v0.16.4 — never route everything at a bridge that cannot forward

v0.16.3 could take a machine off the internet. This release stops it. If you are on v0.16.3, take this before running dns enable again.

What v0.16.3 did

The check that decided whether to write catch-all routing asked whether upstreams were discoverable — a fact about the machine — and inferred from that the bridge would forward. Those are different questions, and where they diverge the result is total:

Global: ~.                     every lookup goes to the bridge
DNS Servers: 127.0.0.1:5354    and the bridge is the only global server

Nothing to fall through to. Every name on the machine went to a bridge that could not forward, and nothing came back — ssh, curl, everything.

A server whose provider drop-in happens to put real upstreams in the same scope survives the identical config. That is why this was not caught before it shipped: the machine available to test on was the one shape where the bug is invisible.

The fix

The bridge is asked directly, before anything is written. Catch-all now requires either a bridge that demonstrably forwards, or no bridge at all — in which case dns enable starts ours, which does.

The probe uses a three-label name on purpose. A two-label name is a Moshpit name to any build: an older bridge answers it with the parking address, and that answer would read as working forwarding. A two-label probe would have passed on the exact machine that broke.

Falling back to per-ending routing is worse — it truncates at the resolver's cap, silently — but its worst case is Moshpit names not resolving, against a machine that cannot reach anything at all. The output now says which was chosen and why:

routing each ending by name — a bridge is already running on this port
and does not forward — stop it first, then re-run

Also in this release

mcp and skills exit non-zero when an engine fails to install.

If v0.16.3 already broke a machine

Two commands, needing neither DNS nor moshcode:

rm /etc/systemd/resolved.conf.d/moshpit.conf      # as root
systemctl restart systemd-resolved                # as root

Upgrading

moshcode update          # as root
moshcode dns enable      # as root

If a bridge from an older build holds port 5354, dns enable will now say so and decline catch-all rather than routing everything at it. Stop that bridge and re-run to get catch-all routing.