Three properties the suite did not reach: a zone wrong in every way at once converges in two passes and then writes nothing on any later pass, a `Replace` interrupted between its withdraw and its publish leaves the name absent rather than answering with somebody else's address and is finished by the next run, and a process that restarts between ticks cannot write at all — which is what makes losing the backoff on restart safe rather than expensive. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: I26a1d68883b27e6583e0d79339f0a3a304a32e0f