifies a label and the foreign nameservers in its NS records.
 type Conflict struct {
-	Label    string
-	Contents []string
+	Label    string   `json:"label"`
+	Contents []string `json:"contents"`
 }
 
 // Failure identifies a label whose NS record could not be created and why.
 type Failure struct {
-	Label  string
-	Reason string
+	Label  string `json:"label"`
+	Reason string `json:"reason"`
 }
 
 // Reconcile lists labels and zone NS records, qualifies eligible live labels,
@@ -150,7 +203,23 @@ type Failure struct {
 // the returned error wraps ErrCeilingReached (testable with errors.Is).
 // Per-label failures do not stop the pass.
 func (r *Reconciler) Reconcile(ctx context.Context) (Result, error) {
-	result := Result{Ceiling: r.maxNSRecords}
+	if err := ctx.Err(); err != nil {
+		return Result{}, err
+	}
+	select {
+	case r.passSlot <- struct{}{}:
+		defer func() { <-r.passSlot }()
+	case <-ctx.Done():
+		return Result{}, ctx.Err()
+	}
+	if err := ctx.Err(); err != nil {
+		return Result{}, err
+	}
+	result := Result{
+		Created: []string{}, AlreadyDelegated: []string{}, Conflicting: []Conflict{},
+		Failed: []Failure{}, DelegatedWithoutLiveActors: []string{},
+		Pending: []string{}, Deferred: []string{}, Ceiling: r.maxNSRecords,
+	}
 	labels, err := r.labels.ListInstanceLabels(ctx, r.zoneRoot)
 	if err != nil {
 		return result, fmt.Errorf("list instance labels for %s: %w", r.zoneRoot, err)
diff --git a/internal/delegation/reconciler_test.go b/internal/delegation/reconciler_test.go
index 393a475..fdb2dbc 100644
--- a/internal/delegation/reconciler_test.go
+++ b/internal/delegation/reconciler_test.go
@@ -170,20 +170,25 @@ type fakeCloudflareRequest struct {
 }
 
 type fakeCloudflareAPI struct {
-	mu              sync.Mutex
-	server          *httptest.Server
-	records         []fakeDNSRecord
-	requests        []fakeCloudflareRequest
-	listingFailPage int
-	listingFailCode int
-	listingFailBody string
-	createFailCode  int
-	createFailBody  string
-	failedPostLabel string
-	failPostLabels  map[string]bool
-	now             func() time.Time
-	maxNSRecords    int
-	postCount       int
+	mu               sync.Mutex
+	server           *httptest.Server
+	records          []fakeDNSRecord
+	requests         []fakeCloudflareRequest
+	listingFailPage  int
+	listingFailCode  int
+	listingFailBody  string
+	createFailCode   int
+	createFailBody   string
+	failedPostLabel  string
+	failPostLabels   map[string]bool
+	now              func() time.Time
+	maxNSRecords     int
+	postCount        int
+	listingCount     int
+	failFirstListing bool
+	holdMethod       string
+	holdEntered      chan struct{}
+	holdRelease      chan struct{}
 	// pageSize overrides the default listing page size when positive.
 	pageSize int
 	// omitResultInfo drops result_info from listing responses.
@@ -226,6 +231,20 @@ func (f *fakeCloudflareAPI) failedLabel() string {
 	return f.failedPostLabel
 }
 
+// holdFirstRequest blocks only the first request of method after recording it.
+// Cleanup releases the handler before the fake server's Close cleanup runs.
+func (f *fakeCloudflareAPI) holdFirstRequest(t *testing.T, method string) (<-chan struct{}, func()) {
+	t.Helper()
+	entered, release := make(chan struct{}), make(chan struct{})
+	f.mu.Lock()
+	f.holdMethod, f.holdEntered, f.holdRelease = method, entered, release
+	f.mu.Unlock()
+	var once sync.Once
+	unblock := func() { once.Do(func() { close(release) }) }
+	t.Cleanup(unblock)
+	return entered, unblock
+}
+
 func (f *fakeCloudflareAPI) serveHTTP(w http.ResponseWriter, r *http.Request) {
 	request := fakeCloudflareRequest{
 		Method: r.Method, Path: r.URL.Path, Query: r.URL.Query(), Authorization: r.Header.Get("Authorization"),
@@ -236,11 +255,21 @@ func (f *fakeCloudflareAPI) serveHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 	f.mu.Lock()
 	f.requests = append(f.requests, request)
+	if r.Method == http.MethodGet {
+		f.listingCount++
+	}
 	if r.Method == http.MethodPost {
 		f.postCount++
 	}
 	postPosition := f.postCount
+	listingPosition := f.listingCount
+	hold := r.Method == f.holdMethod && (r.Method == http.MethodGet && listingPosition == 1 || r.Method == http.MethodPost && postPosition == 1)
+	entered, release := f.holdEntered, f.holdRelease
 	f.mu.Unlock()
+	if hold {
+		close(entered)
+		<-release
+	}
 	if bodyError != nil {
 		w.WriteHeader(http.StatusBadRequest)
 		return
@@ -266,7 +295,7 @@ func (f *fakeCloudflareAPI) serveHTTP(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 		}
-		if page == f.listingFailPage {
+		if page == f.listingFailPage || f.failFirstListing && listingPosition == 1 {
 			w.WriteHeader(f.listingFailCode)
 			_, _ = w.Write([]byte(f.listingFailBody))
 			return
@@ -322,12 +351,12 @@ func (f *fakeCloudflareAPI) serveHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func newTestReconciler(t *testing.T, fake *fakeCloudflareAPI, labels fakeLabelSource) (*Reconciler, *bytes.Buffer) {
+func newTestReconciler(t *testing.T, fake *fakeCloudflareAPI, labels fakeLabelSource, interval ...time.Duration) (*Reconciler, *bytes.Buffer) {
 	t.Helper()
-	return newTestReconcilerWithSource(t, fake, &labels)
+	return newTestReconcilerWithSource(t, fake, &labels, interval...)
 }
 
-func newTestReconcilerWithSource(t *testing.T, fake *fakeCloudflareAPI, labels *fakeLabelSource) (*Reconciler, *bytes.Buffer) {
+func newTestReconcilerWithSource(t *testing.T, fake *fakeCloudflareAPI, labels *fakeLabelSource, interval ...time.Duration) (*Reconciler, *bytes.Buffer) {
 	t.Helper()
 	if labels.contributions == nil {
 		labels.contributions = make(map[string][]store.Contribution)
@@ -345,12 +374,16 @@ func newTestReconcilerWithSource(t *testing.T, fake *fakeCloudflareAPI, labels *
 	})
 	require.NoError(t, err)
 	var log bytes.Buffer
+	var configuredInterval time.Duration
+	if len(interval) > 0 {
+		configuredInterval = interval[0]
+	}
 	reconciler, err := NewReconciler(Options{
 		Client: client, Labels: labels, ZoneRoot: delegationZoneRoot,
 		Nameservers:   []string{"ns1.tdpl.example", "ns2.tdpl.example"},
 		Logger:        slog.New(slog.NewTextHandler(&log, &slog.HandlerOptions{Level: slog.LevelDebug})),
 		Contributions: labels, Acceptances: labels.acceptances, Now: func() time.Time { return fake.now() },
-		MaxNSRecords: fake.maxNSRecords,
+		MaxNSRecords: fake.maxNSRecords, Interval: configuredInterval,
 	})
 	require.NoError(t, err)
 	return reconciler, &log
diff --git a/internal/delegation/run_test.go b/internal/delegation/run_test.go
new file mode 100644
index 0000000..f457874
--- /dev/null
+++ b/internal/delegation/run_test.go
@@ -0,0 +1,219 @@
+package delegation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"tidepool/internal/store"
+)
+
+func testRun(t *testing.T, reconciler *Reconciler) (context.CancelFunc, <-chan struct{}) {
+	t.Helper()
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		reconciler.Run(ctx)
+	}()
+	t.Cleanup(func() {
+		cancel()
+		select {
+		case <-done:
+		case <-time.After(5 * time.Second):
+			t.Error("Run did not return after cancellation")
+		}
+	})
+	return cancel, done
+}
+
+func TestRunStartsImmediatelyAndRepeats(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		interval time.Duration
+		listings int
+	}{
+		{name: "immediate startup pass", interval: time.Hour, listings: 1},
+		{name: "repeats on interval", interval: 10 * time.Millisecond, listings: 3},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fake := newFakeCloudflareAPI(t, nil)
+			reconciler, _ := newTestReconciler(t, fake, fakeLabelSource{}, tc.interval)
+			cancel, done := testRun(t, reconciler)
+			require.Eventually(t, func() bool {
+				return len(requestsByMethod(fake.snapshot(), http.MethodGet)) >= tc.listings
+			}, 2*time.Second, 5*time.Millisecond, "Run must list the zone without waiting for its first interval, then repeat")
+			cancel()
+			require.Eventually(t, func() bool { return channelClosed(done) }, time.Second, 5*time.Millisecond)
+			require.Empty(t, postNames(fake.snapshot()))
+		})
+	}
+}
+
+func TestNewReconcilerDefaultsRunInterval(t *testing.T) {
+	fake := newFakeCloudflareAPI(t, nil)
+	reconciler, _ := newTestReconciler(t, fake, fakeLabelSource{})
+	require.Equal(t, 15*time.Minute, reconciler.interval)
+}
+
+func TestRunRetriesAfterListingFailureAndLogsError(t *testing.T) {
+	fake := newFakeCloudflareAPI(t, nil)
+	fake.failFirstListing = true
+	fake.listingFailCode = http.StatusInternalServerError
+	fake.listingFailBody = `{"success":false,"errors":[{"message":"temporary listing failure"}],"result":null}`
+	reconciler, log := newTestReconciler(t, fake, fakeLabelSource{
+		labels: []store.InstanceLabel{{Label: "retry", HasLiveActor: true}},
+	}, 10*time.Millisecond)
+	cancel, done := testRun(t, reconciler)
+	require.Eventually(t, func() bool {
+		return len(requestsByMethod(fake.snapshot(), http.MethodGet)) >= 2 &&
+			len(postNames(fake.snapshot())) >= 1
+	}, 2*time.Second, 5*time.Millisecond, "a failed first listing must not stop later passes")
+	cancel()
+	require.Eventually(t, func() bool { return channelClosed(done) }, time.Second, 5*time.Millisecond)
+	require.ElementsMatch(t, []string{"retry.tdpl.example"}, postNames(fake.snapshot()))
+	require.Len(t, delegationLogLines(log.String(), "ERROR", `msg="delegation pass failed"`), 1)
+	require.Contains(t, delegationLogLines(log.String(), "ERROR", `msg="delegation pass failed"`)[0], `error="`)
+	require.Contains(t, delegationLogLines(log.String(), "ERROR", `msg="delegation pass failed"`)[0], "temporary listing failure")
+}
+
+func channelClosed(done <-chan struct{}) bool {
+	select {
+	case <-done:
+		return true
+	default:
+		return false
+	}
+}
+
+type heldPassAnswer struct {
+	result Result
+	err    error
+}
+
+// Every row starts a pass, observes the first request inside the fake handler,
+// and leaves it blocked while exercising cancellation or a competing caller.
+func TestHeldDelegationPass(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		blockMethod  string
+		labelCount   int
+		shutdownRun  bool
+		cancelWaiter bool
+	}{
+		{name: "run cancellation interrupts held listing", blockMethod: http.MethodGet, labelCount: 1, shutdownRun: true},
+		{name: "serializes listing GET", blockMethod: http.MethodGet, labelCount: 1},
+		{name: "serializes create POST", blockMethod: http.MethodPost, labelCount: 1},
+		{name: "shared hourly budget across serialized passes", blockMethod: http.MethodGet, labelCount: 25},
+		{name: "cancelled waiter sends no request", blockMethod: http.MethodGet, labelCount: 1, cancelWaiter: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fake := newFakeCloudflareAPI(t, nil)
+			fake.pageSize = 100 // One listing GET per pass, even with 20 newly created records.
+			entered, release := fake.holdFirstRequest(t, tc.blockMethod)
+			source := fakeLabelSource{}
+			for index := range tc.labelCount {
+				source.labels = append(source.labels, store.InstanceLabel{
+					Label: fmt.Sprintf("label%02d", index), HasLiveActor: true,
+				})
+			}
+			reconciler, log := newTestReconciler(t, fake, source, 10*time.Millisecond)
+			if tc.shutdownRun {
+				cancel, done := testRun(t, reconciler)
+				require.Eventually(t, func() bool { return channelClosed(entered) }, 2*time.Second, 5*time.Millisecond,
+					"startup pass must reach the held listing")
+				cancel()
+				require.Eventually(t, func() bool { return channelClosed(done) }, time.Second, 5*time.Millisecond,
+					"Run must return before the held handler is released")
+				require.Never(t, func() bool { return len(fake.snapshot()) > 1 }, 80*time.Millisecond, 5*time.Millisecond)
+				require.Empty(t, delegationLogLines(log.String(), "ERROR", `msg="delegation pass failed"`))
+				release()
+				// label00 qualifies, so a pass still running after Run returned would list again or POST it.
+				require.Never(t, func() bool { return len(fake.snapshot()) > 1 }, 200*time.Millisecond, 5*time.Millisecond,
+					"no request may reach the API once Run has returned")
+				require.Empty(t, postNames(fake.snapshot()))
+				return
+			}
+
+			firstContext, cancelFirst := context.WithCancel(context.Background())
+			firstDone := make(chan struct{})
+			var first heldPassAnswer
+			go func() {
+				defer close(firstDone)
+				first.result, first.err = reconciler.Reconcile(firstContext)
+			}()
+			secondContext, cancelSecond := context.WithCancel(context.Background())
+			secondDone := make(chan struct{})
+			var second heldPassAnswer
+			secondStarted := false
+			t.Cleanup(func() {
+				release()
+				cancelFirst()
+				cancelSecond()
+				<-firstDone
+				if secondStarted {
+					<-secondDone
+				}
+			})
+			require.Eventually(t, func() bool { return channelClosed(entered) }, 2*time.Second, 5*time.Millisecond,
+				"first pass must enter the held handler")
+			aboutToCall := make(chan struct{})
+			secondStarted = true
+			go func() {
+				defer close(secondDone)
+				close(aboutToCall)
+				second.result, second.err = reconciler.Reconcile(secondContext)
+			}()
+			require.Eventually(t, func() bool { return channelClosed(aboutToCall) }, time.Second, 5*time.Millisecond)
+			require.Never(t, func() bool {
+				return channelClosed(secondDone) || len(requestsByMethod(fake.snapshot(), http.MethodGet)) > 1
+			}, 120*time.Millisecond, 5*time.Millisecond,
+				"waiting caller must not list or return while the first pass holds the lock")
+			if tc.cancelWaiter {
+				cancelSecond()
+				require.Eventually(t, func() bool { return channelClosed(secondDone) }, time.Second, 5*time.Millisecond,
+					"cancelled waiter must return without the first pass finishing")
+				require.ErrorIs(t, second.err, context.Canceled)
+				require.Equal(t, Result{}, second.result)
+				require.False(t, channelClosed(firstDone), "first pass is still held")
+			}
+			release()
+			require.Eventually(t, func() bool { return channelClosed(firstDone) }, 2*time.Second, 5*time.Millisecond)
+			require.NoError(t, first.err)
+			if tc.cancelWaiter {
+				require.Len(t, requestsByMethod(fake.snapshot(), http.MethodGet), 1)
+				require.ElementsMatch(t, []string{"label00.tdpl.example"}, postNames(fake.snapshot()))
+				return
+			}
+			require.Eventually(t, func() bool { return channelClosed(secondDone) }, 2*time.Second, 5*time.Millisecond)
+			require.NoError(t, second.err)
+			require.Len(t, requestsByMethod(fake.snapshot(), http.MethodGet), 2, "second caller must run its own pass")
+			if tc.labelCount == 1 {
+				require.ElementsMatch(t, []string{"label00"}, first.result.Created)
+				require.Empty(t, second.result.Created)
+				require.ElementsMatch(t, []string{"label00"}, second.result.AlreadyDelegated)
+				require.ElementsMatch(t, []string{"label00.tdpl.example"}, postNames(fake.snapshot()))
+				return
+			}
+			require.ElementsMatch(t, []string{
+				"label00.tdpl.example", "label01.tdpl.example", "label02.tdpl.example", "label03.tdpl.example", "label04.tdpl.example",
+				"label05.tdpl.example", "label06.tdpl.example", "label07.tdpl.example", "label08.tdpl.example", "label09.tdpl.example",
+				"label10.tdpl.example", "label11.tdpl.example", "label12.tdpl.example", "label13.tdpl.example", "label14.tdpl.example",
+				"label15.tdpl.example", "label16.tdpl.example", "label17.tdpl.example", "label18.tdpl.example", "label19.tdpl.example",
+			}, postNames(fake.snapshot()))
+			require.Len(t, first.result.Created, 20)
+			require.ElementsMatch(t, []string{
+				"label00", "label01", "label02", "label03", "label04", "label05", "label06", "label07", "label08", "label09",
+				"label10", "label11", "label12", "label13", "label14", "label15", "label16", "label17", "label18", "label19",
+			}, second.result.AlreadyDelegated)
+			require.Empty(t, second.result.Created)
+			require.ElementsMatch(t, []string{"label20", "label21", "label22", "label23", "label24"}, second.result.Deferred)
+			require.Equal(t, 20, second.result.DelegatedRecords)
+			require.Equal(t, 1000, second.result.Ceiling)
+		})
+	}
+}
diff --git a/internal/ingest/dns_reconcile_test.go b/internal/ingest/dns_reconcile_test.go
new file mode 100644
index 0000000..ce97228
--- /dev/null
+++ b/internal/ingest/dns_reconcile_test.go
@@ -0,0 +1,341 @@
+package ingest
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"tidepool/internal/ap"
+	"tidepool/internal/delegation"
+	"tidepool/internal/store"
+)
+
+type dnsTestRecord struct {
+	ID        string `json:"id"`
+	Type      string `json:"type"`
+	Name      string `json:"name"`
+	Content   string `json:"content"`
+	CreatedOn string `json:"created_on"`
+}
+
+type dnsTestRequest struct {
+	Method string
+	Path   string
+	Body   map[string]any
+}
+
+type dnsTestCloudflare struct {
+	server       *httptest.Server
+	mu           sync.Mutex
+	records      []dnsTestRecord
+	requests     []dnsTestRequest
+	failListing  bool
+	failCreation bool
+	// listingDelay holds the zone listing GET before it answers, so a pass
+	// can outlast a server's write timeout.
+	listingDelay time.Duration
+}
+
+func newDNSTestCloudflare(t *testing.T) *dnsTestCloudflare {
+	t.Helper()
+	fake := &dnsTestCloudflare{}
+	fake.server = httptest.NewServer(http.HandlerFunc(fake.serveHTTP))
+	t.Cleanup(fake.server.Close)
+	return fake
+}
+
+func (fake *dnsTestCloudflare) serveHTTP(w http.ResponseWriter, r *http.Request) {
+	request := dnsTestRequest{Method: r.Method, Path: r.URL.Path}
+	if r.Method == http.MethodPost {
+		if err := json.NewDecoder(r.Body).Decode(&request.Body); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+	}
+	fake.mu.Lock()
+	fake.requests = append(fake.requests, request)
+	records := append([]dnsTestRecord(nil), fake.records...)
+	failListing, failCreation, listingDelay := fake.failListing, fake.failCreation, fake.listingDelay
+	fake.mu.Unlock()
+	w.Header().Set("Content-Type", "application/json")
+	if r.URL.Path != "/client/v4/zones/zone-ingest/dns_records" {
+		w.WriteHeader(http.StatusNotFound)
+		return
+	}
+	switch r.Method {
+	case http.MethodGet:
+		time.Sleep(listingDelay)
+		if failListing {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"success":false,"errors":[{"message":"dns-listing-intentional-failure"}],"result":null}`))
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"success": true, "errors": []any{}, "result": records,
+			"result_info": map[string]int{"page": 1, "total_pages": 1},
+		})
+	case http.MethodPost:
+		if failCreation {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"success":false,"errors":[{"message":"dns-create-intentional-failure"}],"result":null}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{"success":true,"errors":[],"result":{"id":"new-record"}}`))
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+func (fake *dnsTestCloudflare) snapshot() []dnsTestRequest {
+	fake.mu.Lock()
+	defer fake.mu.Unlock()
+	return append([]dnsTestRequest(nil), fake.requests...)
+}
+
+type dnsTestAcceptance struct{}
+
+func (dnsTestAcceptance) AcceptanceStands(context.Context, string, string) (bool, error) {
+	return true, nil
+}
+
+func configureDNSTestReconciler(t *testing.T, h *harness, fake *dnsTestCloudflare, ceiling int) {
+	t.Helper()
+	client, err := delegation.NewCloudflareClient(delegation.CloudflareOptions{
+		BaseURL: fake.server.URL + "/client/v4", Token: "cf-ingest-test-token", ZoneID: "zone-ingest",
+		HTTPClient: ap.NewGuardedHTTPClient(true, 5*time.Second),
+	})
+	require.NoError(t, err)
+	// Both the reconciler and the admin API log into h.logs, so a test sees
+	// every line a forced pass writes, whichever component writes it.
+	logger := slog.New(slog.NewTextHandler(h.logs, &slog.HandlerOptions{Level: slog.LevelDebug}))
+	reconciler, err := delegation.NewReconciler(delegation.Options{
+		Client: client, Labels: h.actors, Contributions: h.actors, Acceptances: dnsTestAcceptance{},
+		ZoneRoot: "tdpl.example", Nameservers: []string{"ns1.tdpl.example", "ns2.tdpl.example"},
+		MaxNSRecords: ceiling, Now: func() time.Time { return time.Date(2026, 10, 10, 12, 0, 0, 0, time.UTC) },
+		Logger: logger,
+	})
+	require.NoError(t, err)
+	h.admin.logger = logger
+	h.admin.SetDNSReconciler(reconciler)
+}
+
+// dnsTestLogLines returns the captured log lines whose message is message.
+func dnsTestLogLines(h *harness, message string) []string {
+	var lines []string
+	for _, line := range strings.Split(h.logs.String(), "\n") {
+		if strings.Contains(line, `msg="`+message+`"`) {
+			lines = append(lines, line)
+		}
+	}
+	return lines
+}
+
+func seedDNSTestActor(t *testing.T, h *harness, label string, createdAt string, live bool) {
+	t.Helper()
+	did := "did:plc:ingestdnstest" + label + "00000000000000001"
+	actorID := "https://lemmy.example/u/dns-" + label
+	_, err := h.actors.UpsertActor(context.Background(), store.BridgedActor{
+		APActorID: actorID, ActorType: store.ActorTypePerson, DID: did,
+		Handle: "alice." + label + ".tdpl.example", ConsentState: store.ConsentStateOK,
+	})
+	require.NoError(t, err)
+	_, err = h.db.ExecContext(context.Background(), `UPDATE bridged_actors SET created_at = $2 WHERE did = $1`, did, createdAt)
+	require.NoError(t, err)
+	if !live {
+		require.NoError(t, h.actors.SetConsentState(context.Background(), actorID, store.ConsentStateDeleted))
+	}
+}
+
+func dnsTestNS(label, content string) dnsTestRecord {
+	return dnsTestRecord{
+		ID: "record-" + label, Type: "NS", Name: label + ".tdpl.example", Content: content,
+		CreatedOn: "2026-10-04T00:00:00Z",
+	}
+}
+
+func dnsTestJSON(t *testing.T, rec *httptest.ResponseRecorder, status int) map[string]any {
+	t.Helper()
+	require.Equal(t, status, rec.Code, rec.Body.String())
+	require.Equal(t, "application/json", strings.Split(rec.Header().Get("Content-Type"), ";")[0])
+	var body map[string]any
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body))
+	return body
+}
+
+func TestDNSReconcileRequiresAdminBearer(t *testing.T) {
+	h := newHarness(t)
+	fake := newDNSTestCloudflare(t)
+	configureDNSTestReconciler(t, h, fake, 7)
+	for _, tc := range []struct {
+		name, authorization string
+	}{{"no bearer", ""}, {"wrong bearer", "Bearer wrong-token"}} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPost, "https://"+bridgeHost+"/admin/dns/reconcile", nil)
+			if tc.authorization != "" {
+				req.Header.Set("Authorization", tc.authorization)
+			}
+			rec := httptest.NewRecorder()
+			h.router.ServeHTTP(rec, req)
+			assert.Equal(t, http.StatusUnauthorized, rec.Code)
+			assert.Empty(t, fake.snapshot(), "unauthenticated requests must not reach Cloudflare")
+		})
+	}
+}
+
+func TestDNSReconcileAdminReportsDelegation(t *testing.T) {
+	h := newHarness(t)
+	fake := newDNSTestCloudflare(t)
+	fake.records = []dnsTestRecord{
+		dnsTestNS("c", "ns1.tdpl.example"), dnsTestNS("d", "foreign.ns.example"),
+		dnsTestNS("e", "ns2.tdpl.example"),
+	}
+	seedDNSTestActor(t, h, "a", "2026-10-02T00:00:00Z", true)
+	seedDNSTestActor(t, h, "b", "2026-10-04T00:00:00Z", true)
+	seedDNSTestActor(t, h, "c", "2026-10-04T00:00:00Z", true)
+	seedDNSTestActor(t, h, "d", "2026-10-04T00:00:00Z", true)
+	seedDNSTestActor(t, h, "e", "2026-10-04T00:00:00Z", false)
+	configureDNSTestReconciler(t, h, fake, 7)
+
+	body := dnsTestJSON(t, h.adminRequest(http.MethodPost, "/admin/dns/reconcile", nil), http.StatusOK)
+	assert.Equal(t, []any{"a"}, body["created"])
+	assert.Equal(t, []any{"b"}, body["pending"])
+	assert.Equal(t, []any{"c"}, body["already_delegated"])
+	assert.Equal(t, []any{map[string]any{"label": "d", "contents": []any{"foreign.ns.example"}}}, body["conflicting"])
+	assert.Equal(t, []any{"e"}, body["delegated_without_live_actors"])
+	assert.Equal(t, float64(3), body["delegated_records"])
+	assert.Equal(t, float64(7), body["ceiling"])
+	summaries := dnsTestLogLines(h, "delegation pass finished")
+	require.Len(t, summaries, 1, "a forced pass logs its summary once: %s", h.logs.String())
+	assert.Contains(t, summaries[0], "level=INFO")
+	assert.Contains(t, summaries[0], " component=delegation ")
+	assert.Contains(t, summaries[0], " created=[a] ")
+	assert.Contains(t, summaries[0], " pending=[b] ")
+	requests := fake.snapshot()
+	require.Len(t, requests, 2, "the POST must complete before the response is returned")
+	assert.Equal(t, dnsTestRequest{Method: http.MethodPost, Path: "/client/v4/zones/zone-ingest/dns_records",
+		Body: map[string]any{"type": "NS", "name": "a.tdpl.example", "content": "ns1.tdpl.example", "ttl": float64(3600)}}, requests[1])
+}
+
+func TestDNSReconcileAdminErrors(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		setup   func(*dnsTestCloudflare)
+		ceiling int
+	}{
+		{"listing failure", func(fake *dnsTestCloudflare) { fake.failListing = true }, 7},
+		{"ceiling reached", func(fake *dnsTestCloudflare) {
+			fake.records = []dnsTestRecord{dnsTestNS("occupied", "ns1.tdpl.example")}
+		}, 1},
+		{"creation failure", func(fake *dnsTestCloudflare) { fake.failCreation = true }, 7},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			h := newHarness(t)
+			fake := newDNSTestCloudflare(t)
+			tc.setup(fake)
+			seedDNSTestActor(t, h, "a", "2026-10-02T00:00:00Z", true)
+			if tc.name == "ceiling reached" {
+				seedDNSTestActor(t, h, "b", "2026-10-04T00:00:00Z", true)
+			}
+			configureDNSTestReconciler(t, h, fake, tc.ceiling)
+			body := dnsTestJSON(t, h.adminRequest(http.MethodPost, "/admin/dns/reconcile", nil), http.StatusInternalServerError)
+			message, ok := body["error"].(string)
+			require.True(t, ok, "error must be a JSON string: %v", body)
+			result, ok := body["result"].(map[string]any)
+			require.True(t, ok, "result must be a JSON object: %v", body)
+			switch tc.name {
+			case "listing failure":
+				assert.Contains(t, message, "dns-listing-intentional-failure")
+			case "ceiling reached":
+				assert.Contains(t, message, delegation.ErrCeilingReached.Error())
+				assert.Equal(t, []any{"a"}, result["deferred"])
+				assert.Equal(t, []any{"b"}, result["pending"])
+				assert.Equal(t, float64(1), result["ceiling"])
+				assert.Equal(t, float64(1), result["delegated_records"])
+			case "creation failure":
+				assert.Contains(t, message, "dns-create-intentional-failure")
+				failures, ok := result["failed"].([]any)
+				require.True(t, ok, "failed must be a JSON array: %v", result)
+				require.Len(t, failures, 1)
+				failure, ok := failures[0].(map[string]any)
+				require.True(t, ok)
+				assert.Equal(t, "a", failure["label"])
+				assert.NotEmpty(t, failure["reason"])
+			}
+			for _, request := range fake.snapshot() {
+				if tc.name == "ceiling reached" {
+					assert.Equal(t, http.MethodGet, request.Method, "ceiling must prevent every POST")
+				}
+			}
+			summaries := dnsTestLogLines(h, "delegation pass finished")
+			require.Len(t, summaries, 1, "a failed forced pass still logs its summary: %s", h.logs.String())
+			failures := dnsTestLogLines(h, "delegation pass failed")
+			require.Len(t, failures, 1, "a failed forced pass logs its error once: %s", h.logs.String())
+			assert.Contains(t, failures[0], "level=ERROR")
+			assert.Contains(t, failures[0], " component=delegation ")
+			assert.Empty(t, dnsTestLogLines(h, "DNS delegation reconciliation failed"))
+			if tc.name == "ceiling reached" {
+				assert.Contains(t, summaries[0], " pending=[b] ")
+				assert.Contains(t, summaries[0], " deferred_count=1 ")
+			}
+			if tc.name == "creation failure" {
+				requests := fake.snapshot()
+				require.Len(t, requests, 2, "a failed create must reach Cloudflare")
+				assert.Equal(t, http.MethodPost, requests[1].Method)
+				assert.Equal(t, "a.tdpl.example", requests[1].Body["name"])
+			}
+		})
+	}
+}
+
+func TestDNSReconcileAdminCancelledRequestLogsNoError(t *testing.T) {
+	h := newHarness(t)
+	fake := newDNSTestCloudflare(t)
+	seedDNSTestActor(t, h, "a", "2026-10-02T00:00:00Z", true)
+	configureDNSTestReconciler(t, h, fake, 7)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	req := httptest.NewRequest(http.MethodPost, "https://"+bridgeHost+"/admin/dns/reconcile", nil).WithContext(ctx)
+	req.Header.Set("Authorization", "Bearer "+testAdminToken)
+	h.router.ServeHTTP(httptest.NewRecorder(), req)
+	assert.NotContains(t, h.logs.String(), "level=ERROR", "a pass ended by the request's own cancellation is not a failure")
+	assert.Empty(t, fake.snapshot(), "a cancelled request must not reach Cloudflare")
+}
+
+func TestDNSReconcileAdminOutlastsServerWriteTimeout(t *testing.T) {
+	h := newHarness(t)
+	fake := newDNSTestCloudflare(t)
+	fake.listingDelay = 600 * time.Millisecond
+	seedDNSTestActor(t, h, "a", "2026-10-02T00:00:00Z", true)
+	configureDNSTestReconciler(t, h, fake, 7)
+	server := httptest.NewUnstartedServer(h.router)
+	server.Config.WriteTimeout = 200 * time.Millisecond
+	server.Start()
+	t.Cleanup(server.Close)
+
+	req, err := http.NewRequest(http.MethodPost, server.URL+"/admin/dns/reconcile", nil)
+	require.NoError(t, err)
+	req.Header.Set("Authorization", "Bearer "+testAdminToken)
+	resp, err := server.Client().Do(req)
+	require.NoError(t, err, "a pass longer than the server's write timeout must still deliver its result")
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, "application/json", strings.Split(resp.Header.Get("Content-Type"), ";")[0])
+	var body map[string]any
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&body))
+	assert.Equal(t, []any{"a"}, body["created"])
+}
+
+func TestDNSReconcileAdminUnconfigured(t *testing.T) {
+	h := newHarness(t)
+	rec := h.adminRequest(http.MethodPost, "/admin/dns/reconcile", nil)
+	assert.Equal(t, http.StatusNotImplemented, rec.Code, rec.Body.String())
+}
diff --git a/internal/ingest/follow.go b/internal/ingest/follow.go
index 759d52d..b0da074 100644
--- a/internal/ingest/follow.go
+++ b/internal/ingest/follow.go
@@ -13,10 +13,12 @@ import (
 	"net/http"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/go-chi/chi/v5"
 
 	"tidepool/internal/ap"
+	"tidepool/internal/delegation"
 	"tidepool/internal/errors"
 	"tidepool/internal/materialize"
 	"tidepool/internal/store"
@@ -74,6 +76,7 @@ type AdminOptions struct {
 //	POST   /admin/communities/backfill  {"community":"!tech@lemmy.world"}
 //	POST   /admin/communities/refresh-profile {"community":"!tech@lemmy.world"} (or {"all":true})
 //	POST   /admin/communities/reconcile (follow list configured only)
+//	POST   /admin/dns/reconcile         (Cloudflare token configured only)
 //	POST   /admin/reemit                {"did":"did:plc:..."} (or {} for all)
 //	POST   /admin/objects/sweep-deleted {"ap_ids":["https://..."]}
 //	GET    /admin/divergence            (reconciliation report; READ-ONLY)
@@ -95,6 +98,9 @@ type Admin struct {
 	// endpoint answers 501) unless a follow list is configured. Set once
 	// during startup via SetFollowReconciler, before the server listens.
 	reconciler *FollowReconciler
+	// dnsReconciler serves POST /admin/dns/reconcile; set during startup
+	// when Cloudflare delegation is configured.
+	dnsReconciler *delegation.Reconciler
 	// divergence serves GET /admin/divergence; nil (the endpoint answers
 	// 501) unless the reconciliation sweep is wired. Set once during
 	// startup via SetDivergenceReconciler, before the server listens.
@@ -118,6 +124,9 @@ func (a *Admin) SetFollowReconciler(r *FollowReconciler) { a.reconciler = r }
 // construction, as SetFollowReconciler does for the follow list.
 func (a *Admin) SetDivergenceReconciler(r *DivergenceReconciler) { a.divergence = r }
 
+// SetDNSReconciler wires the optional DNS delegation reconciler during startup.
+func (a *Admin) SetDNSReconciler(r *delegation.Reconciler) { a.dnsReconciler = r }
+
 // NewAdmin validates options and builds the Admin API.
 func NewAdmin(opts AdminOptions) (*Admin, error) {
 	if opts.Token == "" {
@@ -173,6 +182,7 @@ func (a *Admin) Routes(r chi.Router) {
 		r.Post("/communities/backfill", a.handleBackfill)
 		r.Post("/communities/refresh-profile", a.handleRefreshProfile)
 		r.Post("/communities/reconcile", a.handleReconcile)
+		r.Post("/dns/reconcile", a.handleDNSReconcile)
 		r.Post("/reemit", a.handleReemit)
 		r.Post("/objects/sweep-deleted", a.handleSweepDeleted)
 		r.Get("/divergence", a.handleDivergence)
@@ -609,6 +619,37 @@ func (a *Admin) handleReconcile(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, result)
 }
 
+// dnsReconcileWriteTimeout bounds how long POST /admin/dns/reconcile may take
+// to write its response. A normal pass takes seconds, but the request first
+// waits behind any running pass (the startup pass runs right when an operator
+// is told to force one) and then runs its own: a zone listing, per-label
+// qualification and up to 20 sequential creates, each Cloudflare request with
+// its own 30s client timeout. The server's default 30s WriteTimeout would drop
+// the result of such a pass after its records were already created.
+const dnsReconcileWriteTimeout = 10 * time.Minute
+
+// handleDNSReconcile runs one delegation pass and returns its result, including
+// partial results when the pass fails. It extends this response's write
+// deadline to dnsReconcileWriteTimeout and logs the pass summary the way the
+// scheduled passes do.
+func (a *Admin) handleDNSReconcile(w http.ResponseWriter, r *http.Request) {
+	if a.dnsReconciler == nil {
+		http.Error(w, "DNS delegation reconciliation is not configured", http.StatusNotImplemented)
+		return
+	}
+	ctx := r.Context()
+	if err := http.NewResponseController(w).SetWriteDeadline(time.Now().Add(dnsReconcileWriteTimeout)); err != nil {
+		a.logger.WarnContext(ctx, "extend DNS reconcile write deadline", "component", "delegation", "error", err)
+	}
+	result, err := a.dnsReconciler.Reconcile(ctx)
+	a.dnsReconciler.LogPass(ctx, result, err)
+	if err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]any{"error": err.Error(), "result": result})
+		return
+	}
+	writeJSON(w, http.StatusOK, result)
+}
+
 // resolveCommunity turns the request's community reference into the Group's
 // AP id: URLs pass through, handles go through WebFinger.
 func (a *Admin) resolveCommunity(ctx context.Context, ref string) (string, error) {
-- 
2.51.2