From 9d5d64008909e8a839f3099794d5e743d59c3105 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@nousagent.com>
Date: Thu, 29 Oct 2026 22:16:51 -0700
Subject: [PATCH] [grade=C
 urn:ump:bayk3f2ibc3nffwv7wiprdts2xegcp2pac525zwabp7dst37ecbq] docs(DC-171):
 qualify dig version claim per deploy judge r3 blocker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

rfc2136.js comment no longer asserts unverified 9.11-9.16 behavior —
states only the documented [name] [type] contract, live-verified against
BIND 9.18.50. Evidence file gains the full production gate record
(rollback two-ops, bundle IDs, test-log paths, all three judge grades).
---
 RELEASE-EVIDENCE-internal.md                   | 16 ++++++++++++++++
 dashcaddy-api/src/dns/dns-providers/rfc2136.js |  6 ++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/RELEASE-EVIDENCE-internal.md b/RELEASE-EVIDENCE-internal.md
index b61236c..90bd424 100644
--- a/RELEASE-EVIDENCE-internal.md
+++ b/RELEASE-EVIDENCE-internal.md
@@ -47,3 +47,19 @@ BIND 9 endpoint. Resolution (fix commit acd0352):
    mirrors currently 404); the shipped argv follows the documented
    positional contract on ALL dig versions, which is the portable form.
 3. Suites at acd0352: DNS parity 23/23; full backend 174/3754; frontend 68/68.
+
+### Production gate record (this deploy)
+- Deploy tree HEAD at gate time: 1747c23 (dc167-deploy2 = 9f5e97c + the
+  DC-171 batch); production rollback target: 9f5e97c (current prod HEAD).
+- Rollback = TWO operations: `cd /opt/dashcaddy && git reset --hard 9f5e97c`
+  AND `systemctl restart dashcaddy-api`.
+- Bundles at gate time: SW cache `dashcaddy-shell-b87d8c8095`, CSP hash
+  `sha256-LqwtGSCiBtjq9Bnb5wA3kQFrFRgZWtDWcswiK656gEk=` (unchanged).
+- Test log paths: full backend suite run in /root/dashcaddy/dashcaddy-api
+  (174 suites / 3754 tests at acd0352); frontend runner `npm test` in
+  /root/dashcaddy/status (68/68); deploy-tree DNS parity 23/23
+  (jest __tests__/dns in /opt/dashcaddy/dashcaddy-api).
+- Judge grades for this deploy: r1 D (urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq),
+  r2 C (urn:ump:2d5onfwgvcigrutqjhoege3ao6mtdxup57accoaumyaqsu7jniqq),
+  r3 C (urn:ump:bayk3f2ibc3nffwv7wiprdts2xegcp2pac525zwabp7dst37ecbq —
+  blocker: unqualified 9.11-9.16 comment in rfc2136.js, since qualified).
diff --git a/dashcaddy-api/src/dns/dns-providers/rfc2136.js b/dashcaddy-api/src/dns/dns-providers/rfc2136.js
index 39bf823..4f23b05 100644
--- a/dashcaddy-api/src/dns/dns-providers/rfc2136.js
+++ b/dashcaddy-api/src/dns/dns-providers/rfc2136.js
@@ -338,8 +338,10 @@ class RFC2136Provider extends BaseDNSProvider {
     const fqdnZone = this._ensureFqdn(effectiveZone);
 
     // dig positional contract is `dig [@server] [name] [type]` — zone name
-    // FIRST, then the AXFR request type (BIND 9.18 happens to accept either
-    // order, but 9.11-9.16 on older distros follow the documented order).
+    // FIRST, then the AXFR request type. This is the documented order
+    // (verified live against BIND 9.18.50); no claim is made here about
+    // other dig versions' leniency or strictness — see
+    // RELEASE-EVIDENCE-internal.md, DC-171 section.
     const args = [
       `@${this.server}`,
       '-p', String(this.port),