Import and synchronize forwarder zones with local overrides and promotion

[drudge]

Catalog imports now preserve forwarder behavior and honor the selected ownership mode. Primary imports create independent, editable Forwarders; Secondary imports create read-only Secondary Forwarders that keep synchronizing their overrides and forwarding settings from Technitium. Previously, private FWD records became empty record types and failed authoritative-zone validation.

Forwarder zones answer matching local records of any supported type before forwarding. this-server uses Sable's default resolver path. Technitium wire decoding preserves supported transports, priority, and consistent DNSSEC validation settings; unsupported options are rejected without creating or replacing the zone.

Secondary Forwarders retain transfer servers and TSIG authentication, use full AXFR snapshots on SOA timers or authorized NOTIFY, retry failures, and stop answering at expiry. Invalid or older snapshots do not replace the last good data. Catalog reconciliation preserves the Forwarder type. These transfers intentionally use AXFR rather than applying IXFR deletions against translated FWD records.

A Convert to independent Forwarder action completes migration using the existing review fingerprint, permissions, and source-freeze confirmation. It defaults to a final transfer, retains overrides and forwarding settings, advances the serial, stops synchronization, and enables record editing—including adding new TXT and other overrides. Failed conversion leaves the Secondary Forwarder unchanged. Catalog-managed members cannot be promoted through this action.

Documentation now covers catalog import modes, AXFR synchronization and expiry, local override precedence, this-server, and the final conversion to an independent Forwarder across the migration, forwarding, transfer, and zone reference guides.

Validation:

• go tool mage verify: generated code, full Go suite, and static analysis.
• Race-enabled tests for forwarding, zone models, DNS resolution, background refresh, and web operations.
• Regression coverage: A/AAAA/TXT/MX/CNAME overrides in both resolver modes; both catalog import modes; unsupported input; AXFR refresh and serial rollback; NOTIFY authorization; retry and expiry; read-only mutations; final-sync success/failure; stale reviews; and writable overrides after promotion.
• Documentation site build and content/internal-link checks passed using an isolated website build. The legacy bookmark navigation test fails identically against the unchanged PR baseline (6 of 7 website tests pass).
• Real Technitium 15.4.0 demo: imported a 19-record Forwarder through a catalog, synchronized a subsequent TXT change after NOTIFY, captured another edit in the final promotion transfer, then verified that later source edits stayed upstream and NOTIFY was rejected after promotion. Public DNSSEC validation was disabled in the isolated demo; this was not a production DNSSEC validation test.

Source-wide resolver and proxy configuration is not migrated. Ordinary one-time zone-file import remains a separate workflow.