Stop nothing the mesh cannot replace, give the tunnel back on failure, and take it over after enrolment

Review of the ADR 0105 build (hq ADR 0105). The takeover stopped the found
unit and then found out whether the mesh's interface would do; a start that
failed left the machine with no tunnel at all.

Now nothing is stopped until the declared interface listens on the found port
at the found address and the key file it names holds the found key — the
refusal names the remedy — and a mesh interface that fails to start after the
takeover has the found unit started again, with the account saying so. The
account has three states (not taken, taken, down) and is given on every
takeover, failure included. An interface raised by hand is looked at again
for a moment and then refused naming `wg-quick down`. A found unit started
again by hand beside the mesh's is said, not stopped: on the hub it cannot
hold the port, and on a spoke two interfaces with one key would fight.

`mesh-host overlay take --tunnel <iface>` is the path for a node that
enrolled before the mesh knew to take a tunnel over: the found key becomes its
overlay key — identity, sealing and serving keys untouched, so nothing sealed
to the node is remade — and the mesh is told with a rekey signed by the
identity key, over the key left, the key taken and the tunnel. Told first,
written second, so a run again puts right whichever half did not happen.

internal/link/messages.go

@@ -1,6 +1,10 @@
 package link
 
-import "time"
+import (
+	"strconv"
+	"strings"
+	"time"
+)
 
 // The wire formats shared with the control plane, which defines them separately because this
 // binary requires nothing present and does not import it. A test on each side asserts the field
@@ -105,18 +109,64 @@ type Report struct {
 	// 0105): which interface, its port, range and peer count, whether the found interface is down
 	// and the mesh's up in its place, and where the found configuration's original was kept.
 	Tunnel *CarriedTunnel `json:"tunnel,omitempty"`
+
+	// Rekey is this node taking a found tunnel's key as its overlay key after enrolment (novox/hq
+	// ADR 0105). Not an account of the machine: a report carrying one says nothing else.
+	Rekey *Rekey `json:"rekey,omitempty"`
 }
 
-// CarriedTunnel is this node's account of the tunnel it took over.
+// CarriedTunnel is this node's account of the tunnel it took over. State is one of the Carried
+// states below; Note is what the host did about it, when it did something.
 type CarriedTunnel struct {
 	Interface string `json:"interface"`
 	Port      int    `json:"port"`
 	Range     string `json:"range"`
 	Peers     int    `json:"peers"`
-	Taken     bool   `json:"taken"`
+	State     string `json:"state"`
+	Note      string `json:"note,omitempty"`
 	Kept      string `json:"kept,omitempty"`
 }
 
+// The states a carried tunnel can be in: the found interface still up and the mesh's not; the
+// found one down and the mesh's up with its key; or the found one down and the mesh's not up — the
+// one state where the peers reach nothing, said as its own word so nothing reads it as either of
+// the others.
+const (
+	CarriedNotTaken = "not-taken"
+	CarriedTaken    = "taken"
+	CarriedDown     = "down"
+)
+
+// Rekey is this node saying it took a found tunnel's key as its overlay key after enrolling
+// (novox/hq ADR 0105): the path for a node that enrolled before the mesh knew to take a tunnel
+// over, since re-enrolling would rotate every key it holds. Signed with the identity key over
+// RekeyProof, so a report forged on a stolen broker account cannot move this node's overlay key.
+type Rekey struct {
+	// Previous is the overlay key this node held until now, as the mesh records it; the mesh
+	// refuses a rekey naming another, which is how a replayed one is refused.
+	Previous   string  `json:"previous"`
+	OverlayKey string  `json:"overlay_key"`
+	Tunnel     *Tunnel `json:"tunnel"`
+	Proof      []byte  `json:"proof"`
+}
+
+// RekeyProof is what a node signs when it rekeys — the node, the key it leaves, the key it takes
+// and the tunnel it took it from — so a proof cannot be moved to another node or another tunnel.
+// Byte for byte the mesh's own (mesh-controller internal/link RekeyProof).
+func RekeyProof(node, previous, key string, tunnel *Tunnel) []byte {
+	var t Tunnel
+	if tunnel != nil {
+		t = *tunnel
+	}
+	peers := make([]string, 0, len(t.Peers))
+	for _, p := range t.Peers {
+		peers = append(peers, p.PublicKey+"@"+p.Address)
+	}
+	return []byte("novox-mesh-rekey\x00" + node + "\x00" + previous + "\x00" + key + "\x00" +
+		t.Interface + "\x00" + t.Unit + "\x00" + t.Config + "\x00" + strconv.Itoa(t.Port) + "\x00" +
+		t.Address + "\x00" + t.Range + "\x00" + t.PublicKey + "\x00" + strings.Join(peers, ","))
+}
+
 // Held is one file or container found on an adopted node and kept as it was.
 type Held struct {
 	ID     string    `json:"id"`

internal/link/run.go

@@ -377,6 +377,39 @@ func handleBody(ctx context.Context, m Membership, body []byte, apply Applier) R
 }
 
 // publishReport tells the mesh what this node did, and says whether the broker took it.
+// Publish sends one report on this node's own connection and returns: the one-shot path for a
+// report a command makes rather than the running host — a rekey (novox/hq ADR 0105). The same
+// account, the same pinned certificate and the same exchange as the running host's reports.
+func Publish(ctx context.Context, m Membership, report Report, timeout time.Duration) error {
+	config, err := PinnedConfig(m.Fingerprint)
+	if err != nil {
+		return err
+	}
+	dsn := fmt.Sprintf("amqps://%s:%s@%s/",
+		url.QueryEscape(m.Node), url.QueryEscape(m.Password), m.Broker)
+	conn, err := amqp.DialConfig(dsn, amqp.Config{
+		TLSClientConfig: config,
+		Dial:            amqp.DefaultDial(timeout),
+	})
+	if err != nil {
+		if errors.Is(err, ErrWrongCertificate) {
+			return err
+		}
+		return fmt.Errorf("cannot reach the broker at %s: %w", m.Broker, err)
+	}
+	defer conn.Close()
+	channel, err := conn.Channel()
+	if err != nil {
+		return err
+	}
+	defer channel.Close()
+	var said string
+	if !publishReport(ctx, channel, m, report, func(s string) { said = s }, timeout) {
+		return errors.New(said)
+	}
+	return nil
+}
+
 func publishReport(ctx context.Context, channel *amqp.Channel, m Membership, report Report,
 	say Announce, timeout time.Duration) bool {
 	report.Node = m.Node