The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247)

A machine with a VPN client that writes /etc/resolv.conf needs its domains
routed to the VPN's servers while every other name still goes to the mesh's
resolvers. node-resolver's holder does that on the machine, owns the resolver
file there, and serves routes, route and unroute. The uplink's holder steps
back from the file only where the resolver is held; every other machine
composes as before.

internal/catalogue/declaration.go

@@ -1035,7 +1035,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		// plane's; making a name resolve is the module's software. Emitted as ordinary files under
 		// this module's name, so they are applied, reported and removed exactly as anything else
 		// it declares.
-		given, err := FactsFrom(m, r, with)
+		// The resolver file is the node-resolver holder's where one is held here, and the uplink's
+		// holder steps back from it (novox/hq ADR 0247).
+		given, err := FactsFrom(stepsBack(m, r.Modules), r, with)
 		if err != nil {
 			return nil, err
 		}