# 161 — resolved: a host the mesh built runs a machine

*2026-09-30. Measured on the workstation.*

```
running: /usr/lib/nox-mesh-host/versions/093231796eb0/nox-mesh-host
agent:   active
reconciles in the last six minutes: 1

mesh-controller node show shanks
  host              093231796eb0
```

A binary the mesh compiled, published to its own registry, delivered over the bus, started by the
launcher, applying declarations, and reporting a version that names the build it came from.

## The two facts, and where each now comes from

**The system it was built for comes from the artifact.** ADR 0142 already made the target a property
of the artifact rather than of the recipe, so the toolchain names the variable it fills and the
artifact supplies the value. It is the one thing a toolchain takes from a module, and it is stated
rather than inferred.

**The version comes from where the binary sits**, which is what
[ADR 0142](../../02-DECISIONS/0142-the-mesh-delivers-its-own-components-as-binaries.md) decided and
nothing had implemented: a delivered host reads the directory it was unpacked into. A host placed by
hand keeps its link-time stamp, which is the honest answer for one the mesh did not deliver — and is
every other machine today.

## Two mistakes on the way, both found by reading the output

**A repeated flag is not a merged one.** The stamp was appended as a second `-ldflags`, and the Go
command takes the last and drops the first. The binary gained its system and lost `-s -w`: 12.2MB
against 8.5MB, with its debug info. The comment I had written said the linker "accepts and merges"
them. It does not. Linker flags are the toolchain's own list now, composed into one flag, and a test
refuses a compile line that carries `-ldflags` itself.

**The delivered binary was named after its package.** `cmd/mesh-host` builds `mesh-host`; every
machine runs `nox-mesh-host`, which is what the launcher looks for inside a version. The first
delivery landed, reported `created … 1 file(s)`, and was invisible. An artifact says what its
executable is called now.

Both were caught by listing the directory and reading the binary rather than believing the line that
said it worked.

## What this cost while it was wrong, and what saved it

A delivered host that cannot apply is a machine the mesh cannot repair, because the declaration that
would fix it is the declaration it cannot apply. The workstation was restored by moving the delivered
versions aside so the launcher fell back to the hand-placed binary — **the fallback in the launcher,
working exactly as designed**, and the reason this was an inconvenience rather than an expedition.

It also loops if you are not careful: the working binary applies, delivers a version, stands aside,
and the broken one starts. Stopping the unit while the fix was built was the way through.

## What is left

**Three machines still run a hand-placed host.** Rolling them forward is one assignment and one push
each, and the control node is worth doing last and watching.