Let the mesh's resolver seat have several holders on record

musl takes the first reply from any listed nameserver, so a public fallback
beside the mesh's resolver answered NXDOMAIN for mesh names in every Alpine
container (hq ADR 0223). The fix is two mesh resolvers and no public one, which
needs mesh-dns-resolver held on two machines: a seat can now be replicated,
each holder recorded by 'seat <name> --add', checkClaims accepts every holder
on record and still refuses a second holder of any other mesh seat, a holder
answers its own requirement, and a roster fact gives each replicated seat's
holders, this machine first, so resolv-conf can list them. Migration 0062 keys
a holding by seat and assignment.

internal/inventory/seats.go

@@ -215,23 +215,50 @@ func (i *Inventory) RenameSeat(ctx context.Context, from, to string) error {
 	return nil
 }
 
-// HoldSeat records that one assignment holds a seat, replacing whoever held it — as one write, so
-// the seat is never without a holder in between (novox/hq ADR 0131, design 28 task 5.3). The
-// assignment must exist; the store refuses otherwise, and that refusal is the right one: a seat
-// cannot be handed to something that is not running anywhere.
+// HoldSeat records that one assignment holds a seat, replacing whoever held it — every holder, for a
+// replicated seat (novox/hq ADR 0223) — as one transaction, so the seat is never without a holder in
+// between (novox/hq ADR 0131, design 28 task 5.3). The assignment must exist; the store refuses
+// otherwise, and that refusal is the right one: a seat cannot be handed to something that is not
+// running anywhere.
 func (i *Inventory) HoldSeat(ctx context.Context, seat, scope, nodeName, module string) error {
 	node, err := i.NodeByName(ctx, nodeName)
 	if err != nil {
 		return err
 	}
-	_, err = i.store.Pool().Exec(ctx,
-		`insert into seat_holding (seat, scope, node, module) values ($1, $2, $3, $4)
-		 on conflict (seat) do update set scope = excluded.scope, node = excluded.node,
-		   module = excluded.module, since = now()`,
-		seat, scope, node.ID, module)
+	tx, err := i.store.Pool().Begin(ctx)
 	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback(context.WithoutCancel(ctx)) }()
+	if _, err := tx.Exec(ctx,
+		`delete from seat_holding where seat = $1 and not (node = $2 and module = $3)`,
+		seat, node.ID, module); err != nil {
+		return fmt.Errorf("handing %s to %s on %s: %w", seat, module, nodeName, err)
+	}
+	if _, err := tx.Exec(ctx,
+		`insert into seat_holding (seat, scope, node, module) values ($1, $2, $3, $4)
+		 on conflict (seat, node, module) do update set scope = excluded.scope, since = now()`,
+		seat, scope, node.ID, module); err != nil {
 		return fmt.Errorf("recording %s on %s as the holder of %s: %w", module, nodeName, seat, err)
 	}
+	return tx.Commit(ctx)
+}
+
+// AddSeatHolder records one more assignment holding a replicated seat, beside those already on
+// record (novox/hq ADR 0223). Whether the seat may have several holders is the caller's to judge —
+// the seat's definition is compiled, and the store holds no column for it. Recording a holder
+// already on record changes nothing.
+func (i *Inventory) AddSeatHolder(ctx context.Context, seat, scope, nodeName, module string) error {
+	node, err := i.NodeByName(ctx, nodeName)
+	if err != nil {
+		return err
+	}
+	if _, err := i.store.Pool().Exec(ctx,
+		`insert into seat_holding (seat, scope, node, module) values ($1, $2, $3, $4)
+		 on conflict (seat, node, module) do nothing`,
+		seat, scope, node.ID, module); err != nil {
+		return fmt.Errorf("adding %s on %s as a holder of %s: %w", module, nodeName, seat, err)
+	}
 	return nil
 }
 
@@ -240,7 +267,7 @@ func (i *Inventory) HoldSeat(ctx context.Context, seat, scope, nodeName, module
 func (i *Inventory) Holdings(ctx context.Context) ([]catalogue.Held, error) {
 	rows, err := i.store.Pool().Query(ctx,
 		`select h.seat, h.scope, n.name, h.module, coalesce(n.site, '')
-		   from seat_holding h join node n on n.id = h.node order by h.seat`)
+		   from seat_holding h join node n on n.id = h.node order by h.seat, n.name, h.module`)
 	if err != nil {
 		return nil, err
 	}