Walk a stopped walk's merges again in the open batch, in one act, and say what stays on the machines (review of #232, hq issue 459)

A new batch beside the open one walked an older commit after a newer one, and a
stop that failed partway could leave a merge on two plans. A module shared with
the stopped merge, built at its branch, would deliver it; it is left out or
withheld. A batch not yet cut can drop a merge, so mesh-delivery can stop a
merge walked again. The stopped walk names what it left on which machines.

cmd/mesh-controller/plan_retry.go

@@ -278,6 +278,13 @@ func retryPlan(ctx context.Context, open *stores, id string) (string, error) {
 	plans = append(plans, recent...)
 	// **A failed walk whose earlier merges are walked alone is not retried** (novox/hq ADR 0276): the search for
 	// the merge that brought the failure answers them now, and a retried walk would name them twice.
+	// **A walk stopped without some merges is not retried** (novox/hq ADR 0299): the merges it left out were stopped,
+	// and the others are another walk's now.
+	if p.Delivery != nil && (p.Delivery.WalkedAgainBy != "" || len(p.Delivery.LeftOut) > 0) {
+		return "", fmt.Errorf("%s was stopped without %s: those merges were stopped, and %s walks the others; a "+
+			"newer merge, or `rebuild <module>`, builds again", p.ID, mergesLeftOutWords(p.Delivery.LeftOut),
+			orWords(p.Delivery.WalkedAgainBy, "nothing"))
+	}
 	if p.Delivery != nil && len(p.Delivery.Merges) > 0 {
 		kept, err := inv.MergesOf(ctx, p.ID)
 		if err != nil {