D-019 captures the Designate deferral to v2 with rationale grounded in
               the 2026-05-27 testcloud topology investigation: outside-in DNS not
               needed (corporate clients use openstack.baldurkeep.com HTTPS chain);
               edge nginx cannot route to cloud-internal anyway; inside-out is
               satisfied by tenant --dns-nameserver pointing at public DNS.

               D-008 (DNS architecture) marked superseded; original text preserved
               for audit trail.

               D-011 validation bar amended to remove "Designate resolves" criterion;
               v2 will reinstate a calibrated DNS criterion.