milestone 28: query provenance — every logged query is exactly explainable

query rows gain qclass, rcode, group, policy action and reason, the
matched rule or list entry with its source, cname and safe-search
targets, route kind, forward zone, and the resolver that actually
answered — the pool and local markers die. servfails are logged and
name the resolver that lost; post-parse protocol refusals become rows.
a detail page at /queries/:id renders the ordered explanation, and
coverage watermarks distinguish an empty history from a missing one.

the schema fingerprint changes: existing query history is recreated
with the old file kept aside and the reset filed as a resolved
diagnostic. fixes an oversized udp reply being rebuilt as noerror,
which handed clients a truncated nxdomain as success.

src/server/doh_server.zig

@@ -592,11 +592,13 @@ const FailingUpstream = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        selected: *?[]const u8,
     ) transport.ExchangeError![]u8 {
         _ = ptr;
         _ = io;
         _ = query;
         _ = response_buf;
+        selected.* = "fake://failing-upstream";
         return error.ConnectFailed;
     }
 

src/server/dot_server.zig

@@ -351,8 +351,10 @@ const FakeUpstream = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        selected: *?[]const u8,
     ) transport.ExchangeError![]u8 {
         _ = io;
+        selected.* = "fake://dot-server-upstream";
         const self: *FakeUpstream = @ptrCast(@alignCast(ptr));
         if (self.reply.len > response_buf.len) return error.ResponseTooLarge;
         @memcpy(response_buf[0..self.reply.len], self.reply);

src/server/phase7_integration_test.zig

@@ -33,6 +33,7 @@ const handler = @import("handler.zig");
 const header = @import("../dns/header.zig");
 const local_tables = @import("local_tables.zig");
 const logger_mod = @import("../storage/logger.zig");
+const provenance = @import("../storage/provenance.zig");
 const manager = @import("../filter/manager.zig");
 const matcher = @import("../filter/matcher.zig");
 const migrations = @import("../storage/migrations.zig");
@@ -183,8 +184,10 @@ const FakeUpstream = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        selected: *?[]const u8,
     ) transport.ExchangeError![]u8 {
         _ = io;
+        selected.* = "fake://phase7-upstream";
         const self: *FakeUpstream = @ptrCast(@alignCast(ptr));
         _ = self.calls.fetchAdd(1, .monotonic);
 
@@ -346,7 +349,8 @@ test "S7 case 1: a blocked domain is answered with the zero address and logged"
     try testing.expectEqual(@as(usize, 1), logged.len);
     try testing.expectEqual(true, logged[0].blocked);
     try testing.expectEqualStrings("ads.example.com", logged[0].domain());
-    try testing.expectEqualStrings("rule_block_exact", logged[0].blockReason());
+    try testing.expectEqual(provenance.PolicyAction.block, logged[0].policy_action);
+    try testing.expectEqual(provenance.PolicyReason.rule_block_exact, logged[0].policy_reason);
     try testing.expectEqualStrings("127.0.0.1", logged[0].clientIp());
 }
 
@@ -593,7 +597,7 @@ test "S7 case 5: a cached answer comes back with a fresh id, an aged ttl and a l
     const logged = drainLog(&lg, io, &entries);
     try testing.expectEqual(@as(usize, 3), logged.len);
     try testing.expectEqual(@as(?bool, false), logged[0].cache_hit);
-    try testing.expectEqualStrings("pool", logged[0].upstream());
+    try testing.expectEqualStrings("fake://phase7-upstream", logged[0].upstream());
     try testing.expectEqual(@as(?bool, true), logged[1].cache_hit);
     try testing.expectEqualStrings("", logged[1].upstream());
     try testing.expectEqual(@as(?bool, true), logged[2].cache_hit);
@@ -651,7 +655,9 @@ test "S7 case 6: a cname into a blocked target blocks the original question" {
     const logged = drainLog(&lg, io, &entries);
     try testing.expectEqual(@as(usize, 1), logged.len);
     try testing.expectEqual(true, logged[0].blocked);
-    try testing.expectEqualStrings("cname:rule_block_exact", logged[0].blockReason());
+    // The reason describes the target's own decision; milestone 28 S3 adds the
+    // target name that says a CNAME chain was followed.
+    try testing.expectEqual(provenance.PolicyReason.rule_block_exact, logged[0].policy_reason);
     try testing.expectEqualStrings("cdn.example.com", logged[0].domain());
 }
 

src/server/resolver_integration_test.zig

@@ -114,8 +114,10 @@ const GoodUpstream = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        selected: *?[]const u8,
     ) transport.ExchangeError![]u8 {
         _ = io;
+        selected.* = "fake://good-upstream";
         const self: *GoodUpstream = @ptrCast(@alignCast(ptr));
         _ = self.calls.fetchAdd(1, .monotonic);
         return answerQuery(query, response_buf);
@@ -138,8 +140,10 @@ const FaultyUpstream = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        selected: *?[]const u8,
     ) transport.ExchangeError![]u8 {
         _ = io;
+        selected.* = "fake://faulty-upstream";
         const self: *FaultyUpstream = @ptrCast(@alignCast(ptr));
         const seen = self.calls.fetchAdd(1, .monotonic);
         if (seen < self.fail_first) return self.fault;

src/server/tcp_server_integration_test.zig

@@ -72,8 +72,10 @@ const FakeUpstream = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        selected: *?[]const u8,
     ) transport.ExchangeError![]u8 {
         _ = io;
+        selected.* = "fake://tcp-server-upstream";
         const self: *FakeUpstream = @ptrCast(@alignCast(ptr));
         if (self.reply.len > response_buf.len) return error.ResponseTooLarge;
         @memcpy(response_buf[0..self.reply.len], self.reply);

src/server/udp_server_integration_test.zig

@@ -73,8 +73,10 @@ const FakeUpstream = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        selected: *?[]const u8,
     ) transport.ExchangeError![]u8 {
         _ = io;
+        selected.* = "fake://udp-server-upstream";
         const self: *FakeUpstream = @ptrCast(@alignCast(ptr));
         if (self.reply.len > response_buf.len) return error.ResponseTooLarge;
         @memcpy(response_buf[0..self.reply.len], self.reply);