more config

STATUS.md

@@ -8,6 +8,18 @@ round before that brought the console onto the Go side of the API contract, so
 both halves of that are done. `AGENTS.md` holds the decisions, invariants and
 working rules; this file holds state and the plan.
 
+## Conditional forwarding update
+
+`upstream.forward_zones` now routes an apex and its descendants to dedicated
+upstreams, using the most specific case-insensitive label suffix. Routes reuse
+health/breaker tracking and UDP-to-TCP retry, never fall back to public servers,
+and apply to background cache refreshes too. Authoritative local zones, ACLs,
+and blocklists retain their precedence. Upstream reloads flush the cache; console
+upstream edits preserve the YAML-only routes and do not promote their targets to
+default servers. The Kubernetes config routes `local` to `10.10.0.1:53` over UDP.
+Direct UDP and TCP probes for `fastpi.local` both returned `10.10.11.117`.
+This repository change still needs a rebuilt image and rollout to become live.
+
 ## Goal
 
 A lightweight, high-performance recursive DNS server with: