Say in every declaration the assignment generation it came from, and record every send (hq issue 234)

A declaration newer in sequence than every other named four fewer modules
than the assignments held, a machine applied it, and nothing the mesh kept
said who sent it or from what view. The store now raises an assignment
generation in the same transaction as every assignment change (a trigger,
so a cascade counts too); a send reads it before composing, carries it to
engines that said they read it, marks a gate's put-back, and is recorded
with its sequence, sender, generation and modules. The would-send is
stamped with what was last sent, so nothing reads behind for it; a refusal
is kept on the send it refused and raised as S20 naming the sender; plan
says what the machine was last told.

cmd/mesh-controller/push.go

@@ -356,10 +356,18 @@ func declare(ctx context.Context, args []string) error {
 	// the mesh did not compose it, so a push that does not name this machine treats it as held.
 	// The epoch it carried, if a person wrote one in, is what the machine heard.
 	var carried struct {
-		Epoch uint64 `json:"epoch"`
+		Epoch      uint64 `json:"epoch"`
+		Sequence   int64  `json:"sequence"`
+		Generation int64  `json:"generation"`
+		PutBack    bool   `json:"put_back"`
 	}
 	_ = json.Unmarshal(raw, &carried)
-	if _, err := recordSent(ctx, inv, node, raw, nil, carried.Epoch); err != nil {
+	// And recorded as every send is (novox/hq issue 234): by hand, from what it carried; the modules it
+	// named are not known, since the mesh did not compose it.
+	if _, err := recordSent(ctx, inv, node, raw, nil, carried.Epoch, sentRecord{sequence: carried.Sequence,
+		epoch: carried.Epoch, generation: carried.Generation, putBack: carried.PutBack,
+		toldGeneration: carried.Generation, toldPutBack: carried.PutBack,
+		sender: senderOf(callerOf(ctx)) + ", a declaration sent by hand"}); err != nil {
 		return err
 	}
 	fmt.Printf("sent %s a signed declaration (%d bytes)\n", node, len(raw))
@@ -798,7 +806,7 @@ func composeEach(names []string, allot func(node string) (order, error),
 			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
 			continue
 		}
-		declared.Sequence, declared.Epoch = numbered.sequence, numbered.epoch
+		numbered.stamp(&declared)
 		if len(declared.Resources) == 0 {
 			// Sent, not skipped (novox/hq issue 127). A node whose declaration composes to
 			// nothing may have HELD something before — the broker opening a placement gave it,
@@ -1016,7 +1024,8 @@ func (b overTheBus) declare(ctx context.Context, s readyNode, body []byte) (stri
 	}
 	// After it is away, not before. A digest recorded for something that failed to send would make
 	// the machine look current for a declaration it never received.
-	digest, err := recordSent(ctx, b.open.inventory, s.node, body, s.declared.Builds, s.declared.Epoch)
+	digest, err := recordSent(ctx, b.open.inventory, s.node, body, s.declared.Builds, s.declared.Epoch,
+		sentRecordOf(ctx, s.declared))
 	if err != nil {
 		return "", err
 	}
@@ -1228,7 +1237,7 @@ func sendToEach(ctx context.Context, open *stores, names []string) ([]string, er
 			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
 			continue
 		}
-		declared.Sequence, declared.Epoch = numbered.sequence, numbered.epoch
+		numbered.stamp(&declared)
 		reportLeftOut(name, declared)
 		sending = append(sending, readyNode{name, declared})
 	}
@@ -1393,6 +1402,11 @@ func wouldSendFrom(ctx context.Context, open *stores,
 		if declared.Epoch, err = open.inventory.SentEpoch(ctx, n.ID); err != nil {
 			return nil, err
 		}
+		// And the generation and put-back mark it was last sent, for the same reason (novox/hq issue 234):
+		// an assignment elsewhere in the mesh is not a change of this machine.
+		if declared.Generation, declared.PutBack, err = open.inventory.SentGeneration(ctx, n.ID); err != nil {
+			return nil, err
+		}
 		body, err := declared.Body()
 		if err != nil {
 			return nil, err
@@ -1531,6 +1545,14 @@ var epochForActs = func(ctx context.Context) (uint64, error) { return theLease.e
 type order struct {
 	sequence int64
 	epoch    uint64
+	// generation is the assignment generation read before the composition, and readsGeneration whether the
+	// machine's node-engine said it reads one (novox/hq issue 234); acting is the lease epoch the sender acts
+	// under, whether or not the machine is sent it — both kept for the record of the send.
+	generation      int64
+	readsGeneration bool
+	acting          uint64
+	// putBack is a gate's put-back (sendScope.putBack), read from the send's context.
+	putBack bool
 }
 
 // allot takes the next sequence for a machine — the number its next declaration carries — under the
@@ -1544,6 +1566,7 @@ func allot(ctx context.Context, inv *inventory.Inventory, node string) (order, e
 	if err != nil {
 		return order{}, err
 	}
+	acting := epoch
 	if epoch > 0 {
 		reads, err := inv.ReadsEpoch(ctx, record.ID)
 		if err != nil {
@@ -1553,11 +1576,24 @@ func allot(ctx context.Context, inv *inventory.Inventory, node string) (order, e
 			epoch = 0
 		}
 	}
+	// **The generation is read here, before the composition reads a single assignment** (novox/hq issue
+	// 234). A generation only grows, so one read before is never newer than the view composed after it:
+	// the declaration may claim a generation older than its content, never newer — and a claim newer than
+	// the content is exactly the stale send the machine must be able to refuse.
+	generation, err := inv.AssignmentGeneration(ctx)
+	if err != nil {
+		return order{}, err
+	}
+	readsGeneration, err := inv.ReadsGeneration(ctx, record.ID)
+	if err != nil {
+		return order{}, err
+	}
 	seq, err := inv.NextSequence(ctx, record.ID)
 	if err != nil {
 		return order{}, err
 	}
-	return order{sequence: seq, epoch: epoch}, nil
+	return order{sequence: seq, epoch: epoch, generation: generation, readsGeneration: readsGeneration,
+		acting: acting, putBack: scopeOf(ctx).putBack}, nil
 }
 
 // recordSent writes down what a machine was just sent, and returns the digest.
@@ -1572,7 +1608,7 @@ func allot(ctx context.Context, inv *inventory.Inventory, node string) (order, e
 // And the build of each module it carried (novox/hq issue 259, ADR 0221), nil when that is not known:
 // what tells a machine held back by a policy or a plan from one a push left behind.
 func recordSent(ctx context.Context, inv *inventory.Inventory, node string, body []byte,
-	builds map[string]string, epoch uint64) (string, error) {
+	builds map[string]string, epoch uint64, sent sentRecord) (string, error) {
 	kept, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
 	defer cancel()
 	record, err := inv.NodeByName(kept, node)
@@ -1583,6 +1619,14 @@ func recordSent(ctx context.Context, inv *inventory.Inventory, node string, body
 	if err := inv.RecordSentUnder(kept, record.ID, digest, builds, epoch); err != nil {
 		return "", err
 	}
+	// And the send itself, who sent it and from which generation (novox/hq issue 234): what the machine
+	// was last told, by whom, is read back from here — and what the would-send is stamped with.
+	if err := inv.RecordSend(kept, inventory.Send{Node: record.ID, Sequence: sent.sequence,
+		Epoch: int64(sent.epoch), Sender: sent.sender, Generation: sent.generation, PutBack: sent.putBack,
+		ToldGeneration: sent.toldGeneration, ToldPutBack: sent.toldPutBack, Digest: digest,
+		Modules: sent.modules}); err != nil {
+		return "", fmt.Errorf("%s was sent its declaration, and the send could not be recorded: %w", node, err)
+	}
 	// And what it was, summarised, so the next push can be compared with it (novox/hq ADR 0217).
 	// Never a reason to fail a send that is already away: a summary that cannot be kept means the
 	// next comparison has nothing to hold against, which is how every machine starts.