[tulik]

Purpose

The protected gov.txt.gz production preflight now reports reason=record_fields, which identifies an invalid five-tab record shape but not the structural category. PR #7 has already merged, so this is a follow-up on fresh main.

Changes

• Add fixed privacy-safe structural reasons: record_blank, record_fields_comment, record_fields_directive, record_fields_space_delimited, record_fields_missing_tabs, record_fields_partial_tabs, and record_fields_mixed_delimiters.
• Apply the same classifier to the first-record preflight check and the streaming production parser.
• Add deterministic synthetic gzipped .gov fixtures, including preflight vs full-build parity for malformed initial and noninitial records and negative assertions that private-looking domain/NS strings never reach CLI output.
• Document code meanings, classification limitations, and protected-runner follow-up.

Invariants preserved

No malformed record is accepted, skipped, or re-tokenized. The existing five-field tab split remains unchanged. SOA serial consistency, complete-input rejection, canonical/plain DNS owner ordering, delegation deduplication, excluded-zone filtering, and process_input interface remain unchanged. Issue #6 checkpoint implementation stays independent. The GitHub Actions publication workflow is unchanged and still fails closed.

Follow-up

After CI and review, rerun protected preflight. Capture only the fixed reason=<code>; do not publish licensed records or exact private counts. The category is diagnostic evidence, not proof that the file is valid DNS master text. Any change to accepted grammar requires a separate synthetic reproducer and invariant review.

Related: merged #7, checkpoint #6.

[tulik]

The exact four-file contents proposed here are now present on main following merged #9 (commit 78669f1757086155d2922ac69840c2868d98769b). I verified matching blob SHAs for README.md, scripts/build_nsdb.py, scripts/preflight_czds.py, and tests/test_preflight.py. CI passed 49 tests on #9 and on the merge to main. Closing this as a duplicate to prevent redundant changes; the protected .gov preflight still needs rerun to identify its structural subcategory.