DNSSEC validates at the registrar, but CDS and CDNSKEY automation stopped and the child zone slowly drifts out of sync

Validation still passes today, yet the delegation path is aging toward failure because the parent update automation quietly stopped.