A + auto-PTR via dns-cli on primary; zone-snapshot + drift-check ALL IN SYNC same session. Serves the fleet-TLS pass for the tsys-librenms docker UIs. Detail: https://projects.knownelement.com/issues/697