A split-DNS VPN rollout looks right and one process namespace still misses...

The VPN config is correct, but one long-lived namespace keeps the pre-VPN resolver state and never learns the route-only domain.