Add DNS diagnostics across dataplane and client

test/server/state-store.test.js

@@ -102,6 +102,8 @@ test('schema v5 migrates rules and diagnostics settings with an exact backup', (
     configured: false,
     customServices: [],
     hiddenServiceIds: [],
+    customDnsResolvers: [],
+    customDnsDomains: [],
   });
   assert.equal(migrated.routeRulesRevision, 7);
   assert.deepEqual(migrated.routeRules.map(({ outbound }) => outbound), ['direct', 'direct']);
@@ -149,6 +151,35 @@ test('schema v7 migrates failover disabled without losing canonical state', (t)
   assert.deepEqual(JSON.parse(fs.readFileSync(store.migration.backupPath, 'utf8')), legacy);
 });
 
+test('schema v9 adds empty DNS settings atomically and preserves the exact backup', (t) => {
+  const filePath = fixture(t);
+  const legacy = {
+    schemaVersion: 9,
+    revision: 23,
+    routeRules: [],
+    appliedRouteRules: [],
+    diagnostics: {
+      configured: true,
+      customServices: [{ id: 'custom-status', label: 'Status', url: 'https://example.com/' }],
+      hiddenServiceIds: ['youtube'],
+    },
+  };
+  const bytes = JSON.stringify(legacy);
+  fs.writeFileSync(filePath, bytes);
+
+  const store = createStateStore(filePath, {
+    now: () => new Date('2026-09-01T12:00:00.000Z'),
+  });
+  const migrated = store.read();
+
+  assert.equal(migrated.schemaVersion, 10);
+  assert.equal(migrated.revision, 23);
+  assert.deepEqual(migrated.diagnostics.customDnsResolvers, []);
+  assert.deepEqual(migrated.diagnostics.customDnsDomains, []);
+  assert.equal(store.migration.fromVersion, 9);
+  assert.equal(fs.readFileSync(store.migration.backupPath, 'utf8'), bytes);
+});
+
 test('schema v6 rejects missing or unknown outbound without rewriting source bytes', (t) => {
   for (const [name, rule] of [
     ['missing', { type: 'domain', value: 'example.com', enabled: true }],