Unexport the unguarded seed write

internal/bind/seed.go

@@ -54,7 +54,8 @@ ns1 IN A %s
 // EnsureSeedZone makes path loadable without discarding live data: it probes
 // the zone file and journal, moves aside whatever cannot load, and writes a
 // skeleton only when there is nothing to preserve. Every caller that needs a
-// zone database file on disk goes through here, never WriteSeedZone directly.
+// zone database file on disk goes through here: writeSeedZone is unexported so
+// the destructive write cannot be reached without a plan.
 func (e *Executor) EnsureSeedZone(ctx context.Context, namespace, pod, zone, path, primaryIP string) error {
 	state, err := e.ZoneDiskState(ctx, namespace, pod, path)
 	if err != nil {
@@ -70,13 +71,12 @@ func (e *Executor) EnsureSeedZone(ctx context.Context, namespace, pod, zone, pat
 	if !plan.WriteSeed {
 		return nil
 	}
-	return e.WriteSeedZone(ctx, namespace, pod, zone, path, primaryIP, plan.Serial)
+	return e.writeSeedZone(ctx, namespace, pod, zone, path, primaryIP, plan.Serial)
 }
 
-// WriteSeedZone writes a seed zone file to path, creating parent directories.
-// It overwrites any existing file unconditionally: use EnsureSeedZone unless
-// the caller has already run PlanSeed and acted on it.
-func (e *Executor) WriteSeedZone(ctx context.Context, namespace, pod, zone, path, primaryIP string, serial int64) error {
+// writeSeedZone writes a seed zone file to path, creating parent directories.
+// It overwrites any existing file unconditionally.
+func (e *Executor) writeSeedZone(ctx context.Context, namespace, pod, zone, path, primaryIP string, serial int64) error {
 	content := renderSeedZone(zone, primaryIP, serial)
 	q := shellQuote(path)
 	cmd := []string{"sh", "-c", fmt.Sprintf("mkdir -p \"$(dirname %s)\" && cat > %s", q, q)}