Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

Two controllers could both act (issue 204), a reconcile's report could
overtake the apply after it and the digest decided (issue 267), and a grant
could make a second writer of a machine's report.

- The lease (internal/lease, ADR 0229): mesh-controller_lease key `holder`,
  15 s age, renewed every 5 s by compare-and-set; the epoch is the revision
  it was taken at. The gate is the clock (stops 3 s before expiry); a refused
  renewal is a loss and the process exits; a holder that stops gives it back.
  serve takes it before asserting the bus. Epochs kept in the store
  (migration 0068 controller_epoch) as a floor: a bucket raised from nothing
  is compacted past it. Unleased (no epoch, S12 urgent) only when nobody
  holds it and the bus will not let it be written. A shell command acts
  under the holder's epoch, or its own lease when none.
- Declarations carry `epoch` inside the signed envelope, only to a machine
  whose latest account carried a report_sequence (mesh-host #35); would-send
  is composed with the epoch last sent. Allot and the send both pass the gate.
- Reports: contract in internal/link/order.go (epoch, sequence,
  report_sequence, older_than, refused_older). Accounts kept by epoch, then
  sequence, then report sequence; older refused, counted; unordered reports
  keep the digest rule. Plans by compare-and-set on a revision, with epoch.
  Conditions and calls carry the epoch and are not written off the lease.
- S12 and S13 (naming the writer by epoch) watched, D5 run; reset of the
  bucket said. Writers table compiled in and enforced in PermissionsFor; the
  controller no longer publishes mesh.control.>. A contract per consumed
  kind, and the empty-on-error lint over the repository.
- mesh-host pinned to its main with the epoch in the validator (D1 validates
  the envelope as sent).

Needs mesh-host's genesis lock with the lease grant (mesh-host PR) for
TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose.

cmd/mesh-controller/queue_test.go

@@ -64,7 +64,7 @@ func TestAFailedPlanIsRetriedAndGoesOnThroughItsLaterTiers(t *testing.T) {
 		Note: "a failed to build in tier 0",
 		Modules: map[string]*inventory.PlanModule{"a": {State: "failed", AskedAt: &before, Build: "build-1",
 			Why: link.KilledByHand}}}
-	if err := open.inventory.SavePlan(ctx, failed); err != nil {
+	if err := open.inventory.SavePlan(ctx, &failed); err != nil {
 		t.Fatal(err)
 	}
 
@@ -156,7 +156,7 @@ func TestARebuildJoinsThePlanHoldingTheModule(t *testing.T) {
 		Created: before, State: inventory.PlanFailed, Tiers: [][]string{{"a"}, {"b"}},
 		Note:    "a failed to build in tier 0",
 		Modules: map[string]*inventory.PlanModule{"a": {State: "failed", AskedAt: &before, Build: "build-1", Why: link.CancelledByHand}}}
-	if err := open.inventory.SavePlan(ctx, failed); err != nil {
+	if err := open.inventory.SavePlan(ctx, &failed); err != nil {
 		t.Fatal(err)
 	}
 	if err := rebuildCommand(ctx, []string{"a"}); err != nil {
@@ -433,7 +433,7 @@ func TestCancelDeletesTheAskAndFailsThePlanThatAskedIt(t *testing.T) {
 	plan := inventory.Plan{ID: "plan-cancel", Repository: "novox/a", Commit: "c0ffee", Created: asked,
 		State: inventory.PlanBuilding, Tiers: [][]string{{"a"}, {"b"}},
 		Modules: map[string]*inventory.PlanModule{"a": {State: "asked", AskedAt: &asked, Build: id}}}
-	if err := open.inventory.SavePlan(ctx, plan); err != nil {
+	if err := open.inventory.SavePlan(ctx, &plan); err != nil {
 		t.Fatal(err)
 	}
 
@@ -631,21 +631,21 @@ func TestAPlanStoppedAtItsFirstMachineIsRetried(t *testing.T) {
 		Note: "a stopped at its first machine in tier 0: laptop refused what it was sent",
 		Modules: map[string]*inventory.PlanModule{"a": {State: "built", BuiltAt: &long, Commit: "c0ffee",
 			First: []string{"laptop"}, FirstAt: &long, Why: "laptop refused what it was sent"}}}
-	if err := open.inventory.SavePlan(ctx, stopped); err != nil {
+	if err := open.inventory.SavePlan(ctx, &stopped); err != nil {
 		t.Fatal(err)
 	}
 
 	// A newer plan holding a refuses it: sending the older build would put it back.
 	newer := inventory.Plan{ID: "plan-newer", Repository: "novox/other", Commit: "d00d", Created: long.Add(time.Hour),
 		State: inventory.PlanDone, Tiers: [][]string{{"a"}}, Modules: map[string]*inventory.PlanModule{}}
-	if err := open.inventory.SavePlan(ctx, newer); err != nil {
+	if err := open.inventory.SavePlan(ctx, &newer); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := retryPlan(ctx, open, stopped.ID); err == nil || !strings.Contains(err.Error(), "plan-newer") {
 		t.Fatalf("retried under a newer plan: %v", err)
 	}
 	newer.State = inventory.PlanSuperseded
-	if err := open.inventory.SavePlan(ctx, newer); err != nil {
+	if err := open.inventory.SavePlan(ctx, &newer); err != nil {
 		t.Fatal(err)
 	}
 
@@ -683,7 +683,7 @@ func TestAPlanIsAnsweredOnlyByTheBuildItAskedFor(t *testing.T) {
 	plan := inventory.Plan{ID: "plan-own", Repository: "novox/a", Commit: "c0ffee", Created: asked,
 		State: inventory.PlanBuilding, Tiers: [][]string{{"a"}},
 		Modules: map[string]*inventory.PlanModule{"a": {State: "asked", AskedAt: &asked, Build: "build-own"}}}
-	if err := open.inventory.SavePlan(ctx, plan); err != nil {
+	if err := open.inventory.SavePlan(ctx, &plan); err != nil {
 		t.Fatal(err)
 	}
 	planBuilt(ctx, open, "a", "0ldc0mm1t", "", time.Now().UTC(), "build-replay")