Every container is given the mesh's names

Internal names are written to the machine's hosts file, which serves the
machine and not what the machine runs: a container gets its own hosts file
holding only its own hostname. So every name the mesh wrote was invisible to
the majority of things that need one — and on the machine it always worked,
which is exactly what made it easy to miss.

It was hit for real in the lab, and worked around by resolving the address on
the machine and passing it in. That workaround is now removed, and its absence
is the assertion.

A file rather than a resolver, which is the decision the mesh already made
about names and this extends rather than overturns: it works on every runtime,
needs no package and has no failure mode of its own. The stated trigger for a
resolver — names that are not one-per-node, service names, wildcards — is
still not met.

Given by the mesh, not chosen by a module: a module that listed the machines
would go stale the day one joins, and one that did not would be a module whose
containers cannot reach anything by name. A container that named its own keeps
them and gets the mesh's beside them.

Only containers, and not the ones on the machine's own network: a runtime
refuses to write a hosts file for those, and a file or a service given the
field is a declaration the host refuses outright — so getting it wrong breaks
the whole machine for something that was never about names.

internal/catalogue/declaration.go

@@ -80,6 +80,13 @@ type Rendering struct {
 	// a fact about the mesh, and resolution answers questions about one machine.
 	Mesh []string
 
+	// Names is every machine's internal name and its address, for containers to be given.
+	//
+	// **A container does not inherit the machine's names**, so every internal name the mesh wrote
+	// is invisible to what the machine runs. Given here rather than looked up on the machine,
+	// because which machines exist is a fact about the mesh.
+	Names map[string]string
+
 	Settings   SettingsBy
 	Generators map[string]Generator
 	// Grants are the credentials this node must create, for the provisions it offers. Passed in
@@ -284,6 +291,17 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 		// merging earlier would throw away the files it still needs.
 		resources = append(append([]map[string]any{}, first...), resources...)
 
+		// Every container is given the mesh's names. Not a choice a module makes: a module that
+		// listed them would go stale the day a machine joins, and one that did not would be a
+		// module whose containers cannot reach anything by name.
+		//
+		// A container that was given names of its own keeps them and gets the mesh's beside them:
+		// the mesh does not know what else a workload needs to reach, and taking something away
+		// to add something is not what "also" means.
+		if len(with.Names) > 0 {
+			resources = withMeshNames(resources, with.Names)
+		}
+
 		for _, unsettled := range resources {
 			resource, err := ApplySettings(unsettled, with.Settings[m.Module])
 			if err != nil {
@@ -517,3 +535,39 @@ func here(r Resolution, requirement string) *Needed {
 	}
 	return nil
 }
+
+// withMeshNames gives every container in a set the mesh's names.
+//
+// Copied rather than edited in place: these maps come from a module's manifest, and mutating one
+// would change what the catalogue holds for every other machine running that module.
+func withMeshNames(resources []map[string]any, names map[string]string) []map[string]any {
+	out := make([]map[string]any, 0, len(resources))
+	for _, r := range resources {
+		if r["type"] != "container" {
+			out = append(out, r)
+			continue
+		}
+		// A container on the machine's own network shares its hosts file already, and a runtime
+		// refuses to write one for it. Adding names there would be an argument the runtime
+		// rejects, which fails the whole container for something it did not need.
+		if network, on := r["network"].(string); on && network == "host" {
+			out = append(out, r)
+			continue
+		}
+
+		copied := map[string]any{}
+		for k, v := range r {
+			copied[k] = v
+		}
+		var given []any
+		if already, ok := copied["hosts"].([]any); ok {
+			given = append(given, already...)
+		}
+		for _, name := range sortedKeys(names) {
+			given = append(given, name+":"+names[name])
+		}
+		copied["hosts"] = given
+		out = append(out, copied)
+	}
+	return out
+}