v1.11.0 — CI reliability, correctness, coverage, IPv6

Batch release covering the review-driven work. Test count 144 to 185, coverage 85% to 95%.

Fixed

CI on main was red and blocking every open PR. The version-sync baseline test asserted a git tag exists, but CI checks out without fetching tags, so it could never pass there — and it passed locally, so running CI locally did not catch it. The test now skips on a tagless checkout and accepts an unreleased version bump; CI fetches full history. ruff is pinned exactly so a new release cannot turn the build red on its own.

Dead subdomains were mislabelled as self-referential CNAMEs. The check compared the current domain against the original, which is trivially true on entry — so any NXDOMAIN name with no CNAME was reported as "the domain points to itself". Found by an authorised live run: 9 of 9 non-resolving hosts were mislabelled. The label is now gated on having actually followed a CNAME.

A network blip during Azure IP-range fetching could kill an entire scan. sys.exit(1) inside the fallback chain terminated the process and discarded all results gathered so far. It now returns empty and the caller skips Azure.

An empty timeout_results_*.txt was written on every run — a leftover from the output consolidation. Removed.

Added

IPv6 resolution. A and AAAA are now queried concurrently; a host serving only AAAA records was previously reported as unresolved. Verified live: ipv6.google.com now resolves to four IPv6 addresses. A domain counts as unresolved only when both record types fail, so takeover detection is unchanged.

Performance

CIDR ranges are parsed once per run rather than once per resolved IP (AWS and Azure publish roughly 67,000 prefixes between them). Duplicate cloud-provider matches are filtered through an in-memory set instead of re-reading the whole output file on every write — which also removes a blocking read from the async path and fixes a substring match that could suppress a legitimately different line.

Tests

Coverage rose from 85% to 95%. EnvironmentManager went from 35% to 86% after extracting its live HTTP call behind a seam so the class can be constructed offline; OutputManager reached 100%. Regression tests lock in each of the fixes above.

Documentation

The Lambda deployment walkthrough moved from the README to docs/LAMBDA.md, cutting the README from 406 to 232 lines, and the DNS-only scope boundary is now stated explicitly. REVIEW.md, ROADMAP.md and docs/roadmap/ record the review findings and the remaining plan.