Measured 2026-10-03 (system-steward, GOV.13). The estate docs say LAN devices use AdGuard (192.168.123.69:53) and each *.angelsworks.org name gets a rewrite. Adding spice.angelsworks.org 'succeeded': yaml edited, container restarted, grep shows the entry. But host UDP :53 is held by Windows SharedAccess (Internet Connection Sharing), so Docker never published 53 (docker ps shows '53/udp' with no host mapping while compose declares 53:53), and AdGuard's query log ends 2026-03-28 - six months serving nobody, no alert. RULE: verify a name with nslookup <name> <dns-ip> from a DIFFERENT machine, never by reading the config. LAN names in this estate resolve only via a public A record (-> 94.104.207.18, hairpin through the modem).