Widen SOA serial counter: YYMMDDNNNN, 10000 bumps/day

The previous YYYYMMDDNN encoding capped at NN=99 (100 bumps/day) and
hard-failed UPDATEs once the day's counter was exhausted — confirmed
in production on 2026-05-22 when ACME activity across the supported.
systems zone hit the cap and SERVFAILed every subsequent UPDATE.

New format: YYMMDD*10000+NNNN. With 4-digit NNNN we get 10000/day, and
dropping the century keeps a 2026-dated serial (2,605,229,999 max) under
uint32's 4,294,967,295 ceiling. A 4-digit year (e.g., 20260522*10000)
would overflow uint32 — RFC 1035's SOA serial type bounds this.

Three behavior changes:

1. On NNNN=9999, roll forward to the next encoded day with NNNN=0001
   rather than erroring. The encoded date drifts ahead of wall time on
   heavy churn days and catches up on quiet days; monotonic ordering
   (the only DNS requirement) holds.

2. Future-encoded serials (from a prior rollover) are honoured — the
   previous "older date" branch downgraded them back to today*100+1,
   producing a backwards serial. This bug also tripped a manual
   workaround on the same day. Now: future encoded dates bump their
   own NNNN.

3. Legacy YYYYMMDDNN serials migrate automatically on first bump. A
   value like 2026052299 (~2.026B) is numerically smaller than today's
   new-format minimum 2605220001 (~2.605B), so the older-or-unparseable
   branch fires and rewrites in place. New > old, so AXFR receivers
   treat it as a clean forward bump.

Tests cover same-day, rollover, future-encoded no-regress, legacy
migration, non-CalVer reset, and no-SOA error.

zonefile.go

@@ -179,12 +179,30 @@ func addRRTo(rrs []dns.RR, rr dns.RR) []dns.RR {
 	return append(rrs, rr)
 }
 
-// bumpSerial advances the SOA's serial in CalVer (YYYYMMDDNN) form.
+// serialCounterMul is the multiplier between the date prefix and the
+// counter in our SOA-serial encoding. The format is YYMMDD*10000 + NNNN,
+// giving 10000 bumps/day (NNNN ∈ [0001, 9999]). The 2-digit year keeps
+// the maximum within uint32 (the RFC 1035 ceiling for SOA serials): for
+// 2026-05-22, max serial 2,605,229,999 is well below 2^32-1=4,294,967,295.
+// A 4-digit year (e.g., 20260522*10000) would overflow uint32.
+const serialCounterMul = 10000
+
+// bumpSerial advances the SOA's serial in CalVer YYMMDD*10000+NNNN form.
+//
 // Behaviour:
-//   - If today is later than the existing serial's date, jump to
-//     today with NN=01.
-//   - Otherwise (same day, or serial-date is in the future), bump NN.
-//   - Caps at NN=99; returns an error if exceeded.
+//   - If cur encodes today (or a future-encoded date from a prior NNNN
+//     rollover), increment NNNN. On NNNN=9999, roll forward to the next
+//     encoded day with NNNN=0001. The encoded date drifts ahead of wall
+//     time during heavy churn and catches back up on quiet days; serial
+//     numbers stay strictly monotonic, which is the only DNS hard
+//     requirement.
+//   - Otherwise (older serial; including legacy YYYYMMDDNN-format serials
+//     left over from before this format change), jump to today*10000+1.
+//     Legacy serials migrate automatically here: a value like 2026052299
+//     (~2.026B) is numerically smaller than today's new-format minimum
+//     2605220001 (~2.605B), so it falls to this branch and gets rewritten
+//     in-place. The new value is strictly greater, so AXFR receivers (HE
+//     et al.) treat it as a normal forward bump and pull cleanly.
 //
 // The SOA is found by type (there should be exactly one); mutated in
 // place. The returned slice is the same slice with the SOA's serial
@@ -201,24 +219,54 @@ func bumpSerial(rrs []dns.RR, now time.Time) error {
 		return fmt.Errorf("zone has no SOA record")
 	}
 
-	today := now.UTC().Format("20060102")
-	cur := fmt.Sprintf("%d", soa.Serial)
+	today := now.UTC().Format("060102") // YYMMDD
+	cur := fmt.Sprintf("%010d", soa.Serial)
 
-	if len(cur) == 10 && cur[:8] == today {
-		nn := atoi(cur[8:10])
-		if nn >= 99 {
-			return fmt.Errorf("serial counter exhausted for %s (NN=99)", today)
+	// Try the new-format read: cur[:6] is YYMMDD, cur[6:10] is NNNN.
+	// We only honour this when the encoded date is today or later — an
+	// older encoded date means a normal new-day reset (or a legacy
+	// serial that happens to look like a valid YYMMDD prefix but is in
+	// the past, which is the same handling: jump to today).
+	if curDate := cur[:6]; isValidYYMMDD(curDate) && curDate >= today {
+		nnnn := atoi(cur[6:10])
+		if nnnn < 9999 {
+			soa.Serial = uint32(parseUint(curDate)*serialCounterMul + uint64(nnnn+1))
+			return nil
 		}
-		soa.Serial = uint32(parseUint(today)*100 + uint64(nn+1))
+		// NNNN=9999: roll to next encoded day, NNNN=0001.
+		d, err := time.Parse("060102", curDate)
+		if err != nil {
+			return fmt.Errorf("serial date %q unparseable: %w", curDate, err)
+		}
+		next := d.AddDate(0, 0, 1).Format("060102")
+		soa.Serial = uint32(parseUint(next)*serialCounterMul + 1)
 		return nil
 	}
 
-	// Either the date is older, or the format isn't CalVer at all —
-	// either way, today + 01 is the next valid serial.
-	soa.Serial = uint32(parseUint(today)*100 + 1)
+	// Older or unparseable: jump to today*10000+1. Migration path for
+	// legacy YYYYMMDDNN serials lives here.
+	candidate := uint32(parseUint(today)*serialCounterMul + 1)
+	if candidate <= soa.Serial {
+		// Defensive: don't regress. If something has somehow
+		// provisioned a serial >= today's new-format candidate (e.g.,
+		// far-future serial from a hand-edit), just +1 to advance.
+		soa.Serial++
+		return nil
+	}
+	soa.Serial = candidate
 	return nil
 }
 
+// isValidYYMMDD reports whether s is a 6-character YYMMDD string with a
+// valid month and day. Year is any 2-digit value (00-99).
+func isValidYYMMDD(s string) bool {
+	if len(s) != 6 {
+		return false
+	}
+	_, err := time.Parse("060102", s)
+	return err == nil
+}
+
 // atoi is a tiny helper that ignores errors — only called on a
 // substring we already validated is two digits.
 func atoi(s string) int {