[READ] Show servers and domains currently limited by recursive fetch caps.

[READ] Show trust anchors through rndc's response channel, without a dump file.

[READ] Show current DNS TCP timeouts without changing them.

[READ] List a zone's ongoing and completed DNSSEC signing state.

[READ] Show DNSSEC signing status for one zone.

[READ] Show BIND managed DNSSEC trust-key status.

[READ] Show whether stale DNS answers are currently served.

[READ] Show a running dynamic zone's configuration when enabled.

[READ] Query a specified DNS server for a supported record type.

[WRITE] Check config and queue a zone reload; completion remains unknown.

[WRITE] Ask a secondary zone to refresh; transfer completion remains unknown.

[WRITE] Flush one DNS name from cache; cache state cannot be restored.

[WRITE] Request a secondary zone retransfer; completion remains unknown.

[WRITE] Resend NOTIFY for one zone; downstream refresh remains unknown.

[READ] Get named service status from rndc.

[READ] Validate BIND config and loaded zone files with named-checkconf -z.

[READ] Get BIND's live zonestatus for one zone.

[READ] Check current DNSSEC validation setting using rndc.

[READ] Query the configured DNS server and expose its actual response code.

[READ] Compare primary and secondary SOA serials; unknown stays null.

[READ] Correlate named, config, zone, SOA and DNSSEC probes; report failures.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

One extra row is read so truncated is measured rather than guessed from the row count matching the limit; when it is true, older tokens exist.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited under its own risk tier. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.