test: restore transport-failure coverage with loopback nameservers

The DNS-mock removal deleted TestQueryNameserverIP_Timeout and left a
comment in its place, so the resolver's StatusTimeout / StatusError
classification branch went untested. The stated obstacle was that a
query to a black-holed RFC 5737 address comes back StatusOK, because
the build environment transparently intercepts UDP/53 and answers it
locally. That is a property of that environment, not of the resolver,
and it only rules out choosing a remote address.

internal/resolver/transport_test.go binds real nameservers on
127.0.0.1 instead and aims the query at them: one silent on A queries
and answering every other type (StatusTimeout), one answering SERVFAIL
(StatusError), and one address with nothing listening, which is
refused rather than dropped and so classifies as NoData. This is not a
mock — no DNSClient is substituted. The resolver dials a real socket,
writes a real query with the real miekg/dns client, and applies its
real deadline and real classification logic to what comes back.
Substituting the client is what TESTING.md bans; choosing the server
is not, and the resolver is aimed at a caller-chosen nameserver in
production too.

queryDNS now dials a nameserver address that already carries a port as
written, defaulting to 53 only for a bare address. That is what makes
a nameserver on any other port reachable, on loopback or otherwise.

Silence on one record type rather than all eight keeps the timeout
test to two query timeouts (4s) instead of sixteen (32s), and it is
asserted: the test fails if it ever costs more than 8s.

The watcher's assertStatePopulated and TestDomainPortAndTLSChecks
asserted only that hostname, port and certificate state were
non-empty, plus non-zero checker call counts. Neither was vacuous, but
neither would have caught the watcher resolving the wrong addresses.
The port and TLS test doubles now record their arguments, and both
tests assert that the state keys and the arguments the checkers were
actually called with match the addresses live DNS returned — exactly
those, no more and no fewer. Verified by mutation: making the watcher
drop all but one resolved address fails both tests, and it passed both
of them before.

TESTING.md records why a loopback nameserver is not a mock, so the new
tests are not mistaken for a violation of the rule they respect.

internal/resolver/iterative.go

@@ -116,8 +116,7 @@ func (r *Resolver) retryTCP(
 // specifies a port is dialled as written, which is what makes a
 // nameserver listening somewhere other than 53 reachable.
 func nameserverAddr(nsIP string) string {
-	_, _, err := net.SplitHostPort(nsIP)
+	if _, _, err := net.SplitHostPort(nsIP); err == nil {
-	if err == nil {
 		return nsIP
 	}
 

internal/resolver/transport_test.go

@@ -73,16 +73,13 @@ func startNameserver(
 ) string {
 	t.Helper()
 
-	var lc net.ListenConfig
+	conn, err := net.ListenPacket("udp", "127.0.0.1:0")
-
-	conn, err := lc.ListenPacket(t.Context(), "udp", "127.0.0.1:0")
 	require.NoError(t, err, "binding loopback nameserver")
 
 	stopped := make(chan struct{})
 
 	t.Cleanup(func() {
 		_ = conn.Close()
-
 		<-stopped
 	})
 
@@ -123,8 +120,7 @@ func serveNameserver(
 			continue
 		}
 
-		_, err = conn.WriteTo(wire, from)
+		if _, err := conn.WriteTo(wire, from); err != nil {
-		if err != nil {
 			return
 		}
 	}
@@ -135,9 +131,7 @@ func serveNameserver(
 func unservedAddr(t *testing.T) string {
 	t.Helper()
 
-	var lc net.ListenConfig
+	conn, err := net.ListenPacket("udp", "127.0.0.1:0")
-
-	conn, err := lc.ListenPacket(t.Context(), "udp", "127.0.0.1:0")
 	require.NoError(t, err, "binding loopback port")
 
 	addr := conn.LocalAddr().String()

internal/watcher/watcher_test.go

@@ -84,6 +84,7 @@ type mockPortChecker struct {
 	mu      sync.Mutex
 	openAll bool
 	err     error
+	calls   int
 	seen    []portCall
 }
 
@@ -95,6 +96,7 @@ func (m *mockPortChecker) CheckPort(
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
+	m.calls++
 	m.seen = append(m.seen, portCall{address: address, port: port})
 
 	if m.err != nil {
@@ -111,6 +113,13 @@ func (m *mockPortChecker) setOpenAll(open bool) {
 	m.openAll = open
 }
 
+func (m *mockPortChecker) callCount() int {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	return m.calls
+}
+
 // checkedKeys returns the distinct "address:port" pairs the checker
 // was asked about, sorted, in the same form as the state store's
 // port keys so the two can be compared directly.
@@ -139,6 +148,7 @@ type mockTLSChecker struct {
 	mu    sync.Mutex
 	cert  *tlscheck.CertificateInfo
 	err   error
+	calls int
 	seen  []tlsCall
 }
 
@@ -150,6 +160,7 @@ func (m *mockTLSChecker) CheckCertificate(
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
+	m.calls++
 	m.seen = append(
 		m.seen, tlsCall{address: address, hostname: hostname},
 	)
@@ -174,6 +185,13 @@ func (m *mockTLSChecker) setCert(cert *tlscheck.CertificateInfo) {
 	m.cert = cert
 }
 
+func (m *mockTLSChecker) callCount() int {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	return m.calls
+}
+
 // checkedKeys returns the distinct certificate keys the checker was
 // asked about, sorted, in the state store's "address:port:hostname"
 // form so the two can be compared directly.