catalogue keeps only what a reader or the node-engine's composition uses; the judge's rules are the indexer's own (ADR 0578 §7, ADR 0593 §1)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/catalogue/node_resolver.go

@@ -2,25 +2,6 @@ package catalogue
 
 import "path"
 
-// The machine's own resolver (novox/hq ADR 0247).
-//
-// **Most machines have none.** Every machine lists the mesh's resolvers in /etc/resolv.conf and nothing
-// else, and the module holding its uplink writes that file (ADR 0223). A machine with a VPN client that
-// pushes its own resolvers for its own domains needs a third answer: those domains to the VPN's servers,
-// over the VPN's link, and every other name to the mesh's resolvers as before. One file cannot list both
-// sets of servers — musl takes the first reply, glibc the first server's "no such name" — so the domains
-// are routed by a resolver on the machine itself: the `node-resolver` seat's holder.
-//
-// **Where it is held, it owns the resolver file.** The file then names the machine's own resolver, which
-// routes; the uplink's holder steps back from writing it on that machine, by the rule below and not by
-// two modules writing one path. There are two uplink holders (NetworkManager's and systemd-networkd's),
-// and the resolver is its own module so it is written once, not once in each.
-//
-// **It knows nothing of any VPN.** Its verbs route a set of domains to a set of servers over one link,
-// list what is routed and remove a route. A module wrapping a VPN client that writes /etc/resolv.conf
-// itself carries its own adapter and calls those verbs; a VPN that tells systemd-resolved its link's DNS
-// itself needs none.
-
 // ResolverSeat is the machine's own resolver (novox/hq ADR 0247).
 const ResolverSeat = "node-resolver"