* skip rewriting /etc/resolver files when dns config is unchanged on macOS * change resolver drift detection from size to content checks * fix some nits * treat unreadable resolver files as unmanaged instead of failing