Refuse a declaration composed from an older assignment generation than the machine applied (hq issue 234)

A newer sequence carrying an older view of the assignments undeclared four
assigned modules on 2026-10-04; the sequence cannot tell it, the generation
can. The engine keeps the highest generation it applied, refuses an older one
before reading the machine unless the declaration is a gate's put-back, and
says the refusal in its report so the controller can name the sender. A
declaration without a generation is applied as before, and every report says
it reads one, so the controller sends it only to engines that do.

internal/link/queue.go

@@ -211,6 +211,12 @@ func (q *Queue) step(ctx context.Context) bool {
 		q.Say(fmt.Sprintf("refused declaration %s (%s): this node applied %s, from a newer lease "+
 			"holder — %d refused as older so far", short(report.Declared), report.Order.Words(),
 			report.OlderThan.Words(), total))
+	case report.OlderGeneration != nil:
+		// Said here, and the report names it, so the controller raises it naming the sender (novox/hq
+		// issue 234). Not counted with the lease's refusals: those are S13's, by epoch.
+		q.Say(fmt.Sprintf("refused declaration %s (%s): it was composed from assignment generation %d, and "+
+			"this node applied generation %d", short(report.Declared), report.Order.Words(),
+			report.OlderGeneration.Generation, report.OlderGeneration.Applied))
 	case report.Refused != "":
 		q.Say("refused a declaration: " + report.Refused)
 	case len(report.Failed) > 0:
@@ -228,7 +234,7 @@ func (q *Queue) step(ctx context.Context) bool {
 	// A refusal as older is not kept to be said again: what the mesh waits for from this node is the
 	// account of the last apply, and that is still what is kept.
 	kind := applied
-	if report.OlderThan != nil {
+	if report.OlderThan != nil || report.OlderGeneration != nil {
 		kind = refusedOlder
 	}
 	q.tell(ctx, report, kind, latest)
@@ -336,6 +342,9 @@ func (q *Queue) stamp(r Report) Report {
 	r.Node = q.Membership.Node
 	r.ReportSequence = q.numbers.sequence
 	r.RefusedOlder = q.numbers.refused
+	// Every report of a node-engine that orders its reports says it reads a generation (novox/hq issue
+	// 234): this build does, and the controller sends one only to a machine that said so.
+	r.ReadsGeneration = true
 	return r
 }