The roster is the machines: each node's internal domain covers its routes (hq ADR 0191)

The roster published routed names — public ones first, then (in this PR's first take) internal ones
told apart by suffix. Neither is needed: a node has one internal domain and every route on it is a
name under it, answered by the resolver's per-node wildcard; a node's public domains are public
DNS's. routeNamesInTheMesh and NamesServed are removed, and a test pins .Names to the machines.

cmd/mesh-controller/roster_failure_test.go

@@ -2,13 +2,12 @@ package main
 
 import (
 	"context"
-	"strings"
 	"testing"
 )
 
 // A node's own set failing to compose, and the mesh being unable to answer at all, are different
 // things, and only the first may be passed over when something is gathered across every machine
-// (novox/hq 04-ISSUES/152). These pin that distinction where the three gatherers rely on it.
+// (novox/hq 04-ISSUES/152). These pin that distinction where the gatherers rely on it.
 
 func TestASetThatDoesNotComposeIsMarkedAsTheNodesOwnProblem(t *testing.T) {
 	open := aMesh(t)
@@ -45,55 +44,3 @@ func TestAStoreThatCannotBeReadIsNotANodeThatDoesNotCompose(t *testing.T) {
 		t.Fatalf("a question the mesh could not answer was read as a node that runs nothing: %v", err)
 	}
 }
-
-func TestOneIncoherentNodeDoesNotCostTheRestTheirNames(t *testing.T) {
-	open := aMesh(t)
-	one, two := rivals()
-	register(t, open, one)
-	register(t, open, two)
-	for _, m := range []string{one.Module, two.Module} {
-		if _, err := open.inventory.Assign(t.Context(), "laptop", m); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	// laptop cannot compose. That is laptop's problem and nobody else's: the roster is still
-	// answerable, and anchor keeps whatever it serves.
-	if _, err := routeNamesInTheMesh(t.Context(), open); err != nil {
-		t.Fatalf("one node's broken set cost the whole mesh its roster: %v", err)
-	}
-}
-
-func TestARosterIsNeverReturnedWithNamesItCouldNotRead(t *testing.T) {
-	open := aMesh(t)
-
-	stopped, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	names, err := routeNamesInTheMesh(stopped, open)
-	if err == nil {
-		t.Fatalf("a roster was composed from a store that could not be read: %v", names)
-	}
-	// The failure must be raised, not turned into an absence. A roster missing a machine's names
-	// is indistinguishable, on every machine that receives it, from the operator withdrawing them —
-	// and because the roster is part of every container's identity, it replaces all of them.
-	if names != nil {
-		t.Fatalf("a partial roster was returned beside the error: %v", names)
-	}
-}
-
-// Kept so the reason survives the next person reading it: the message the gatherer raises must say
-// which machine could not be read, or the operator is left with a mesh-wide failure and no name.
-func TestTheRaisedFailureNamesTheMachineItCouldNotRead(t *testing.T) {
-	open := aMesh(t)
-	stopped, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	_, err := routeNamesInTheMesh(stopped, open)
-	if err == nil {
-		t.Fatal("no failure was raised")
-	}
-	if !strings.Contains(err.Error(), "cannot be read") {
-		t.Fatalf("the failure does not say the mesh could not be read: %v", err)
-	}
-}