Dns.Forward was an I/O-free decision core but mutated its state in place
(cfg, cache, health, hosts) and pulled an injected clock and RNG. Rework
it into a pure state machine, matching the monorepo's pure-core doctrine:

- the state is immutable; decide and on_reply return the next state
(a cache lookup prunes, on_reply caches and records health);
- now and rng are passed per call rather than held;
- the reload verbs are with_config/with_hosts (pure), and a new
with_hosts/hosts pair lets a control plane swap the local names table
live -- the hosts analogue of the existing config reload.

nox-dns-eio's Forward_eio becomes the thin I/O edge: it holds the one
mutable core ref, threads the clock and RNG into each call, and swaps in
the state the core returns. Its public API (resolve, set_config,
set_hosts) is unchanged, so downstream consumers are untouched.

A new fuzz property pins the invariant the pure core now guarantees and
the old mutable core could not: decide and on_reply never mutate the
state handed to them. It forwards a name, caches the reply into the
returned state, and asserts the pre-reply state still treats the name as
a miss -- under the old core that check saw a cache hit.

A bare [nameservers] in the doc reads as a reference to the exported accessor; naming the constructor's options in the leading code span marks them as documented arguments.

Three alcobar fuzzers for the forwarder state machines, with emphasis on connection reuse, interleaving and livelock. id_mux drives the pure transaction-id allocator through a fuzzed alloc/free/route order over one flow and asserts, after every step, that no two in-flight queries share an id, that the outstanding count is bounded by max_elements and equals the live count (no leak), that in_use routes a response to exactly its query, and that completion frees the id; the scale test fills the outstanding table to the cap and frees back to a zero baseline.

cache drives the LRU response cache past its capacity and asserts eviction keeps size within the bound while dropping evicted names; a compare-counting doubling test pins the O(log n) lookup of the balanced-tree table shared by the cache (Lru.F/Map.Make) and the id-mux outstanding set (Set.Make(Int)). forward replays the edge's priority-group race over the real decide/on_reply/servfail core against a fuzzed reply/garbage/timeout stream and a mock clock, and asserts a query always reaches a decodable reply within a budget equal to the attempt count (no livelock) and that a valid canned reply is never spuriously dropped.

Each fuzzer was verified to fail on a broken core, then the core restored: id_mux free=identity (never freed) fails interleave and scale on the leak; alloc cap-guard disabled fails scale (id past the cap); cache without LRU.trim fails bounded (size past capacity); a List-backed table model fails O(log n) (1024->2048 compares on doubling); on_reply returning Failed for a valid answer fails progress (rejected a valid canned reply); the race retrying the same attempt fails progress (attempt budget exceeded).

Scale: the O(log n) table model was validated at n=2^20 (1,048,576) with a worst-case 20 key comparisons (= log2 1M), far under the 3*log2 n bound; CI caps n at 2048 for speed. No unbounded-growth bug was found here: Id_mux is capped by max_elements and Cache trims to its LRU weight, and both bounds held under the fuzzed op orders.

RFC 7766 TCP connection reuse is not modelled: the edge connects per query and decide builds fresh attempts with fresh transaction ids each time, so no reused connection state exists to fuzz and that sub-fuzzer is omitted. Retransmit and serve-stale/prefetch (the build plan's Layer 8) are likewise unimplemented, so progress is fuzzed over the group/attempt fall-through that exists today.

Dns_eio.v discovered nameservers by reading /etc/resolv.conf with
blocking stdlib channels inside an Eio program -- benign at config-build
time, but the pattern the tree bans, and the caller had no way to name
the file or supply a capability.

v now takes ?resolv_conf, an Eio.Path capability naming the file to
read; discovery goes through Eio.Path.load and the file's content is
parsed by Dns.Resolv_conf (retiring the inline duplicate parser). An
explicit ~nameservers list still wins, and a missing, unreadable, or
nameserver-less file falls back to 1.1.1.1/8.8.8.8 as before.

The no-argument default keeps reading /etc/resolv.conf with one stdlib
read at configuration build: the call sites that omit both arguments
(atproto-handle, mirage caps) hold no filesystem capability, so the
read stays at this documented boundary and never runs per query.

Tests land with the new entry point: nameservers from a file named by
a capability (exact values, IPv4 + IPv6), fallback on a missing file
and on one without nameserver lines, and explicit-list precedence.
Also links the of_string doc reference in resolv_conf.mli the odoc way
(E420, follow-up to the previous commit).

Two copies of the resolv.conf parse existed: Forward_config.of_resolv_conf
in the core and an inline parse_resolv_conf in dns-eio's nameserver
discovery. Extract the shared logic into Dns.Resolv_conf, the typed home
for resolv.conf(5) content: an I/O-free of_string over the file's text,
with nameservers in file order and the search list carried.

The shared parser follows resolv.conf(5) where the copies diverged from
it: fields split on tabs as well as spaces, ';' starts a comment like
'#', and when several search directives are present only the last one is
used. Forward_config.of_resolv_conf is rebuilt on top and keeps its
signature.

The module lands with its tests in this commit (E605): exact-value
nameserver extraction (IPv4 and IPv6), comment and whitespace handling,
malformed-line tolerance, and the last-search-wins rule.

dns-eio's inline copy is retired in the follow-up commit that moves its
file read behind a capability.