Tracking issue: Initial findings

[sshine]

docs/FINDINGS.md split one section per issue, verbatim, so the file can be removed without
losing anything. Section numbers map straight onto issue numbers: §7 is #7. Cross-references
inside the sections were rewritten from §N to #N; the one exception is §7 of
docs/protocol.md, which is a different document and reads as before.

What the file said above its first section:

Two batches, from two different kinds of work.

#1–#9 changed the implementation, and were found by reading source rather than
documentation. Each says what the mechanism is, what would have gone wrong, and what the code
does about it.

#10–#19 were found by running the Go provider this replaces, and are correlated against
this codebase here rather than acted on. They come from external-dns-desec-provider#26
— a year of production fixes — from the review of it, and from
sshine/external-dns-desec-provider#2, another operator's account of the same failure
from a four-cluster deployment. Some describe holes this design has that the Go provider does
not. Some describe problems this design retired outright, recorded so they are not
re-litigated. One is a correction to #4. None of them is a decision; several are almost
certainly not worth their complexity.

Corrections to claims I had already written into comments or docs are marked, because a wrong
reason in a comment is worse than no reason at all.

Read from source, implemented, pinned by tests

• max_retries(0) on the deSEC client is load-bearing, not cautious #1
• Ownership TXT records never reach /adjustendpoints #2
• #[tokio::test(start_paused = true)] cannot be used with a real socket #3
• axum::Json as an *extractor* would have failed every single write #4
• Four HTTP statuses that look right are all permanent failures #5
• DS at a subname is yours; DS at the apex is deSEC's #6
• An empty /records cannot cause deletion — but a missing filter can #7
• prometheus-client's derive puts Rust variant names on the wire #8
• desec::api::rrsets::Rrset cannot be constructed #9

Correlated against the Go provider, not acted on

• A 429 with no Retry-After teaches the limiter nothing #10
• The limiter's memory of a throttle is two seconds long #11
• The write path emits no deSEC request metrics at all #12
• A throttle never says how long, anywhere an operator will look #13
• The documented way to turn on debug logging turns off the interesting logs #14
• The nine-second budget does not start when the request does #15
• snapshot_age_seconds measures the zone list, not the records #16
• #4 claims a debug body dump that does not exist #17
• Per-domain in-flight dedup solves a problem this design does not have #18
• The rest of the correlation #19