docs: health check wording follows the code (rework for #302)

The README, the comments and TODO.md say the health check gives error
only when every lookup in a round failed because no root server gave a
usable reply, and the README drops the claim that the other failures
are reported as notifications.

Model: opus-5-5

internal/watcher/dnsunreachable_test.go

@@ -15,9 +15,10 @@ import (
 // four operators mark their replies recursion available, as on a network
 // that intercepts DNS queries; one that gives no reply is passed over
 // for the next, and if none replies, no root server answered. Either
-// way no lookup got a reply from a root server, so the round could not
-// reach the DNS. TestFirstRunBaseline and TestDomainThatDoesNotExist
-// check rounds in which the root servers answered.
+// way every lookup failed because no root server gave a usable reply,
+// so the round could not reach the DNS. TestFirstRunBaseline and
+// TestDomainThatDoesNotExist check rounds in which the root servers
+// gave a usable reply.
 func TestDNSUnreachableWhenNoRootServerReplies(t *testing.T) {
 	t.Parallel()
 
@@ -58,7 +59,7 @@ func TestDNSUnreachableWhenNoRootServerReplies(t *testing.T) {
 
 			if !w.DNSUnreachable() {
 				t.Error("DNSUnreachable is false after a round in " +
-					"which no lookup got a reply from a root server")
+					"which no root server gave a usable reply")
 			}
 		})
 	}

internal/watcher/watcher.go

@@ -204,13 +204,13 @@ func (w *Watcher) RunOnce(ctx context.Context) {
 }
 
 // DNSUnreachable reports whether the most recent round of DNS checks
-// could not reach the DNS at all: no lookup in it got a reply from a
-// root server, because none of them answered or because the network
-// intercepts DNS queries. A round in which the root servers answered
-// reached the DNS, even when a name's own nameservers did not answer or
-// a domain does not exist. It is false until the first round finishes,
-// and a round that shutdown cut short changes nothing. It may be called
-// while a round runs.
+// could not reach the DNS at all: every lookup in it failed because no
+// root server gave a usable reply, as when none of them answered or the
+// network intercepts DNS queries. A round reached the DNS even when a
+// name's own nameservers did not answer or a domain does not exist,
+// since the root servers gave a usable reply to those lookups. It is
+// false until the first round finishes, and a round that shutdown cut
+// short changes nothing. It may be called while a round runs.
 func (w *Watcher) DNSUnreachable() bool {
 	return w.dnsUnreachable.Load()
 }
@@ -304,10 +304,10 @@ func (w *Watcher) runDNSChecks(ctx context.Context) {
 }
 
 // noRootServerReplied reports whether errs, the errors of the lookups in
-// a round of DNS checks, nil for a lookup that succeeded, show that no
-// lookup got a reply from a root server: each failed because none of
-// them answered, or because the network intercepts DNS queries. A round
-// with no lookups shows nothing.
+// a round of DNS checks, nil for a lookup that succeeded, show that
+// every lookup failed because no root server gave a usable reply: each
+// is ErrNoRootServerAnswered or ErrIntercepted. A round with no lookups
+// shows nothing.
 func noRootServerReplied(errs []error) bool {
 	for _, err := range errs {
 		if !errors.Is(err, resolver.ErrNoRootServerAnswered) &&