The mesh knows which host runs a machine, and says who is behind another

novox/hq 04-ISSUES/087. A host refuses a declaration carrying a field it
does not know, and refuses it WHOLE — deliberately, because that keeps a
half-understood declaration off a machine. It makes every new declaration
field a flag day: hosts first, then the controller. The mesh had no record
of which host any machine ran, so that order was kept by somebody
remembering it, and a machine that refused for this reason reported a
failure with nothing saying why.

The machine has reported its host version since ADR 0141. The
controller's own copy of the report did not have the field, so it was
unmarshalled into nothing and thrown away on arrival. It has it now,
records it, and shows it in `node show` — "not reported" rather than
blank, because a machine that has not said is not a machine running
nothing.

Status says which machines run an older host than another machine does,
and which is newest. Deliberately disagreement rather than staleness:
nothing delivers a host version yet (ADR 0141, accepted and not built), so
the mesh holds no canonical current version and cannot honestly say a
machine is behind THE host. What it can say is that the oldest host in the
mesh is what the mesh may send.

A machine that has reported nothing is left out rather than called
behind. Versions compare as strings, which suits the timestamps and
commits this mesh uses and is wrong for a scheme where "10" sorts before
"9" — said in the code, at the place that would have to learn.

internal/inventory/migrations/0045-a-machine-says-which-host-runs-it.sql

@@ -0,0 +1,15 @@
+-- The version of the host running on a machine, as the machine reports it.
+--
+-- novox/hq 04-ISSUES/087. A host parses a declaration strictly: a field it does not know makes it
+-- refuse the whole declaration and apply nothing. That is deliberate — it keeps a half-understood
+-- declaration off a machine — and it makes every new field in a declaration a flag day, hosts before
+-- controller. The mesh had no record of which host a machine runs, so it could neither refuse to send
+-- a declaration a machine cannot parse nor say which machines were behind. The order was kept by
+-- somebody remembering it.
+--
+-- The machine has been reporting this since ADR 0141 and the control plane discarded it: the field was
+-- absent from the controller's own copy of the report, so it was unmarshalled into nothing.
+--
+-- Null for a machine that has not reported since this column existed, which is not the same as a
+-- machine running no host — so a reader is never told a version the mesh does not have.
+alter table node add column host_version text;

internal/inventory/nodes.go

@@ -63,6 +63,11 @@ type Node struct {
 	// entry. What decides who a file under a home is owned by, and which account `ssh <node>` uses.
 	Account     string
 	AccountHome string
+
+	// HostVersion is the version of the host this machine reported running (novox/hq 04-ISSUES/087).
+	// Empty when it has not said since the mesh began keeping it — which is not the same as running
+	// no host, so nothing derives "behind" from an empty one.
+	HostVersion string
 }
 
 // Home is the account's home directory, derived when not stored: /root for root, /home/<account>
@@ -136,15 +141,20 @@ func (i *Inventory) AddNodeAs(ctx context.Context, name string, adopted bool) (N
 
 // nodeColumns and scanNode are the one reading of a node row, so every way of finding a node
 // says whether it is adopted.
-const nodeColumns = `id, name, created, last_seen, adopted, adopted_since, account, account_home`
+const nodeColumns = `id, name, created, last_seen, adopted, adopted_since, account, account_home,
+	host_version`
 
 func scanNode(row pgx.Row) (Node, error) {
 	var n Node
 	var seen, since *time.Time
+	var host *string
 	if err := row.Scan(&n.ID, &n.Name, &n.Created, &seen, &n.Adopted, &since,
-		&n.Account, &n.AccountHome); err != nil {
+		&n.Account, &n.AccountHome, &host); err != nil {
 		return Node{}, err
 	}
+	if host != nil {
+		n.HostVersion = *host
+	}
 	if seen != nil {
 		n.LastSeen = *seen
 	}
@@ -980,3 +990,18 @@ type Machine struct {
 	// being out of date and reads differently to whoever is looking.
 	Never bool
 }
+
+// RecordHostVersion keeps the version of the host a machine reported running (novox/hq 04-ISSUES/087).
+//
+// Never cleared by a report that carries none: a bare word that the node is there says nothing about
+// its host, and a machine whose host predates ADR 0141 reports none at all. So an empty version means
+// the mesh has not been told, and the caller does not write it.
+func (i *Inventory) RecordHostVersion(ctx context.Context, id, version string) error {
+	version = strings.TrimSpace(version)
+	if version == "" {
+		return nil
+	}
+	_, err := i.store.Pool().Exec(ctx,
+		`update node set host_version = $2, last_seen = now() where id = $1`, id, version)
+	return err
+}

internal/link/enrolment.go

@@ -312,6 +312,14 @@ func (e Enrolment) Heard(ctx context.Context, report Report) (news bool, err err
 			return false, err
 		}
 	}
+	// Which host produced this report (novox/hq 04-ISSUES/087), whenever it says. Recorded on every
+	// report that carries it and never cleared by one that does not — a bare word that the node is
+	// there says nothing about its host, and a machine whose host predates this reports none.
+	if report.Host != "" {
+		if err := e.Inventory.RecordHostVersion(ctx, node.ID, report.Host); err != nil {
+			return false, err
+		}
+	}
 	// What it says about the tunnel it carried (novox/hq ADR 0105), whenever it says it.
 	if report.Tunnel != nil {
 		if err := e.Inventory.RecordCarriedTunnel(ctx, node.ID, inventory.Carried{

internal/link/protocol.go

@@ -184,6 +184,15 @@ type Report struct {
 	// leaves the one it has: a rule written around a link with no name is a rule set that does not
 	// load, and that is a machine filtering nothing while its unit reports success.
 	Outward []string `json:"outward,omitempty"`
+
+	// Host is the version of the host that produced this report (novox/hq ADR 0141).
+	//
+	// **The machine has sent this since 0141 and this struct did not have it**, so it was
+	// unmarshalled into nothing and the mesh could not say which host any machine runs
+	// (novox/hq 04-ISSUES/087). A host refuses a declaration carrying a field it does not know, and
+	// refuses it whole — which is right, and makes every new field a flag day that the mesh could
+	// not see coming.
+	Host string `json:"host,omitempty"`
 	// Reachable is what can be reached on the machine now: every listening socket and every
 	// published container port. Only an adopted node reports it; it is what converging previews.
 	Reachable []Reach `json:"reachable,omitempty"`