A DNS sinkhole activates for new queries (DNS Resolution Failure)

The block policy is correct now and resolver memory still reflects the old decision. Steady-state traffic looked healthy until the resilience drill activated the alternate path and exposed a stale dependency. The issue stayed hidden until the system had to rebuild the dependency path from a cold-start posture.