feat(domains): what actually happens to a name, and the two verbs a client cannot compose (T46)

[haiquang9994]

Closes T46. T44 built a DNS server, T45 made a machine send it a name, and this is where a person can
ask what actually happened to one.

Three methods

domain.add    { site, domain, accept_risky_tld? }  ->  SiteDetail
domain.remove { domain }                           ->  SiteDetail
domain.dns_status { domain? }                      ->  DomainStatusReport

remove carries no site: site_domains_domain is UNIQUE — the index its own migration calls "the
one that decides ownership" — so a name belongs to exactly one site.

The two verbs add no capability, and exist anyway

site.update already replaces a site's whole domain list. A client could compose an addition from
it — read the list, append, send it back — which is business logic in a client, forbidden outright by
CLAUDE.md, and a read-modify-write that silently drops whatever another client added in between.

They are thin over the same sites::update, so the TLD check, the hosts queueing and the front-end
re-render keep exactly one implementation between them.

Two refusals, and the second is the interesting one. A site's last domain is refused because "at
least one" is the invariant 0001_initial.sql records as this layer's to uphold, SQLite having no
deferred constraint to express it with. A site's primary is refused because promoting another name
in its place would change what the site is — its canonical URL, and from phase 5 the name on its
certificate — under a verb that says "remove a domain". site.update reorders, and the head of the
list it is given is the primary; that is where changing a primary belongs.

Four facts and no verdict

http://blog.test failing has four independent causes that look identical from a browser. The report
gives each its own field: which site declares the name, whether the managed hosts block holds a line
for it, whether its TLD is wired so names under it are answered by pattern, what this daemon's own
server answers when asked over its socket, and what the operating system actually resolves it to.
Plus one sentence naming the first thing that is wrong.

Collapsing them into one boolean is exactly what DnsStatus::wildcards had to stop doing in T45: a
hosts line with no server, a server with no resolver, and a resolver wired to a TLD this name is not
on are three faults with three fixes.

The sentence says what is wrong and never what to do. Repair is T47's, and mix doctor should
render this report rather than recompute it — a second implementation of the four facts is a second
answer to one question.

A name nothing declares is answered rather than refused. Somebody asking why foo.test does not
work when they never declared it is owed exactly that, and the other three facts still hold an answer.

The instrument

getaddrinfo, and never nslookup — T45 measured that nslookup bypasses the Name Resolution Policy
Table and answers NXDOMAIN for a name getaddrinfo resolves at the same moment, so a diagnostic built
with it would send every correctly wired Windows user looking for a fault that is not there.

The OS cache is included on purpose, which is the opposite of what T45's own test needed: that one
defeated the cache because it was asking whether a mechanism works. This asks what the user's
browser sees right now, and the cached answer is that answer.

One recorded cost. spawn_blocking cannot be cancelled, so the bound on a lookup stops the daemon
waiting and does not stop the lookup: a hung resolver holds one blocked thread per domain asked
about until it gives up. Written into the function rather than hidden behind the timeout, because a
timeout that reads like a cancellation is how a thread leak becomes invisible.

Testing

Every negative assertion carries a control taken with the same instrument at the same moment — T45's
D14. The suites assert that a name under .test does not resolve on a machine nothing wired,
which is what every machine running them is; without proving localhost resolves in the same run,
that would be a claim about getaddrinfo rather than about the machine. Four of the six measurement
rounds behind T45 were void for exactly that.

No elevation anywhere: all four facts are reads.

Design: docs/superpowers/specs/2026-08-24-t46-domain-rpc-design.md