Keep what a machine said about itself, not just the yes

novox/hq ADR 0009: a capability's presence gates an assignment and its detail
carries a value — seat: card1-DP-1, an architecture, an amount of memory. So
'can this run here' and 'what should it be configured as' are one fact read two
ways, and the mesh was keeping the first read and discarding the second.

The reason an absent capability is absent went the same way, which is the case
a person most needs: 'this machine has no container runtime' is the answer and
'docker is not installed' is why, and only the machine knows why.

`node show` says it back. Never reported and reported nothing stay different
things there — one machine has not run the host, the other ran it and can do
nothing, and those send a person to different places.

internal/inventory/catalogue.go

@@ -331,16 +331,11 @@ func (i *Inventory) ProfileOf(ctx context.Context, nodeName string) (map[string]
 		// machine", which is wrong but visible. Better than assuming it can do everything.
 		return out, nil
 	}
-	var reported struct {
-		Capabilities []struct {
-			Name    string `json:"name"`
-			Present bool   `json:"present"`
-		} `json:"capabilities"`
-	}
-	if err := json.Unmarshal(raw, &reported); err != nil {
+	held, err := profileFrom(raw)
+	if err != nil {
 		return nil, err
 	}
-	for _, c := range reported.Capabilities {
+	for _, c := range held {
 		if c.Present {
 			out[c.Name] = true
 		}
@@ -348,6 +343,57 @@ func (i *Inventory) ProfileOf(ctx context.Context, nodeName string) (map[string]
 	return out, nil
 }
 
+// Capability is one named fact a machine reported about itself.
+//
+// **Detected and never assumed** (novox/hq ADR 0009). The detail is the part that was being
+// thrown away: a capability's presence gates an assignment and *its detail can also carry a
+// value* — `seat: card1-DP-1`, an architecture, an amount of memory. So *can this run here* and
+// *what should it be configured as* are the same fact read two ways, and keeping only the first
+// read makes the second unanswerable.
+//
+// It is also what a refusal should quote. "This machine has no seat" is the right answer and
+// "no graphics devices are present" is the reason, and only the machine knows the reason.
+type Capability struct {
+	Name    string `json:"name"`
+	Present bool   `json:"present"`
+	// Detail is what the detector observed, in its own words — including when it found nothing,
+	// which is the case a person most needs explaining.
+	Detail string `json:"detail,omitempty"`
+}
+
+// Profile is everything a machine last reported about what it can do.
+//
+// The same read ProfileOf uses, unreduced. Two functions parsing one column would be two things
+// to keep agreeing about what a profile is.
+func (i *Inventory) Profile(ctx context.Context, nodeName string) ([]Capability, error) {
+	var raw []byte
+	err := i.store.Pool().QueryRow(ctx,
+		`select profile from node where name = $1`, nodeName).Scan(&raw)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, fmt.Errorf("%w: %s", ErrNoSuchNode, nodeName)
+	}
+	if err != nil {
+		return nil, err
+	}
+	return profileFrom(raw)
+}
+
+func profileFrom(raw []byte) ([]Capability, error) {
+	if len(raw) == 0 {
+		// A machine that has never reported. Not an error and not an empty machine: nil says
+		// "nothing is known", where an empty slice would say "it reported having nothing", and
+		// those send a person to different places.
+		return nil, nil
+	}
+	var reported struct {
+		Capabilities []Capability `json:"capabilities"`
+	}
+	if err := json.Unmarshal(raw, &reported); err != nil {
+		return nil, err
+	}
+	return reported.Capabilities, nil
+}
+
 // SetSettings records what somebody wants a module's configuration to say.
 //
 // An empty node name means the whole mesh. Replacing rather than merging what is already there: