poimen.riotpiao.com resolved only because someone edited the live coredns ConfigMap by hand. Neither terraform/files/coredns/Corefile nor the Talos machine config carried the line, so the next Talos reconcile would have deleted it and broken in-cluster resolution of a heavily used service. Live and source now agree on both hostnames the retirement touched.