Zone delegated + authoritative, verified via public recursion; per-session nonce queries attributed in the observations API. First test caught Google's 0x20 case randomization vs Cloudflare's plain case. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>