Goal

Make just update / just bootstrap idiot-proof: the operator picks a correctly-constructed domain name and the Justfile derives the box role and ansible-playbook tags. No YAML spelunking, no silent partial converges from a missing --tags.

Domain → role → tags

• infra.sovrn.at — exact match — metrics box → --tags common,secrets,metrics-box
• mxb.<region>.sovrn.at — ^mxb\.[a-z0-9-]+\.sovrn\.at$ — pri-20 store-and-forward relay → --tags common,secrets,stalwart-backup-secret,stalwart-backup-install,caddy,stalwart-backup-bootstrap,stalwart-backup-relay,telemetry-edge (full backup slice, bug d43eebe)
• mx<N>.<region>.sovrn.at — ^mx[0-9]+\.[a-z0-9-]+\.sovrn\.at$ — cell box → full run, no --tags
• Anything else (sovrn.at, infra.sovrn.at, unknown) → loud fail before Ansible runs, message lists the three valid shapes.

Bare --tags metrics-box alone is NOT enough for a fresh infra box: common creates the sovrn user/group, base dirs, firewall (common/tasks/main.yml), and metrics_box chowns to {{ sovrn_user }}. Same logic drives the full backup slice (relay needs common + caddy for the ACME challenge proxy + telemetry-edge so it is not blind).

Lifecycle coverage

• Build cell: provision-zds-secrets CELL (validates mxN shape) → bootstrap CELL → persist-bootstrap-secrets CELL → update CELL.
• Build infra: provision-metrics-secret + vault edit → update infra.sovrn.at. No bootstrap / recovery / host-vault / stalwart-binary path.
• Build relay: bootstrap mxb… → persist-bootstrap-secrets mxb… → update mxb…. Relay credential generation requires mode=bootstrap (stalwart/tasks/secret.yml, stalwart_backup/secret.yml), so bootstrap accepts mxN and mxb, refuses infra + unknown.
• Cell sick: recovery-backup CELL → manual provider move → recovery-bootstrap CELL → relay-drain verify. Both recovery-* are mxN-only; on infra/relay they fail loudly (“no state to recover — wipe + update; drain the relay queue first per relay-drain-verify.md”).
• Update in place: update <cell|infra.sovrn.at|mxb…> with automatic tags. update rejects user-supplied --tags/--skip-tags in ARGS and points at new update-slice TARGET *ARGS escape hatch (canary edge, caddy-only, relay map-only runbooks).
• _precheck derives box type from the domain (not inventory groups): stalwart binary required for cell+relay only, host vault for cell+relay, ZDS secrets for cell only; keeps inventory-membership check + mismatch warning.

Verification

• bash -n on rendered recipes, just --dry-run per shape.
• Regex matrix: valid infra.sovrn.at, mx1.eu.sovrn.at, mxb.eu.sovrn.at; invalid sovrn.at, infra.sovrn.at, mx.eu.sovrn.at, MX1.eu.sovrn.at.
• --tags rejection, STAGING=1 preserved on bootstrap.