A node is known by a key it generated

The thing I had been calling blocked for weeks, built in an afternoon once it
was pointed out that it was already decided. 08-connectivity says of the
overlay keys: each node generates its own keypair, the private half never
leaves the machine, the public half is published -- and says outright this IS
ADR 0004's "a node holds its own identity". Nobody had applied it to node
identity itself.

identity now holds the public half of each node's key. Only the public half,
which is the property worth having: a copy of this database is a list of who to
believe, not a set of credentials, so compromise of a node really is compromise
of only that node.

Exactly one key is live per node, and re-enrolment revokes the one it replaced
in the same transaction -- two live identities is the stolen-laptop case with
the replaced machine still believed.

Fault injection was worth the time here. Three findings. The unique index was
defended by no test at all: sequential enrolment is already safe because the
code revokes before inserting, so removing the constraint changed nothing. The
constraint only matters when two enrolments race, and there is now a test that
runs six at once and fails without it.

My injection harness also lied to me. One injection matched nothing, changed no
file, and reported NO BITE identically to a real one -- so a test that defends
nothing and an injection that does nothing look the same. The harness now
checksums the files and says NO-OP when they did not change.

And one honest NO BITE left standing: making the key lookup return a zero key
for an unknown node does not fail the test, because the signature check refuses
it a line later. Two independent mechanisms, not a placebo.

61 tests, none skipped.

README.md

@@ -26,7 +26,7 @@ argument that is not settled there.
 | | |
 |---|---|
 | `inventory` | node records and enrolment tokens — **built, as far as identity** |
-| `identity` | the control plane's own signing key — **built, and no further** |
+| `identity` | the control plane's signing key, and the keys nodes are known by — **built** |
 | `config`, `connectivity`, `provisioning`, `delivery`, `observability` | not built |
 | the interface every surface speaks to | not built; its shape is not decided |
 
@@ -87,16 +87,24 @@ for one. Run `migrate` with only one and it stops, naming the grant it does not
 A token needs a node record from one and a signing key from the other. Neither reads the other's
 store — the process holding both grants asks each for its part.
 
-### Where this stops, and why there
+### How a node is known
 
-At **identity**. A node's own identity is the next thing needed and its cryptographic form is not
-decided anywhere: whether a node holds a keypair whose public half the mesh keeps, or something
-else. Modelling it would have meant guessing, in a migration — which is the most expensive place
-in this system to guess, because a schema that ran is finished and the only way back is another
-migration.
+**The node generates a keypair; the mesh records the public half.** The same principle as SSH, and
+the same rule `08-connectivity` already applies to the overlay keys — which is where this was
+settled all along, though it took being asked directly to notice.
 
-So the node table holds what a node record *is* — a name, when it was made, what the machine last
-reported about itself, when it was last heard from — and stops before what a node *presents*.
+Only the public half is ever stored, and that is the property worth having: **a copy of this
+database grants nothing.** It is a list of who to believe, not a set of credentials, which is what
+makes *compromise of a node is compromise of that node* literally true.
+
+Exactly one key is live per node. Re-enrolment revokes the one it replaced, in the same
+transaction — two live identities for one node record is the stolen-laptop case, with the replaced
+machine still believed. The database enforces it as well as the code, and there is a test running
+six concurrent enrolments that fails when the constraint is removed.
+
+**Not the machine's SSH host key**, though that was the obvious economy. Host keys are regenerated
+by reinstalls and image clones, which would silently un-enrol a node; their lifecycle belongs to
+sshd rather than the mesh; and a partial host has no SSH daemon at all.
 
 ## Reaching a store