Restore split-view DNS without breaking public names

Edit dns-resolution-plan.json. Keep public example.test and private example.test, corp.example.test and 4.80.10.in-addr.arpa zones. Place records in their most specific zone; use A/CNAME for forward zones and PTR for reverse. Verified private resolvers: 10.80.0.53 and 10.80.0.54; public: 192.0.2.53 and 192.0.2.54. Either or both within a class work. Office portal.example.test must return 10.80.4.20; internet must return 203.0.113.40. Private api.corp.example.test must own A value 10.80.4.30. inventory.corp.example.test must reach that canonical owner through one or more CNAMEs, within 16 hops. Each alias owner must have one target and no other data. PTR owner 30.4.80.10.in-addr.arpa must name api.corp.example.test, whose office A lookup must still return 10.80.4.30. Both clients must retain status.example.test at 203.0.113.60 and the read-only external public record updates.vendor.test at 198.51.100.80. Internet API and inventory lookups must return NXDOMAIN. No public record may expose corp.example.test names, targets into that namespace or RFC 1918 addresses, even if unused. Office forwarding uses the longest matching label suffix, otherwise defaultForwarders. Defaults must use verified public resolvers. Conditional rules must use verified private resolvers, cover the whole corp.example.test and reverse-zone suffixes, and stay inside example.test or 4.80.10.in-addr.arpa. Each source selects its most specific zone without public fallback after a private negative answer. A broad private view therefore needs the public status record too. Alias targets follow the same client's forwarding rules again. Names are absolute; case and a final root dot are equivalent. Replay checks after edits and repair failures without Reset. Addresses and .test names are practice data.