Publish a reconcile report when what is reachable changed, so the controller's converge preview stays fresh (hq ADR 0100)

cmd/mesh-host/main.go

@@ -669,12 +669,18 @@ type adoptionWatch struct {
 	last string
 }
 
-// fingerprint is what a report says about adoption: each hold and whether it changed, and the
-// firewall.
+// fingerprint is what a report says about adoption: each hold and whether it changed, the
+// firewall, and what is reachable on the machine — which only an adopted node reports, and which
+// is what the controller previews a flip from, so a port that opens or closes between deliveries
+// must reach it too (novox/hq ADR 0100).
 func adoptionFingerprint(r link.Report) string {
 	parts := []string{"firewall=" + r.Firewall}
 	for _, h := range r.Held {
-		parts = append(parts, h.ID+"="+h.Changed)
+		parts = append(parts, "held "+h.ID+"="+h.Changed)
+	}
+	for _, reach := range r.Reachable {
+		parts = append(parts, fmt.Sprintf("reach %s %s:%d %s %v %d", reach.Protocol, reach.Address,
+			reach.Port, reach.By, reach.Published, reach.ContainerPort))
 	}
 	sort.Strings(parts[1:])
 	return strings.Join(parts, "\n")