[lr00rl]

Summary

Design 32 S5a, the DNS check method, server part.

• Validation (internal/server/monitor_dns.go): a dns create, edit or definition address uses the SDK's ParseDNSResolver and the destination rule in monitor_checks.go (checkMonitorHost), so a private, loopback, link-local, metadata or numeric resolver host is refused, as is an unknown scheme or a DoH target without a path. The target is stored canonical (DNSResolver.String), so two spellings expand to one id. The question: name at most 253 bytes, type A/AAAA/CNAME/TXT/MX/NS (default A), at most 16 expected values stored in the form an agent compares, dns_expect_rcode NOERROR (stored empty) or NXDOMAIN, which takes no values. Every refusal carries R6's field (dns_expect[1], dns_name, ...). The dns fields are refused on every other kind; empty ones echoed by an editor are not.
• Edits: MonitorUpdate changes the question in place; the resolver is the target and cannot change (another spelling of the same endpoint is the same target).
• Definitions: method dns takes resolver endpoints as addresses (node targets wait for the dnsproxy engine), copies the question onto each expanded monitor, and an edit of the question alone rewrites every monitor. managedMonitorEqual already compares whole records; it now reads an empty dns_expect as missing.
• Probe gate: generic; with the SDK knowing dns, a source whose agent does not report it reads agent_too_old and is not handed the check.
• Ingestion: results keep dns_rcode (mnemonic shape) and at most 16 dns_answers of at most 255 bytes, cut rather than refused; other kinds and unknown runs keep neither. A DoH or DoT result keeps cert_not_after; any other agent claim of one is still dropped. The bolt row maps the two new fields, and the latest view exposes them.
• Expiring: a DoH or DoT check is listed as a tls_certificate item, dated by the soonest of each running source's newest certificate reading.
• Paths: a resolver whose host is a node's public address draws its path to that node.

SDK pin: v0.2.24-0.20261025003326-6485e4abe7b9 and sdk.ref 6485e4ab, the pushed branch commit of LatticeNet/lattice-sdk#45. Re-pin both after that merges.

Decisions a reviewer may question:

• Expiring takes the soonest certificate among sources, not the newest reading: with anycast or several PoPs, one vantage point that still sees an unrenewed certificate is the one worth showing. A source no longer assigned stops counting.
• Out-of-bound answers are truncated, not refused, because they are display data and the run's verdict was already made by the agent.
• The create refusal for an unknown type now lists dns ("only tcp, http, icmp, beacon, dns and tls monitors are supported").

Left out: node targets for dns definitions (spec: wait for the dnsproxy engine); audit metadata does not list the question.

Test plan

• go test ./internal/store/ ./internal/server/ (full packages, through the desk lock)
• gosec on both packages, gofmt -l .
• internal/server/monitor_dns_test.go: every create refusal of the spec's server list (private, loopback, metadata resolver, unknown scheme, name over 253 bytes, 17 expected values, rcode other than NOERROR or NXDOMAIN) plus shape and cross-kind refusals, each with its field; canonical storage; edits; the agent gate and agent_too_old; a dns definition with two addresses (three spellings) over two sources expanding to two monitors and four paths, a question-only edit reaching every monitor, the dry run; definition refusals; ingestion bounds and certificate handling; Expiring from two sources
• CI race shards