docs(dns): correct idle-mosdns premise in alternatives research (W1N-56)

docs/lan-dns-alternatives.md

@@ -2,11 +2,19 @@
 
 **Status: research only. No configuration was changed.** This page evaluates
 resolvers/splitters that are genuinely better than — or meaningfully different
-from — the current "AdGuard Home (AGH) + idle mosdns" setup on
+from — the current "AdGuard Home (AGH) + mosdns" setup on
 [`dns.windy.lan`](../hosts/dns.windy.lan.md) (`.36`), for a GFW-constrained
 China home LAN. Claims are cited to primary sources (official repos, official
 docs, upstream READMEs); anything not verified is flagged as such.
 
+> 2026-08-12: facts in this page's scope recap were refreshed by W1N-56 live
+> verification — mosdns on `.1` is **not idle**, it is clash's
+> `nameserver`/`default-nameserver` (DIRECT-rule real-IP resolution); the
+> canonical decision record is
+> [`lan-dns-architecture.md`](lan-dns-architecture.md) (final verdict aligned,
+> Phase 0 kill-test evidence incl. a measured upstream-blackhole degradation
+> gap).
+
 Scope recap (from [`lan-overview.md`](lan-overview.md), verified 2026-08-06):
 
 - Clients get DNS via EdgeRouter DHCP option 6 → AGH `192.168.66.36:53`.
@@ -14,8 +22,10 @@ Scope recap (from [`lan-overview.md`](lan-overview.md), verified 2026-08-06):
   `https://adg.chans.xyz/dns-query`. **DNSSEC disabled** (known-bad-signature
   check failed on the selected path). Rewrites: `hass.local` / `hass.windy.lan`.
 - `gfw` OpenWrt (`.1`) runs OpenClash fake-ip + TPROXY; dnsmasq → clash DNS
-  `127.0.0.1#7874`. A `mosdns` binary listens on `127.0.0.1:6052` but is **not**
-  on the active path.
+  `127.0.0.1#7874`. `mosdns` on `127.0.0.1:6052` is clash's
+  `nameserver`/`default-nameserver` (DIRECT-rule real-IP resolution: domestic →
+  AGH `.36:53`, foreign → `223.5.5.5`/`119.29.29.29`); it is **not** in the LAN
+  client query path.
 - No local authoritative PTR source yet; private reverse DNS is a known gap.
 
 ---
@@ -45,9 +55,12 @@ The genuinely worthwhile changes, in order of value:
    [blocky](https://0xerr0r.github.io/blocky/latest/configuration/#dnssec-validation))
    and re-test a known-bad-signature domain; or (b) insert a validating
    resolver (blocky is the lightest) between AGH and the upstreams.
-3. **Either actually configure mosdns or delete it.** It is idle on the active
-   path; leaving a half-configured listener is surface area with no benefit. If
-   kept, be aware its cache strips EDNS0 and it performs no DNSSEC validation
+3. **mosdns on `.1` is resolved, not idle** — it is clash's
+   `nameserver`/`default-nameserver` (DIRECT-rule real-IP resolution, verified
+   2026-08-12), so "delete it" is off the table; its role is documented in
+   [`lan-dns-architecture.md`](lan-dns-architecture.md) §1. If a future change
+   moves this role to an AGH-side companion, keep in mind mosdns's cache strips
+   EDNS0 and it performs no DNSSEC validation
    ([mosdns v5 executable plugins](https://irine-sistiana.gitbook.io/mosdns-wiki/mosdns-v5/ru-he-pei-zhi-mosdns/ke-zhi-xing-cha-jian.md)).
 
 Top-3 alternatives worth pursuing (see §3 for detail):
@@ -138,7 +151,7 @@ Verdict: **Already installed and capable of the geo-split itself.** The current
 setup under-uses it: only a load-balanced CN pair + fallback, no per-domain
 routing and no validating upstream. This is the cheapest "better" state — see §5.
 
-### 3.2 mosdns v5 — installed but idle
+### 3.2 mosdns v5 — installed, active as clash nameserver (gateway-side)
 
 What it is: "一个 DNS 转发器" (a DNS forwarder) — plugin-based, sequence-driven
 ([README](https://github.com/IrineSistiana/mosdns), GPL-3.0, ~3.7k★).