The mesh computes every name under a machine, for a resolver to answer

Services are named under the machine they run on — postgres.novox.internal,
plex.ace.internal. The first label is the service and the rest is the node, so
what has to resolve is anything under a node's name. What routes it once it
arrives is a proxy's concern and stays separate.

A hosts file cannot do that. It answers exact names, and a wildcard there would
mean writing down every service in advance — which is the enumeration the
arrangement exists to avoid. novox/hq 08-connectivity named this exact case as
the trigger for needing a resolver rather than a file, and it is the first
thing to meet it.

The mesh writes the data and runs no daemon. A resolver is third-party
software, and third-party software runs on the mesh rather than being of it
(ADR 0001): the mesh has no business shipping one, choosing which one, or
knowing its configuration language. What only the mesh can know is which
machines exist and where they are. A module that runs a resolver requires what
this provides and reads one file, so swapping the daemon changes that module
and nothing here.

Separate from names rather than part of them: a machine with no container
runtime can still have a hosts file, and folding them together would take exact
names away from a machine that cannot run a daemon in order to give it a
wildcard it cannot use either.

A machine with no address is left out. A wildcard pointing at nothing is worse
than no wildcard — every name under it resolves and then hangs, where an
unresolvable name fails at once and says which name it was.

cmd/mesh-control/main.go

@@ -243,7 +243,8 @@ func migrate(ctx context.Context) error {
 func providedModules() []catalogue.Manifest {
 	var out []catalogue.Manifest
 	for _, raw := range []map[string]any{
-		overlay.Manifest(), overlay.NamesManifest(), overlay.DomainManifest(),
+		overlay.Manifest(), overlay.NamesManifest(), overlay.ResolverManifest(),
+		overlay.DomainManifest(),
 	} {
 		var m catalogue.Manifest
 		b, _ := json.Marshal(raw)
@@ -762,8 +763,9 @@ func generators(ctx context.Context, inv *inventory.Inventory) (
 	// Both generators see the same machines: the ones on the private network. Names for a machine
 	// that is not on it would resolve to addresses it cannot reach, which is worse than no names.
 	return map[string]catalogue.Generator{
-		overlay.Name:  net,
-		overlay.Names: overlay.NamesFor(net.Nodes()),
+		overlay.Name:     net,
+		overlay.Names:    overlay.NamesFor(net.Nodes()),
+		overlay.Resolver: overlay.ResolverFor(net.Nodes()),
 	}, nil
 }