Answer the review of hq issue 348's catalogue change

- The dnsmasq watch restarts only a unit that runs, without waiting for
  its start; a unit stopped, starting or failed is held and said (C2).
- dnsmasq_resolve asks only an address the resolver listens on (C3).
- Tests for the watch loop keeping its budget, a watch that wrote nothing
  or stopped looking, and a unit not running (C4).
- A restart is remembered as said only once emitted, restarts made before
  the bundle started are said, and whether one helped is said (C5).
- docker_events reads the runtime's whole buffer: complete when it is not
  full or reaches past the window, never a quiet machine read as lost (C6).
- netcheck: refused read with errors.Is; tests for addresses and ports,
  and for a container named as docker knows it.

modules/docker/cmd/docker-tools/docker_test.go

@@ -300,7 +300,7 @@ func TestEventsAreABoundedWindowWithoutExecNoise(t *testing.T) {
 {"Type":"container","Action":"die","Actor":{"ID":"aaaaaaaaaaaaaaaa","Attributes":{"name":"web","mesh-host.id":"hello-web.server","exitCode":"137"}},"timeNano":2}
 `
 	f := (&fake{}).on("docker events", Ran{Stdout: out})
-	got, err := client(f, 1000).Events(context.Background(), 30, "container", 10, false)
+	got, err := client(f, 1000).eventsAt(context.Background(), time.Unix(0, 3), 30, "container", 10, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -309,7 +309,7 @@ func TestEventsAreABoundedWindowWithoutExecNoise(t *testing.T) {
 		t.Fatalf("%v", evs)
 	}
 	// The type is filtered here, not by the runtime: the history's start is only known from all of it (issue 348).
-	if !f.ran("docker events --since 30m --until 0s --format {{json .}}") || f.ran("docker events --since 30m --until 0s --format {{json .}} --filter") {
+	if !f.ran("docker events --since 0 --until 0s --format {{json .}}") || f.ran("docker events --since 0 --until 0s --format {{json .}} --filter") {
 		t.Fatalf("%+v", f.calls)
 	}
 	if _, err := client(f, 1000).Events(context.Background(), 30, "secret", 10, false); err == nil {
@@ -376,15 +376,15 @@ func eventLine(at time.Time, kind, action, name string) string {
 func TestEventsSayWhereTheRuntimesHistoryBeginsWhenTheWindowReachesFurther(t *testing.T) {
 	now := time.Date(2026, 10, 9, 11, 24, 0, 0, time.UTC)
 	var out strings.Builder
-	for i := 0; i < 250; i++ {
+	for i := 0; i < RuntimeEventsKept; i++ {
 		out.WriteString(eventLine(now.Add(-10*time.Minute+time.Duration(i)*2*time.Second), "container", "exec_die", "mailu-webmail"))
 	}
 	got, err := client((&fake{}).on("docker events", Ran{Stdout: out.String()}), 1000).eventsAt(context.Background(), now, 180, "", 200, false)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got["count"] != 0 || got["held"] != 250 {
-		t.Fatalf("count %v held %v, want 0 shown of 250 held", got["count"], got["held"])
+	if got["count"] != 0 || got["held"] != RuntimeEventsKept {
+		t.Fatalf("count %v held %v, want 0 shown of %d held", got["count"], got["held"], RuntimeEventsKept)
 	}
 	if got["complete"] != false || !strings.Contains(fmt.Sprint(got["history"]), "gone from here, not absent") ||
 		got["oldest_held"] != "2026-10-09T11:14:00Z" {
@@ -394,7 +394,10 @@ func TestEventsSayWhereTheRuntimesHistoryBeginsWhenTheWindowReachesFurther(t *te
 
 func TestEventsCoveringTheWholeWindowSayItIsCompleteAndFilterTheTypeHere(t *testing.T) {
 	now := time.Date(2026, 10, 9, 11, 24, 0, 0, time.UTC)
-	out := eventLine(now.Add(-59*time.Minute), "network", "destroy", "build-net") +
+	// A quiet machine: three events in the whole buffer, the oldest inside the window. Complete — the buffer
+	// is not full, so it holds every event since the runtime started.
+	out := eventLine(now.Add(-90*time.Minute), "container", "start", "old") +
+		eventLine(now.Add(-59*time.Minute), "network", "destroy", "build-net") +
 		eventLine(now.Add(-30*time.Minute), "container", "die", "build-bus") +
 		eventLine(now.Add(-1*time.Minute), "network", "create", "build-net")
 	f := (&fake{}).on("docker events", Ran{Stdout: out})
@@ -402,14 +405,29 @@ func TestEventsCoveringTheWholeWindowSayItIsCompleteAndFilterTheTypeHere(t *test
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got["complete"] != true || got["count"] != 2 || got["history"] != nil {
-		t.Fatalf("a covered window: %v", got)
+	if got["complete"] != true || got["count"] != 2 || got["held"] != 4 || !strings.Contains(fmt.Sprint(got["history"]), "every event since it started") {
+		t.Fatalf("a quiet machine's window: %v", got)
 	}
-	if f.ran("docker events --since 60m --until 0s --format {{json .}} --filter") {
+	if f.ran("docker events --since 0 --until 0s --format {{json .}} --filter") {
 		t.Fatal("the type was filtered by the runtime, so the history's start is unknown")
 	}
+	// A quiet machine asked for ten minutes, its newest event an hour old: complete, and none.
+	got, _ = client(f, 1000).eventsAt(context.Background(), now.Add(time.Hour), 10, "", 200, false)
+	if got["complete"] != true || got["count"] != 0 {
+		t.Fatalf("a quiet machine read as one whose history was lost: %v", got)
+	}
+	// No events at all: none since the runtime started.
 	got, _ = client((&fake{}).on("docker events", Ran{}), 1000).eventsAt(context.Background(), now, 60, "", 200, false)
-	if got["complete"] != false || got["history"] == nil {
-		t.Fatalf("no events at all reads as quiet: %v", got)
+	if got["complete"] != true || got["count"] != 0 {
+		t.Fatalf("an empty buffer: %v", got)
+	}
+	// A full buffer whose oldest is before the window: complete.
+	var full strings.Builder
+	for i := 0; i < RuntimeEventsKept; i++ {
+		full.WriteString(eventLine(now.Add(-2*time.Hour+time.Duration(i)*time.Second), "container", "exec_die", "x"))
+	}
+	got, _ = client((&fake{}).on("docker events", Ran{Stdout: full.String()}), 1000).eventsAt(context.Background(), now, 60, "", 200, false)
+	if got["complete"] != true || got["history"] != nil {
+		t.Fatalf("a full buffer reaching past the window: %v", got)
 	}
 }