The server creates the system key ddi-agent-update (hmac-sha256, sealed like every key) with the first dynamic zone and at start, marks it in the new column tsig_keys.system (migration 00007) and puts it into the generator input (Source version 4). System keys are listed, rotatable and not deletable (key_system); their name is reserved (key_exists). The address check no longer reports dynamic_zone (ADR 0026). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>