Pi-hole records: mount addn-hosts into FTL hostsdir, not dnsmasq.d

FTL's generated dnsmasq.conf has no conf-dir: /etc/dnsmasq.d/ is never
read (the 2026-08-24 scratch-name test proved the file was inert; names
only resolved from the query cache). The only file-based local-record
mechanism is hostsdir=/etc/pihole/hosts. Mount the record file there.
Doc: record the pitfall in Pi-hole.md.

dankclaw/pihole/quadlet/pihole.container

@@ -32,7 +32,7 @@ PublishPort=0.0.0.0:8083:80/tcp
 EnvironmentFile=/home/dank/Containers/pihole/env
 Volume=/home/dank/Containers/pihole/etc-pihole:/etc/pihole
 Volume=/home/dank/Containers/pihole/etc-dockers:/etc/dockers
-Volume=/home/dank/Containers/pihole/addn-hosts:/etc/dnsmasq.d/addn-hosts:ro
+Volume=/home/dank/Containers/pihole/addn-hosts:/etc/pihole/hosts/addn-hosts:ro
 
 [Service]
 Restart=always

docs/Infrastructure/Pi-hole.md

@@ -20,13 +20,21 @@ Pi-hole is the LAN DNS server for the homelab. It runs as a quadlet container on
 - **Mounts:**
   - `/home/dank/Containers/pihole/etc-pihole` → `/etc/pihole` (config + state, preserved across restarts)
   - `/home/dank/Containers/pihole/etc-dockers` → `/etc/dockers` (blocklists)
-  - `/home/dank/Containers/pihole/addn-hosts` → `/etc/dnsmasq.d/addn-hosts` (read-only; the record file from this repo)
+  - `/home/dank/Containers/pihole/addn-hosts` → `/etc/pihole/hosts/addn-hosts` (read-only; the record file from this repo)
 - **Restart:** `Restart=always`, `RestartSec=5`
 - **Deploy:** `./scripts/deploy-pihole-quadlet.sh dankclaw` (idempotent; preserves the data dirs)
 
 ## Records
 
-The quadlet mounts `dankclaw/pihole/addn-hosts` into the container's dnsmasq config dir. FTL reads it and answers one A record per Caddy vhost, all pointing at `192.168.0.143`. The file stays in sync with the Caddyfile (`tests/pihole.bats` cross-checks the two). Add a name there and in Porkbun, then deploy. See [[LAN-DNS]] for the two-place rule.
+FTL does not read `/etc/dnsmasq.d/` — its generated `dnsmasq.conf` has no `conf-dir`. The only file-based local-record mechanism is `hostsdir=/etc/pihole/hosts`: FTL parses every file in that directory as an `/etc/hosts` file. The quadlet therefore mounts the repo record file there, read-only:
+
+```
+/home/dank/Containers/pihole/addn-hosts -> /etc/pihole/hosts/addn-hosts
+```
+
+The file format is hosts-style (`<IP> <name> [<name> ...]`), one A record per Caddy vhost, all pointing at `192.168.0.143`. The file stays in sync with the Caddyfile (`tests/pihole.bats` cross-checks the two). Add a name there and in Porkbun, then deploy. See [[LAN-DNS]] for the two-place rule.
+
+**Pitfall (2026-08-24):** the first quadlet mounted the file into `/etc/dnsmasq.d/`. FTL never read it; names only resolved from the query cache. A fresh name returned NXDOMAIN. Mount into `/etc/pihole/hosts/`, not `/etc/dnsmasq.d/`.
 
 ## Upstream
 

tests/pihole.bats

@@ -40,8 +40,12 @@ HOSTS="$PIHOLE_DIR/addn-hosts"
     grep -q '^EnvironmentFile=/home/dank/Containers/pihole/env$' "$QUADLET"
 }
 
-@test "the pihole quadlet mounts the addn-hosts record file read-only" {
-    grep -qE '^Volume=/home/dank/Containers/pihole/addn-hosts:/etc/dnsmasq\.d/addn-hosts:ro$' "$QUADLET"
+@test "the pihole quadlet mounts the addn-hosts record file into the FTL hostsdir" {
+    # FTL (a dnsmasq fork) does not read /etc/dnsmasq.d/ (the generated
+    # dnsmasq.conf has no conf-dir). Its only file-based local-record
+    # mechanism is hostsdir=/etc/pihole/hosts (each file parsed as an
+    # /etc/hosts file). Mount the record file there, read-only.
+    grep -qE '^Volume=/home/dank/Containers/pihole/addn-hosts:/etc/pihole/hosts/addn-hosts:ro$' "$QUADLET"
 }
 
 @test "the pihole env example has placeholder values only" {