Keep what a machine said about itself, not just the yes

novox/hq ADR 0009: a capability's presence gates an assignment and its detail
carries a value — seat: card1-DP-1, an architecture, an amount of memory. So
'can this run here' and 'what should it be configured as' are one fact read two
ways, and the mesh was keeping the first read and discarding the second.

The reason an absent capability is absent went the same way, which is the case
a person most needs: 'this machine has no container runtime' is the answer and
'docker is not installed' is why, and only the machine knows why.

`node show` says it back. Never reported and reported nothing stay different
things there — one machine has not run the host, the other ran it and can do
nothing, and those send a person to different places.

cmd/mesh-control/main.go

@@ -129,6 +129,7 @@ func usage() {
   migrate                        bring each context's schema up to date
   node add <name>                create a node record
   node list                      the nodes this mesh knows about
+  node show <name>               what one machine reported it can do, and why
   token issue --node <name>      a one-time right to join, for an existing record
   token issue --new <name>       create the record and issue for it
   identity show                  this control plane's signing key
@@ -267,7 +268,7 @@ func openInventory(ctx context.Context) (*inventory.Inventory, error) {
 
 func nodeCommand(ctx context.Context, args []string) error {
 	if len(args) == 0 {
-		return errors.New("node add <name>, or node list")
+		return errors.New("node add <name>, node list, or node show <name>")
 	}
 	inv, err := openInventory(ctx)
 	if err != nil {
@@ -276,6 +277,11 @@ func nodeCommand(ctx context.Context, args []string) error {
 	defer inv.Close()
 
 	switch args[0] {
+	case "show":
+		if len(args) != 2 {
+			return errors.New("node show <name>")
+		}
+		return showNode(ctx, inv, args[1])
 	case "add":
 		if len(args) != 2 {
 			return errors.New("node add <name>")
@@ -2560,3 +2566,56 @@ func theThreeQuestions(ctx context.Context, inv *inventory.Inventory) (answers,
 	}
 	return out, nil
 }
+
+// showNode says what one machine reported about itself, in its own words.
+//
+// **A capability is detected and never assumed** (novox/hq ADR 0009), so the only account of what
+// a machine can do is the one it gave — and its detail is half of that account. The mesh was
+// keeping the yes and discarding the reason, which makes *this machine has no seat* an answer with
+// nowhere to go: a person told a machine lacks something wants to know what the detector saw.
+//
+// It is also where "what should it be configured as" is read. The same line that gates an
+// assignment carries `card1-DP-1`, and a person composing settings for that machine needs it.
+func showNode(ctx context.Context, inv *inventory.Inventory, name string) error {
+	node, err := inv.NodeByName(ctx, name)
+	if err != nil {
+		return err
+	}
+	fmt.Printf("%s\n", node.Name)
+	fmt.Printf("  last heard from   %s\n", heardFrom(node))
+
+	held, err := inv.Profile(ctx, name)
+	if err != nil {
+		return err
+	}
+	if held == nil {
+		// Never reported is not the same as reported nothing, and the remedy differs: one is a
+		// machine that has not run the host yet, the other is a machine that ran it and can do
+		// nothing.
+		fmt.Printf("\n  this machine has never said what it can do, so everything requiring a\n" +
+			"  capability is refused here — run the host on it\n")
+		return nil
+	}
+	if len(held) == 0 {
+		fmt.Printf("\n  it reported no capabilities at all\n")
+		return nil
+	}
+
+	fmt.Printf("\n  what it can do, as it reported:\n")
+	for _, c := range held {
+		mark := "no "
+		if c.Present {
+			mark = "yes"
+		}
+		fmt.Printf("    %s  %-20s %s\n", mark, c.Name, c.Detail)
+	}
+
+	assigned, err := inv.Assigned(ctx, name)
+	if err != nil {
+		return err
+	}
+	if len(assigned) > 0 {
+		fmt.Printf("\n  assigned: %s\n", strings.Join(assigned, ", "))
+	}
+	return nil
+}