# diff: mount token (or dm_lock) around the nresolve walk and every setpassive/insert/remove; node lock+ref before strcmp.