[Purple10101]

Part 2 of 5, with owl-os#59, node-infra, retina-gui and retina-node all on 20260921-node-id-schema-v2. This is the one worth real scrutiny — the other four are tolerance widenings that provably change nothing today. This one changes runtime behaviour.

Two changes pulling opposite ways, deliberately

collect/identity.py widens. retg + 15 hex is accepted alongside ret + 8 hex. A node validates only its own id, so either format is judged correctly by the same rule, and a legacy node is unaffected by the new format existing elsewhere. That is what lets the fleet migrate one node at a time rather than at once.

wire/registration.py gates. The ingest spec still pins ^ret[0-9a-f]{8}$, and wire/models.py is generated from it, so a migrated node would otherwise build a payload the generated model rejects with a Pydantic validation error nobody can act on. Instead it is held back on purpose, with a message that names the spec rather than the board.

The gate opens by itself

spec_node_id_pattern() reads the pattern out of the generated model rather than repeating it. wire/models.py is derived from docs/node-ingest-v1.yml, which is the contract, so regenerating it against a spec that carries the current format lifts the gate with no code change here. A second copy of the pattern would be a second place to remember, and therefore the one that gets forgotten.

Only real ids are intercepted

"Unknown", the retina-node config placeholder and anything truncated are not nodes waiting on a spec. Claiming they were would send whoever read it hunting for a migration that never happened. They keep falling through to the generated model, whose validation error is the honest answer. Two existing tests caught this in an earlier draft of the guard and are the reason it is narrowed.

NodeState.NODE_ID_UNSUPPORTED

Sits directly below NO_IDENTITY and above the agreement and wizard gates. Those two are cleared by the owner doing something; this one is not, and telling someone to finish a wizard that cannot unblock them is worse than telling them nothing. It reaches the server in no form, because saying so needs a token.

An operator sees, verbatim:

this node has been migrated to the current node_id format, which the server's ingest spec does not carry yet. Registration is held back on purpose rather than attempted and rejected. The node is otherwise healthy and will register on its own once the spec accepts the format; nothing done here will help.

The consequence to be explicit about

From the moment this ships, any node built from a current image is telemetry-invisible until the spec moves. Not only migrated nodes. A fresh board enrols in Mender, gets a Cloudflare tunnel and reports inventory, and never registers.

That is the intended trade: a deliberate, self-explaining hold instead of a confusing failure. It is worth agreeing to explicitly rather than discovering.

retina-gui needs no change to show it

Checked: telemetry_status.py passes state and detail through verbatim, node_id_unsupported is not in TRANSIENT_STATES, and no template does state-specific rendering.

Verified

Full suite green, ruff check and ruff format --check clean. New tests cover the union pattern, the gate reading the generated model, the refusal naming the spec, the subclass so existing IncompletePayload handlers still catch it, the precedence of the new state, and that garbage still reaches Pydantic.

Vendors tests/node-id-test-vectors.json from owl-os with a test asserting this repo's pattern is the canonical one, so a drifted copy fails rather than looking authoritative.

Not verified

The container has never run on hardware. The gate has not been observed on a real node. Closes naturally in Wave 1 of the rollout, when the image ships via retina-node's TELEMETRY_V pin.

🤖 Generated with Claude Code

[Purple10101]

Closing: this work is not being taken forward. The branch is deleted, but the commits stay reachable from this closed PR if it is ever revived.