Refuse a declaration composed from an older assignment generation than the machine applied (hq issue 234)

A newer sequence carrying an older view of the assignments undeclared four
assigned modules on 2026-10-04; the sequence cannot tell it, the generation
can. The engine keeps the highest generation it applied, refuses an older one
before reading the machine unless the declaration is a gate's put-back, and
says the refusal in its report so the controller can name the sender. A
declaration without a generation is applied as before, and every report says
it reads one, so the controller sends it only to engines that do.

internal/link/queue_test.go

@@ -540,3 +540,26 @@ func TestALinkIsNotHeldForAReconcileInHand(t *testing.T) {
 		t.Fatalf("a report was said on a link let go: %+v", l.said())
 	}
 }
+
+// **Every report says this node-engine reads a declaration's generation** (novox/hq issue 234): the
+// controller sends one only to a machine that said so, because an older node-engine refuses the key.
+func TestEveryReportSaysItReadsAGeneration(t *testing.T) {
+	m, key := aMember(t)
+	l := newQuietLink()
+	a := &applies{}
+	q := aQueue(m, a.apply, &keptInMemory{})
+	q.attach(context.Background(), l)
+	q.Deliver(ordered(t, key, "new", 7, 12))
+	ctx, stop := context.WithCancel(context.Background())
+	worker := runWorker(ctx, q)
+	eventually(t, "the delivery was never reported", func() bool { return len(l.said()) == 1 })
+	stop()
+	<-worker
+	raw, err := json.Marshal(l.said()[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(raw), `"reads_generation":true`) {
+		t.Fatalf("the report does not say it reads a generation: %s", raw)
+	}
+}