[grade=C urn:ump:bayk3f2ibc3nffwv7wiprdts2xegcp2pac525zwabp7dst37ecbq] docs(DC-171): qualify dig version claim per deploy judge r3 blocker

rfc2136.js comment no longer asserts unverified 9.11-9.16 behavior —
states only the documented [name] [type] contract, live-verified against
BIND 9.18.50. Evidence file gains the full production gate record
(rollback two-ops, bundle IDs, test-log paths, all three judge grades).

RELEASE-EVIDENCE-internal.md

@@ -47,3 +47,19 @@ BIND 9 endpoint. Resolution (fix commit acd0352):
    mirrors currently 404); the shipped argv follows the documented
    positional contract on ALL dig versions, which is the portable form.
 3. Suites at acd0352: DNS parity 23/23; full backend 174/3754; frontend 68/68.
+
+### Production gate record (this deploy)
+- Deploy tree HEAD at gate time: 1747c23 (dc167-deploy2 = 9f5e97c + the
+  DC-171 batch); production rollback target: 9f5e97c (current prod HEAD).
+- Rollback = TWO operations: `cd /opt/dashcaddy && git reset --hard 9f5e97c`
+  AND `systemctl restart dashcaddy-api`.
+- Bundles at gate time: SW cache `dashcaddy-shell-b87d8c8095`, CSP hash
+  `sha256-LqwtGSCiBtjq9Bnb5wA3kQFrFRgZWtDWcswiK656gEk=` (unchanged).
+- Test log paths: full backend suite run in /root/dashcaddy/dashcaddy-api
+  (174 suites / 3754 tests at acd0352); frontend runner `npm test` in
+  /root/dashcaddy/status (68/68); deploy-tree DNS parity 23/23
+  (jest __tests__/dns in /opt/dashcaddy/dashcaddy-api).
+- Judge grades for this deploy: r1 D (urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq),
+  r2 C (urn:ump:2d5onfwgvcigrutqjhoege3ao6mtdxup57accoaumyaqsu7jniqq),
+  r3 C (urn:ump:bayk3f2ibc3nffwv7wiprdts2xegcp2pac525zwabp7dst37ecbq —
+  blocker: unqualified 9.11-9.16 comment in rfc2136.js, since qualified).

dashcaddy-api/src/dns/dns-providers/rfc2136.js

@@ -338,8 +338,10 @@ class RFC2136Provider extends BaseDNSProvider {
     const fqdnZone = this._ensureFqdn(effectiveZone);
 
     // dig positional contract is `dig [@server] [name] [type]` — zone name
-    // FIRST, then the AXFR request type (BIND 9.18 happens to accept either
-    // order, but 9.11-9.16 on older distros follow the documented order).
+    // FIRST, then the AXFR request type. This is the documented order
+    // (verified live against BIND 9.18.50); no claim is made here about
+    // other dig versions' leniency or strictness — see
+    // RELEASE-EVIDENCE-internal.md, DC-171 section.
     const args = [
       `@${this.server}`,
       '-p', String(this.port),