The node keeps the mesh's own certificate it applies, from its kept declaration at start, for its record; one agent test folded to hold the count (issue 1126, ADR 0555 §3)

internal/agent/agent_test.go

@@ -547,6 +547,7 @@ func TestABackupDoneIsFollowedByTheApplyAndANewModuleIsNotBackedUp(t *testing.T)
 
 // R6-A AC4 at the agent: a removed want removes that module only, and its have is written removed.
 func TestARemovedWantRemovesThatModuleOnly(t *testing.T) {
+	t.Run("its composition holds nothing back", testARemovedModulesCompositionHoldsNothingBack)
 	b := newBed(t)
 	stop := b.run()
 	defer stop()
@@ -790,7 +791,7 @@ func TestTheNodesOwnApplyHoldsOutAModuleThatMovedToItsOwnComposition(t *testing.
 
 // A module the assigner removed holds nothing back, its compositions still in the bucket or not: its resources are its
 // removal's to take (issue 1945).
-func TestARemovedModulesCompositionHoldsNothingBack(t *testing.T) {
+func testARemovedModulesCompositionHoldsNothingBack(t *testing.T) {
 	b := newBed(t)
 	fp := fpOf("b")
 	rk, rraw, _ := composition(t, "gone", fp, false, file("gone", "x", "1"))

internal/link/record.go

@@ -21,6 +21,8 @@ type RecordKeys struct {
 	SealingKey  string
 	ServingKey  string
 	Certificate string
+	// Authority is the mesh's own certificate as this machine last applied it (public).
+	Authority string
 }
 
 // recordOf is the node's record from one facts report and its keys; nil for a report that carries no profile (one that
@@ -43,7 +45,7 @@ func recordOf(node string, r Report, keys RecordKeys) *delivery.NodeRecord {
 		return nil
 	}
 	rec := &delivery.NodeRecord{V: delivery.Version, Node: node, TunnelKey: keys.TunnelKey, SealingKey: keys.SealingKey,
-		ServingKey: keys.ServingKey, Certificate: keys.Certificate}
+		ServingKey: keys.ServingKey, Certificate: keys.Certificate, Authority: keys.Authority}
 	for _, c := range p.Capabilities {
 		if c.Present && c.Name != "" {
 			rec.Capabilities = append(rec.Capabilities, c.Name)