fix(machine): the published address moves onto the interface that wears the rule sets, and what a machine answers on stops being a guess (#548)

[stephrobert]

Closes #548.

A server created with a public IP kept an unfiltered routed NIC beside its
private one: the group covered one and not the other. #573 made the emulator
honest about it, #581 measured a third path that works — and did not ship it,
because Inspect decided which address a machine "answers on" by taking the
first global IPv4 of the lowest-named interface, so moving the address would
have made Binding.Address report the private one.

That inference was the defect. Interface order is a convention, and what
varies here becomes a field: the pack already declares which block is public,
and #541 gave the layer PublicAddressOf / PrivateAddressOf for exactly this
question.

The reproduction, per mode, read on the NIC

From the API alone: group drop plus one rule on 443, server created with its
flexible IP, private NIC afterwards, listeners on 443 and 80, and 8080 bare as
the negative control.

	--vm incus-ovn	--vm incus
before	eth0 routed ipv4.address=203.0.113.2, no security.acls; eth1 managed with the group	identical, eth1 also carrying the drop default
	443 OPEN · 80 OPEN ← the escape · 8080 refused	443 OPEN · 80 OPEN · 8080 refused
after	eth0 routed, no address at all; eth1 ipv4.routes.external=203.0.113.2/32 and security.acls=scw-…	eth1 ipv4.routes=203.0.113.2/32 and security.acls
	443 OPEN · 80 refused · 8080 refused	443 OPEN · 80 timed out · 8080 timed out
after a restart	unchanged; eth1 carries 10.199.0.2/24 again	unchanged

The bridge had never been measured on this shape. It reproduced the escape
exactly, and the remedy holds there too — which is #574's lesson repaid: the
poorest population is the one that bites.

Step 1 was necessary and not sufficient, and that was measured rather than assumed

Machine.IP is gone; Machine.Addresses is the whole set, and
PublicAddressOf / PrivateAddressOf pick from it by the pack's declared block,
so interface order can no longer decide a kind.

That alone was not enough. After a reboot of a migrated machine:

• step 1 alone: the store recorded 10.199.0.2 — the private address only,
  because the boot records before the replay installs the addresses the plan
  promised. PublicAddressOf would have answered nothing.
• with the re-read (Binding.Rescan, at the end of Reconciler.PowerOn):
  10.199.0.2,203.0.113.2.

So the re-read is part of the delivery, and the pack's Settle hook moved after
it. That ordering was named by a test, not guessed: Outscale's
TestAStoppedVmKeepsItsPrivateAddress went red the moment the re-read landed and
the hook stayed.

A second regression the measurement caught: after a restart the guest had no
address on the hot-attached NIC — a pre-existing #549-family gap that until now
only cost the peered routes, because the public address rode its own NIC.
restoreGuestNetwork now restores what a device reserves, in both modes,
before the wait.

The skip is gone, and what replaced it is an assertion

functional.sh no longer skips the public half unconditionally. The assertion it
hid passes on both stacks, on every pass:

the station reaches platform-web-0 on 443 and is refused on 9090,
both listening inside

Both stacks gained a 9090 listener, declared as service.closed_port in
proof.json — and a stack that declares none fails, rather than quietly
proving less. What remains is a skip gated on a declared capability, new in
health schema 7: capabilities.firewall_public_when_joined.
firewall_public_only stays and stays false — still true of a machine with
nowhere to move an address.

Falsification

public-address-migration.json, 9 new mutations, plus retargets across
lifecycle-tells-the-truth, address-kind, routed-nic, interface-plan,
pack-firewall-handoff and balancer-dataplane — falsify:lint was carrying
8 dead mutations before this lot; 932 fragments apply now.

Every mutation compiled and reddened its test: migration ownership (instance
and network), the escape-only-if-it-carries condition, the hot-attach replay,
Inspect's full set, the stored-address parse, the pinned-address restore, the
re-read, and its refusal to overwrite with nothing.

And one falsification found a test that had stopped measuring its subject:
moving the restore in front of the wait made
TestAGuestThatNeverConfiguresItsInterfaceIsReported pass for the wrong reason.
Its fixture now answers every command and carries nothing.

Gates

prepush · conformance:leg -- probe · -- fields ·
FEINT_VM=incus mise run conformance:leg -- runtime (all four dataplane
suites) · FEINT_VM=incus-ovn mise run conformance:functional (3 passes, 112
oks, run twice — once mid-way, once on the final code) · the four named contract
tests and the fourth pack — all green. notInTheDriverSurface still empty.

What was not obtained

• FEINT_VM=incus-ovn conformance:leg -- runtime is red, and not from this
  branch. outscale/network.sh fails at "two Nets, a machine in each":
  feint-osc-… does not carry 10.184.1.4. feint was rebuilt from 8467c11 and
  the same suite run on the same station: identical failure. Pre-existing,
  OVN-only — the bridge leg passes it — and filed as The runtime leg fails on the maintainer's station and passes in CI, at a wait of 24 seconds for an address under OVN: a verdict that depends on the host #587. The leg stops there,
  so the exoscale and balancer suites did not run under OVN; they did under the
  bridge.
• Outbound from a migrated machine still does not work (ping answers
  nothing), the same before and after, station as the control. docs/limits.md
  now says so rather than repeating fix(store, scaleway): what a pack stores is what a snapshot gives back, and the VPC body answers the name Scaleway publishes today (#567, #570) #581's "outbound survives".
• mise run limits:check is red on main too, on the #277 section. Only the
  two sections actually audited were re-dated; re-dating fifty would claim a pass
  nobody made.
• conformance:stacks and the 27 other specs the plan named were not played;
  lint proves their fragments still apply and the nightly replays them.

Where testplan was wrong

It never named FEINT_VM=incus mise run conformance:leg -- runtime — only the
OVN one. The bridge is where the escape also lived, where the restart regression
also lived, and it is the only leg that got through the Outscale suite.

Its own closing paragraph, shipped an hour earlier in #588, says why: it routes
on paths, and the population is the half it cannot know.