No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

Two incidents had one shape: a change took effect that nobody saw first (hq issues 241, 304).
Three guards, each silent when nothing is at stake:

- settings show [--history], and a set that answers each key it adds, changes and removes, and
  refuses a removal unless --replace; the replaced or cleared layer is kept in settings_history,
  in the same transaction as the write (migration 0078).
- every send keeps a summary of what it sent (no file content), plan <node> --diff compares with
  it, and push with no machine is refused unless --all.
- a push that would give a running container's mount another host directory holds that machine,
  naming the module, mount and both directories, until push <node> --move <module>; a named push's
  cascade is held the same way.

Rebased onto main and fitted to it: the hold runs before the push says what it recreates, a whole
push still says so first and leaves machines waiting for a gate, the verb's push with no machine is
still --behind and a push still needs why. The verbs take plan diff, settings replace and history,
and push move beside a machine, each refused where it cannot take effect.

cmd/mesh-controller/plan.go

@@ -1185,12 +1185,15 @@ func planCommand(ctx context.Context, args []string) error {
 	// checking it against the host's own parser, most usefully, which is the only way to know
 	// that what the control plane emits is what the host accepts.
 	asJSON := set.Bool("json", false, "print the declaration this node would be sent")
+	// What a push would change, against what the machine was last sent (novox/hq ADR 0217): read
+	// before sending, so a change that removes, moves or recreates something is seen first.
+	asDiff := set.Bool("diff", false, "what a push would change on this node, against what it was last sent")
 	positionals, err := parseAround(set, args)
 	if err != nil {
 		return err
 	}
 	if len(positionals) != 1 {
-		return errors.New("plan <node> [--files] [--json]")
+		return errors.New("plan <node> [--files] [--json] [--diff]")
 	}
 	args = positionals
 	open, err := openStores(ctx)
@@ -1207,6 +1210,17 @@ func planCommand(ctx context.Context, args []string) error {
 		fmt.Printf("%s is assigned nothing\n", args[0])
 		return nil
 	}
+	if *asDiff {
+		declared, err := declarationFor(ctx, open, args[0], plan, settings)
+		if err != nil {
+			return err
+		}
+		body, err := declared.Body()
+		if err != nil {
+			return err
+		}
+		return writePlanDiff(ctx, open.inventory, args[0], body)
+	}
 	if *asJSON {
 		declared, err := declarationFor(ctx, open, args[0], plan, settings)
 		if err != nil {