`config = { ...; } // lib.mkIf` merges a top-level `config` into the mkIf sentinel set, so nixpkgs only walked `content` and silently dropped the `services.resolved.enable = mkForce false`. Return the mkIf directly and keep the mkForce inside it, so hosts without adguardhome keep resolved.