The node agent writes what the machine observes of itself as its record in its own have key, only when it changed (issue 1126, ADR 0555 §3)

cmd/mesh-host/main.go

@@ -1115,6 +1115,8 @@ func runLink(ctx context.Context, opts options) error {
 	proof := &proving{statePath: opts.state, version: runningVersion(), say: say}
 	queue := &link.Session{
 		Membership: membership,
+		// And the public halves and certificate its record says (novox/hq ADR 0555 §3), read at each facts report.
+		Keys: recordKeys(opts.state),
 		// And the first have this build writes is what proves it to the launcher (ADR 0539 §9, ADR 0227 §8).
 		HaveWritten: proof.haveWritten,
 		// And the operator's hand-over of a directory used as found, carried by the controller from the
@@ -2131,3 +2133,25 @@ func newlyMissing(last map[string]bool, st liveness.Statement) ([]string, map[st
 	}
 	return missingModules(fresh), now
 }
+
+// recordKeys reads the public halves of the node's keys and the certificate the mesh issued for its internal name from
+// its state directory (novox/hq ADR 0555 §3): what the node's record says of them. A key that cannot be read is left
+// empty, never invented; the certificate is there only after the first declaration that carried it.
+func recordKeys(state string) func() link.RecordKeys {
+	return func() link.RecordKeys {
+		var k link.RecordKeys
+		if id, err := identity.Load(identity.Path(state)); err == nil {
+			k.TunnelKey = id.Overlay.Public
+		}
+		if sk, err := identity.LoadSealingKey(identity.SealingKeyPath(state)); err == nil {
+			k.SealingKey = sk.Public
+		}
+		if sv, err := identity.LoadServingKey(identity.ServingKeyPath(state)); err == nil {
+			k.ServingKey = sv.Public
+		}
+		if cert, err := os.ReadFile(identity.CertificatePath(state)); err == nil {
+			k.Certificate = string(cert)
+		}
+		return k
+	}
+}