converge apex NS per record, not by RRset replace

BIND ignores an RRset-wide delete of apex NS, so the previous replace only
appended to the seed placeholder.

internal/bind/nsupdate_test.go

@@ -0,0 +1,42 @@
+package bind
+
+import "testing"
+
+func TestNSUpdateScriptReplaceSemantics(t *testing.T) {
+	got := nsupdateScript("acme.unkin.net", []RecordUpdate{
+		{FQDN: "www", Type: "A", TTL: 60, Values: []string{"10.0.0.1", "10.0.0.2"}},
+		{FQDN: "old.acme.unkin.net.", Type: "TXT", Delete: true},
+	})
+	want := `server 127.0.0.1
+zone acme.unkin.net.
+update delete www. A
+update add www. 60 A 10.0.0.1
+update add www. 60 A 10.0.0.2
+update delete old.acme.unkin.net. TXT
+send
+`
+	if got != want {
+		t.Errorf("got:\n%s\nwant:\n%s", got, want)
+	}
+}
+
+// At the apex BIND ignores an RRset-wide delete of NS, so the apex sync must add
+// the new names and delete the old ones record by record, adds first: named
+// refuses to leave an apex with no NS record.
+func TestNSUpdateScriptPerValueApexNS(t *testing.T) {
+	got := nsupdateScript("acme.unkin.net", []RecordUpdate{
+		{FQDN: "acme.unkin.net.", Type: "NS", TTL: 60, Values: []string{"acme-ns1.unkin.net."}, PerValue: true},
+		{FQDN: "acme.unkin.net.", Type: "NS", Values: []string{"ns1.acme.unkin.net."}, PerValue: true, Delete: true},
+		{FQDN: "ns1.acme.unkin.net.", Type: "A", Delete: true},
+	})
+	want := `server 127.0.0.1
+zone acme.unkin.net.
+update add acme.unkin.net. 60 NS acme-ns1.unkin.net.
+update delete acme.unkin.net. NS ns1.acme.unkin.net.
+update delete ns1.acme.unkin.net. A
+send
+`
+	if got != want {
+		t.Errorf("got:\n%s\nwant:\n%s", got, want)
+	}
+}