🔴 HIGH SEV · Mock-IP Allocation Errors (DNS resolution breaking) 🔥 Mock-IP allocation is erroring — DNS inside the tunnel is returning SERVFAIL <|📈 graph> · <|📊 service dashboard> · :rotating_light: alarm definition · :no_bell: silence _A Redis GET/INCR/SETNX error inside GetMockIP makes it return nil, and mockdns/server.go:105 turns nil into SERVFAIL on the A query. There is NO fallback: the tunnel hands the device 1.1.1.1 and 8.8.8.8, but nftables redirects all VPN-subnet UDP:53 to our own mock DNS regardless of destination, and TCP:53 is dropped. The device retries the second resolver, hits the same server, and has nowhere else to go. BLAST RADIUS GROWS WITH DURATION, it is not instantly total: only domains being resolved for the FIRST time are affected, because the device DNS cache holds 60s. So a short blip is nearly invisible and a long one looks like 'the internet is broken'. This is the LOUD failure mode — expect support contact. Distinct from lost-mock-IP dials, which are an attribution gap (TLS survives via SNI). Baseline: 0 over 7d, alloc p99 4.4ms. Panel: /d/redis-service-health 'Is the mock-DNS IP pool working?'. Ticket: CLE-514, CLE-399._ Grafana vmain-ed3d476