The mesh keeps a copy of what each node owns

novox/hq 09-the-node-lifecycle asks for this and it was missing: the host
reports what it owns and the mesh keeps the last report. A backup, never a
source -- nothing decides anything from it, and a node that disagrees with it
wins, because the node is the one that can see the machine.

Its point is the orphans. A node that loses its state file currently strands
whatever it applied: nothing on the machine knows those resources were the
mesh's doing, so nothing removes them. With this, a rebuilt node receives both
the declaration and the record of what it previously owned.

Never reported and reported nothing are kept apart, and that is the whole care
in it. A node that applied nothing holds nothing; a node that has never spoken
is unknown -- and handing back an empty list for the second would tell a
rebuilding node it owns nothing and have it remove whatever it found.

The age comes back with the answer rather than being left for the caller to go
and find. An answer about a machine is worth much less without one, and this
repository has already been bitten by a cache with no age on it.

A refusal or a partial failure moves last_seen and nothing else: neither is an
account of what the machine holds, and recording one as though it were would
tell a rebuilding node to remove what it still has.

internal/inventory/inventory_test.go

@@ -290,3 +290,87 @@ func TestAnUnknownSecretIsRefusedTheSameWayAsAnExpiredOne(t *testing.T) {
 		t.Errorf("the two are distinguishable:\n  unknown: %v\n  expired: %v", unknownErr, expiredErr)
 	}
 }
+
+func TestNeverReportedIsNotTheSameAsReportedNothing(t *testing.T) {
+	// The distinction that makes this safe to hand back. A node that applied nothing holds
+	// nothing; a node that has never spoken is unknown — and returning an empty list for the
+	// second would tell a rebuilding node it owns nothing, and have it remove whatever it found
+	// on the machine.
+	inv := fresh(t)
+	node, err := inv.AddNode(t.Context(), "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	owned, reported, err := inv.Owned(t.Context(), node.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if owned != nil {
+		t.Errorf("a node that never reported came back owning %v", owned)
+	}
+	if !reported.IsZero() {
+		t.Error("a node that never reported has a report time")
+	}
+
+	if err := inv.RecordOwned(t.Context(), node.ID, []string{}); err != nil {
+		t.Fatal(err)
+	}
+	owned, reported, err = inv.Owned(t.Context(), node.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if owned == nil {
+		t.Error("a node that reported holding nothing is indistinguishable from one that never spoke")
+	}
+	if reported.IsZero() {
+		t.Error("a report that happened has no time on it")
+	}
+}
+
+func TestWhatANodeOwnsIsReplacedNotAccumulated(t *testing.T) {
+	// The question this answers is what is on that machine now. A node that stopped owning
+	// something and had it remembered would be handed it back on a rebuild and put it there again.
+	inv := fresh(t)
+	node, err := inv.AddNode(t.Context(), "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordOwned(t.Context(), node.ID, []string{"a", "b", "c"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordOwned(t.Context(), node.ID, []string{"a"}); err != nil {
+		t.Fatal(err)
+	}
+
+	owned, _, err := inv.Owned(t.Context(), node.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(owned) != 1 || owned[0] != "a" {
+		t.Errorf("after reporting a, the mesh believes the node owns %v", owned)
+	}
+}
+
+func TestAnAnswerAboutAMachineCarriesItsAge(t *testing.T) {
+	// This repository has already been bitten by a cache with no age on it: a node running from
+	// one looked identical to a node running from the database. An answer about a machine is
+	// worth much less without knowing how old it is, so the age comes back with it.
+	inv := fresh(t)
+	node, err := inv.AddNode(t.Context(), "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	before := time.Now().Add(-time.Second)
+	if err := inv.RecordOwned(t.Context(), node.ID, []string{"a"}); err != nil {
+		t.Fatal(err)
+	}
+
+	_, reported, err := inv.Owned(t.Context(), node.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reported.Before(before) {
+		t.Errorf("the report time is %s, which is before the report", reported)
+	}
+}