From d8c9d7985534cba3b9f53a1e87f6921670c6227e Mon Sep 17 00:00:00 2001
From: Hermes <hermes@nousagent.com>
Date: Thu, 29 Oct 2026 22:18:44 -0700
Subject: [PATCH] [grade=C
 urn:ump:iysmn53oxuhn57y5v6emmztvbissz275wl3wbp2pa2w5ou77mvua] docs(DC-171):
 evidence-file consistency per deploy judge r4 blockers

Gate record now carries both gate-time HEADs (1747c23 r3 / 0e58ca9 r4),
the r3 remediation commit 9d5d640, the r4 grade + its three resolved
blockers, the 'ALL dig versions' phrasing narrowed to the documented
contract + BIND 9.18.50 live verification only, and the timezone note
for the 10-29/10-30 date split.
---
 RELEASE-EVIDENCE-internal.md | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/RELEASE-EVIDENCE-internal.md b/RELEASE-EVIDENCE-internal.md
index 90bd424..41d7f7b 100644
--- a/RELEASE-EVIDENCE-internal.md
+++ b/RELEASE-EVIDENCE-internal.md
@@ -44,13 +44,18 @@ BIND 9 endpoint. Resolution (fix commit acd0352):
    AXFR path works across both server implementations; BIND is the
    judge-required one and is satisfied above. Older-dig (9.11–9.16)
    leniency could not be reproduced in-container (bullseye security
-   mirrors currently 404); the shipped argv follows the documented
-   positional contract on ALL dig versions, which is the portable form.
-3. Suites at acd0352: DNS parity 23/23; full backend 174/3754; frontend 68/68.
+   mirrors currently 404); the shipped argv follows dig's documented
+   `[name] [type]` positional contract (man dig) and was live-verified
+   against BIND 9.18.50; no portability claim is made for other dig
+   versions beyond the documented contract itself.
+ 3. Suites at acd0352: DNS parity 23/23; full backend 174/3754; frontend 68/68.
 
 ### Production gate record (this deploy)
-- Deploy tree HEAD at gate time: 1747c23 (dc167-deploy2 = 9f5e97c + the
-  DC-171 batch); production rollback target: 9f5e97c (current prod HEAD).
+- Deploy tree HEAD at gate time: 1747c23 for r3, then 0e58ca9 for r4
+  (dc167-deploy2 = 9f5e97c + the DC-171 batch); production rollback
+  target: 9f5e97c (current prod HEAD).
+- r3 remediation commit: 9d5d640 (qualifies the dig version comment;
+  adds this gate record).
 - Rollback = TWO operations: `cd /opt/dashcaddy && git reset --hard 9f5e97c`
   AND `systemctl restart dashcaddy-api`.
 - Bundles at gate time: SW cache `dashcaddy-shell-b87d8c8095`, CSP hash
@@ -62,4 +67,9 @@ BIND 9 endpoint. Resolution (fix commit acd0352):
 - Judge grades for this deploy: r1 D (urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq),
   r2 C (urn:ump:2d5onfwgvcigrutqjhoege3ao6mtdxup57accoaumyaqsu7jniqq),
   r3 C (urn:ump:bayk3f2ibc3nffwv7wiprdts2xegcp2pac525zwabp7dst37ecbq —
-  blocker: unqualified 9.11-9.16 comment in rfc2136.js, since qualified).
+  blocker: unqualified 9.11-9.16 comment in rfc2136.js, fixed by 9d5d640),
+  r4 C (urn:ump:iysmn53oxuhn57y5v6emmztvbissz275wl3wbp2pa2w5ou77mvua —
+  blockers: stale gate record naming 1747c23, the 'ALL dig versions'
+  phrasing, and no r4 entry; all three addressed in this update).
+- Timestamp note: dates in this file are host-local (UTC+8); the judge
+  sandbox observed 2026-10-29 — same moment, different timezone.