resolver, watcher: a record type whose query fails keeps its previous records (closes #231 )

The resolver lists in FailedTypes each record type whose query to a nameserver got no usable reply (no reply, a code other than NOERROR or NXDOMAIN, a referral, or a truncated reply whose TCP retry failed) and logs it unless shutdown cut it short. A nameserver that answered no type has failed. The watcher saves such a type in failedTypes with the previous check's records, leaves it out of the comparison with other nameservers on that check, and compares it with the next answer. When the previous check did not know its records either, it is also in unknownTypes and not compared until it answers. A nameserver whose A, AAAA or CNAME query failed is no answer when following a CNAME or resolving addresses. Model: opus-5-5
2026-10-02 08:22:45 +00:00
44 changed files with 644 additions and 2251 deletions
@@ -1,75 +1,9 @@
-# .dockerignore does NOT use .gitignore semantics. Docker matches with
+# .git is sent, without its config: the builder stage derives the version it
-# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+# stamps into the binary from it, and `git describe` does not need the config,
-# `/` and an unprefixed pattern is anchored at the context root. Every
+# which can hold a credential (a password in the remote URL, a CI token). No
-# depth-independent pattern therefore needs `**/`, or `config/.env` and
+# tracked file may be listed here: git in the build would see it as deleted
-# `certs/server.key` still ship while this file reads as solved. Only
+# and mark the version -dirty, and an excluded .md would silently drop out of
-# genuinely root-anchored entries go unprefixed. Never transplant these
+# the prettier check in Dockerfile.fmt.
-# into .gitignore, where `**/` is wrong.
+.git/config
-#
+bin/
-# Matching is case-sensitive, so secrets use character ranges rather
+node_modules/
 # than an ALL-CAPS twin, which would still miss `Server.Key`.
 #
 # Extend with this repo's own host-built artifacts, written anchored:
 # `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
 # deletes the package directory from the context.
 # .git is sent without its config. Without a VERSION build argument the
 # stage that compiles runs `git describe --tags --always` on .git, which
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
 # Each submodule keeps a config with the same exposure in its git directory
 # under .git/modules/, nested again for a submodule's own submodules, or in
 # its own .git directory when it keeps one.
 # KNOWN GAP: a submodule whose name has a `config` segment (`config`,
 # `deploy/config`, `config/lib`) loses its whole git directory, because
 # `**/.git/modules/**/config` also matches that segment's directory
 # under .git/modules/. Go's version stamping then fails the build;
 # nothing leaks. Name such a submodule without that segment:
 # `git submodule add --name`.
 **/.git/config
 **/.git/modules/**/config
 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.
 # KNOWN GAP: a repo running agents in subdirectories still ships
 # `services/api/.claude/` and must add its own anchored entry.
 .claude
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Re-include a committed template with a negation if the
 # build needs one: `!docs/example.env`.
 **/*.[eE][nN][vV]
 **/.[eE][nN][vV].*
 **/.[eE][nN][vV][rR][cC]
 # Private keys and the bundles carrying them. Public certificates
 # (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
 **/*.[pP][eE][mM]
 **/*.[kK][eE][yY]
 **/*.[pP]12
 **/*.[pP][fF][xX]
 **/[iI][dD]_[rR][sS][aA]
 **/[iI][dD]_[dD][sS][aA]
 **/[iI][dD]_[eE][cC][dD][sS][aA]
 **/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 **/[iI][dD]_[eE][dD]25519
 **/[iI][dD]_[eE][dD]25519_[sS][kK]
 # Dependencies: restored inside the image, never copied in.
 **/node_modules
 # OS metadata.
 **/.DS_Store
 **/Thumbs.db
 # Editor state: never a build input, and it churns COPY.
 **/*.swp
 **/*.swo
 **/*~
 **/*.bak
 **/.idea
 **/.vscode
 **/*.sublime-*
 # This repository's host-built artifacts: `make build` writes bin/.
 /bin
@@ -10,6 +10,3 @@ insert_final_newline = true
 [Makefile]
 indent_style = tab
 [*.go]
 indent_style = tab
@@ -9,7 +9,7 @@ jobs:
    check:
        runs-on: ubuntu-latest
        steps:
-            # actions/checkout v4.2.2, 2026-02-22
+            # actions/checkout v4.2.2, 2026-02-28
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
              # script/cibuild needs no token, so none is left in .git/config.
              with:
@@ -1,57 +1,7 @@
 # OS
 .DS_Store
 Thumbs.db
 # Editors
 *.swp
 *.swo
 *~
 *.bak
 .idea/
 .vscode/
 *.sublime-*
 # Agent scratch (worktrees of this repo, created and destroyed by
 # in-flight tooling). Unanchored: .gitignore patterns already match at
 # every depth, so no prefix is wanted here. This is not a .dockerignore
 # entry and must not be given a `**/` prefix on the way into one.
 .claude/
 # Node
 node_modules/
 # Secrets. Unanchored like every entry above, so each matches at every
 # depth. Matching is case-sensitive on Linux, so names use character
 # ranges rather than a lowercase form that misses `Server.Key`.
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Only the templates `example.env` and `sample.env` are
 # re-included below. A repository that commits any other template adds
 # its own negation after these lines, for example `!.env.example`.
 *.[eE][nN][vV]
 .[eE][nN][vV].*
 .[eE][nN][vV][rR][cC]
 !example.env
 !sample.env
 # Private keys and the bundles carrying them.
 *.[pP][eE][mM]
 *.[kK][eE][yY]
 *.[pP]12
 *.[pP][fF][xX]
 [iI][dD]_[rR][sS][aA]
 [iI][dD]_[dD][sS][aA]
 [iI][dD]_[eE][cC][dD][sS][aA]
 [iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 [iI][dD]_[eE][dD]25519
 [iI][dD]_[eE][dD]25519_[sS][kK]
 # This repository's own entries, kept after the canonical content above.
 *.log
 *.out
 *.test
 bin/
 node_modules/
 vendor/
 data/
 .env
 *.exe
 /dnswatcher
@@ -17,7 +17,6 @@ linters:
  disable:
    # Genuinely incompatible with project patterns
    - exhaustruct      # Requires all struct fields
    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
    - godot            # Requires comments to end with periods
    - wrapcheck        # Too verbose for internal packages
    - varnamelen       # Short names like db, id are idiomatic Go
@@ -1,2 +1,5 @@
 bin/
 data/
 node_modules/
-yarn.lock
+.claude/
 static/css/tailwind.min.css
@@ -1,102 +1,68 @@
-# Lint phase, built alone by script/lint. The linter is invoked directly
+# Lint stage - fast feedback on lint issues, before the build starts.
-# rather than through `make lint`, which is itself a docker build and
+# The linter is invoked directly rather than through `make lint`: that
-# would recurse into a daemon that does not exist in a build step.
+# target shells out to `docker build -f Dockerfile.lint`, and there is
-# golangci/golangci-lint:v2.14.0 (Debian-based), 2026-10-06
+# no docker daemon inside a docker build. For the same reason this stage
-FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
+# runs only the Go half of `make fmt-check`; script/cibuild runs the
 # markdown half after this build.
 # script/cibuild and script/docker name this stage in --no-cache-filter.
 # golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
 FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN script/fmt-check-go
 RUN golangci-lint run --config .golangci.yml ./...
-# Test phase, built alone by script/test. -race needs cgo and so a C
+# Build stage
-# compiler, which the Debian Go image ships and the alpine one does not.
+# script/cibuild and script/docker name this stage in --no-cache-filter.
 # The tests query live DNS (TESTING.md), so this step needs the network.
 # -count=1 keeps Go's test result cache out of both runs, as TESTING.md
 # requires. -timeout 90s is a backstop above the 60-second cap on the
 # suite. The rerun with -v only shows details: the build fails however
 # it ends, because the first run already failed.
 # golang 1.25.7-trixie, 2026-10-06
 FROM golang@sha256:2b174ffcf56c7ad0c47d30d2630693265639ddf2a5141149c2da34db921791b4 AS test
 # The file permission tests skip themselves as root, so the tests run as
 # an ordinary user, whose home directory holds Go's build cache.
 RUN useradd --create-home tester
 USER tester
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN go test -count=1 -race -timeout 90s -cover ./... || \
    { echo "--- Rerunning with -v for details ---"; \
      go test -count=1 -race -timeout 90s -v ./...; exit 1; }
 # Markdown formatting with prettier, at the version package.json and
 # yarn.lock pin, so it is never installed on the host. script/fmt-check
 # builds the fmt-check stage and script/fmt the fmt-out stage; the image
 # does not depend on any of these stages, so a plain `docker build .`
 # skips them.
 # node:22-bookworm-slim, 2026-09-05
 FROM node@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5 AS nodedeps
 # prettier lives outside /src, so the COPY of the repo cannot overwrite
 # it and node_modules is not in the tree prettier walks.
 WORKDIR /tools
 COPY package.json yarn.lock ./
 RUN yarn install --frozen-lockfile --non-interactive --no-progress
 ENV PATH="/tools/node_modules/.bin:${PATH}"
 WORKDIR /src
 # --config rather than discovery: a missing .prettierrc is then an error
 # instead of prettier's defaults, under which every wrap passes.
 # --no-editorconfig so .prettierrc alone sets the style.
 FROM nodedeps AS fmt-check
 COPY . .
 RUN prettier --config .prettierrc --no-editorconfig --check "**/*.md"
 # Only the markdown is copied out, with its paths, so the export cannot
 # put anything else back over the working tree.
 FROM nodedeps AS fmt
 COPY . .
 RUN prettier --config .prettierrc --no-editorconfig --write "**/*.md" && \
    mkdir -p /out && \
    find . -name '*.md' -type f -exec cp --parents '{}' /out/ ';'
 FROM scratch AS fmt-out
 COPY --from=fmt /out/ /
 # Build stage. Nothing is wanted from the lint and test phases; the
 # copies are what make BuildKit build them first, so this stage cannot
 # run unless lint and test passed.
 # golang 1.25-alpine, 2026-02-28
 FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
-COPY --from=lint /src/go.sum /dev/null
+
-COPY --from=test /src/go.sum /dev/null
+RUN apk add --no-cache git make gcc musl-dev binutils-gold
-RUN apk add --no-cache git
+
-# A tar-stream context keeps the sender's file owners, which git refuses.
+# A build context sent as a tar archive keeps its files' owners, and git
 # refuses to read a checkout owned by another user. Trust this one
 # whoever owns it.
 RUN git config --system --add safe.directory /src
 # Force BuildKit to run the lint stage before proceeding
 COPY --from=lint /src/go.sum /dev/null
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-# The VERSION build arg when one is given (script/docker and
+# Run the tests - build fails if any test fails
-# script/cibuild pass one), otherwise `git describe --tags --always` on
+RUN make test
-# the .git in the build context. With .git present, a version that is
+
-# still empty, dev or unknown fails the build: git is missing or could
+# Version stamped into the binary: the VERSION build arg when one is
-# not read the checkout.
+# given and not empty (script/docker passes one), otherwise what
 # `git describe` says of the .git in the build context, so a plain
 # `docker build .` of a clone stamps its tag or short commit. The build
 # arg reaches make through the environment.
 ARG VERSION
-RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+
 # A context that carries .git, as a directory or as a file, must yield a
 # real version: one that is empty, `dev` or `unknown` cannot be traced
 # back to a commit.
 RUN version="$(make version)"; \
    if [ -e .git ]; then \
-        case "$VERSION" in ""|dev|unknown) \
+        case "$version" in \
-            echo "version is '$VERSION' although .git is present" >&2; \
+            "" | dev | unknown) \
                echo "version is \"$version\" although the build context carries .git" >&2; \
                exit 1 ;; \
        esac; \
-    fi; \
+    fi
    CGO_ENABLED=0 go build -trimpath \
        -ldflags="-s -w -X main.Version=${VERSION}" \
        -o /src/bin/dnswatcher ./cmd/dnswatcher/
-# Runtime stage, and the last one: a plain `docker build .` builds this
+RUN make build
-# stage's chain and nothing else.
+
 # Runtime stage
 # alpine 3.21, 2026-02-28
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
@@ -0,0 +1,54 @@
 # prettier over the markdown, in a container, so it is never installed
 # on the host. script/fmt-check-markdown builds the fmt-check stage;
 # script/fmt builds fmt-out and takes the formatted files back.
 # node:22-bookworm-slim, 2026-09-05
 FROM node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5 AS nodedeps
 # prettier lives outside /src so that a `COPY . .` of the repo cannot
 # overwrite it, and so that node_modules never appears in the tree
 # prettier is about to walk.
 WORKDIR /tools
 # package.json pins the version and yarn.lock pins the bytes:
 # --frozen-lockfile installs exactly the lockfile's resolution and fails
 # if package.json disagrees with it, so the tool cannot float between
 # runs. yarn is the one in the image above.
 COPY package.json yarn.lock ./
 RUN yarn install --frozen-lockfile --non-interactive --no-progress
 ENV PATH="/tools/node_modules/.bin:${PATH}"
 WORKDIR /src
 # Read-only markdown check. Must match $stage in
 # script/fmt-check-markdown.
 FROM nodedeps AS fmt-check
 COPY . .
 # --config, not discovery: a .prettierrc that failed to arrive would
 # otherwise leave prettier on its defaults, where proseWrap is "preserve"
 # and every wrap this check exists to enforce passes. Missing the file is
 # a hard error instead. --no-editorconfig so that .prettierrc alone sets
 # the style.
 RUN prettier --config .prettierrc --no-editorconfig --check "**/*.md"
 # Write path. Not a check: script/fmt builds this and takes the files.
 FROM nodedeps AS fmt
 COPY . .
 RUN prettier --config .prettierrc --no-editorconfig --write "**/*.md"
 # Only the markdown leaves, with its paths intact, so that the export
 # below cannot put anything else back over the caller's working tree.
 RUN mkdir -p /out && cd /src && \
    find . -name '*.md' -type f -exec cp --parents '{}' /out/ ';'
 # Export target: `docker build --target fmt-out --output type=local`
 # writes /out's tree into a directory on the client, which is how
 # script/fmt gets formatted markdown back without a bind mount.
 # Must match $stage in script/fmt.
 FROM scratch AS fmt-out
 COPY --from=fmt /out/ /
@@ -0,0 +1,29 @@
 # Lint-only image: used by script/lint. golangci-lint is never run on
 # the host — the repo is COPYed into the build context and the linter
 # runs as a build step, so a successful build IS a clean lint. This
 # also works where the docker daemon is remote and bind mounts are
 # impossible.
 #
 # `golangci-lint config verify` is deliberately NOT run here: it
 # fetches its JSON schema over a live, unpinned HTTPS call, which would
 # make linting network-dependent and defeat hash-pinning. The cost of
 # that: unknown top-level keys in .golangci.yml are silently ignored,
 # so a mistyped or wrong-schema key lints clean while applying nothing.
 #
 # golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
 FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
 WORKDIR /src
 # Dependencies first, so this stage stays cached across lint runs.
 COPY go.mod go.sum ./
 RUN go mod download
 # Everything below is invalidated on every run by the
 # --no-cache-filter=lint that script/lint passes: caching is explicitly
 # waived for linting, and a cached build lints nothing.
 FROM deps AS lint
 COPY . .
 RUN golangci-lint run --config .golangci.yml ./...
@@ -2,9 +2,9 @@
 BINARY := dnswatcher
 # VERSION given on the command line (`make build VERSION=...`) or in the
-# environment wins over what `git describe` says of this checkout. An
+# environment, which is how the Dockerfile's VERSION build arg arrives,
-# empty one counts as not given; `override` is what replaces an empty
+# wins over what `git describe` says of this checkout. An empty one counts
-# command-line value.
+# as not given; `override` is what replaces an empty command-line value.
 ifeq ($(VERSION),)
 override VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 endif
@@ -25,7 +25,7 @@ setup:
 build:
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/dnswatcher
-# Prints the version `make build` stamps.
+# Prints the version `make build` stamps; the Dockerfile checks it.
 version:
 	@echo "$(VERSION)"
@@ -73,21 +73,9 @@ notification endpoint set, changes show only on the dashboard; see
  to discover all authoritative nameservers (NS records) for each domain.
 - Queries **every** discovered authoritative nameserver independently.
 - Stores the domain's NS record set, as its parent zone's servers delegate it,
-  and the IPv4 and IPv6 addresses each nameserver's name resolves to. The set is
+  and the IPv4 and IPv6 addresses each nameserver's name resolves to.
  only ever the domain's own delegation. A domain whose parent zone's servers
  answer NXDOMAIN, that it does not exist, has no nameservers and is shown as
  not existing (see Web Dashboard and HTTP API). A domain that exists but has no
  delegation of its own, such as `octocat.github.io`, has no nameservers either.
  When the parent zone's servers do not answer, the check fails and the set from
  the previous check is kept.
 - Any change triggers a notification:
-    - NS added to or removed from that set. A domain that had nameservers on the
+    - NS added to or removed from that set.
      previous check and no longer exists gets one with all of them removed.
      After an upgrade, a domain with no delegation of its own, for which an
      earlier version saved its parent zone's nameservers, also gets one with
      all of them removed, on its first check. That one does not mean the domain
      stopped existing: it is not shown as not existing, and its records are
      still watched.
    - NS address change: a nameserver that stays in the set resolves to
      different addresses than on the previous check. A nameserver added or
      removed gets only the NS change notification. When the lookup of a
@@ -99,11 +87,7 @@ notification endpoint set, changes show only on the dashboard; see
  records, stored per nameserver. Their changes are notified as a hostname's
  are, as a record change, NS query failure, NS recovery, inconsistency or CNAME
  address change, in a message that starts `Domain:` where a hostname's starts
-  `Hostname:`. A domain listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no
+  `Hostname:`.
  record change or inconsistency notification. A domain with no delegation of
  its own has these records asked at the servers of the zone it is in, as a
  hostname has. A domain that does not exist has none: they are not asked for,
  and those saved by an earlier check are removed without a notification.
 ### DNS Hostname Monitoring (Subdomains)
@@ -111,11 +95,7 @@ notification endpoint set, changes show only on the dashboard; see
  via the Public Suffix List).
 - Every **1 hour** by default, performs a full iterative trace to discover the
  authoritative nameservers of the zone the hostname is in, which is not always
-  its last two labels (a name under `co.uk`, or in a delegated subdomain). The
+  its last two labels (a name under `co.uk`, or in a delegated subdomain).
  trace moves from a name to its parent only when the servers asked answer that
  the name has no delegation of its own, or does not exist. When they do not
  answer, the check fails and the hostname's records from the previous check are
  kept.
 - Queries **each** authoritative nameserver independently for **all** record
  types: A, AAAA, CNAME, MX, TXT, SRV, CAA, NS.
 - Each record type is a query of its own. When a nameserver answers some types
@@ -137,14 +117,10 @@ notification endpoint set, changes show only on the dashboard; see
  lower case, because names are case-insensitive and nameservers may answer in
  any letter case. TXT and CAA values keep their letter case; they are not
  lower-cased.
- Any observable change in any nameserver's response triggers a notification,
+- Any observable change in any nameserver's response triggers a notification.
-  except a record change or an inconsistency for a domain or hostname listed in
+  This includes:
  `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`. This includes:
    - **Record change**: A nameserver returns different records than it did on
-      the previous check (additions, removals, value changes). For a domain or
+      the previous check (additions, removals, value changes).
      hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`, neither a
      record change nor an inconsistency is notified; its records are still
      checked and saved, and its other notifications are sent.
    - **NS query failure**: A nameserver that previously responded becomes
      unreachable (timeout, SERVFAIL, REFUSED, network error). This is distinct
      from "responded with no records": a nameserver that answers NXDOMAIN or
@@ -165,8 +141,7 @@ notification endpoint set, changes show only on the dashboard; see
      failed on it, and answers differently is reported on the check where it
      answers. So is a pair that differs in a record type whose query to either
      nameserver failed on the previous check. If a pair agrees again and later
-      disagrees, the alert is sent again. For a domain or hostname listed in
+      disagrees, the alert is sent again.
      `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`, no inconsistency is notified.
    - **CNAME address change**: The addresses at the end of a name's CNAME chain
      differ from those of the previous check. They are found when its
      nameservers answer with a CNAME and no address; a name that answers with
@@ -192,13 +167,9 @@ notification endpoint set, changes show only on the dashboard; see
 - Any change in port availability triggers a notification:
    - Port transitioned from open to closed (or vice versa).
    - New IP appeared (from DNS change): its port state is recorded without a
-      port notification; the DNS change notification shows the new address. A
+      port notification; the DNS change notification shows the new address.
      domain or hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets
      no notification for an address added to its own A or AAAA records.
    - IP disappeared (from DNS change) — noted in the DNS change notification;
-      port state for that IP is removed. A domain or hostname listed in
+      port state for that IP is removed. When none of a name's nameservers
      `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no notification for an address
      removed from its own A or AAAA records. When none of a name's nameservers
      answered, its addresses are not known, so the port state saved for them is
      kept.
@@ -220,9 +191,7 @@ notification endpoint set, changes show only on the dashboard; see
 **Every observable state change produces a notification.** dnswatcher is
 designed as a real-time change feed — degradations, failures, recoveries, and
-routine changes are all reported equally. A domain or hostname listed in
+routine changes are all reported equally.
 `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no record change or inconsistency
 notification.
 Supported notification backends:
@@ -247,9 +216,7 @@ includes:
 - **NS recoveries**: Which nameserver recovered, which hostname/domain.
 - **NS inconsistencies**: Which nameservers disagree, what each one returned,
  which hostname or domain affected.
- **Port changes**: Which IP:port, its new state, and the domains and the
+- **Port changes**: Which IP:port, its new state, all associated hostnames.
  hostnames that resolve to it, on a `Domains:` line and a `Hostnames:` line. A
  line that would name nothing is left out.
 - **TLS expiry warnings**: Expiry date and days remaining, CN, associated
  hostname and IP.
 - **TLS certificate changes**: Old and new CN and issuer, associated hostname
@@ -276,14 +243,6 @@ clears them.
  false-positive change notifications.
 - State is written atomically (write to temp file, then rename) to prevent
  corruption.
 - A name removed from `DNSWATCHER_TARGETS` is removed from the state at startup,
  before the first check, without a notification: its domain, hostname and
  certificate entries go, it is taken off each port entry's list of names, and a
  port entry left with no name goes, so the dashboard and `/api/v1/status` no
  longer list or count it. The first check's port checks remove the port entries
  of addresses no configured name has.
 - Each port check also removes the certificate entries for an address their name
  no longer resolves to, except while none of the name's nameservers answer.
 ### Web Dashboard
@@ -291,13 +250,11 @@ dnswatcher includes an unauthenticated, read-only web dashboard at the root URL
 (`/`). It displays:
 - **Summary counts** for monitored domains, hostnames, ports, and certificates.
- **Domains** with their discovered nameservers, or "does not exist" for a
+- **Domains** with their discovered nameservers, and each domain's own records
-  domain whose parent zone's servers answered NXDOMAIN, and each domain's own
+  per nameserver and status, shown as a hostname's are.
  records per nameserver and status, shown as a hostname's are.
 - **Hostnames** with per-nameserver DNS records and status. For a nameserver
  whose query failed, the reason is shown in place of the records.
- **Ports** with open/closed state and the domains and hostnames that resolve to
+- **Ports** with open/closed state and associated hostnames.
  each address, in separate columns.
 - **TLS certificates** with CN, issuer, expiry, and status. For a failed check,
  the reason is shown in place of CN, issuer and expiry.
 - **Recent alerts** (last 100 notifications sent since the process started),
@@ -330,11 +287,7 @@ In `/api/v1/status`, each nameserver entry and certificate entry whose `status`
 is `error` also has `error`, the reason, as in the state file (see State File
 Format). A domain's own records are in its entry in `domains`, under
 `recordsByNameserver`, in the form a hostname's entry in `hostnames` has them
-under `nameservers`; `hostnames` and `counts.hostnames` hold no domain. A domain
+under `nameservers`; `hostnames` and `counts.hostnames` hold no domain.
 entry's `nxdomain` is `true` when the domain's parent zone's servers answered
 NXDOMAIN, that it does not exist; its `nameservers` and `recordsByNameserver`
 are then empty. A port entry lists the domains that resolve to its address in
 `domains`, and the hostnames in `hostnames`.
 `/metrics` is served only when `DNSWATCHER_METRICS_USERNAME` is set, behind
 Basic Auth. It has the Prometheus Go client's default metrics only (Go runtime,
@@ -422,12 +375,11 @@ following precedence (highest to lowest):
 ### Environment Variables
 | Variable                            | Description                                                                                                 | Default               |
-| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| ----------------------------------- | ----------------------------------------------------------------------------------------------------------- | --------------------- |
 | `PORT`                              | HTTP listen port                                                                                            | `8080`                |
 | `DNSWATCHER_DEBUG`                  | Enable debug logging                                                                                        | `false`               |
 | `DNSWATCHER_DATA_DIR`               | Directory for state file                                                                                    | `/var/lib/dnswatcher` |
 | `DNSWATCHER_TARGETS`                | Comma-separated DNS names (auto-classified via PSL)                                                         | `""`                  |
 | `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` | Comma-separated names from `DNSWATCHER_TARGETS` for which no record change or inconsistency is notified; any other name stops startup | `""`                  |
 | `DNSWATCHER_SLACK_WEBHOOK`          | Slack incoming webhook URL                                                                                  | `""`                  |
 | `DNSWATCHER_MATTERMOST_WEBHOOK`     | Mattermost incoming webhook URL                                                                             | `""`                  |
 | `DNSWATCHER_NTFY_TOPIC`             | ntfy topic URL                                                                                              | `""`                  |
@@ -623,11 +575,6 @@ nothing for it. Both lists are left out when empty.
 resolves to. A state file without it loads, and the next check fills it in
 without a notification.
 A domain entry has `"nxdomain": true` when the domain's parent zone's servers
 answered NXDOMAIN, that it does not exist. Its `nameservers` and
 `nameserverAddresses` are then empty, and `hostnames` holds no entry for it.
 `nxdomain` is left out when false.
 `cnameAddresses` lists the sorted addresses at the end of the chain of every
 CNAME target a hostname's nameservers gave, found when they answered with a
 CNAME and no address; it is empty when they answered with an address. When a
@@ -636,9 +583,8 @@ for A, AAAA and CNAME, the previous check's list is kept, or `null` when no
 earlier check saved one. A state file without it loads, and the first check
 after that saves it without a notification.
-A port entry's `hostnames` lists every name that resolves to its address,
+A port entry in the older format, with one `hostname` instead of the `hostnames`
-domains included. A port entry in the older format, with one `hostname` instead
+list, loads as a list of that one name.
 of the `hostnames` list, loads as a list of that one name.
 ---
@@ -656,42 +602,48 @@ provide:
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
  git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
- `script/test` — run the test suite (race detector, coverage) by building the
+- `script/test` — run the test suite (race detector, coverage). Caching is
-  `Dockerfile`'s test phase, which queries live DNS. `-count=1` keeps Go's test
+  waived for testing, exactly as it is for linting: `-count=1` forces every
-  result cache out. Failures are rerun with `-v` automatically, and the build
+  invocation to execute, because the suite queries live DNS and a cached pass
  queries nothing. Failures are rerun with `-v` automatically, and the build
  fails even if that rerun passes.
- `script/lint` — run golangci-lint by building the `Dockerfile`'s lint phase,
+- `script/lint` — run golangci-lint, always inside Docker: it builds
-  on the digest-pinned `golangci-lint` image, so a successful build is a clean
+  `Dockerfile.lint`, which COPYs the repo into the digest-pinned `golangci-lint`
-  lint. The linter is never installed or run on the host, and Docker is the only
+  image and lints as a build step, so a successful build is a clean lint. The
-  prerequisite.
+  linter is never installed or run on the host, and Docker is the only
  prerequisite. Caching is waived for linting: the lint stage is forced to
  execute on every run with `--no-cache-filter`, because a cached build lints
  nothing.
 - `script/fmt` — format all code (gofmt -s, goimports) and all Markdown
  (prettier). goimports runs with `go run` at a pinned commit, never from your
-  `PATH`. prettier runs inside Docker, in a stage of the `Dockerfile` on a
+  `PATH`. prettier runs inside Docker, built from `Dockerfile.fmt` on a
  digest-pinned node image, at the version pinned by `package.json` and
  `yarn.lock`; it is never installed on the host.
 - `script/fmt-check` — check formatting (read-only) with the same tools, failing
-  on any file `script/fmt` would change: gofmt and goimports on the host,
+  on any file `script/fmt` would change. It runs the two scripts below.
-  prettier inside Docker
+- `script/fmt-check-go` — the gofmt and goimports half, on the host. The
  `Dockerfile` lint stage runs it.
 - `script/fmt-check-markdown` — the prettier half, inside Docker, forced to
  execute on every run with `--no-cache-filter`
 - `script/check` — run test, lint, and fmt-check
 - `script/docker` — build the Docker image tagged via `script/projectname`, with
-  the version from `git describe` passed as `--build-arg VERSION`
+  `--no-cache-filter=lint,builder` so the lint stage and the builder stage,
- `script/cibuild` — CI entrypoint: `script/bootstrap`, then `script/check`,
+  which runs the tests, run on every invocation, and with the version from
-  then the image build `script/docker` does, which runs the lint and test phases
+  `git describe` passed as `--build-arg VERSION`
-  again
+- `script/cibuild` — CI entrypoint: `docker build` with
  `--no-cache-filter=lint,builder`, so the lint stage and the builder stage,
  which runs the tests, run on every invocation, because a cached build lints
  nothing and queries no DNS; then `script/fmt-check-markdown`
 - `script/precommit` — run by the git pre-commit hook; `go mod tidy` guard, then
  `script/check`
 - `script/install-precommit` — install the git pre-commit hook
 Linting and testing are phases of the `Dockerfile`, and the image is built only
 when both pass. Every `docker build` in `script/` passes `--no-cache`, because a
 cached build lints nothing and queries no DNS.
 ## Building
 ```sh
 make build      # Build binary to bin/dnswatcher
 make version    # Print the version make build stamps
-make test       # Run tests with race detector in Docker (requires docker)
+make test       # Run tests with race detector
 make lint       # Run golangci-lint in Docker (requires docker)
 make fmt        # Format code and Markdown (requires docker)
 make check      # Run all checks (test, lint, fmt-check)
@@ -706,20 +658,21 @@ the environment, otherwise from `git describe --tags --always --dirty`, and
 `dev` without git metadata. An empty `VERSION` counts as not given. The version
 appears in the startup log and in the health check response.
-The image takes it from `git describe --tags --always` on the `.git` the build
+The image takes it the same way, from the `.git` the build context carries, so a
-context carries, so a plain `docker build .` of a clone stamps the commit it was
+plain `docker build .` of a clone stamps the commit it was built from; a clone
-built from; a clone without tags stamps the short commit. A clone made with
+without tags stamps the short commit. A clone made with `--depth 1` carries at
-`--depth 1` carries at most a tag on its own commit, so such a clone of an
+most a tag on its own commit, so such a clone of an untagged commit stamps the
-untagged commit stamps the short commit. In a build from a directory,
+short commit. In a build from a directory, `.dockerignore` keeps out
-`.dockerignore` keeps out `.git/config` and every submodule's git config, which
+`.git/config`, which `git describe` does not need and which can hold a
-`git describe` does not need and which can hold a credential. Docker does not
+credential. Docker does not apply `.dockerignore` to a context sent as a tar
-apply `.dockerignore` to a context sent as a tar archive, as upaas sends it, so
+archive, as upaas sends it, so that context carries `.git/config` into the
-that context carries `.git/config` into the build. It also keeps its files'
+build. It also keeps its files' owners, so git in the build trusts the checkout
-owners, so git in the build trusts the checkout whoever owns it. A non-empty
+whoever owns it. A non-empty `--build-arg VERSION=...` takes precedence;
-`--build-arg VERSION=...` takes precedence; `make docker` passes the version
+`make docker` passes the version `git describe` gives on the host. The build
-`git describe` gives on the host. The build fails when the context carries
+fails when the context carries `.git`, as a directory or as a file, and the
-`.git`, as a directory or as a file, and the version comes out empty, `dev` or
+version comes out empty, `dev` or `unknown`. `.dockerignore` must list no
-`unknown`.
+tracked file: git in the build would see it as deleted and mark the version
 `-dirty`.
 ---
@@ -775,8 +728,7 @@ docker run -d \
 1. **Startup**: Check that the data directory can be written, and exit with an
   error naming it if not. Load state from disk. If no state file exists, start
   with empty state (first check will establish baseline without triggering
-   change notifications). Remove from the state the names no longer in
+   change notifications).
   `DNSWATCHER_TARGETS` (see State Management).
 2. **Initial check**: Immediately perform all DNS, port, and TLS checks on
   startup.
 3. **Periodic checks** (DNS always runs first):
@@ -792,9 +744,7 @@ docker run -d \
      nameservers answered, the addresses an earlier check found at the end of
      the chain are used.
 4. **On change detection**: Send notifications to all configured endpoints,
-   update in-memory state, persist to disk. A record change or inconsistency for
+   update in-memory state, persist to disk.
   a domain or hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` sends
   no notification, but the state is still updated and saved.
 5. **Shutdown**: The watcher stops checking and saves the final state to disk,
   and shutdown waits for that save before it goes on. Then it waits for
   in-flight notification deliveries to complete. Both waits share the fx
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-04
+last_modified: 2026-08-07
 ---
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,28 +60,17 @@ style conventions are in separate documents:
  prerequisite since nvm requires bash. yarn is then pinned via
  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
+  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  scripts are our own extensions to the standard: `script/check` runs
-  `script/bootstrap` first**, because the workflow checks out the repo and runs
+  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  nothing else, while `script/fmt-check` runs the formatter on the host: on a
+  what the git pre-commit hook runs, and it calls `script/check`;
-  pristine checkout with nothing installed the run dies there, after the
+  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  containerised gates have passed. **The bootstrap alone is not enough**:
+  target shims to it); and `script/projectname` (literally that filename) simply
-  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
+  outputs the project's name. Scripts that need the name call
-  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
+  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
+  so those scripts stay byte-identical across all repos. Repo-type-specific
-  source nvm for the pinned node version before invoking it, exactly as
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  `script/precommit`, not in the hook itself. Model scripts are at
  docker and git then gets through `script/check`. Four further scripts are our
  own extensions to the standard: `script/check` runs `script/test`,
  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
  installs the git pre-commit hook (the `make hooks` target shims to it); and
  `script/projectname` (literally that filename) simply outputs the project's
  name. Scripts that need the name call `script/projectname` — e.g.
  `script/docker` assembles its image tag from it — so those scripts stay
  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
  the hook itself. Model scripts are at
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
  must document the provided scripts in an **Entrypoints** section (see the
  README requirements below).
@@ -100,198 +89,87 @@ style conventions are in separate documents:
  contributor should be able to understand the entire development workflow by
  reading the Makefile.
- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  `lint` phase and a `test` phase, with the final stage depending on both so the
+  as a build step so the build fails if the branch is not green. For non-server
-  image cannot be built unless they pass. For non-server repos the final stage
+  repos, the Dockerfile should bring up a development environment and run
-  brings up a development environment; for server repos it is the runtime image.
+  `make check`. For server repos, `make check` should run as an early build
-  The gate phases and the build stage start from their pinned base images and
+  stage before the final image is assembled. Dockerfiles install development
-  install what those images lack either inline, as the canonical Go `Dockerfile`
+  prerequisites by running `script/bootstrap` rather than duplicating installs
-  below does for `git`, or by running `script/bootstrap`, as the `prompts`
+  inline; COPY `script/` and the dependency manifests (`package.json` +
-  repo's own `Dockerfile` does for its yarn packages. The development
+  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  environment stage installs development prerequisites by running
+  layer stays cached until dependencies change.
  `script/bootstrap` rather than duplicating its installs inline. A stage that
  runs `script/bootstrap` COPYs `script/` and the dependency manifests
  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  no separate lint file. `script/lint` and `script/test` each build one phase
+  repos use a multistage build where linting runs in an independent stage based
-  and nothing else:
+  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
  `make fmt-check` and `make lint` before the full build begins. The build stage
  then declares an explicit dependency on the lint stage via
  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
  linting before proceeding to compilation and tests. This ensures lint failures
  surface in seconds rather than minutes, without blocking on dependency
  download or compilation in the build stage.
-    ```sh
+    The standard pattern for a Go repo Dockerfile is:
    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
    docker build --no-cache --target test -t "$(script/projectname)-test" .
    ```
    **A stage that is not the last one in the file is built only when the final
    stage's chain depends on it, or when `--target` names it.** That is why the
    two gates are always invoked by name here, and why the final stage carries a
    `COPY --from=` of a harmless file from each of them: without that edge a
    plain `docker build .` builds the last stage alone and exits 0 having linted
    and tested nothing.
    **Every `docker build` in `script/` is tagged**, here and in
    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
    image behind on every invocation, on every developer host and every CI
    runner; a tagged one replaces the previous image.
    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
    themselves a `docker build` and would recurse into a daemon that does not
    exist in a build step. Formatting is the exception and stays on the host:
    `script/fmt` writes the working tree, and `script/fmt-check` is its
    read-only twin.
    **No lint verdict may come from a host invocation of the linter.** On a
    shared host golangci-lint reads a result cache keyed on file content rather
    than location, so a second checkout of the same content is served the first
    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
    exit non-zero with `parallel golangci-lint is running` — a status a caller
    cannot tell from real findings. Both have produced wrong verdicts in this
    org, in both directions. A container has its own cache, its own `TMPDIR` and
    a digest-pinned binary, so neither is reachable.
 - **Any build that runs checks is built with `--no-cache`.** Docker invalidates
  a `COPY` layer only when the copied content changes, so on an unchanged tree
  the check `RUN` is served from cache, nothing executes, and the build still
  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
  four, and there is no fifth — `script/check` runs the two gate phases and
  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
  not evidence that anything ran: a sub-second build reporting success is a
  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
  and friends destroy a build cache shared with every other build on the host.
  When a check is added or changed, prove it works by planting a defect it must
  catch and watching the run fail on it, then revert the defect. A green run
  alone shows neither that the check ran nor that it covers what it should.
 - **The gate phases are separate stages, and the build stage depends on both.**
  The lint phase is based on the `golangci/golangci-lint` image (pinned by
  hash), so lint failures surface in seconds rather than after a full compile,
  and the test phase is based on the Debian Go image. The canonical Go repo
  `Dockerfile`:
    ```dockerfile
-    # Lint phase
+    # Lint stage — fast feedback on formatting and lint issues
    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
    FROM golangci/golangci-lint@sha256:... AS lint
    WORKDIR /src
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
-    RUN golangci-lint run --config .golangci.yml ./...
+    RUN make fmt-check
    RUN make lint
-    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
+    # Build stage
    # image ships and the alpine one does not.
    # golang:1.x, YYYY-MM-DD
    FROM golang@sha256:... AS test
    WORKDIR /src
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
    RUN go test -timeout 90s -race -cover ./... || \
        { echo "--- Rerunning with -v for details ---"; \
          go test -timeout 90s -race -v ./...; exit 1; }
    # Build stage. Nothing is wanted from either phase above; the copies
    # are what make BuildKit build them first, so this stage cannot run
    # unless lint and test passed.
    # golang:1.x-alpine, YYYY-MM-DD
    FROM golang@sha256:... AS builder
    COPY --from=lint /src/go.sum /dev/null
    COPY --from=test /src/go.sum /dev/null
    RUN apk add --no-cache git
    # A tar-stream context keeps the sender's file owners, which git refuses.
    RUN git config --system --add safe.directory /src
    WORKDIR /src
    # Force BuildKit to run the lint stage before proceeding
    COPY --from=lint /src/go.sum /dev/null
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
    RUN make test
-    # The VERSION build arg when one is given, otherwise
+    ARG VERSION=dev
-    # `git describe --tags --always` on the .git in the build context. With
+    RUN CGO_ENABLED=0 go build -trimpath \
    # .git present, a version that is still empty, dev or unknown fails the
    # build: git is missing or could not read the checkout.
    ARG VERSION
    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
        if [ -e .git ]; then \
            case "$VERSION" in ""|dev|unknown) \
                echo "version is '$VERSION' although .git is present" >&2; \
                exit 1 ;; \
            esac; \
        fi; \
        CGO_ENABLED=0 go build -trimpath \
        -ldflags="-s -w -X main.Version=${VERSION}" \
        -o /app ./cmd/app/
-    # Runtime stage, and the last one
+    # Runtime stage
    FROM alpine@sha256:...
    COPY --from=builder /app /usr/local/bin/app
    ENTRYPOINT ["app"]
    ```
    Key points:
-    - The lint phase uses the `golangci/golangci-lint` image directly (it has
+    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      both Go and the linter), so nothing needs installing.
+      includes both Go and the linter), so there is no need to install the
-    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
+      linter separately.
-      purpose is the ordering edge. BuildKit runs stages in parallel by default,
+    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      and a stage nothing depends on is not built at all, so without these two
+      a stage dependency. BuildKit runs stages in parallel by default; without
-      lines a red gate would not fail the build.
+      this line, the build stage would not wait for lint to finish and a lint
-    - Keep the runtime stage last, and if you add a stage after it, give it the
+      failure might not fail the overall build.
      same two copies. A plain `docker build .` builds the last stage's chain
      and nothing else.
    - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint phase must
+      (e.g. a web frontend compiled in a separate stage), the lint stage must
      create placeholder files so the embed directives resolve. Example:
      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-    - If the project requires CGO or system libraries for linting, install them
+      The lint stage should not depend on the actual build output — it exists to
-      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
+      fail fast.
-      has no `apk`, so install with `apt-get` under the Debian package name
+    - If the project requires CGO or system libraries for linting (e.g.
-      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
+      `vips-dev`), install them in the lint stage with `apk add`.
-      lists in the same `RUN`, so the layer does not keep them:
+    - The build stage runs `make test` after compilation setup. Tests run in the
-
+      build stage, not the lint stage, because they may require compiled
-        ```dockerfile
+      artifacts or heavier dependencies.
        RUN apt-get update \
            && apt-get install -y --no-install-recommends libvips-dev \
            && rm -rf /var/lib/apt/lists/*
        ```
    - `.dockerignore` lets `.git` into the build context. It keeps out every git
      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
      repository's own, each submodule's under `.git/modules/`, and that of a
      submodule keeping its own `.git` directory. `git describe` does not need
      them, and each can hold a credential: a password in a remote URL, or the
      token the CI checkout step stores there. A submodule whose name has a
      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
      git directory to `**/.git/modules/**/config`, and Go's version stamping
      then fails the build: give it a name without that segment
      (`git submodule add --name`). The stage that compiles has `git` (the
      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
      takes the version from the `VERSION` build argument when one is given,
      otherwise from `git describe --tags --always`. That gives the tag on a
      tagged commit; on a later commit, the tag, the number of commits since it
      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
      tag is reachable. The stage that compiles also marks its working directory
      safe for git (`git config --system --add safe.directory /src`): a context
      sent as a tar stream keeps the sender's file owners, and git refuses a
      checkout owned by another user, so the version would come out empty.
      `ARG VERSION` has no default, and the build fails if the context carries
      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
      `docker build .` with no build arguments must succeed; a Dockerfile that
      refuses an empty build argument drops that refusal and keeps the argument.
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  That script bootstraps, runs the gate phases, and then builds the image, so a
+  Dockerfile already runs `make check`, a successful build implies all checks
-  successful run means every check passed; a bare `docker build .` does not
+  pass.
  carry the same guarantee, because its gate phases may come from the cache. The
  image build is uncached and so runs the gate phases a second time. That is the
  price of the rule above, and it is worth paying: the image that ships is built
  from a run of its own gates rather than from a cache entry. A separate
  workflow limited to `main` by a `branches` list under `on: push` cannot be
  checked by review: to try a change to it, add the feature branch to that list
  and push, then remove the branch from the list again before merging. Keep any
  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
  from the feature branch publishes nothing.
 - Use platform-standard formatters: `black` for Python, `prettier` for
  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -315,17 +193,15 @@ style conventions are in separate documents:
  suite that exceeds it fails. Under 20 seconds is the target. A suite between
  20 and 60 seconds is still green, but the overage must be filed as an
  improvement bug against that repo. Add a 90-second timeout to the test
-  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
+  invocation in the Makefile (`go test -timeout 90s`). The backstop deliberately
-  hard cap so that it catches a genuinely hung test rather than a merely slow
+  sits above the hard cap so that it catches a genuinely hung test rather than a
-  one.
+  merely slow one.
- **The test command should use the conditional verbose rerun pattern.** Run
+- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  tests without `-v` (verbose) first. If tests fail, automatically rerun with
+  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  `-v` to show full output. This keeps CI logs and `docker build` output clean
+  show full output. This keeps CI logs and `docker build` output clean on
-  on success (just package/suite summaries) while providing full diagnostic
+  success (just package/suite summaries) while providing full diagnostic detail
-  detail on failure (every test case, every assertion). The command lives in the
+  on failure (every test case, every assertion). The general shell pattern:
  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
  Makefile form below is the same pattern for any repo-local invocation:
    ```makefile
    test:
@@ -338,26 +214,11 @@ style conventions are in separate documents:
    ```makefile
    test:
-    	@go test -count=1 -timeout 90s -race -cover ./... || \
+    	@go test -timeout 90s -race -cover ./... || \
    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
+    		  go test -timeout 90s -race -v ./...; exit 1; }
    ```
    `-count=1` is required on both invocations: it defeats Go's test _result_
    cache, so neither run can report a stored pass in place of running the
    tests. It leaves the build cache alone, so it costs the runtime of the suite
    and no recompilation.
    That cache is Go's own, separate from Docker's layer cache. Go stores a
    passing result in its cache directory (`GOCACHE`), and when the same tests
    run again on unchanged code it prints that result, marked `(cached)`,
    without running them. That matters on a developer's machine, where this
    target runs and the directory lasts from one run to the next. The `test`
    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
    result for this repo's tests and nothing before its `go test` step runs a
    test, so there is nothing to replay. `--no-cache` (above) is what makes that
    step run on an unchanged tree.
    Python example:
    ```makefile
@@ -383,84 +244,10 @@ style conventions are in separate documents:
  must be in `.gitignore`. No exceptions.
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  Fetch the standard `.gitignore` from
-  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  setting up a new repo. These patterns are written to `.gitignore`'s own
+  a new repo.
  semantics, in which an unanchored pattern already matches at every depth; they
  are not a `.dockerignore` and must not be transplanted into one unmodified.
 - **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
  across unmodified leaves secrets in the build context.** Docker matches with
  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
  therefore excludes only the copies at the repository root, while `config/.env`
  and `certs/server.key` still reach the context and can land in an image layer
  — which is more dangerous than a short file with no secret patterns at all,
  because it reads as solved and stops anyone looking. Give every
  depth-independent pattern the `**/` prefix and leave only genuinely
  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
  binary, written `/myapp` and never `**/myapp`, which would also match
  `cmd/myapp/` and delete the package directory from the context. Matching is
  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
  also catches something the build needs, re-include it with a negation
  (`!docs/example.env`); deleting the pattern reopens the exposure for every
  other file it covers. Fetch the standard `.dockerignore` from
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
  it with the repo's own artifacts.
 - **In-repo agent scratch belongs in both files, written to each file's own
  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
  additional checkout of the repo — so under `COPY . .` the build context
  inflates by a multiple of the repo and another session's unreviewed work can
  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
  prefix, because the prefixed form would also delete any nested directory of
  that name from the build. Anchoring carries a known gap that the canonical
  `.dockerignore` states in its own comment, since consuming repos receive the
  file and not the tracker: the directory is created in the agent's working
  directory, so a repo running agents in subdirectories still ships
  `services/api/.claude/` and must add its own anchored entry there.
 - **A plain `docker build .` of a clone stamps the version that
  `git describe --tags --always` gives**, derived from the `.git` in the build
  context as the canonical `Dockerfile` above shows. Without its failure check,
  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
  and the build would still exit 0. `script/docker` and `script/cibuild` pass
  the version they compute on the host; it takes precedence. They do this
  byte-identically across repos:
    ```sh
    # Own line: a failing command substitution inside an argument does not
    # trip `set -e`, so the inline form degrades to an empty constant.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
    docker build --no-cache \
        --build-arg VERSION="$version" \
        -t "$(script/projectname)" .
    ```
    `--always` makes an untagged repo yield an abbreviated commit hash rather
    than failing, and the `[ -n "$version" ]` line is the single place the
    fallback is applied — a live check that fires on a build from an export with
    no `.git` and on a repository with no commits yet. Do not fold it into the
    substitution as `|| echo unknown`, which makes the guard unreachable. The
    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
    the scripts stay byte-identical. One consequence for CI: the standard
    checkout action clones shallow and fetches no tags, so a repo that embeds a
    tag-derived version must set `fetch-depth: 0` on its checkout step.
 - **Verify `.dockerignore` by enumerating the image, not by reading the
  patterns.** Plant files at the root _and_ at least two directories deep, build
  a probe image that does `COPY . .`, and list what actually landed
  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
  size is not a substitute: a nested secret is a few bytes, and BuildKit
  transfers only the delta from the previous build.
 - **No build artifacts in version control.** Code-derived data (compiled
  bundles, minified output, generated assets) must never be committed to the
@@ -476,56 +263,12 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
  feature branch.
- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  _NEVER_ be modified by an agent: fetch it from
+  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The
-  byte-identical, so that no repo can quietly loosen its own linting. Linter
+  canonical golangci-lint version is v2.12.2 (released 2026-05-06), installed
-  configuration changes are made to the canonical copy in the `prompts` repo and
+  commit-pinned via
-  reach consuming repos by re-vendoring; an agent may open a PR against
+  `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`.
  canonical, which only the user merges. One list is exempt from byte-identity,
  because it cannot be written once for every repo: the `deny` list of the
  `test-support` depguard rule, where a repo names its own test-support packages
  by full import path. A repo adds entries there and changes nothing else, and a
  re-vendor carries its entries forward. The canonical golangci-lint version is
  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
  image
  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
  directive must not name a newer Go minor version than the one golangci-lint
  was built with, or golangci-lint refuses to lint it: this release lints
  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
  installs golangci-lint on the host. A repo sets the lint phase digest to the
  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
  the two prompted the change: the canonical copy can name linters that an older
  golangci-lint rejects, and a newer golangci-lint can add linters that
  `default: all` switches on until the canonical copy disables them.
 - **`script/bootstrap` installs a pinned tool by comparing versions, never by
  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
  `PATH` only, so on an already-provisioned machine the pin is inert and a
  version bump is a silent no-op — while the Dockerfile, installing into a clean
  image, gets the pinned version, so a local `make check` and `make docker` can
  disagree about what the tool even is. The canonical form:
    - compares the installed version against the pin over the **whole** version
      token; a parser that stops at the first `-` reports `2.12.2` for a host
      running `2.12.2-rc1` and skips the install;
    - treats absent, non-zero, empty or unrecognised `--version` output as a
      mismatch, so the failure direction is a redundant install and never a
      skipped one;
    - after installing, re-resolves the binary the way callers do — `hash -r`,
      then through `PATH`, not through the directory the installer wrote to —
      and fails naming the resolved path, since an install that a shadowing
      binary hides succeeds while changing nothing any caller sees;
    - is actually called, and prints the version on both success paths: a
      function defined and never invoked has the same exit status and the same
      empty output as one that worked.
    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
    A Go tool a repo needs on the host is installed with `go install` pinned to
    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
    a `go.mod` tool dependency or through a `tools.go` file, either of which
    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 - When pinning images or packages by hash, add a comment above the reference
  with the version and date (YYYY-MM-DD).
@@ -639,14 +382,12 @@ style conventions are in separate documents:
  settings.
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
+  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
+  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  and language-specific config). Everything else goes in a subdirectory.
+  language-specific config). Everything else goes in a subdirectory. Canonical
-  Canonical subdirectory names:
+  subdirectory names:
    - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+    - `cmd/` — Go command entrypoints
      body is a single call into `internal/` or `pkg/`, no project logic in
      `cmd/`
    - `configs/` — configuration templates and examples
    - `deploy/` — deployment manifests (k8s, compose, terraform)
    - `docs/` — documentation and markdown (README.md stays in root)
@@ -673,7 +414,3 @@ style conventions are in separate documents:
    - Go: `go.mod`, `go.sum`, `.golangci.yml`
    - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
    - Python: `pyproject.toml`
 - Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
  is never committed under a file or directory named after one agent tool, such
  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.
@@ -38,7 +38,7 @@ works correctly in production.
  responses
 - **Do not add `-short` flags** to skip slow tests
 - **Do not increase `-timeout`** to hide hanging queries
- **Do not remove `-count=1` from the test phase of the `Dockerfile`** — Go's
+- **Do not remove `-count=1` from `script/test`** — Go's test cache replays a
-  test cache replays a previous run's output without querying anything, so a
+  previous run's output without querying anything, so a cached pass is not
-  cached pass is not evidence that live resolution works
+  evidence that live resolution works
 - **Do not modify linter configuration** to suppress findings
@@ -19,26 +19,8 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 # Completed Steps
 - 2026-10-06: canonical files re-fetched from `sneak/prompts` at `dd4027b`; lint
  and test are phases of the `Dockerfile`, every scripted build uncached (closes
  #257).
 - 2026-10-05: a name listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no
  Record Change or Inconsistency notification; a name listed there that is not
  in `DNSWATCHER_TARGETS` stops startup (closes #255).
 - 2026-10-02: a nameserver whose query for one record type failed while the
  others answered with no records is `ok`, not `nodata` (closes #253).
 - 2026-10-02: a domain that does not exist is shown so, with no nameservers; no
  name gets a parent's nameservers when its own did not answer (closes #222).
 - 2026-10-02: the refused-query test sends one query to four operators' public
  resolvers in turn until one replies, not eight to one operator (closes #251).
 - 2026-10-02: a name removed from `DNSWATCHER_TARGETS` leaves the state, and so
  the dashboard and API, at startup, before the first check (closes #223).
 - 2026-10-02: a record type whose query to a nameserver fails keeps its previous
  records and alerts nothing; the other types are still saved (closes #231).
 - 2026-10-02: a Port Change notification lists the port's domains on a
  `Domains:` line and its hostnames on a `Hostnames:` line (closes #248).
 - 2026-10-02: the dashboard's Ports table and `/api/v1/status` port entries list
  a port's domains apart from its hostnames (closes #245).
 - 2026-10-02: nameservers a referral names without addresses are looked up,
  three deep at most; `pool.ntp.org`'s nameservers resolve (closes #221).
 - 2026-10-02: an apex domain is not counted or listed as a hostname; its records
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
 	"slices"
 	"strings"
 	"time"
@@ -36,10 +35,6 @@ var ErrInvalidInterval = errors.New(
 	"interval must be a positive duration such as 30m or 1h",
 )
 // ErrNotInTargets is returned when DNSWATCHER_SKIP_RECORD_NOTIFICATIONS
 // lists a name that is not in DNSWATCHER_TARGETS.
 var ErrNotInTargets = errors.New("name is not in DNSWATCHER_TARGETS")
 // Params contains dependencies for Config.
 type Params struct {
 	fx.In
@@ -55,7 +50,6 @@ type Config struct {
 	DataDir              string
 	Domains              []string
 	Hostnames            []string
 	SkipRecordNotifications []string
 	SlackWebhook         string
 	MattermostWebhook    string
 	NtfyTopic            string
@@ -109,7 +103,6 @@ func setupViper(name string) {
 	viper.SetDefault("DEBUG", false)
 	viper.SetDefault("DATA_DIR", "/var/lib/"+name)
 	viper.SetDefault("TARGETS", "")
 	viper.SetDefault("SKIP_RECORD_NOTIFICATIONS", "")
 	viper.SetDefault("SLACK_WEBHOOK", "")
 	viper.SetDefault("MATTERMOST_WEBHOOK", "")
 	viper.SetDefault("NTFY_TOPIC", "")
@@ -154,20 +147,12 @@ func buildConfig(
 		return nil, err
 	}
 	skipRecordNotifications, err := parseSkipRecordNotifications(
 		domains, hostnames,
 	)
 	if err != nil {
 		return nil, err
 	}
 	cfg := &Config{
 		Port:                 viper.GetInt("PORT"),
 		Debug:                viper.GetBool("DEBUG"),
 		DataDir:              viper.GetString("DATA_DIR"),
 		Domains:              domains,
 		Hostnames:            hostnames,
 		SkipRecordNotifications: skipRecordNotifications,
 		SlackWebhook:         viper.GetString("SLACK_WEBHOOK"),
 		MattermostWebhook:    viper.GetString("MATTERMOST_WEBHOOK"),
 		NtfyTopic:            viper.GetString("NTFY_TOPIC"),
@@ -219,36 +204,6 @@ func parseAndValidateTargets() ([]string, []string, error) {
 	return domains, hostnames, nil
 }
 // parseSkipRecordNotifications reads DNSWATCHER_SKIP_RECORD_NOTIFICATIONS,
 // a comma-separated list of names from the targets. Each name is written
 // as ClassifyTargets writes a target, in lower case without a trailing
 // dot, and a name listed more than once is kept once. A name that is
 // not one of domains or hostnames is an error naming it.
 func parseSkipRecordNotifications(
 	domains, hostnames []string,
 ) ([]string, error) {
 	value := viper.GetString("SKIP_RECORD_NOTIFICATIONS")
 	var names []string
 	for _, listed := range parseCSV(value) {
 		name := strings.ToLower(strings.TrimSuffix(listed, "."))
 		if !slices.Contains(domains, name) && !slices.Contains(hostnames, name) {
 			return nil, fmt.Errorf(
 				"invalid DNSWATCHER_SKIP_RECORD_NOTIFICATIONS %q: %w",
 				listed, ErrNotInTargets,
 			)
 		}
 		if !slices.Contains(names, name) {
 			names = append(names, name)
 		}
 	}
 	return names, nil
 }
 func parseCSV(input string) []string {
 	if input == "" {
 		return nil
@@ -57,7 +57,6 @@ func TestNew_DefaultValues(t *testing.T) {
 	assert.Empty(t, cfg.MetricsUsername)
 	assert.Empty(t, cfg.MetricsPassword)
 	assert.False(t, cfg.SendTestNotification)
 	assert.Empty(t, cfg.SkipRecordNotifications)
 }
 func TestNew_EnvironmentOverrides(t *testing.T) {
@@ -236,33 +235,6 @@ func TestNew_TargetsWithTrailingComma(t *testing.T) {
 		"trailing comma should be ignored")
 }
 func TestNew_SkipRecordNotifications(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.net,www.example.net,example.org")
 	t.Setenv("DNSWATCHER_SKIP_RECORD_NOTIFICATIONS",
 		" WWW.Example.net. , example.net,www.example.net")
 	cfg, err := config.New(nil, newTestParams(t))
 	require.NoError(t, err)
 	assert.Equal(t,
 		[]string{"www.example.net", "example.net"},
 		cfg.SkipRecordNotifications,
 		"names are written as targets are, each once",
 	)
 }
 func TestNew_SkipRecordNotificationsNotInTargetsStopsStartup(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.net")
 	t.Setenv("DNSWATCHER_SKIP_RECORD_NOTIFICATIONS",
 		"example.net,www.example.net")
 	_, err := config.New(nil, newTestParams(t))
 	require.ErrorIs(t, err, config.ErrNotInTargets)
 	require.ErrorContains(t, err, "DNSWATCHER_SKIP_RECORD_NOTIFICATIONS")
 	require.ErrorContains(t, err, `"www.example.net"`)
 }
 func TestNew_CustomDNSIntervalDuration(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.com")
@@ -45,14 +45,11 @@ func newDashboardTemplate() *template.Template {
 // dashboardData is the data passed to the dashboard template. Hostnames
 // and DomainRecords split the records in Snapshot.Hostnames, which also
-// holds the apex domains' own (see splitHostnames). Ports holds
+// holds the apex domains' own (see splitHostnames).
 // Snapshot.Ports with each port's names split into domains and
 // hostnames, as /api/v1/status gives them (see buildPorts).
 type dashboardData struct {
 	Snapshot      state.Snapshot
 	Hostnames     map[string]*state.HostnameState
 	DomainRecords map[string]*state.HostnameState
 	Ports         map[string]*statusPortInfo
 	Alerts        []notify.AlertEntry
 	StateAge      string
 	GeneratedAt   string
@@ -74,7 +71,6 @@ func (h *Handlers) HandleDashboard() http.HandlerFunc {
 			Snapshot:      snap,
 			Hostnames:     hostnames,
 			DomainRecords: domainRecords,
 			Ports:         buildPorts(snap),
 			Alerts:        alerts,
 			StateAge:      relTime(snap.LastUpdated),
 			GeneratedAt:   time.Now().UTC().Format("2006-01-02 15:04:05"),
@@ -191,83 +191,17 @@ func TestDashboardShowsDomainRecordsUnderDomains(t *testing.T) {
 	words := strings.Join(strings.Fields(page), " ")
-	footer := "monitoring 2 domains + 1 hostnames"
+	footer := "monitoring 1 domains + 1 hostnames"
 	if !strings.Contains(words, footer) {
 		t.Errorf("dashboard does not say %q", footer)
 	}
-	// With the tags taken out, the summary bar starts "Domains 2
+	// With the tags taken out, the summary bar starts "Domains 1
 	// Hostnames 1".
 	text := regexp.MustCompile(`<[^>]*>`).ReplaceAllString(page, " ")
-	summary := "Domains 2 Hostnames 1"
+	summary := "Domains 1 Hostnames 1"
 	if !strings.Contains(strings.Join(strings.Fields(text), " "), summary) {
 		t.Errorf("summary bar does not say %q", summary)
 	}
 }
 // TestDashboardMarksDomainThatDoesNotExist checks that the Domains
 // section says a domain that does not exist does not exist, and does
 // not say so of a domain that exists.
 func TestDashboardMarksDomainThatDoesNotExist(t *testing.T) {
 	t.Parallel()
 	page := get(t, newHandlersWithFailures(t).HandleDashboard())
 	domains := dashboardSection(t, page, "Domains")
 	if !strings.Contains(dashboardRow(t, domains, missingDomain), "does not exist") {
 		t.Errorf("row of %s does not say it does not exist", missingDomain)
 	}
 	if strings.Contains(dashboardRow(t, domains, testDomain), "does not exist") {
 		t.Errorf("row of %s says it does not exist", testDomain)
 	}
 }
 // rowCells returns the text of each cell of a dashboard table row
 // whose cells start with tag, "<th" or "<td".
 func rowCells(row string, tag string) []string {
 	tags := regexp.MustCompile(`<[^>]*>`)
 	parts := strings.Split(row, tag)[1:]
 	cells := make([]string, 0, len(parts))
 	for _, cell := range parts {
 		text := tags.ReplaceAllString(tag+cell, " ")
 		cells = append(cells, strings.Join(strings.Fields(text), " "))
 	}
 	return cells
 }
 // TestDashboardPortsTellDomainsFromHostnames checks that the Ports
 // table lists an apex domain under Domains and a hostname under
 // Hostnames when both resolve to the port's address.
 func TestDashboardPortsTellDomainsFromHostnames(t *testing.T) {
 	t.Parallel()
 	page := get(t, newHandlersWithFailures(t).HandleDashboard())
 	ports := dashboardSection(t, page, "Ports")
 	headings := rowCells(dashboardRow(t, ports, "Address</th>"), "<th")
 	cells := rowCells(dashboardRow(t, ports, sharedPort), "<td")
 	if len(cells) != len(headings) {
 		t.Fatalf("row of %s has cells %q under headings %q",
 			sharedPort, cells, headings)
 	}
 	under := make(map[string]string)
 	for i, heading := range headings {
 		under[heading] = cells[i]
 	}
 	if under["Domains"] != testDomain {
 		t.Errorf("row of %s lists %q under Domains, want %q",
 			sharedPort, under["Domains"], testDomain)
 	}
 	if under["Hostnames"] != testHostname {
 		t.Errorf("row of %s lists %q under Hostnames, want %q",
 			sharedPort, under["Hostnames"], testHostname)
 	}
 }
@@ -10,12 +10,10 @@ import (
 // statusDomainInfo holds status information for a monitored domain.
 // RecordsByNameserver holds the domain's own records, in the form a
-// hostname's Nameservers holds the hostname's. NXDomain is true when
+// hostname's Nameservers holds the hostname's.
 // the domain's parent zone's servers answered that it does not exist.
 type statusDomainInfo struct {
 	Nameservers         []string                         `json:"nameservers"`
 	RecordsByNameserver map[string]*statusHostnameNSInfo `json:"recordsByNameserver"`
 	NXDomain            bool                             `json:"nxdomain"`
 	LastChecked         time.Time                        `json:"lastChecked"`
 }
@@ -34,11 +32,8 @@ type statusHostnameInfo struct {
 }
 // statusPortInfo holds status information for a monitored port.
 // Domains and Hostnames list the apex domains and the hostnames that
 // resolve to its address.
 type statusPortInfo struct {
 	Open        bool      `json:"open"`
 	Domains     []string  `json:"domains"`
 	Hostnames   []string  `json:"hostnames"`
 	LastChecked time.Time `json:"lastChecked"`
 }
@@ -104,6 +99,7 @@ func buildStatusResponse(
 		LastUpdated:  snap.LastUpdated,
 		Domains:      make(map[string]*statusDomainInfo),
 		Hostnames:    make(map[string]*statusHostnameInfo),
 		Ports:        make(map[string]*statusPortInfo),
 		Certificates: make(map[string]*statusCertificateInfo),
 	}
@@ -111,7 +107,7 @@ func buildStatusResponse(
 	buildDomains(snap, domainRecords, resp)
 	buildHostnames(hostnames, resp)
-	resp.Ports = buildPorts(snap)
+	buildPorts(snap, resp)
 	buildCertificates(snap, resp)
 	buildCounts(resp)
@@ -157,7 +153,6 @@ func buildDomains(
 		resp.Domains[name] = &statusDomainInfo{
 			Nameservers:         ns,
 			RecordsByNameserver: records,
 			NXDomain:            ds.NXDomain,
 			LastChecked:         ds.LastChecked,
 		}
 	}
@@ -200,36 +195,21 @@ func nameserverInfo(
 	return info
 }
-// buildPorts returns the port entries saved in snap. A port entry
+func buildPorts(
-// saves apex domains with its hostnames; they are told apart as in
+	snap state.Snapshot,
-// splitHostnames, by a domain entry in snap.Domains.
+	resp *statusResponse,
-func buildPorts(snap state.Snapshot) map[string]*statusPortInfo {
+) {
 	ports := make(map[string]*statusPortInfo, len(snap.Ports))
 	for key, ps := range snap.Ports {
-		domains := []string{}
+		hostnames := make([]string, len(ps.Hostnames))
-		hostnames := []string{}
+		copy(hostnames, ps.Hostnames)
 		for _, name := range ps.Hostnames {
 			if _, isDomain := snap.Domains[name]; isDomain {
 				domains = append(domains, name)
 			} else {
 				hostnames = append(hostnames, name)
 			}
 		}
 		sort.Strings(domains)
 		sort.Strings(hostnames)
-		ports[key] = &statusPortInfo{
+		resp.Ports[key] = &statusPortInfo{
 			Open:        ps.Open,
 			Domains:     domains,
 			Hostnames:   hostnames,
 			LastChecked: ps.LastChecked,
 		}
 	}
 	return ports
 }
 func buildCertificates(
@@ -21,12 +21,8 @@ import (
 // The state the handler tests serve: www.example.com has one nameserver
 // that answered and one whose query failed, and its certificate check
 // failed. example.net is an apex domain, whose own records are saved
-// with the hostnames' records, as the watcher saves them. Both names
+// with the hostnames' records, as the watcher saves them.
 // resolve to domainAddress, whose port 443 entry lists them.
 // missingDomain is an apex domain whose parent zone's servers answered
 // that it does not exist, saved with no nameservers and no records.
 const (
 	missingDomain    = "does-not-exist.example"
 	testHostname     = "www.example.com"
 	answeringNS      = "ns1.example.com."
 	failedNS         = "ns2.example.com."
@@ -36,7 +32,6 @@ const (
 	testDomain       = "example.net"
 	domainNS         = "a.iana-servers.net."
 	domainAddress    = "192.0.2.2"
 	sharedPort       = domainAddress + ":443"
 )
 // newHandlersWithFailures builds real Handlers whose state holds the
@@ -70,31 +65,12 @@ func newHandlersWithFailures(t *testing.T) *handlers.Handlers {
 		t.Fatalf("state.New: %v", err)
 	}
 	setTestState(st)
 	hnd, err := handlers.New(nil, handlers.Params{
 		Logger:  log,
 		Globals: glob,
 		State:   st,
 		Notify:  notifier,
 	})
 	if err != nil {
 		t.Fatalf("handlers.New: %v", err)
 	}
 	return hnd
 }
 // setTestState sets the entries described above in st.
 func setTestState(st *state.State) {
 	now := time.Now()
 	st.SetHostnameState(testHostname, &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
 			answeringNS: {
-				Records: map[string][]string{
+				Records:     map[string][]string{"A": {"192.0.2.1"}},
 					"A": {"192.0.2.1", domainAddress},
 				},
 				Status:      "ok",
 				LastChecked: now,
 			},
@@ -130,17 +106,17 @@ func setTestState(st *state.State) {
 		LastChecked: now,
 	})
-	st.SetPortState(sharedPort, &state.PortState{
+	hnd, err := handlers.New(nil, handlers.Params{
-		Open:        true,
+		Logger:  log,
-		Hostnames:   []string{testDomain, testHostname},
+		Globals: glob,
-		LastChecked: now,
+		State:   st,
 		Notify:  notifier,
 	})
 	if err != nil {
 		t.Fatalf("handlers.New: %v", err)
 	}
-	st.SetDomainState(missingDomain, &state.DomainState{
+	return hnd
 		Nameservers: []string{},
 		NXDomain:    true,
 		LastChecked: now,
 	})
 }
 // get serves one GET request to handler and returns the response body.
@@ -241,69 +217,3 @@ func TestStatusGivesDomainRecordsUnderTheDomain(t *testing.T) {
 			testDomain, domainNS, records, domainAddress)
 	}
 }
 // TestStatusMarksDomainThatDoesNotExist checks that /api/v1/status sets
 // nxdomain for a domain that does not exist, with no nameservers or
 // records, and not for a domain that exists.
 func TestStatusMarksDomainThatDoesNotExist(t *testing.T) {
 	t.Parallel()
 	body := get(t, newHandlersWithFailures(t).HandleStatus())
 	var resp struct {
 		Domains map[string]struct {
 			Nameservers         []string       `json:"nameservers"`
 			RecordsByNameserver map[string]any `json:"recordsByNameserver"`
 			NXDomain            bool           `json:"nxdomain"`
 		} `json:"domains"`
 	}
 	err := json.Unmarshal([]byte(body), &resp)
 	if err != nil {
 		t.Fatalf("decoding response: %v", err)
 	}
 	missing := resp.Domains[missingDomain]
 	if !missing.NXDomain || len(missing.Nameservers) != 0 ||
 		len(missing.RecordsByNameserver) != 0 {
 		t.Errorf("domain %s = %+v, want nxdomain and nothing else",
 			missingDomain, missing)
 	}
 	if resp.Domains[testDomain].NXDomain {
 		t.Errorf("domain %s has nxdomain set", testDomain)
 	}
 }
 // TestStatusPortsTellDomainsFromHostnames checks that a port entry in
 // /api/v1/status lists an apex domain in domains and a hostname in
 // hostnames when both resolve to its address.
 func TestStatusPortsTellDomainsFromHostnames(t *testing.T) {
 	t.Parallel()
 	body := get(t, newHandlersWithFailures(t).HandleStatus())
 	var resp struct {
 		Ports map[string]struct {
 			Domains   []string `json:"domains"`
 			Hostnames []string `json:"hostnames"`
 		} `json:"ports"`
 	}
 	err := json.Unmarshal([]byte(body), &resp)
 	if err != nil {
 		t.Fatalf("decoding response: %v", err)
 	}
 	port := resp.Ports[sharedPort]
 	if !slices.Equal(port.Domains, []string{testDomain}) {
 		t.Errorf("port %s domains = %v, want [%s]",
 			sharedPort, port.Domains, testDomain)
 	}
 	if !slices.Equal(port.Hostnames, []string{testHostname}) {
 		t.Errorf("port %s hostnames = %v, want [%s]",
 			sharedPort, port.Hostnames, testHostname)
 	}
 }
@@ -84,11 +84,7 @@
                  {{ $name }}
                </td>
                <td class="py-2 px-3 text-slate-400 break-all">
                  {{ if $ds.NXDomain }}
                  <span class="text-red-400">does not exist</span>
                  {{ else }}
                  {{ joinStrings $ds.Nameservers ", " }}
                  {{ end }}
                </td>
                <td class="py-2 px-3 text-slate-500 whitespace-nowrap">
                  {{ relTime $ds.LastChecked }}
@@ -161,20 +157,19 @@
        >
          Ports
        </h2>
-        {{ if .Ports }}
+        {{ if .Snapshot.Ports }}
        <div class="overflow-x-auto">
          <table class="w-full text-left text-xs">
            <thead>
              <tr class="text-slate-500 uppercase tracking-wider">
                <th class="py-2 px-3">Address</th>
                <th class="py-2 px-3">State</th>
                <th class="py-2 px-3">Domains</th>
                <th class="py-2 px-3">Hostnames</th>
                <th class="py-2 px-3">Checked</th>
              </tr>
            </thead>
            <tbody class="divide-y divide-slate-800">
-              {{ range $key, $ps := .Ports }}
+              {{ range $key, $ps := .Snapshot.Ports }}
              <tr class="hover:bg-surface-800/50">
                <td class="py-2 px-3 text-slate-200 font-medium">
                  {{ $key }}
@@ -192,9 +187,6 @@
                  >
                  {{ end }}
                </td>
                <td class="py-2 px-3 text-slate-400 break-all">
                  {{ joinStrings $ps.Domains ", " }}
                </td>
                <td class="py-2 px-3 text-slate-400 break-all">
                  {{ joinStrings $ps.Hostnames ", " }}
                </td>
@@ -10,10 +10,6 @@ var (
 		"no authoritative nameservers found",
 	)
 	// ErrNXDomain is returned when the servers of the zone a domain
 	// is in answer NXDOMAIN: the domain does not exist.
 	ErrNXDomain = errors.New("domain does not exist")
 	// ErrNoNameserverAnswered is returned when every nameserver
 	// asked about a name timed out, failed or returned a referral,
 	// so whether the name has addresses is unknown.
@@ -17,43 +17,6 @@ func NewWithFailingTCP(log *slog.Logger) *Resolver {
 	return r
 }
 // NewWithQueryTimeout returns a Resolver whose queries over UDP give up
 // after timeout, so a test that asks an address where nothing answers
 // does not wait out the usual timeout.
 func NewWithQueryTimeout(log *slog.Logger, timeout time.Duration) *Resolver {
 	r := NewFromLogger(log)
 	r.client = &udpClient{timeout: timeout}
 	return r
 }
 // FollowDelegation exports followDelegation for testing.
 func (r *Resolver) FollowDelegation(
 	ctx context.Context,
 	domain string,
 	servers []string,
 ) ([]string, error) {
 	return r.followDelegation(ctx, domain, servers)
 }
 // FindAuthoritativeNameserversFrom exports findAuthoritativeNameservers
 // for testing.
 func (r *Resolver) FindAuthoritativeNameserversFrom(
 	ctx context.Context,
 	domain string,
 	servers []string,
 ) ([]string, error) {
 	return r.findAuthoritativeNameservers(ctx, domain, servers)
 }
 // ResolveNSIterative exports resolveNSIterative for testing.
 func (r *Resolver) ResolveNSIterative(
 	ctx context.Context,
 	domain string,
 ) ([]string, error) {
 	return r.resolveNSIterative(ctx, domain)
 }
 // ExtractRecordValue exports extractRecordValue for testing.
 func ExtractRecordValue(rr dns.RR) string {
 	return extractRecordValue(rr)
@@ -8,7 +8,6 @@ import (
 	"net"
 	"slices"
 	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -204,12 +203,6 @@ func glueIPs(nsNames []string, glue map[string][]net.IP) []string {
 	return ips
 }
 // followDelegation follows referrals from servers, the root servers, to
 // domain and returns the NS set of domain's delegation. When the servers
 // of the zone domain is in answer that domain does not exist, the error
 // is ErrNXDomain. When they answer that it has no delegation of its own,
 // because it is not the zone's apex, the set is empty and there is no
 // error. Any other error means that no such answer came.
 func (r *Resolver) followDelegation(
 	ctx context.Context,
 	domain string,
@@ -240,15 +233,10 @@ func (r *Resolver) followDelegation(
 		// An authoritative reply comes from the servers of the zone
 		// domain is in; it is not a referral, even when its authority
 		// section lists that zone's NS records. Without NS records in
-		// the answer, domain has no nameservers of its own: it does
+		// the answer, domain is not the zone's apex and has no
-		// not exist, when the reply is NXDOMAIN, or else it is not the
+		// nameservers of its own.
 		// zone's apex.
 		if resp.Authoritative && resp.Rcode == dns.RcodeNameError {
 			return nil, ErrNXDomain
 		}
 		if resp.Authoritative {
-			return []string{}, nil
+			return nil, ErrNoNameservers
 		}
 		authNS := extractNSSet(resp.Ns)
@@ -497,8 +485,7 @@ func (r *Resolver) resolveNSIPs(
 // resolveNSIterative queries for NS records using iterative
 // resolution as a fallback when followDelegation finds no
-// authoritative answer in the delegation chain. Its result means what
+// authoritative answer in the delegation chain.
 // followDelegation's does.
 func (r *Resolver) resolveNSIterative(
 	ctx context.Context,
 	domain string,
@@ -528,16 +515,6 @@ func (r *Resolver) resolveNSIterative(
 			return nsNames, nil
 		}
 		// As in followDelegation: domain has no nameservers of its
 		// own.
 		if resp.Authoritative && resp.Rcode == dns.RcodeNameError {
 			return nil, ErrNXDomain
 		}
 		if resp.Authoritative {
 			return []string{}, nil
 		}
 		// Follow delegation.
 		authNS := extractNSSet(resp.Ns)
 		if len(authNS) == 0 {
@@ -623,23 +600,12 @@ func (r *Resolver) resolveARecord(
 // FindAuthoritativeNameservers traces the delegation chain from
 // root servers to discover all authoritative nameservers for the
 // given domain, as the delegation from its parent zone's servers lists
-// them. When the servers asked answer that the name has no delegation
+// them. For a name that is not a zone apex it tries each
-// of its own, or does not exist, it tries each parent name in turn, so
+// parent name in turn, so it returns the nameservers of the zone the
-// it returns the nameservers of the zone the name is in. When they do
+// name is in.
 // not answer, it returns the error and tries no parent name.
 func (r *Resolver) FindAuthoritativeNameservers(
 	ctx context.Context,
 	domain string,
 ) ([]string, error) {
 	return r.findAuthoritativeNameservers(ctx, domain, rootServerList())
 }
 // findAuthoritativeNameservers is FindAuthoritativeNameservers with each
 // walk starting at servers, the root servers.
 func (r *Resolver) findAuthoritativeNameservers(
 	ctx context.Context,
 	domain string,
 	servers []string,
 ) ([]string, error) {
 	if checkCtx(ctx) != nil {
 		return nil, ErrContextCanceled
@@ -655,16 +621,19 @@ func (r *Resolver) findAuthoritativeNameservers(
 		candidate := strings.Join(labels[i:], ".") + "."
-		nsNames, err := r.followDelegation(ctx, candidate, servers)
+		nsNames, err := r.followDelegation(
-		if err != nil && !errors.Is(err, ErrNXDomain) {
+			ctx, candidate, rootServerList(),
-			return nil, err
+		)
-		}
+		if err == nil && len(nsNames) > 0 {
 		if len(nsNames) > 0 {
 			sort.Strings(nsNames)
 			return nsNames, nil
 		}
 		// The root servers would refuse every parent name too.
 		if errors.Is(err, ErrIntercepted) {
 			return nil, err
 		}
 	}
 	return nil, ErrNoNameservers
@@ -756,8 +725,7 @@ func (r *Resolver) queryTypes(
 type queryState struct {
 	gotNXDomain bool
-	gotErrorReply bool
+	errorReply  string // code of an error reply, such as SERVFAIL
 	errorReply    string // its code, such as SERVFAIL, or number if unnamed
 	gotRefused  bool
 	gotTimeout  bool
 	gotReferral bool
@@ -865,14 +833,7 @@ func readReply(
 	}
 	if isErrorReply(msg) {
-		state.gotErrorReply = true
+		state.errorReply = dns.RcodeToString[msg.Rcode]
 		code, named := dns.RcodeToString[msg.Rcode]
 		if !named {
 			code = strconv.Itoa(msg.Rcode)
 		}
 		state.errorReply = code
 		return fmt.Errorf(
 			"server returned %s: %w", state.errorReply, ErrUnusableReply,
@@ -882,7 +843,9 @@ func readReply(
 	// A reply with no answer that lists other nameservers, from a server
 	// that does not hold the name's zone, is a referral and says nothing
 	// about the name's records. A server named in the delegation that
-	// does not hold the zone may send one.
+	// does not hold the zone may send one, as do a parent zone's servers
 	// when FindAuthoritativeNameservers found no delegation for the
 	// name's zone and moved on to a parent name.
 	if !msg.Authoritative && len(msg.Answer) == 0 &&
 		len(extractNSSet(msg.Ns)) > 0 {
 		state.gotReferral = true
@@ -941,9 +904,7 @@ func isTimeout(err error) bool {
 // classifyResponse sets the nameserver's status. One that answered no
 // record type has failed, and Error says why; one that answered some has
-// the status of those answers. It has no data only when every type
+// the status of those answers.
 // answered with no records: a type in FailedTypes may have records, so a
 // nameserver with one stays ok.
 func classifyResponse(resp *NameserverResponse, state queryState) {
 	switch {
 	case state.gotNXDomain && !state.hasRecords:
@@ -951,7 +912,7 @@ func classifyResponse(resp *NameserverResponse, state queryState) {
 	case state.gotTimeout && !state.answered:
 		resp.Status = StatusTimeout
 		resp.Error = "all queries timed out"
-	case state.gotErrorReply && !state.answered:
+	case state.errorReply != "" && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "server returned " + state.errorReply
 	case state.gotRefused && !state.answered:
@@ -963,8 +924,7 @@ func classifyResponse(resp *NameserverResponse, state queryState) {
 	case state.gotReferral && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "server returned a referral"
-	// An NXDOMAIN reply with no records was taken by the first case.
+	case !state.hasRecords && !state.gotNXDomain:
 	case !state.hasRecords && len(resp.FailedTypes) == 0:
 		resp.Status = StatusNoData
 	}
 }
@@ -1053,22 +1013,12 @@ func (r *Resolver) queryEachNS(
 	return results, nil
 }
-// LookupNS returns the NS record set of a domain, as the delegation from
+// LookupNS returns the NS record set for a domain.
 // its parent zone's servers lists it, and never a parent name's. When
 // they answer that the domain does not exist, the error is ErrNXDomain.
 // When they answer that it has no delegation of its own, the set is
 // empty and there is no error.
 func (r *Resolver) LookupNS(
 	ctx context.Context,
 	domain string,
 ) ([]string, error) {
-	if checkCtx(ctx) != nil {
+	return r.FindAuthoritativeNameservers(ctx, domain)
 		return nil, ErrContextCanceled
 	}
 	return r.followDelegation(
 		ctx, dns.Fqdn(strings.ToLower(domain)), rootServerList(),
 	)
 }
 // LookupAllRecords performs iterative resolution to find all DNS
@@ -1,87 +1,66 @@
 package resolver
 import (
 	"strconv"
 	"syscall"
 	"testing"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // TestClassifyResponse sets a nameserver's status from the results of
-// its queries and the record types whose query failed, built here. One
+// its queries, built here. One that answered some record types, even
-// that answered some record types, even with no records, has not failed
+// with no records, has not failed when its query for another type got
-// when its query for another type got no usable reply, whatever the
+// no usable reply, whatever the reason; one whose every query got none
-// reason, and is ok, not nodata: that type may have records. One whose
+// has.
 // every query got none has failed. Only one whose every type answered
 // with no records is nodata.
 func TestClassifyResponse(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name       string
 		results    queryState
 		failedTypes []string
 		wantStatus string
 		wantError  string
 	}{
 		{
-			"every type answered with no records",
+			"some types answered with no records, another timed out",
-			queryState{answered: true},
+			queryState{answered: true, gotTimeout: true},
 			nil,
 			StatusNoData, "",
 		},
 		{
 			"some types answered with no records, another timed out",
 			queryState{answered: true, gotTimeout: true},
 			[]string{"A"},
 			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another got SERVFAIL",
-			queryState{
+			queryState{answered: true, errorReply: "SERVFAIL"},
-				answered: true, gotErrorReply: true, errorReply: "SERVFAIL",
+			StatusNoData, "",
 			},
 			[]string{"A"},
 			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another was refused",
 			queryState{answered: true, gotRefused: true},
-			[]string{"A"},
+			StatusNoData, "",
 			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another got a network error",
 			queryState{answered: true, netErr: syscall.ECONNREFUSED},
-			[]string{"A"},
+			StatusNoData, "",
 			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another's reply was " +
 				"truncated and its retry over TCP failed",
 			queryState{answered: true, netErr: ErrTruncated},
-			[]string{"TXT"},
+			StatusNoData, "",
 			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another got a referral",
 			queryState{answered: true, gotReferral: true},
-			[]string{"A"},
+			StatusNoData, "",
 			StatusOK, "",
 		},
 		{
 			"every query timed out",
 			queryState{gotTimeout: true},
 			[]string{"A", "AAAA", "CNAME"},
 			StatusTimeout, "all queries timed out",
 		},
 		{
 			"every query got NOTIMP",
-			queryState{gotErrorReply: true, errorReply: "NOTIMP"},
+			queryState{errorReply: "NOTIMP"},
 			[]string{"A", "AAAA", "CNAME"},
 			StatusError, "server returned NOTIMP",
 		},
 	}
@@ -90,39 +69,34 @@ func TestClassifyResponse(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			resp := &NameserverResponse{Status: StatusOK, FailedTypes: tt.failedTypes}
+			resp := &NameserverResponse{Status: StatusOK}
 			classifyResponse(resp, tt.results)
 			assert.Equal(t, tt.wantStatus, resp.Status)
 			assert.Equal(t, tt.wantError, resp.Error)
 			assert.Equal(t, tt.failedTypes, resp.FailedTypes)
 		})
 	}
 }
 // TestReadReply checks which replies to a query about one record type,
 // built here, are an answer: one with the code NOERROR or NXDOMAIN. A
-// reply with any other code is not, and the type's query has failed; a
+// reply with any other code is not, and the type's query has failed.
 // nameserver whose only reply it is has failed, and Error gives the
 // code, or its number when the code has no name.
 func TestReadReply(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		rcode    int
-		wantStatus string
+		answered bool
 		wantError  string
 	}{
-		{dns.RcodeSuccess, StatusNoData, ""},
+		{dns.RcodeSuccess, true},
-		{dns.RcodeNameError, StatusNXDomain, ""},
+		{dns.RcodeNameError, true},
-		{dns.RcodeServerFailure, StatusError, "server returned SERVFAIL"},
+		{dns.RcodeServerFailure, false},
-		{dns.RcodeNotImplemented, StatusError, "server returned NOTIMP"},
+		{dns.RcodeNotImplemented, false},
-		{dns.RcodeFormatError, StatusError, "server returned FORMERR"},
+		{dns.RcodeFormatError, false},
 		{12, StatusError, "server returned 12"}, // unassigned, no name
 	}
 	for _, tt := range tests {
-		t.Run(strconv.Itoa(tt.rcode), func(t *testing.T) {
+		t.Run(dns.RcodeToString[tt.rcode], func(t *testing.T) {
 			t.Parallel()
 			msg := new(dns.Msg)
@@ -130,20 +104,13 @@ func TestReadReply(t *testing.T) {
 			msg.Rcode = tt.rcode
 			resp := &NameserverResponse{Records: map[string][]string{}}
 			err := readReply(msg, resp, &queryState{})
-			var state queryState
+			if tt.answered {
-
+				assert.NoError(t, err)
 			err := readReply(msg, resp, &state)
 			classifyResponse(resp, state)
 			if tt.wantStatus == StatusError {
 				require.ErrorIs(t, err, ErrUnusableReply)
 			} else {
-				require.NoError(t, err)
+				assert.ErrorIs(t, err, ErrUnusableReply)
 			}
 			assert.Equal(t, tt.wantStatus, resp.Status)
 			assert.Equal(t, tt.wantError, resp.Error)
 		})
 	}
 }
@@ -187,8 +187,8 @@ func liveFindAuthoritative(
 	return out
 }
-// liveLookupNS looks up the NS record set of domain, a domain that has
+// liveLookupNS is liveFindAuthoritative through the LookupNS entry
-// one, retrying until the delegation chain can be walked.
+// point, so that both entry points stay independently exercised.
 func liveLookupNS(
 	t *testing.T,
 	r *resolver.Resolver,
@@ -25,13 +25,6 @@ import (
 // Test helpers
 // ----------------------------------------------------------------
 // nonexistentDomain is a .com domain that does not exist.
 const nonexistentDomain = "dnswatcher-test-does-not-exist.com"
 // noAnswerAddress is 192.0.2.1, a documentation address: nothing
 // answers there.
 const noAnswerAddress = "192.0.2.1"
 func newTestResolver(t *testing.T) *resolver.Resolver {
 	t.Helper()
@@ -95,47 +88,6 @@ func TestFindAuthoritativeNameservers_Subdomain(
 	assert.Equal(t, fromZone, fromHost)
 }
 // TestFindAuthoritativeNameservers_DelegatedSubdomain looks up the
 // nameservers of www.cs.cmu.edu, a name in cs.cmu.edu, a zone that
 // cmu.edu delegates to other servers. The servers of cs.cmu.edu answer
 // that the name has no delegation of its own, so it gets their names,
 // not those of the cmu.edu servers. Every referral on the way gives the
 // nameservers' addresses, so the walk sends few queries.
 func TestFindAuthoritativeNameservers_DelegatedSubdomain(
 	t *testing.T,
 ) {
 	t.Parallel()
 	r := newTestResolver(t)
 	fromHost := liveFindAuthoritative(t, r, "www.cs.cmu.edu")
 	fromZone := liveLookupNS(t, r, "cs.cmu.edu")
 	fromParent := liveLookupNS(t, r, "cmu.edu")
 	assert.Equal(t, fromZone, fromHost)
 	assert.NotEqual(t, fromParent, fromHost)
 }
 // TestFindAuthoritativeNameservers_NoAnswer starts each walk for
 // www.google.com at 192.0.2.1, a documentation address where nothing
 // answers. A walk that got no answer does not say that the name has no
 // delegation of its own, so the lookup returns that walk's error, about
 // www.google.com, and tries no parent name: trying google.com and com
 // would end in ErrNoNameservers, or in the error of a walk for one of
 // them.
 func TestFindAuthoritativeNameservers_NoAnswer(t *testing.T) {
 	t.Parallel()
 	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
 	nameservers, err := r.FindAuthoritativeNameserversFrom(
 		t.Context(), "www.google.com", []string{noAnswerAddress},
 	)
 	require.Error(t, err)
 	require.NotErrorIs(t, err, resolver.ErrNoNameservers)
 	assert.Contains(t, err.Error(), "query www.google.com. @"+noAnswerAddress)
 	assert.Empty(t, nameservers)
 }
 func TestFindAuthoritativeNameservers_ReturnsSorted(
 	t *testing.T,
 ) {
@@ -490,45 +442,48 @@ func TestQueryNameserver_Refused(t *testing.T) {
 	assert.Equal(t, "server returned REFUSED", resp.Error)
 }
-// TestQueryServers_RecursiveResolverRefused passes a public recursive
+// TestQueryNameserverIP_RecursiveResolverRefused asks Quad9, a public
-// resolver to QueryServers as the server of google.com. These resolvers
+// recursive resolver, about google.com at both of its addresses. Quad9
-// refuse a query that does not ask for recursion and answer one that
+// refuses a query that does not ask for recursion and answers one that
-// does. The resolver never asks for recursion, so the query must be
+// does. The resolver never asks for recursion, so it must be reported
-// reported as refused, never answered. Each resolver is run by a
+// as refusing, never as answering.
-// different operator, and they are asked in turn until one replies, so
+func TestQueryNameserverIP_RecursiveResolverRefused(t *testing.T) {
 // one operator not answering does not fail the test.
 func TestQueryServers_RecursiveResolverRefused(t *testing.T) {
 	t.Parallel()
 	r := newTestResolver(t)
 	resolvers := []string{
 		"64.6.64.6", "185.222.222.222", "4.2.2.1", "9.9.9.9",
 	}
-	var err error
+	for _, ip := range []string{"9.9.9.9", "149.112.112.112"} {
 		var resp *resolver.NameserverResponse
 		livednstest.Retry(
 			t,
-		"QueryServers(public recursive resolvers, google.com)",
+			"QueryNameserverIP("+ip+", google.com)",
 			func(ctx context.Context) error {
-			for _, ip := range resolvers {
+				var err error
-				_, err = r.QueryServers(
+
-					ctx, []string{ip}, "google.com.", "google.com.",
+				resp, err = r.QueryNameserverIP(
-					dns.TypeA,
+					ctx, ip, ip, "google.com",
 				)
 				if err != nil {
 					return err
 				}
 				// A timeout or a network error is no reply at all.
 				if resp.Status == resolver.StatusTimeout ||
 					strings.HasPrefix(resp.Error, "network error") {
 					return fmt.Errorf(
 						"%w: %s: %s",
 						livednstest.ErrNoAnswer, ip, resp.Error,
 					)
 				}
 				// A refusal or an answer is a reply; anything else may
 				// be no reply at all, so the next resolver is asked.
 				if err == nil || errors.Is(err, resolver.ErrRefused) {
 				return nil
 				}
 			}
 			return fmt.Errorf("%w: %w", livednstest.ErrNoAnswer, err)
 			},
 		)
-	require.ErrorIs(t, err, resolver.ErrRefused)
+		assert.Equal(t, resolver.StatusError, resp.Status, ip)
 		assert.Equal(t, "server returned REFUSED", resp.Error, ip)
 	}
 }
 // googleNameserverIPv4s returns the IPv4 addresses of google.com's
@@ -876,7 +831,8 @@ func TestLookupNS_MatchesFindAuthoritative(t *testing.T) {
 // nameservers of g.ntpns.org. The org servers delegate its parent zone,
 // ntpns.org, without the addresses of its nameservers, so the walk has
 // to look them up to ask them. If it did not, the walk for g.ntpns.org
-// would fail.
+// would fail and LookupNS would return the nameservers of ntpns.org,
 // which a.ntpns.org is not one of.
 func TestLookupNS_ParentZoneDelegatedWithoutAddresses(t *testing.T) {
 	t.Parallel()
@@ -886,131 +842,6 @@ func TestLookupNS_ParentZoneDelegatedWithoutAddresses(t *testing.T) {
 	assert.Contains(t, nameservers, "a.ntpns.org.")
 }
 // TestLookupNS_DomainThatDoesNotExist looks up the nameservers of a .com
 // domain that does not exist. The .com servers answer NXDOMAIN, so the
 // error is ErrNXDomain, and the domain does not get their names.
 func TestLookupNS_DomainThatDoesNotExist(t *testing.T) {
 	t.Parallel()
 	r := newTestResolver(t)
 	var (
 		nameservers []string
 		err         error
 	)
 	livednstest.Retry(
 		t,
 		"LookupNS("+nonexistentDomain+")",
 		func(ctx context.Context) error {
 			nameservers, err = r.LookupNS(ctx, nonexistentDomain)
 			if errors.Is(err, resolver.ErrNXDomain) {
 				return nil
 			}
 			return err
 		},
 	)
 	require.ErrorIs(t, err, resolver.ErrNXDomain)
 	assert.Empty(t, nameservers)
 }
 // TestLookupNS_NoDelegationOfItsOwn looks up the nameservers of
 // www.google.com, a name in the google.com zone with no delegation of
 // its own, as a domain such as octocat.github.io is. The google.com
 // servers answer with no NS records for it: the set is empty, and it is
 // not ErrNXDomain.
 func TestLookupNS_NoDelegationOfItsOwn(t *testing.T) {
 	t.Parallel()
 	r := newTestResolver(t)
 	var nameservers []string
 	livednstest.Retry(
 		t,
 		"LookupNS(www.google.com)",
 		func(ctx context.Context) error {
 			var err error
 			nameservers, err = r.LookupNS(ctx, "www.google.com")
 			return err
 		},
 	)
 	assert.Empty(t, nameservers)
 }
 // TestFollowDelegation_NoAnswer starts the walk LookupNS uses, for
 // google.com, at 192.0.2.1, a documentation address where nothing
 // answers. A walk that got no answer is an error, not an empty set,
 // which the watcher would report as an NS Change with every nameserver
 // removed.
 func TestFollowDelegation_NoAnswer(t *testing.T) {
 	t.Parallel()
 	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
 	nameservers, err := r.FollowDelegation(
 		t.Context(), "google.com.", []string{noAnswerAddress},
 	)
 	require.Error(t, err)
 	assert.Empty(t, nameservers)
 }
 // TestResolveNSIterative_NoDelegationOfItsOwn walks to the nameservers
 // of www.google.com as the fallback walk does. As in
 // TestLookupNS_NoDelegationOfItsOwn, the set is empty, with no error.
 func TestResolveNSIterative_NoDelegationOfItsOwn(t *testing.T) {
 	t.Parallel()
 	r := newTestResolver(t)
 	var nameservers []string
 	livednstest.Retry(
 		t,
 		"ResolveNSIterative(www.google.com)",
 		func(ctx context.Context) error {
 			var err error
 			nameservers, err = r.ResolveNSIterative(ctx, "www.google.com")
 			return err
 		},
 	)
 	assert.Empty(t, nameservers)
 }
 // TestResolveNSIterative_DomainThatDoesNotExist walks to the nameservers
 // of a .com domain that does not exist as the fallback walk does. As in
 // TestLookupNS_DomainThatDoesNotExist, the error is ErrNXDomain.
 func TestResolveNSIterative_DomainThatDoesNotExist(t *testing.T) {
 	t.Parallel()
 	r := newTestResolver(t)
 	var err error
 	livednstest.Retry(
 		t,
 		"ResolveNSIterative("+nonexistentDomain+")",
 		func(ctx context.Context) error {
 			_, err = r.ResolveNSIterative(ctx, nonexistentDomain)
 			if errors.Is(err, resolver.ErrNXDomain) {
 				return nil
 			}
 			return err
 		},
 	)
 	require.ErrorIs(t, err, resolver.ErrNXDomain)
 }
 // ----------------------------------------------------------------
 // ResolveIPAddresses tests
 // ----------------------------------------------------------------
@@ -38,13 +38,10 @@ type Params struct {
 // DomainState holds the monitoring state for an apex domain.
 // NameserverAddresses holds the sorted addresses each nameserver's name
 // resolves to, by nameserver name. A state file written before it
-// existed loads with it nil. NXDomain is true when the domain's parent
+// existed loads with it nil.
 // zone's servers answered that it does not exist; it then has no
 // nameservers.
 type DomainState struct {
 	Nameservers         []string            `json:"nameservers"`
 	NameserverAddresses map[string][]string `json:"nameserverAddresses"`
 	NXDomain            bool                `json:"nxdomain,omitempty"`
 	LastChecked         time.Time           `json:"lastChecked"`
 }
@@ -301,27 +298,6 @@ func (s *State) GetDomainState(
 	return ds, ok
 }
 // DeleteDomainState removes a domain state entry.
 func (s *State) DeleteDomainState(domain string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	delete(s.snapshot.Domains, domain)
 }
 // GetAllDomainNames returns the names of all domain state entries.
 func (s *State) GetAllDomainNames() []string {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	names := make([]string, 0, len(s.snapshot.Domains))
 	for name := range s.snapshot.Domains {
 		names = append(names, name)
 	}
 	return names
 }
 // SetHostnameState updates the state for a hostname.
 func (s *State) SetHostnameState(
 	hostname string,
@@ -345,28 +321,6 @@ func (s *State) GetHostnameState(
 	return hs, ok
 }
 // DeleteHostnameState removes a hostname state entry.
 func (s *State) DeleteHostnameState(hostname string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	delete(s.snapshot.Hostnames, hostname)
 }
 // GetAllHostnames returns the names of all hostname state entries,
 // which include each apex domain's own records.
 func (s *State) GetAllHostnames() []string {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	names := make([]string, 0, len(s.snapshot.Hostnames))
 	for name := range s.snapshot.Hostnames {
 		names = append(names, name)
 	}
 	return names
 }
 // SetPortState updates the state for a port.
 func (s *State) SetPortState(key string, ps *PortState) {
 	s.mu.Lock()
@@ -429,27 +383,6 @@ func (s *State) GetCertificateState(
 	return cs, ok
 }
 // DeleteCertificateState removes a certificate state entry.
 func (s *State) DeleteCertificateState(key string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	delete(s.snapshot.Certificates, key)
 }
 // GetAllCertificateKeys returns all certificate state keys.
 func (s *State) GetAllCertificateKeys() []string {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	keys := make([]string, 0, len(s.snapshot.Certificates))
 	for k := range s.snapshot.Certificates {
 		keys = append(keys, k)
 	}
 	return keys
 }
 // checkDataDirWritable creates the data directory if needed, then writes
 // and removes the temp file that Save uses. It runs at startup so that an
 // unwritable directory stops the process, instead of the process running
@@ -107,11 +107,6 @@ func (w *Watcher) MaybeSendTestNotification(ctx context.Context) {
 	w.maybeSendTestNotification(ctx)
 }
 // CleanupRemovedTargets exports cleanupRemovedTargets for testing.
 func (w *Watcher) CleanupRemovedTargets() {
 	w.cleanupRemovedTargets()
 }
 // CheckAllPorts exports checkAllPorts for testing.
 func (w *Watcher) CheckAllPorts(ctx context.Context) {
 	w.checkAllPorts(ctx)
@@ -11,9 +11,7 @@ import (
 // DNSResolver performs iterative DNS resolution.
 type DNSResolver interface {
-	// LookupNS returns a domain's NS record set, as its parent zone's
+	// LookupNS discovers authoritative nameservers for a domain.
 	// servers delegate it: empty when they answer that it has none, and
 	// resolver.ErrNXDomain when they answer that it does not exist.
 	LookupNS(
 		ctx context.Context,
 		domain string,
@@ -165,51 +165,3 @@ func TestStartupNotificationCountsConfiguredNames(t *testing.T) {
 		t.Errorf("sent %v, want one message with %q", notifications, counts)
 	}
 }
 // A Port Change notification lists the configured apex domain and the
 // hostname that resolve to the port's address on separate lines. The
 // port checks read the saved hostname state and look nothing up, so the
 // watcher has no resolver.
 func TestPortChangeListsDomainsApartFromHostnames(t *testing.T) {
 	t.Parallel()
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{domain}
 	cfg.Hostnames = []string{host}
 	deps := newTestDeps(t, cfg)
 	w := watcher.NewForTest(
 		cfg, deps.state, nil,
 		deps.portChecker, deps.tlsChecker, deps.notifier,
 	)
 	w.SetFirstRun(false)
 	// Both names resolve to ip1, whose port 443 the previous check
 	// found open. It is closed now.
 	for _, name := range []string{domain, host} {
 		deps.state.SetHostnameState(name, saved(
 			map[string]*state.NameserverRecordState{
 				nsA: answered(map[string][]string{"A": {ip1}}),
 			},
 		))
 	}
 	key := ip1 + ":443"
 	deps.state.SetPortState(key, &state.PortState{
 		Open: true, Hostnames: []string{domain, host},
 	})
 	deps.portChecker.closed = true
 	w.CheckAllPorts(t.Context())
 	title := "Port Change: " + key
 	want := `Domains: example.net
 Hostnames: www.example.net
 Address: 192.0.2.1:443
 Port now closed`
 	got := deps.notifier.getNotifications()
 	if len(got) != 1 || got[0].Title != title || got[0].Message != want {
 		t.Errorf("sent %v, want one %q with message:\n%s", got, title, want)
 	}
 }
@@ -1,224 +0,0 @@
 package watcher_test
 import (
 	"maps"
 	"slices"
 	"testing"
 	"sneak.berlin/go/dnswatcher/internal/state"
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
 // TestRemovedTargetsLeaveTheState loads a state saved while a domain
 // and a hostname now removed from the configuration were still in it,
 // and runs the removal that Run does before the first check. The
 // removed names' domain, hostname and certificate entries are gone,
 // the configured names' are kept, and nothing is notified. Nothing is
 // looked up: the watcher has no resolver.
 func TestRemovedTargetsLeaveTheState(t *testing.T) {
 	t.Parallel()
 	const (
 		removedDomain = "example.com"
 		removedHost   = "www.example.com"
 	)
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{domain}
 	cfg.Hostnames = []string{host}
 	deps := newTestDeps(t, cfg)
 	w := watcher.NewForTest(
 		cfg, deps.state, nil,
 		deps.portChecker, deps.tlsChecker, deps.notifier,
 	)
 	// The state a check of all four names saves, each name at ip1.
 	for _, name := range []string{domain, removedDomain} {
 		deps.state.SetDomainState(name, &state.DomainState{
 			Nameservers: []string{nsA},
 		})
 	}
 	for _, name := range []string{domain, host, removedDomain, removedHost} {
 		deps.state.SetHostnameState(name, saved(
 			map[string]*state.NameserverRecordState{
 				nsA: answered(map[string][]string{"A": {ip1}}),
 			},
 		))
 		deps.state.SetCertificateState(
 			ip1+":443:"+name, &state.CertificateState{Status: "ok"},
 		)
 	}
 	err := deps.state.Save()
 	if err != nil {
 		t.Fatalf("saving the state: %v", err)
 	}
 	err = deps.state.Load()
 	if err != nil {
 		t.Fatalf("loading the state: %v", err)
 	}
 	w.CleanupRemovedTargets()
 	snap := deps.state.GetSnapshot()
 	got := slices.Sorted(maps.Keys(snap.Domains))
 	if want := []string{domain}; !slices.Equal(got, want) {
 		t.Errorf("domain entries %v, want %v", got, want)
 	}
 	got = slices.Sorted(maps.Keys(snap.Hostnames))
 	if want := []string{domain, host}; !slices.Equal(got, want) {
 		t.Errorf("hostname entries %v, want %v", got, want)
 	}
 	got = slices.Sorted(maps.Keys(snap.Certificates))
 	if want := []string{
 		ip1 + ":443:" + domain, ip1 + ":443:" + host,
 	}; !slices.Equal(got, want) {
 		t.Errorf("certificate entries %v, want %v", got, want)
 	}
 	if sent := deps.notifier.getNotifications(); len(sent) != 0 {
 		t.Errorf("sent %v, want nothing", sent)
 	}
 }
 // TestRemovedTargetsLeaveThePortEntries loads a state whose port
 // entries name a domain and a hostname now removed from the
 // configuration, and runs the removal that Run does before the first
 // check. The removed names are off each port entry's list of names, the
 // entry only they had is gone, the entry that also names configured
 // names is kept for the port checks, and nothing is notified.
 func TestRemovedTargetsLeaveThePortEntries(t *testing.T) {
 	t.Parallel()
 	const (
 		removedDomain = "example.com"
 		removedHost   = "www.example.com"
 	)
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{domain}
 	cfg.Hostnames = []string{host}
 	deps := newTestDeps(t, cfg)
 	w := watcher.NewForTest(
 		cfg, deps.state, nil,
 		deps.portChecker, deps.tlsChecker, deps.notifier,
 	)
 	// The port 443 entries a check of all four names saves: each name
 	// at ip1, except the removed hostname, at ip2.
 	deps.state.SetPortState(ip1+":443", &state.PortState{
 		Open: true, Hostnames: []string{removedDomain, domain, host},
 	})
 	deps.state.SetPortState(ip2+":443", &state.PortState{
 		Open: true, Hostnames: []string{removedHost},
 	})
 	err := deps.state.Save()
 	if err != nil {
 		t.Fatalf("saving the state: %v", err)
 	}
 	err = deps.state.Load()
 	if err != nil {
 		t.Fatalf("loading the state: %v", err)
 	}
 	w.CleanupRemovedTargets()
 	if sent := deps.notifier.getNotifications(); len(sent) != 0 {
 		t.Errorf("sent %v, want nothing", sent)
 	}
 	snap := deps.state.GetSnapshot()
 	got := slices.Sorted(maps.Keys(snap.Ports))
 	if want := []string{ip1 + ":443"}; !slices.Equal(got, want) {
 		t.Fatalf("port entries %v, want %v", got, want)
 	}
 	got = snap.Ports[ip1+":443"].Hostnames
 	if want := []string{domain, host}; !slices.Equal(got, want) {
 		t.Errorf("names of port entry %s:443 %v, want %v", ip1, got, want)
 	}
 }
 // TestCertificateStateForAnAddressGone runs the port checks on hostname
 // state built here for a configured hostname, with certificate entries
 // saved for it at ip1, ip2 and an IPv6 address. When its nameservers
 // answered with ip1 and the IPv6 address, the entry for ip2 is removed.
 // When none of them answered, its addresses are not known, and every
 // entry is kept. Nothing is notified, and nothing is looked up.
 func TestCertificateStateForAnAddressGone(t *testing.T) {
 	t.Parallel()
 	const ip6 = "2001:db8::1"
 	tests := []struct {
 		name     string
 		hostname *state.HostnameState
 		want     []string
 	}{
 		{
 			"answered without ip2",
 			saved(map[string]*state.NameserverRecordState{
 				nsA: answered(map[string][]string{
 					"A": {ip1}, "AAAA": {ip6},
 				}),
 			}),
 			[]string{ip1 + ":443:" + host, ip6 + ":443:" + host},
 		},
 		{
 			"no nameserver answered",
 			saved(map[string]*state.NameserverRecordState{
 				nsA: failed(), nsB: failed(),
 			}),
 			[]string{
 				ip1 + ":443:" + host,
 				ip2 + ":443:" + host,
 				ip6 + ":443:" + host,
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			cfg := defaultTestConfig(t)
 			cfg.Hostnames = []string{host}
 			deps := newTestDeps(t, cfg)
 			w := watcher.NewForTest(
 				cfg, deps.state, nil,
 				deps.portChecker, deps.tlsChecker, deps.notifier,
 			)
 			w.SetFirstRun(false)
 			deps.state.SetHostnameState(host, tt.hostname)
 			for _, ip := range []string{ip1, ip2, ip6} {
 				deps.state.SetCertificateState(
 					ip+":443:"+host, &state.CertificateState{Status: "ok"},
 				)
 			}
 			w.CheckAllPorts(t.Context())
 			got := slices.Sorted(maps.Keys(deps.state.GetSnapshot().Certificates))
 			if !slices.Equal(got, tt.want) {
 				t.Errorf("certificate entries %v, want %v", got, tt.want)
 			}
 			if sent := deps.notifier.getNotifications(); len(sent) != 0 {
 				t.Errorf("sent %v, want nothing", sent)
 			}
 		})
 	}
 }
@@ -1,107 +0,0 @@
 package watcher_test
 import (
 	"slices"
 	"testing"
 	"sneak.berlin/go/dnswatcher/internal/config"
 	"sneak.berlin/go/dnswatcher/internal/state"
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
 // TestSkipRecordNotificationsAlerts runs the hostname change detection
 // for two names on the same check: nsA's address changes, so that nsA
 // now differs from nsB, and nsC stops answering. The name in
 // SkipRecordNotifications gets only the NS Failure; the other name also
 // gets the Record Change and the Inconsistency.
 func TestSkipRecordNotificationsAlerts(t *testing.T) {
 	t.Parallel()
 	const skipped = "skipped.example.net"
 	prev := saved(map[string]*state.NameserverRecordState{
 		nsA: answered(map[string][]string{"A": {ip1}}),
 		nsB: answered(map[string][]string{"A": {ip1}}),
 		nsC: answered(map[string][]string{"A": {ip1}}),
 	})
 	current := saved(map[string]*state.NameserverRecordState{
 		nsA: answered(map[string][]string{"A": {ip2}}),
 		nsB: answered(map[string][]string{"A": {ip1}}),
 		nsC: failed(),
 	})
 	cfg := &config.Config{
 		Hostnames:               []string{host, skipped},
 		SkipRecordNotifications: []string{skipped},
 	}
 	// The hostname change detection uses only the configuration and the
 	// notifier.
 	notifier := &mockNotifier{}
 	w := watcher.NewForTest(cfg, nil, nil, nil, nil, notifier)
 	w.DetectHostnameChanges(t.Context(), host, prev, current)
 	w.DetectHostnameChanges(t.Context(), skipped, prev, current)
 	sent := notifier.getNotifications()
 	titles := make([]string, 0, len(sent))
 	for _, n := range sent {
 		titles = append(titles, n.Title)
 	}
 	slices.Sort(titles)
 	want := []string{
 		"Inconsistency: " + host,
 		"NS Failure: " + skipped,
 		"NS Failure: " + host,
 		"Record Change: " + host,
 	}
 	if !slices.Equal(titles, want) {
 		t.Errorf("sent %v, want %v", titles, want)
 	}
 }
 // TestSkipRecordNotificationsCheck checks testHost, which is in
 // SkipRecordNotifications, from a saved state in which every nameserver
 // live DNS lists answered with an address live DNS never returns. No
 // Record Change and no Inconsistency is sent, and the check still saves
 // what the nameservers answer.
 func TestSkipRecordNotificationsCheck(t *testing.T) {
 	t.Parallel()
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 	cfg.SkipRecordNotifications = []string{testHost}
 	nameservers := lookupNameservers(t, testHost)
 	_, deps := runChecks(t, cfg, func(deps *testDeps) {
 		byNameserver := make(map[string]*state.NameserverRecordState)
 		for _, ns := range nameservers {
 			byNameserver[ns] = answered(map[string][]string{"A": {oldIP}})
 		}
 		deps.state.SetHostnameState(testHost, saved(byNameserver))
 	})
 	for _, title := range []string{
 		"Record Change: " + testHost,
 		"Inconsistency: " + testHost,
 	} {
 		if n := countNotifications(deps, title); n != 0 {
 			t.Errorf("sent %d %q, want 0", n, title)
 		}
 	}
 	// A nameserver whose query for A failed keeps oldIP, so the check
 	// is that some address live DNS gave was saved.
 	hs, _ := deps.state.GetHostnameState(testHost)
 	fromLiveDNS := func(ip string) bool { return ip != oldIP }
 	if !slices.ContainsFunc(addresses(hs), fromLiveDNS) {
 		t.Errorf("saved addresses %v, want those live DNS gave", addresses(hs))
 	}
 }
@@ -131,7 +131,6 @@ func (w *Watcher) Run(ctx context.Context) {
 		"tlsInterval", w.config.TLSInterval.String(),
 	)
 	w.cleanupRemovedTargets()
 	w.RunOnce(ctx)
 	w.maybeSendTestNotification(ctx)
@@ -202,59 +201,6 @@ func (w *Watcher) detectFirstRun() {
 	}
 }
 // cleanupRemovedTargets removes from the loaded state the domain,
 // hostname and certificate entries of names no longer in the
 // configuration, which changes only at a restart, and takes those names
 // off each port entry's list of names, removing a port entry left with
 // none. Nothing is notified. A configured domain's own records are
 // saved as a hostname entry under its name, which is kept.
 func (w *Watcher) cleanupRemovedTargets() {
 	for _, name := range w.state.GetAllDomainNames() {
 		if !w.isDomain(name) {
 			w.state.DeleteDomainState(name)
 		}
 	}
 	for _, name := range w.state.GetAllHostnames() {
 		if !w.isConfigured(name) {
 			w.state.DeleteHostnameState(name)
 		}
 	}
 	for _, key := range w.state.GetAllCertificateKeys() {
 		if _, hostname := parseCertKey(key); !w.isConfigured(hostname) {
 			w.state.DeleteCertificateState(key)
 		}
 	}
 	for _, key := range w.state.GetAllPortKeys() {
 		ps, ok := w.state.GetPortState(key)
 		if !ok {
 			continue
 		}
 		var names []string
 		for _, name := range ps.Hostnames {
 			if w.isConfigured(name) {
 				names = append(names, name)
 			}
 		}
 		if len(names) == 0 {
 			w.state.DeletePortState(key)
 			continue
 		}
 		w.state.SetPortState(key, &state.PortState{
 			Open:        ps.Open,
 			Hostnames:   names,
 			LastChecked: ps.LastChecked,
 		})
 	}
 }
 // runDNSChecks performs DNS resolution for all configured domains
 // and hostnames, updating state with freshly resolved records.
 // This must complete before port or TLS checks run so those
@@ -289,13 +235,6 @@ func (w *Watcher) checkDomain(
 	domain string,
 ) {
 	nameservers, err := w.resolver.LookupNS(ctx, domain)
 	// A domain that does not exist has no nameservers.
 	nxdomain := errors.Is(err, resolver.ErrNXDomain)
 	if nxdomain {
 		nameservers, err = []string{}, nil
 	}
 	if err != nil {
 		w.logFailedLookup(
 			ctx,
@@ -330,18 +269,9 @@ func (w *Watcher) checkDomain(
 	w.state.SetDomainState(domain, &state.DomainState{
 		Nameservers:         nameservers,
 		NameserverAddresses: addresses,
 		NXDomain:            nxdomain,
 		LastChecked:         now,
 	})
 	// A domain that does not exist has no records of its own: none are
 	// asked for, and those saved by an earlier check are removed.
 	if nxdomain {
 		w.state.DeleteHostnameState(domain)
 		return
 	}
 	// The apex domain's records are also checked and saved as a
 	// hostname's, so that the port and TLS checks find its addresses.
 	// Notifications about them name it as a domain (see nameLine).
@@ -651,50 +581,17 @@ func (w *Watcher) detectHostnameChanges(
 	w.detectCNAMEAddressChanges(ctx, hostname, prev, current)
 }
 // isDomain reports whether name is a configured apex domain, whose own
 // records are checked and saved as a hostname's are.
 func (w *Watcher) isDomain(name string) bool {
 	return slices.Contains(w.config.Domains, name)
 }
 // nameLine is the line a notification about name's records starts with:
-// "Domain: " and the name for a configured apex domain, and
+// "Domain: " and the name for a configured apex domain, whose own
-// "Hostname: " otherwise.
+// records are checked as a hostname's are, and "Hostname: " otherwise.
 func (w *Watcher) nameLine(name string) string {
-	if w.isDomain(name) {
+	if slices.Contains(w.config.Domains, name) {
 		return "Domain: " + name
 	}
 	return "Hostname: " + name
 }
 // portNameLines lists the names that resolve to a port's address, the
 // configured apex domains on one line and the hostnames on the next,
 // leaving out a line that would name nothing.
 func (w *Watcher) portNameLines(names []string) string {
 	var domains, hostnames []string
 	for _, name := range names {
 		if w.isDomain(name) {
 			domains = append(domains, name)
 		} else {
 			hostnames = append(hostnames, name)
 		}
 	}
 	var lines []string
 	if len(domains) > 0 {
 		lines = append(lines, "Domains: "+strings.Join(domains, ", "))
 	}
 	if len(hostnames) > 0 {
 		lines = append(lines, "Hostnames: "+strings.Join(hostnames, ", "))
 	}
 	return strings.Join(lines, "\n")
 }
 // detectCNAMEAddressChanges notifies when the addresses at the end of
 // hostname's CNAME chain differ from those the previous check saved,
 // including a change from or to none. When the previous addresses are
@@ -730,16 +627,12 @@ func (w *Watcher) detectCNAMEAddressChanges(
 // failed on either check has no records to compare. The records kept
 // for a record type whose query failed are compared too, but not those
 // of a type in UnknownTypes on either check, which the message leaves
-// out as well. Nothing is sent for a name in SkipRecordNotifications.
+// out as well.
 func (w *Watcher) detectRecordChanges(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
 	if slices.Contains(w.config.SkipRecordNotifications, hostname) {
 		return
 	}
 	for ns, cur := range current.RecordsByNameserver {
 		prevNS, ok := prev.RecordsByNameserver[ns]
 		if !ok || prevNS.Status != statusOK || cur.Status != statusOK {
@@ -839,18 +732,11 @@ func (w *Watcher) detectNSFailures(
 	}
 }
 // detectInconsistencies notifies each pair of nameservers that newly
 // disagree (see newlyDisagreeingPairs). Nothing is sent for a name in
 // SkipRecordNotifications.
 func (w *Watcher) detectInconsistencies(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
 	if slices.Contains(w.config.SkipRecordNotifications, hostname) {
 		return
 	}
 	for _, pair := range newlyDisagreeingPairs(prev, current) {
 		ns1, ns2 := pair[0], pair[1]
 		state1 := current.RecordsByNameserver[ns1]
@@ -942,10 +828,8 @@ func (w *Watcher) checkAllPorts(ctx context.Context) {
 	}
 	// Phase 3: Remove port state entries that no longer have
-	// any hostname referencing them, and certificate entries for
+	// any hostname referencing them.
 	// an address their name no longer has.
 	w.cleanupStalePorts(associations)
 	w.cleanupStaleCertificates()
 }
 // buildPortAssociations constructs a map from IP:port keys to
@@ -1029,45 +913,11 @@ func (w *Watcher) cleanupStalePorts(
 	}
 }
 // cleanupStaleCertificates removes the certificate entries for an
 // address their name no longer resolves to. An entry saved for a name
 // none of whose nameservers answered is kept: that name's addresses are
 // not known, not gone.
 func (w *Watcher) cleanupStaleCertificates() {
 	for _, key := range w.state.GetAllCertificateKeys() {
 		ip, hostname := parseCertKey(key)
 		if slices.Contains(w.collectIPs(hostname), ip) ||
 			w.noNameserverAnswered(hostname) {
 			continue
 		}
 		w.state.DeleteCertificateState(key)
 	}
 }
 // parseCertKey splits an "ip:port:hostname" certificate key into its
 // address and hostname.
 func parseCertKey(key string) (string, string) {
 	lastColon := strings.LastIndex(key, ":")
 	if lastColon < 0 {
 		return "", key
 	}
 	ip, _ := parsePortKey(key[:lastColon])
 	return ip, key[lastColon+1:]
 }
 // isConfigured reports whether name is a configured domain or hostname.
 func (w *Watcher) isConfigured(name string) bool {
 	return w.isDomain(name) || slices.Contains(w.config.Hostnames, name)
 }
 // noNameserverAnswered reports whether name is a configured domain or
 // hostname and none of its nameservers answered on its last check.
 func (w *Watcher) noNameserverAnswered(name string) bool {
-	if !w.isConfigured(name) {
+	if !slices.Contains(w.config.Hostnames, name) &&
 		!slices.Contains(w.config.Domains, name) {
 		return false
 	}
@@ -1156,8 +1006,8 @@ func (w *Watcher) checkSinglePort(
 		}
 		msg := fmt.Sprintf(
-			"%s\nAddress: %s\nPort now %s",
+			"Hosts: %s\nAddress: %s\nPort now %s",
-			w.portNameLines(hostnames), key, stateStr,
+			strings.Join(hostnames, ", "), key, stateStr,
 		)
 		w.notify.SendNotification(
@@ -482,119 +482,6 @@ func TestNSChangeDetection(t *testing.T) {
 	}
 }
 // TestDomainThatDoesNotExist checks a .com domain that does not exist,
 // with nameservers and records saved by an earlier check. The .com
 // servers answer that it does not exist, so it is saved with nxdomain
 // set and no nameservers, an NS Change removes them all, and its saved
 // records are removed rather than asked for at the .com servers.
 func TestDomainThatDoesNotExist(t *testing.T) {
 	t.Parallel()
 	const domain = "dnswatcher-test-does-not-exist.com"
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{domain}
 	var deps *testDeps
 	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
 		var w *watcher.Watcher
 		w, deps = newTestWatcher(t, cfg)
 		deps.state.SetDomainState(domain, &state.DomainState{
 			Nameservers: []string{oldNS1, oldNS2},
 		})
 		deps.state.SetHostnameState(domain, &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				oldNS1: {
 					Records: map[string][]string{"A": {oldIP}},
 					Status:  "ok",
 				},
 			},
 		})
 		started := time.Now()
 		w.RunOnce(ctx)
 		// When no server answered, the domain's state is not saved.
 		ds, _ := deps.state.GetDomainState(domain)
 		if ds.LastChecked.Before(started) {
 			return fmt.Errorf("%s: %w", domain, livednstest.ErrNoAnswer)
 		}
 		return nil
 	})
 	ds, _ := deps.state.GetDomainState(domain)
 	if !ds.NXDomain || len(ds.Nameservers) != 0 {
 		t.Errorf("saved nxdomain %v and nameservers %v, want true and none",
 			ds.NXDomain, ds.Nameservers)
 	}
 	if hs, ok := deps.state.GetHostnameState(domain); ok {
 		t.Errorf("records saved for %s: %v", domain, hs.RecordsByNameserver)
 	}
 	assertNotified(t, deps, "NS Change: "+domain, "warning")
 	// That is the only notification, and it removes both nameservers,
 	// in either order.
 	for _, n := range deps.notifier.getNotifications() {
 		removed := strings.TrimPrefix(
 			n.Message, "Domain: "+domain+"\nAdded: \nRemoved: ",
 		)
 		if removed != oldNS1+", "+oldNS2 && removed != oldNS2+", "+oldNS1 {
 			t.Errorf("unexpected notification: %v", n)
 		}
 	}
 }
 // TestDomainWithNoDelegationOfItsOwn checks a domain with no delegation
 // of its own: codeberg.page is on the public suffix list, so
 // docs.codeberg.page is a domain, but the .page servers delegate only
 // codeberg.page, whose servers answer for it. It is saved with no
 // nameservers and without nxdomain, and its records, asked at the
 // codeberg.page servers, are saved. Those are testSmallDomain's two
 // nameservers; github.io, the zone of the README's example, has eight.
 func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
 	t.Parallel()
 	const domain = "docs.codeberg.page"
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{domain}
 	var deps *testDeps
 	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
 		var w *watcher.Watcher
 		w, deps = newTestWatcher(t, cfg)
 		err := checkOnce(ctx, w, deps)
 		// A domain saved as not existing has no records to wait for;
 		// the checks below fail on it.
 		if ds, ok := deps.state.GetDomainState(domain); ok && ds.NXDomain {
 			return nil
 		}
 		return err
 	})
 	ds, _ := deps.state.GetDomainState(domain)
 	if ds.NXDomain || len(ds.Nameservers) != 0 {
 		t.Errorf("saved nxdomain %v and nameservers %v, want false and none",
 			ds.NXDomain, ds.Nameservers)
 	}
 	if _, ok := deps.state.GetHostnameState(domain); !ok {
 		t.Errorf("no records saved for %s", domain)
 	}
 }
 func TestNSAddressChangeDetection(t *testing.T) {
 	t.Parallel()
@@ -3,12 +3,12 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
-# goimports is not installed here: script/fmt and script/fmt-check run
+# goimports is not installed here: script/fmt and script/fmt-check-go
-# it with `go run` at a pinned commit.
+# run it with `go run` at a pinned commit.
 # The linter is NOT installed here: golangci-lint runs via docker only
 # (script/lint), pinned by image digest, so its only prerequisite is a
-# working docker. Nor is prettier: script/fmt and script/fmt-check run
+# working docker. Nor is prettier: script/fmt and
-# it in a stage of the Dockerfile.
+# script/fmt-check-markdown run it in a container from Dockerfile.fmt.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -67,12 +67,12 @@ main() {
    if missing make; then pkg_install gnumake make make make; fi
    if missing go; then pkg_install go golang go go; fi
-    # Testing, linting and the markdown formatter run via docker only.
+    # Linting and the markdown formatter run via docker only. Warn,
-    # Warn, don't fail: make build works without it.
+    # don't fail: building and testing work without it.
    if missing docker; then
        echo "bootstrap: WARNING: docker not found; install it to" \
-            "run make test, make lint, make fmt, make fmt-check," \
+            "run make lint, make fmt, make fmt-check, make check" \
-            "make check and make docker." >&2
+            "and make docker." >&2
    fi
    go mod download
@@ -1,10 +1,14 @@
 #!/bin/sh
-# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# script/cibuild: run the CI build. The Dockerfile's lint stage runs
-# checks out and runs this and nothing else, and script/fmt-check runs
+# the Go half of make fmt-check and golangci-lint; its builder stage
-# the formatter on the host, which a pristine checkout cannot do.
+# runs make test and make build. The markdown half of make fmt-check
-# --no-cache for the same reason as script/docker: the gate phases the
+# runs after that build, as its own build of Dockerfile.fmt, because
-# final stage depends on are RUN steps, and a cached one is a check that
+# there is no docker inside a docker build.
-# did not run.
+#
 # --no-cache-filter=lint,builder runs both stages on every invocation;
 # otherwise an unchanged tree is served from the layer cache and passes
 # without linting or querying live DNS. script/fmt-check-markdown busts
 # its own cache the same way.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -12,17 +16,8 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
-    "$SCRIPT_DIR/bootstrap"
+    docker build --no-cache-filter=lint,builder .
-    "$SCRIPT_DIR/check"
+    "$SCRIPT_DIR/fmt-check-markdown"
    # Own line: a failing command substitution inside an argument does
    # not trip `set -e`, so the inline form degrades silently to an
    # empty constant. The VERSION build argument takes precedence over
    # the version a build stage derives from the .git in the context.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
    docker build --no-cache \
        --build-arg VERSION="$version" \
        -t "$("$SCRIPT_DIR/projectname")" .
 }
 main "$@"
@@ -1,8 +1,10 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
+# The tag comes from script/projectname.
-# --no-cache because the gate phases the final stage depends on are RUN
+#
-# steps, and a cached one is a check that did not run.
+# --no-cache-filter=lint,builder runs the lint stage and the builder
 # stage (make test) on every invocation; otherwise an unchanged tree is
 # served from the layer cache without linting or querying live DNS.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -12,11 +14,11 @@ main() {
    cd "$ROOT"
    # Own line: a failing command substitution inside an argument does
    # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
+    # empty constant. The VERSION build arg takes precedence over what
-    # the version a build stage derives from the .git in the context.
+    # the build would derive from the .git in its context.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
-    docker build --no-cache \
+    docker build --no-cache-filter=lint,builder \
        --build-arg VERSION="$version" \
        -t "$("$SCRIPT_DIR/projectname")" .
 }
@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/fmt: format all files (writes). Go with gofmt and goimports on
-# the host, markdown with prettier in the Dockerfile's fmt stage.
+# the host, markdown with the prettier pinned by Dockerfile.fmt.
 #
 # goimports runs with `go run` at a pinned commit, never from PATH, so
 # every machine formats with the same version and nothing installs it.
@@ -8,15 +8,21 @@
 # The markdown pass is a `docker build --output type=local` rather than a
 # `docker run -v`, so it needs no bind mount and behaves the same against
 # a remote daemon; the formatted documents come back out of the build and
-# are copied over the tree here. --output writes files and makes no
+# are copied over the tree here.
-# image, so there is nothing to tag.
+#
 # Unlike script/fmt-check-markdown this does not bust the cache: it is
 # not a gate, and any edit to a document changes the COPY layer above the
 # prettier step, so a cached result is a result over this exact tree.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-# goimports v0.42.0, 2026-08-07. Must match script/fmt-check.
+# goimports v0.42.0, 2026-08-07. Must match script/fmt-check-go.
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
 # Must match the export stage name in Dockerfile.fmt.
 stage=fmt-out
 die() {
    echo "script/fmt: $*" >&2
    exit 1
@@ -30,9 +36,10 @@ main() {
    tmp="$(mktemp -d "${TMPDIR:-/tmp}/dnswatcher-fmt.XXXXXX")"
    trap 'rm -rf "$tmp"' EXIT INT TERM
-    docker build --no-cache \
+    docker build \
-        --target fmt-out \
+        --target "$stage" \
-        --output "type=local,dest=$tmp/out" .
+        --output "type=local,dest=$tmp/out" \
        -f Dockerfile.fmt .
    # An empty export means prettier was handed nothing, which must not
    # read as "already formatted".
@@ -1,37 +1,14 @@
 #!/bin/sh
 # script/fmt-check: check formatting (read-only). Same tools and scope
-# as script/fmt, but fails instead of writing and names what it would
+# as script/fmt, but fails instead of writing: the Go on the host, the
-# change: the Go on the host, the markdown with prettier in the
+# markdown with prettier in a container.
 # Dockerfile's fmt-check stage.
 #
 # --no-cache because a cached check layer is a check that did not run.
 # The tag makes each build replace the previous image instead of leaving
 # a dangling one behind.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 # goimports v0.42.0, 2026-08-07. Must match script/fmt.
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
 main() {
-    cd "$ROOT"
+    "$SCRIPT_DIR/fmt-check-go"
-    files="$(gofmt -s -l .)"
+    "$SCRIPT_DIR/fmt-check-markdown"
    if [ -n "$files" ]; then
        echo "gofmt: files not formatted:" >&2
        echo "$files" >&2
        exit 1
    fi
    files="$(go run "$GOIMPORTS_REF" -l .)"
    if [ -n "$files" ]; then
        echo "goimports: files not formatted:" >&2
        echo "$files" >&2
        exit 1
    fi
    docker build --no-cache \
        --target fmt-check \
        -t "$("$SCRIPT_DIR/projectname")-fmt-check" .
 }
 main "$@"
@@ -0,0 +1,31 @@
 #!/bin/sh
 # script/fmt-check-go: fail unless every Go source is formatted the way
 # script/fmt would leave it, and name the files that are not. Read-only.
 #
 # Its own script because the Dockerfile's lint stage runs this half
 # alone: there is no docker inside a docker build to run the markdown
 # half in.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # goimports v0.42.0, 2026-08-07. Must match script/fmt.
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
 main() {
    cd "$ROOT"
    files="$(gofmt -s -l .)"
    if [ -n "$files" ]; then
        echo "gofmt: files not formatted:" >&2
        echo "$files" >&2
        exit 1
    fi
    files="$(go run "$GOIMPORTS_REF" -l .)"
    if [ -n "$files" ]; then
        echo "goimports: files not formatted:" >&2
        echo "$files" >&2
        exit 1
    fi
 }
 main "$@"
@@ -0,0 +1,29 @@
 #!/bin/sh
 # script/fmt-check-markdown: fail unless every .md is formatted the way
 # script/fmt would leave it. Read-only.
 #
 # prettier is never installed on the host: it runs in a container built
 # from Dockerfile.fmt, pinned by package.json and yarn.lock.
 # --no-cache-filter is here for the reason script/lint gives: a cached
 # build checks nothing.
 #
 # Its own script because script/cibuild runs this half alone, after the
 # Dockerfile's lint stage has checked the Go.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Must match the markdown check stage name in Dockerfile.fmt.
 stage=fmt-check
 main() {
    cd "$ROOT"
    docker build \
        --progress=plain \
        --no-cache-filter="$stage" \
        --target "$stage" \
        -f Dockerfile.fmt \
        .
 }
 main "$@"
@@ -1,23 +1,28 @@
 #!/bin/sh
-# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# script/lint: run the linter. golangci-lint is never installed or run
-# this builds that phase alone; the linter is never installed or run on
+# on the host: it runs via docker only, one way, everywhere. This
-# a developer host, where a shared result cache and a host-global lock
+# builds Dockerfile.lint, which COPYs the repo into the digest-pinned
-# make its answer untrustworthy.
+# golangci-lint image and lints as a build step, so a successful build
 # means a clean lint.
 #
-# The phase is not the last stage in the file, so it is built only when
+# --no-cache-filter=lint forces the lint stage (source copy + linter
-# --target names it. --no-cache because a cached lint layer is a lint
+# run) to execute on every invocation. Without it an unchanged tree
-# that did not run. The tag makes each build replace the previous image
+# returns success in well under a second having linted nothing. The
-# instead of leaving a dangling one behind.
+# deps stage (base image + go mod download) stays cached, and no global
 # cache invalidation is performed. --progress=plain keeps the linter's
 # own output visible.
 set -eu
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
-    docker build --no-cache \
+    docker build \
        --progress=plain \
        --no-cache-filter=lint \
        --target lint \
-        -t "$("$SCRIPT_DIR/projectname")-lint" .
+        -f Dockerfile.lint \
        .
 }
 main "$@"
@@ -1,19 +1,35 @@
 #!/bin/sh
-# script/test: run the test suite. Testing is a phase of the Dockerfile
+# script/test: run the test suite.
-# and this builds that phase alone, on the same terms as script/lint:
+#
-# --target because a phase that is not the last stage is built only when
+# -count=1 disables Go's test cache, and is load-bearing here. This
-# named, --no-cache because a cached test layer is a test that did not
+# suite queries live DNS on every run by policy (TESTING.md); a cached
-# run, and a tag so each build replaces the previous image.
+# result is a replay of an earlier run's output with no query made at
 # all. On an unchanged tree the whole suite would return success in
 # under a second having resolved nothing, which makes the repeated-run
 # green that is used as evidence for flakiness fixes worthless. Do not
 # remove it.
 #
 # Conditional verbose rerun per REPO_POLICIES.md: run quiet first so
 # CI and docker build logs stay readable, and rerun with -v only on
 # failure. The rerun also carries -count=1 (a cached replay of the
 # failure would show nothing new), and the exit status is forced to 1
 # no matter how the rerun ends: the first failure already proved the
 # suite broken, so a flaky test that passes the second time must not
 # turn the build green.
 #
 # -timeout 90s is a deliberate backstop above the 60s hard cap on
 # suite duration. Do not lower it.
 set -eu
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
-    docker build --no-cache \
+    go test -count=1 -race -timeout 90s -cover ./... || {
-        --target test \
+        echo "--- Rerunning with -v for details ---" >&2
-        -t "$("$SCRIPT_DIR/projectname")-test" .
+        go test -count=1 -race -timeout 90s -v ./... || true
        exit 1
    }
 }
 main "$@"