docs: name the Private DNS zone and instance hostnames

compute/private-dns.mdx

@@ -11,22 +11,42 @@ resolves only from inside that network.
 
 ## Instance names
 
-Compute publishes Instance names beneath the `instances` subtree of the
-network's managed DNS suffix. A name has this general form:
+Compute publishes each Instance under the `instances` subdomain of the
+network's `datum.internal` zone:
 
 ```text
-<instance-name>.instances.<network-managed-suffix>
+<instance-name>.instances.datum.internal
 ```
 
-Compute normalizes the Instance name into a valid DNS label when necessary. If
-two Instance names normalize to the same DNS name, Private DNS keeps the first
-claim and reports a name conflict for the other Instance.
+The Instance name is the one `datumctl get instances` shows. Instances that a
+Workload creates are named `<workload>-<placement>-<location>-<index>`, so the
+first Instance of a Workload named `web` is reachable from another Instance on
+the same network at:
 
-Treat the complete name that Datum reports as an output. The managed suffix is
-a platform allocation, so don't build or parse it in your app.
+```shell
+$ dig +short AAAA web-default-us-central-1-0.instances.datum.internal
+fd20:1::5
+$ curl http://web-default-us-central-1-0.instances.datum.internal:8080/
+```
 
-Datum reports the allocated hostname and its publication state in
-`Instance.status.dns`.
+Records have a 30 second TTL.
+
+Compute turns the Instance name into a valid DNS label by replacing `.` with
+`-`. Names longer than 63 characters are shortened and given a hash suffix.
+Read the exact hostname from `Instance.status.dns` rather than building it
+yourself:
+
+```yaml
+status:
+  dns:
+    - network:
+        name: default
+      hostnames: [web-default-us-central-1-0.instances.datum.internal]
+      conditions:
+        - type: Ready
+          status: "True"
+          reason: Published
+```
 
 ## Published addresses
 

domain-dns/private-dns.mdx

@@ -23,7 +23,7 @@
 - **Keep records aligned with resources:** Service-managed records update or
   disappear as their resources and addresses change.
 
 Apps use ordinary DNS lookups. On an associated network, private names
 resolve alongside public names with no resolver configuration in the app.
 
 ## Private and public DNS
@@ -40,16 +40,21 @@
 
 ## Names and zones
 
-Each network receives a managed DNS suffix for automatic service names. You can
-also associate private zones with a network for your own names.
+Every network gets a managed private zone named `datum.internal`. Datum
+services publish their names in it. For example, an Instance named
+`web-default-us-central-1-0` is reachable at:
 
-- **Managed names:** Datum services publish predictable names beneath the
-  network's managed suffix.
-- **Private zones:** Your internal names resolve only from the networks that
-  the zone is associated with.
+```text
+web-default-us-central-1-0.instances.datum.internal
+```
 
-The complete service-managed name includes the network's allocated suffix. Use
-the name that the service reports instead of building it in your app.
+Every network uses the same zone name, but each network has its own copy. A
+lookup of that name returns the Instance on the client's network, and returns
+nothing on any other network. Use the full name: short names depend on the
+search domains the client is configured with.
+
+You can also associate private zones with a network for your own names. Their
+records resolve only from the networks the zone is associated with.
 
 ## Service integrations