No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

Two incidents had one shape: a change took effect that nobody saw first (hq issues 241, 304).
Three guards, each silent when nothing is at stake:

- settings show [--history], and a set that answers each key it adds, changes and removes, and
  refuses a removal unless --replace; the replaced or cleared layer is kept in settings_history,
  in the same transaction as the write (migration 0078).
- every send keeps a summary of what it sent (no file content), plan <node> --diff compares with
  it, and push with no machine is refused unless --all.
- a push that would give a running container's mount another host directory holds that machine,
  naming the module, mount and both directories, until push <node> --move <module>; a named push's
  cascade is held the same way.

Rebased onto main and fitted to it: the hold runs before the push says what it recreates, a whole
push still says so first and leaves machines waiting for a gate, the verb's push with no machine is
still --behind and a push still needs why. The verbs take plan diff, settings replace and history,
and push move beside a machine, each refused where it cannot take effect.

cmd/mesh-controller/modules.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"net"
 	"os"
-	"sort"
 	"strings"
 
 	"github.com/novox/mesh-controller/internal/broker"
@@ -383,7 +382,8 @@ func assignCommand(ctx context.Context, verb string, args []string) error {
 
 func settingsCommand(ctx context.Context, args []string) error {
 	if len(args) == 0 {
-		return errors.New("settings set <module> <file> [--node <node>], or settings clear <module> [--node <node>]")
+		return errors.New("settings show <module> [--node <node>] [--history], settings set <module> <file> " +
+			"[--node <node>] [--replace], or settings clear <module> [--node <node>]")
 	}
 	open, err := openStores(ctx)
 	if err != nil {
@@ -394,6 +394,11 @@ func settingsCommand(ctx context.Context, args []string) error {
 
 	set := flag.NewFlagSet("settings", flag.ContinueOnError)
 	node := set.String("node", "", "one machine, rather than the whole mesh")
+	// **What a set removes is refused unless meant** (novox/hq ADR 0217). A layer is replaced whole,
+	// and on 2026-10-05 setting one placement dropped a machine's whole layer for a module without a
+	// word (novox/hq issue 304). Adding and changing keys needs nothing; removing one needs this.
+	replace := set.Bool("replace", false, "for set: remove the keys the new layer does not name")
+	history := set.Bool("history", false, "for show: the layers this one replaced, the latest first")
 	positionals, err := parseAround(set, args[1:])
 	if err != nil {
 		return err
@@ -421,17 +426,76 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if err := json.Unmarshal(raw, &values); err != nil {
 			return fmt.Errorf("%s is not a settings file: %w", positionals[1], err)
 		}
+		before, _, err := inv.Layer(ctx, *node, positionals[0])
+		if err != nil {
+			return err
+		}
+		added, changed, removed := settingsChange(before, values)
+		if len(removed) > 0 && !*replace {
+			return fmt.Errorf("%s on %s: this layer would no longer set %s. A layer is replaced whole; "+
+				"read it with `settings show %s%s` and include what should stay, or add --replace if the "+
+				"removal is meant (novox/hq ADR 0217). Nothing was changed",
+				positionals[0], where, strings.Join(removed, ", "), positionals[0], nodeFlag(*node))
+		}
 		if err := inv.SetSettings(ctx, *node, positionals[0], values); err != nil {
 			return err
 		}
-
-		var keys []string
-		for k := range values {
-			keys = append(keys, k)
+		fmt.Printf("%s on %s:\n", positionals[0], where)
+		if len(added)+len(changed)+len(removed) == 0 {
+			fmt.Println("  nothing changed")
 		}
-		sort.Strings(keys)
-		fmt.Printf("%s on %s: %s\n", positionals[0], where, strings.Join(keys, ", "))
-		fmt.Println("  run `push` to send it")
+		for _, p := range added {
+			fmt.Printf("  + %s\n", p)
+		}
+		for _, p := range changed {
+			fmt.Printf("  ~ %s\n", p)
+		}
+		for _, p := range removed {
+			fmt.Printf("  - %s\n", p)
+		}
+		if before != nil {
+			fmt.Printf("  the layer it replaced is kept: settings show %s%s --history\n", positionals[0], nodeFlag(*node))
+		}
+		if *node != "" {
+			fmt.Printf("  run `plan %s --diff` to see what it changes, `push %s` to send it\n", *node, *node)
+		} else {
+			fmt.Println("  run `push --behind` to send it to the machines running it")
+		}
+		return nil
+
+	case "show":
+		if len(positionals) != 1 {
+			return errors.New("settings show <module> [--node <node>] [--history]")
+		}
+		if *history {
+			past, err := inv.SettingsHistory(ctx, *node, positionals[0])
+			if err != nil {
+				return err
+			}
+			if len(past) == 0 {
+				fmt.Printf("%s on %s: no layer has been replaced\n", positionals[0], where)
+				return nil
+			}
+			for _, p := range past {
+				shown, _ := json.MarshalIndent(p.Values, "  ", "  ")
+				fmt.Printf("%s on %s, until %s (%s):\n  %s\n", positionals[0], where,
+					p.ReplacedAt.Local().Format("2006-01-02 15:04:05"), p.ReplacedBy, shown)
+			}
+			return nil
+		}
+		values, has, err := inv.Layer(ctx, *node, positionals[0])
+		if err != nil {
+			return err
+		}
+		if !has {
+			fmt.Printf("%s on %s: no layer — the module's definition says\n", positionals[0], where)
+			return nil
+		}
+		shown, err := json.MarshalIndent(values, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(shown))
 		return nil
 
 	case "clear":
@@ -445,10 +509,18 @@ func settingsCommand(ctx context.Context, args []string) error {
 		return nil
 
 	default:
-		return fmt.Errorf("settings has no %q; it has set and clear", args[0])
+		return fmt.Errorf("settings has no %q; it has show, set and clear", args[0])
 	}
 }
 
+// nodeFlag is ` --node <node>` for a machine's layer, nothing for the whole mesh's.
+func nodeFlag(node string) string {
+	if node == "" {
+		return ""
+	}
+	return " --node " + node
+}
+
 // describeOffers says what a module provides, and marks the ones answered from anywhere in the
 // mesh — because "provides a database" and "provides a shell" are read the same way and mean
 // entirely different things about where the answer has to be.
@@ -683,7 +755,7 @@ func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manife
 		Emits: m.EmitsAll(), Consumes: m.Consumes, Serves: m.Tools,
 	}); needed {
 		if busAddress == "" {
-			fmt.Printf("  %s consumes; its consumer is created when the bus is reachable (`push`, then "+
+			fmt.Printf("  %s consumes; its consumer is created when the bus is reachable (`push --behind`, then "+
 				"`rollout mint` again is harmless)\n", m.Module)
 		} else {
 			js, err := broker.Dial(busAddress)