resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

internal/handlers/status_test.go

@@ -23,7 +23,10 @@ import (
 // failed. example.net is an apex domain, whose own records are saved
 // with the hostnames' records, as the watcher saves them. Both names
 // resolve to domainAddress, whose port 443 entry lists them.
+// missingDomain is an apex domain whose parent zone's servers answered
+// that it does not exist, saved with no nameservers and no records.
 const (
+	missingDomain    = "does-not-exist.example"
 	testHostname     = "www.example.com"
 	answeringNS      = "ns1.example.com."
 	failedNS         = "ns2.example.com."
@@ -132,6 +135,12 @@ func setTestState(st *state.State) {
 		Hostnames:   []string{testDomain, testHostname},
 		LastChecked: now,
 	})
+
+	st.SetDomainState(missingDomain, &state.DomainState{
+		Nameservers: []string{},
+		NXDomain:    true,
+		LastChecked: now,
+	})
 }
 
 // get serves one GET request to handler and returns the response body.
@@ -233,6 +242,39 @@ func TestStatusGivesDomainRecordsUnderTheDomain(t *testing.T) {
 	}
 }
 
+// TestStatusMarksDomainThatDoesNotExist checks that /api/v1/status sets
+// nxdomain for a domain that does not exist, with no nameservers or
+// records, and not for a domain that exists.
+func TestStatusMarksDomainThatDoesNotExist(t *testing.T) {
+	t.Parallel()
+
+	body := get(t, newHandlersWithFailures(t).HandleStatus())
+
+	var resp struct {
+		Domains map[string]struct {
+			Nameservers         []string       `json:"nameservers"`
+			RecordsByNameserver map[string]any `json:"recordsByNameserver"`
+			NXDomain            bool           `json:"nxdomain"`
+		} `json:"domains"`
+	}
+
+	err := json.Unmarshal([]byte(body), &resp)
+	if err != nil {
+		t.Fatalf("decoding response: %v", err)
+	}
+
+	missing := resp.Domains[missingDomain]
+	if !missing.NXDomain || len(missing.Nameservers) != 0 ||
+		len(missing.RecordsByNameserver) != 0 {
+		t.Errorf("domain %s = %+v, want nxdomain and nothing else",
+			missingDomain, missing)
+	}
+
+	if resp.Domains[testDomain].NXDomain {
+		t.Errorf("domain %s has nxdomain set", testDomain)
+	}
+}
+
 // TestStatusPortsTellDomainsFromHostnames checks that a port entry in
 // /api/v1/status lists an apex domain in domains and a hostname in
 // hostnames when both resolve to its address.