The mesh's names are written into the hosts file, not over it (hq 128)

/etc/hosts is the machine's: the distribution's localhost lines, the
operator's own entries, and marked blocks other tools maintain there.
Writing node-names whole replaced all of it the moment the private
network was taken, and every later write by those tools was lost at
the next machine joining. The node-names fact is now emitted with
into: "block", so the host owns only its marked region and keeps the
rest byte for byte. The region holds only the mesh's names: no header
claiming the file, no localhost, no 127.0.1.1 line — the floor was
never the mesh's to write. How a fact is written is a property of the
fact in the closed table; node-zones stays a whole file the mesh owns.

Sequencing: a host older than the block mode refuses the whole
declaration on an unknown into, so every host must be upgraded before
this controller is rolled out.

internal/catalogue/facts_test.go

@@ -54,9 +54,60 @@ func TestAMachinesOwnNameIsItsMeshAddress(t *testing.T) {
 	if !strings.HasPrefix(line, "10.42.0.1") {
 		t.Fatalf("a machine's own mesh name is not its mesh address: %q", line)
 	}
-	// And the loopback floor is still there, or things with nothing to do with the mesh break.
-	if !strings.Contains(out, "127.0.0.1\tlocalhost") {
-		t.Fatalf("the loopback floor was removed:\n%s", out)
+}
+
+// novox/hq issue 128: the names are the mesh's region of the machine's hosts file, and only that.
+//
+// **The loopback floor is the machine's now, not the mesh's.** It was written here while the mesh
+// wrote the whole file. Written into a region, a `localhost` or a `127.0.1.1 homer` of the mesh's
+// would stand beside the distribution's own — a second answer nobody could say the owner of, and
+// one that goes when the mesh leaves. A header claiming the file would be a lie about the rest of
+// it. And no line may look like the host's own markers, or the host would refuse the region.
+func TestTheNamesAreOnlyTheMeshsRegionOfTheFile(t *testing.T) {
+	out := nodeNames(Resolution{Node: "homer"}, threeMachines, "")
+	want := "# The mesh's names. This region is replaced whenever a machine joins or leaves.\n" +
+		"10.42.0.1\thomer.internal\thomer\t# this machine\n" +
+		"10.42.0.2\tmarge.internal\tmarge\n"
+	if out != want {
+		t.Fatalf("the region is not exactly the mesh's names:\n%s\n--- want ---\n%s", out, want)
+	}
+	for _, floor := range []string{"localhost", "127.0.", "::1", "Generated by the mesh", "# BEGIN mesh ", "# END mesh "} {
+		if strings.Contains(out, floor) {
+			t.Fatalf("the region carries %q, which is not the mesh's to write:\n%s", floor, out)
+		}
+	}
+}
+
+// The hosts file is written into; the resolver's zones are written whole. A property of each fact,
+// so a module asking for node-names at another path still does not get a file of the mesh's.
+func TestOnlyTheNamesAreWrittenIntoASharedFile(t *testing.T) {
+	m := Manifest{Module: "resolver", Facts: map[string]string{
+		FactNodeZones: "/etc/mesh-resolver/nodes.conf", FactNodeNames: "/etc/hosts",
+	}}
+	given, err := FactsInto(m, Resolution{Node: "homer"}, threeMachines, threeMachines, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(given) != 2 {
+		t.Fatalf("expected two files, got %v", given)
+	}
+	for _, f := range given {
+		switch f["path"] {
+		case "/etc/hosts":
+			if f["into"] != "block" {
+				t.Errorf("the hosts file is written over rather than into: %v", f)
+			}
+		case "/etc/mesh-resolver/nodes.conf":
+			// The mesh owns the resolver's zones; nothing else writes there.
+			if into, set := f["into"]; set {
+				t.Errorf("the zones file is written into (%v), and it is the mesh's whole", into)
+			}
+			if !strings.HasPrefix(f["content"].(string), "# Generated by the mesh.") {
+				t.Errorf("the zones file lost its header: %v", f["content"])
+			}
+		default:
+			t.Errorf("a file nobody asked for: %v", f)
+		}
 	}
 }