Walk a stopped walk's merges again in the open batch, in one act, and say what stays on the machines (review of #232, hq issue 459)

A new batch beside the open one walked an older commit after a newer one, and a
stop that failed partway could leave a merge on two plans. A module shared with
the stopped merge, built at its branch, would deliver it; it is left out or
withheld. A batch not yet cut can drop a merge, so mesh-delivery can stop a
merge walked again. The stopped walk names what it left on which machines.

internal/inventory/plans.go

@@ -111,6 +111,12 @@ type PlanBatch struct {
 	// a merge never shares a batch with one that waits for mesh-delivery's (ADR 0276, decided during the
 	// build, 2026-10-10).
 	Own bool `json:"own,omitempty"`
+	// Closed says the window was closed by a stop that walks a stopped walk's merges again in this batch: they
+	// were heard before, and an older commit never waits behind a newer one (novox/hq ADR 0299). Withheld are
+	// the modules a stopped merge moves: built at the branch, which holds that merge, they would deliver it, so
+	// the batch's walk does not build them.
+	Closed   bool     `json:"closed,omitempty"`
+	Withheld []string `json:"withheld,omitempty"`
 }
 
 // OwnPath says the record is a batch of merges on the controller's own path.
@@ -192,6 +198,9 @@ type PlanDelivery struct {
 	// ends stopped with the walk, one of a merge walked again follows that batch's walk.
 	WalkedAgainBy string        `json:"walked_again_by,omitempty"`
 	LeftOut       []PlanLeftOut `json:"left_out,omitempty"`
+	// Kept are the modules the stopped walk already sent and nothing walks again: the machines named keep running
+	// the stopped walk's build (novox/hq ADR 0299).
+	Kept []PlanKept `json:"kept,omitempty"`
 	// Batch is the window of a batch; nil once it is cut into a walk.
 	Batch *PlanBatch `json:"batch,omitempty"`
 	// Alone says the walk walks one merge on its own commit, after a failed walk carried it in a later one:
@@ -205,8 +214,18 @@ type PlanDelivery struct {
 type PlanLeftOut struct {
 	Repository string `json:"repository"`
 	Commit     string `json:"commit"`
-	// Contains is the stopped merge a later merge contains; empty for a merge stopped itself.
+	// Contains is the stopped merge a later merge contains, or whose modules it shares; empty for a merge
+	// stopped itself.
 	Contains string `json:"contains,omitempty"`
+	// Shares are the modules it moves that a stopped merge moves too: built at the branch, which holds the stopped
+	// merge, they would deliver it.
+	Shares []string `json:"shares,omitempty"`
+}
+
+// PlanKept is a module a stopped walk sent and nothing walks again, and the machines it reached.
+type PlanKept struct {
+	Module   string   `json:"module"`
+	Machines []string `json:"machines"`
 }
 
 // Waiting is whether the walk waits for its delivery's word.
@@ -400,39 +419,28 @@ func (p Plan) Open() bool { return p.State == PlanBuilding || p.State == PlanRol
 // with ErrPlanMoved otherwise; and only by a process that may act (ActsUnder), whose epoch it records.
 // On success p's revision and epoch are the ones written, so the caller may save it again.
 func (i *Inventory) SavePlan(ctx context.Context, p *Plan) error {
+	return i.SavePlansMoving(ctx, []*Plan{p}, nil)
+}
+
+// MergeMove is a merge given to the plan that answers it now (novox/hq ADR 0276).
+type MergeMove struct {
+	Repository, Commit, Plan string
+	Alone                    bool
+}
+
+// SavePlansMoving writes plans, as SavePlan does each, and gives merges to the plans that answer them, all in one
+// transaction: every write and move, or none (novox/hq ADR 0299 decision 7 — a stop that walks merges again never
+// leaves a merge answered by two plans, nor a walk stopped whose merges were not moved). A plan written by
+// somebody else since it was read refuses the whole act with ErrPlanMoved. Each plan is said (PlanSaved) once
+// the transaction is committed, in order.
+func (i *Inventory) SavePlansMoving(ctx context.Context, plans []*Plan, moves []MergeMove) error {
 	epoch, err := i.actingEpoch(ctx)
 	if err != nil {
-		return fmt.Errorf("the plan for %s %s is not written: %w", p.Repository, p.Commit, err)
-	}
-	tiers, err := json.Marshal(p.Tiers)
-	if err != nil {
+		if len(plans) > 0 {
+			return fmt.Errorf("the plan for %s %s is not written: %w", plans[0].Repository, plans[0].Commit, err)
+		}
 		return err
 	}
-	modules, err := json.Marshal(p.Modules)
-	if err != nil {
-		return err
-	}
-	var release, delivery, commits, times []byte
-	if p.Times != nil {
-		if times, err = json.Marshal(p.Times); err != nil {
-			return err
-		}
-	}
-	if len(p.Commits) > 0 {
-		if commits, err = json.Marshal(p.Commits); err != nil {
-			return err
-		}
-	}
-	if p.Release != nil {
-		if release, err = json.Marshal(p.Release); err != nil {
-			return err
-		}
-	}
-	if p.Delivery != nil {
-		if delivery, err = json.Marshal(p.Delivery); err != nil {
-			return err
-		}
-	}
 	// **And how long the tier it left took** (novox/hq to-be 45 Phase 0): measured here, where the
 	// plan moves, in the same transaction as the move, so no save can move a tier unmeasured or
 	// measure one twice.
@@ -441,9 +449,77 @@ func (i *Inventory) SavePlan(ctx context.Context, p *Plan) error {
 		return err
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
+	type written struct {
+		revision int64
+		entered  time.Time
+	}
+	done := make([]written, len(plans))
+	for n, p := range plans {
+		revision, entered, err := writePlan(ctx, tx, p, epoch)
+		if err != nil {
+			return err
+		}
+		done[n] = written{revision, entered}
+	}
+	for _, m := range moves {
+		if _, err := tx.Exec(ctx,
+			`update batched_merge set plan_id = nullif($3, ''), alone = $4 where repository = lower($1) and commit_hash = $2`,
+			m.Repository, m.Commit, m.Plan, m.Alone); err != nil {
+			return err
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return err
+	}
+	for n, p := range plans {
+		p.Revision, p.TierEntered = done[n].revision, done[n].entered
+		if epoch != nil {
+			p.Epoch = uint64(*epoch)
+		} else {
+			p.Epoch = 0
+		}
+		if PlanSaved != nil {
+			PlanSaved(*p)
+		}
+	}
+	return nil
+}
+
+// writePlan writes one plan within a transaction, by compare-and-set on its revision: its new revision, and when
+// it entered its tier.
+func writePlan(ctx context.Context, tx pgx.Tx, p *Plan, epoch *int64) (int64, time.Time, error) {
+	tiers, err := json.Marshal(p.Tiers)
+	if err != nil {
+		return 0, time.Time{}, err
+	}
+	modules, err := json.Marshal(p.Modules)
+	if err != nil {
+		return 0, time.Time{}, err
+	}
+	var release, delivery, commits, times []byte
+	if p.Times != nil {
+		if times, err = json.Marshal(p.Times); err != nil {
+			return 0, time.Time{}, err
+		}
+	}
+	if len(p.Commits) > 0 {
+		if commits, err = json.Marshal(p.Commits); err != nil {
+			return 0, time.Time{}, err
+		}
+	}
+	if p.Release != nil {
+		if release, err = json.Marshal(p.Release); err != nil {
+			return 0, time.Time{}, err
+		}
+	}
+	if p.Delivery != nil {
+		if delivery, err = json.Marshal(p.Delivery); err != nil {
+			return 0, time.Time{}, err
+		}
+	}
 	entered, err := planTierLeft(ctx, tx, *p, time.Now())
 	if err != nil {
-		return err
+		return 0, time.Time{}, err
 	}
 	var revision int64
 	err = tx.QueryRow(ctx,
@@ -464,24 +540,9 @@ func (i *Inventory) SavePlan(ctx context.Context, p *Plan) error {
 		// The row is there and at another revision — moved since this was read, or there already
 		// when this one is new: either way not this writer's to overwrite. (A plan saved before plans
 		// had revisions is at zero, and its first save here is from a read at zero.)
-		return fmt.Errorf("the plan for %s %s (%s) is not written: %w", p.Repository, short(p.Commit), p.ID, ErrPlanMoved)
+		return 0, time.Time{}, fmt.Errorf("the plan for %s %s (%s) is not written: %w", p.Repository, short(p.Commit), p.ID, ErrPlanMoved)
 	}
-	if err != nil {
-		return err
-	}
-	if err := tx.Commit(ctx); err != nil {
-		return err
-	}
-	p.Revision, p.TierEntered = revision, entered
-	if epoch != nil {
-		p.Epoch = uint64(*epoch)
-	} else {
-		p.Epoch = 0
-	}
-	if PlanSaved != nil {
-		PlanSaved(*p)
-	}
-	return nil
+	return revision, entered, err
 }
 
 // short is a commit as a person reads it.