009 — Stable claim code on retry

Context

After a claim window ends, the user retries via domains.verify. Rotating the challenge token on every retry would force another DNS update and amplify TTL confusion.

Decision

Reuse the same domain_claims.code when reviving a failed claim. Mint a new code only when starting a brand-new claim row (first claim for that claimant user_domain).

Consequences

• Users can leave the apex TXT in place across failed windows.
• The code is not treated as a long-lived secret; optional rotate-on-manual-reset remains a future escape hatch, not the default retry path.