docs(DC-171): record BIND 9.18.50 live AXFR verification evidence (deploy judge r2 demand)

Adapter code path verified against a real BIND 9.18.50 ESV in Docker
(zone dc171test.internal, 7 records parsed correctly) plus the secondary
Technitium run (zone sami, 48 records). Internal evidence only.

RELEASE-EVIDENCE-internal.md

@@ -11,3 +11,39 @@ Judging per-change is recorded in commit messages and the internal ledger. Grade
 - **DC-164 judge: grade B (round 6)** urn:ump:5vuahbn4znf7hrrshjvu2pcbqln5m6qcrpkkn3mx6y2rvvmdtqoa
 - **DC-163 judge: grade B (round 2)** urn:ump:l2tg66wmchkmd6fde4k3ojwc56zpxqh657spe37bu6dpvduswalq
 - **DC-162 judge: grade B (round 3)** urn:ump:or2qqhcytp6lfzlyi7xru7hdqy3uar2hbjllsrrbxrbray3c5kpa
+
+## DC-171 phase 1 — BIND 9 live AXFR verification (2026-10-30)
+
+Deploy judge r1 (dc-prod-deploy-dc171, grade D urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq)
+blocked the cutover on dig argv order (AXFR/zone swapped vs the documented
+`dig [name] [type]` contract) and demanded verification against an actual
+BIND 9 endpoint. Resolution (fix commit acd0352):
+
+1. ARGV FIXED to `@server -p port <zone> AXFR +options` (documented order).
+2. LIVE BIND 9 ENDPOINT: a real BIND 9.18.50 (Extended Support Version —
+   the line Ubuntu 22.04/24.04 ship) was stood up in Docker
+   (internetsystemsconsortium/bind9:9.18) on this host with zone
+   `dc171test.internal` (master, allow-transfer any; SOA/NS/3xA/TXT/CNAME
+   records). The ADAPTER'S OWN CODE PATH (real execFile dig, real parser,
+   zero mocks) ran listRecords({zone:'dc171test.internal'}):
+
+   BIND 9 LIVE AXFR VIA ADAPTER — SUCCESS
+   zone: dc171test.internal | count: 7
+     dc171test.internal. 300 SOA ns1.dc171test.internal. admin.dc171test.internal. 2026102901 3600 900 604800 300
+     dc171test.internal. 300 NS ns1.dc171test.internal.
+     app.dc171test.internal. 300 A 192.0.2.10
+     db.dc171test.internal. 300 A 192.0.2.20
+     ns1.dc171test.internal. 300 A 192.0.2.53
+     txt.dc171test.internal. 300 TXT "dc171 live verification"
+     www.dc171test.internal. 300 CNAME app.dc171test.internal.
+   types: SOA,NS,A,TXT,CNAME
+
+   named.log: `zone dc171test.internal/IN: loaded serial 2026102901`.
+   The same check against the production Technitium server (100.121.150.22,
+   zone `sami`) returned 48 records (SOA/A/NS, real fleet names) — the
+   AXFR path works across both server implementations; BIND is the
+   judge-required one and is satisfied above. Older-dig (9.11–9.16)
+   leniency could not be reproduced in-container (bullseye security
+   mirrors currently 404); the shipped argv follows the documented
+   positional contract on ALL dig versions, which is the portable form.
+3. Suites at acd0352: DNS parity 23/23; full backend 174/3754; frontend 68/68.