Keep a named push from sending builds a policy or a plan holds back

A named push flushed every other machine whose declaration differed from
what it was last sent (hq ADR 0083). Under an upgrade policy of `record`,
or a plan still waiting on its first machine (ADR 0218), every machine
running the module differs, so `push <one>` sent the held build to all of
them (hq issue 259).

Each send now records which build of each module it carried
(node.sent_builds, migration 0061). The cascade, and the bus holder added
to a named push, skip a machine any of whose modules would move to a
build its policy records or an open plan has not sent it, and say which
module, which build, why, and that `push <node>` sends it. A machine
whose last send was not recorded is held until it is named. The named
machine itself, a whole-mesh push and `push --behind` are unchanged.

internal/inventory/nodes.go

@@ -909,18 +909,53 @@ func (i *Inventory) LastReports(ctx context.Context) ([]Reported, error) {
 	return out, rows.Err()
 }
 
-// RecordSent keeps a digest of the declaration a machine was last sent.
+// RecordSent keeps a digest of the declaration a machine was last sent, and the build of each module
+// it carried.
 //
 // **A digest rather than the declaration.** The mesh can compute what a machine should be at any
 // moment; keeping a copy would be a second account of it, able to disagree with the first. What
 // cannot be recomputed is what was *actually sent*, and that is the whole difference between a
 // machine that is out of date and one that has never been told.
-func (i *Inventory) RecordSent(ctx context.Context, node, digest string) error {
+//
+// **And which build of each module** (novox/hq issue 259, ADR 0221): module name to the commit its
+// build was made from. A digest cannot say whether a machine differs because a module moved to a build
+// its upgrade policy holds back, or because of something a push made — a grant — and only the second
+// is a push's to send to a machine it did not name. Nil records that it is not known, as for a
+// declaration sent by hand.
+func (i *Inventory) RecordSent(ctx context.Context, node, digest string, builds map[string]string) error {
+	var carried *string
+	if builds != nil {
+		raw, err := json.Marshal(builds)
+		if err != nil {
+			return err
+		}
+		text := string(raw)
+		carried = &text
+	}
 	_, err := i.store.Pool().Exec(ctx,
-		`update node set sent = $2, sent_at = now() where id = $1`, node, digest)
+		`update node set sent = $2, sent_at = now(), sent_builds = $3::jsonb where id = $1`, node, digest, carried)
 	return err
 }
 
+// SentBuilds is the build of each module a machine was last sent, by its name: module to the commit
+// its build was made from (novox/hq issue 259). Known is false when that was not kept — a machine
+// last sent before it was, sent a declaration by hand, or one the mesh does not know.
+func (i *Inventory) SentBuilds(ctx context.Context, name string) (builds map[string]string, known bool, err error) {
+	var raw []byte
+	err = i.store.Pool().QueryRow(ctx, `select sent_builds from node where name = $1`, name).Scan(&raw)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, false, nil
+	}
+	if err != nil || raw == nil {
+		return nil, false, err
+	}
+	builds = map[string]string{}
+	if err := json.Unmarshal(raw, &builds); err != nil {
+		return nil, false, err
+	}
+	return builds, true, nil
+}
+
 // RecordSentBusUsers keeps a digest of the bus's user list a machine was just sent, by its name
 // (novox/hq issue 249): whether the machine holding the bus must go first is whether this differs
 // from the list composed now.