A machine waiting to be enrolled is not a broken one

The launcher already ran `host run`, and `run` on a machine with no identity
exited with an error. So a freshly installed host, sitting exactly as intended
waiting for somebody to bring it a token, would have counted three failed
starts and rolled back its own installation.

It waits now, and says what it is waiting for. That is the *hosted* state from
the lifecycle: the host is running, it has no identity, and there is nobody to
link to. Every machine passes through it.

An identity that exists and cannot be read is still a fault rather than a wait.
Treating that as "not enrolled yet" would leave a node sitting quietly for ever
while the mesh believes it is a member.

Also: a node now says it is there once a minute. Nothing but its name, because
anything more would be a report, and reports are rare where this is constant --
reading one as the other would make a quiet node look like a stale one. Not
published mandatory, unlike a report: losing one is nothing, the next is a
minute away, and the mesh reads a gap rather than counting arrivals.

Verified in the lab: a node was stopped and the mesh said "out of touch 4m",
then it was started and the mesh said "here" again, without anything else being
touched.

cmd/mesh-host/main.go

@@ -535,14 +535,20 @@ func firstNonEmpty2(values ...[]byte) []byte {
 // is down it is disconnected, which is an ordinary situation rather than a failure — the machine
 // keeps running whatever it was last told, from its own store.
 func runLink(ctx context.Context, opts options) error {
-	mine, err := identity.Load(identity.Path(opts.state))
-	if errors.Is(err, identity.ErrNoIdentity) {
-		return errors.New("this machine has not joined a mesh. Enrol it first: " +
-			"mesh-host enrol --token <token> --name <name>")
-	}
+	// A machine that has not enrolled waits here rather than failing. It is *hosted*: the host is
+	// running, it has no identity, and there is nobody to link to — an ordinary state, and the
+	// one every machine passes through (novox/hq 09-the-node-lifecycle).
+	//
+	// Exiting instead would be worse than untidy. The launcher counts a failed start, and three
+	// of them roll the binary back — so a freshly installed host, waiting to be enrolled exactly
+	// as intended, would undo its own installation.
+	mine, err := waitForEnrolment(ctx, opts)
 	if err != nil {
 		return err
 	}
+	if mine.Node == "" {
+		return nil // asked to stop while waiting
+	}
 
 	fmt.Printf("node %s, linking to %s\n", mine.Node, mine.Membership.Broker)
 
@@ -668,3 +674,38 @@ func applyAndKeep(ctx context.Context, opts options, raw []byte, signed *store.D
 	}
 	return report
 }
+
+// waitForEnrolment returns this node's identity, waiting for one if it has none.
+//
+// It applies the carried bundle first, if there is one, because that is what a first node does
+// before there is a mesh at all — and a machine that has been installed and not yet enrolled
+// should still be whatever its bundle says it is.
+func waitForEnrolment(ctx context.Context, opts options) (identity.Identity, error) {
+	const look = 5 * time.Second
+
+	said := false
+	for {
+		mine, err := identity.Load(identity.Path(opts.state))
+		if err == nil {
+			return mine, nil
+		}
+		if !errors.Is(err, identity.ErrNoIdentity) {
+			// An identity that exists and cannot be read is a fault, not a wait. Treating it as
+			// "not enrolled yet" would leave a node sitting quietly for ever while the mesh
+			// believes it is a member.
+			return identity.Identity{}, err
+		}
+
+		if !said {
+			fmt.Println("this machine has not joined a mesh, and is waiting to be told which one.")
+			fmt.Println("  enrol it with: mesh-host enrol --token <token> --name <name>")
+			said = true
+		}
+
+		select {
+		case <-ctx.Done():
+			return identity.Identity{}, nil
+		case <-time.After(look):
+		}
+	}
+}