refactor: trim dead code and stray comments from the netdev feature

internal/agentconfig/agentconfig.go

@@ -71,9 +71,6 @@ func (d *Document) Validate() error {
 	if err := validateNftables(d.Nftables); err != nil {
 		return err
 	}
-	if err := validateNetdev(d.Netdev); err != nil {
-		return err
-	}
 	return nil
 }
 
@@ -155,15 +152,6 @@ func validateNftables(nft *NftablesConfig) error {
 	return nil
 }
 
-// validateNetdev checks the netdev section. Both a nil section (the NIC is left
-// untouched) and a present section are valid: the section carries only a boolean
-// toggle, so there is nothing to constrain. It exists to keep the validation
-// surface uniform and ready for future fields.
-func validateNetdev(nd *NetdevConfig) error {
-	_ = nd
-	return nil
-}
-
 // validateRule checks every field of the NftablesRule at index i. It returns
 // the first violation found, naming the offending field.
 func validateRule(i int, rule NftablesRule) error {

internal/agentconfig/agentconfig_types.go

@@ -21,22 +21,19 @@ type Document struct {
 	WireGuard WireGuardConfig `json:"wireguard"`
 	// Nftables is the optional DNAT ruleset; set only on uplink nodes.
 	Nftables *NftablesConfig `json:"nftables,omitempty"`
-	// Netdev is the optional host NIC tuning section. A nil section is a no-op
-	// (the NIC is left untouched); when present it is applied wherever the
-	// document carries it, independent of the node role.
+	// Netdev is the optional host NIC tuning section. A nil section leaves the
+	// NIC untouched.
 	Netdev *NetdevConfig `json:"netdev,omitempty"`
 }
 
-// NetdevConfig tunes the underlay network interface of the host. tunnelctl
-// resolves the underlay interface itself at apply time (the device of the
-// default route to a public IP), so this section carries only the desired
-// behavior and never an interface name. A nil section means leave the NIC
-// untouched; presence with DisableOffloads true turns the offloads off.
+// NetdevConfig tunes the underlay network interface of the host. It carries the
+// desired behavior only, never an interface name: the underlay device is
+// resolved at apply time.
 type NetdevConfig struct {
-	// DisableOffloads turns GRO and GSO off on the resolved underlay NIC. It is
-	// intended for encapsulated/non-uniform UDP payloads where GRO coalescing
-	// can corrupt datagram boundaries; it defaults off because disabling it
-	// degrades throughput for ordinary TCP/QUIC traffic.
+	// DisableOffloads turns GRO and GSO off on the underlay NIC. It is for
+	// encapsulated, non-uniform UDP payloads where receive coalescing corrupts
+	// datagram boundaries; off by default because it degrades throughput for
+	// ordinary TCP/QUIC traffic.
 	DisableOffloads bool `json:"disableOffloads"`
 }
 

internal/agentrun/agentrun.go

@@ -63,9 +63,6 @@ func Apply(doc *agentconfig.Document) error {
 			return err
 		}
 	}
-	// netdev tunes the host underlay NIC. A nil section is left untouched; a
-	// present section is applied wherever the document carries it, regardless of
-	// node role (the relay carries it when the EdgeNode requests it).
 	if doc.Netdev != nil {
 		if err := applyNetdev(*doc.Netdev); err != nil {
 			return err