Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

A refusal of a send the mesh never recorded went only to stderr; it is now kept
with its sender said to be unknown, and raised. A counter behind the machine (a
store put back) is raised and the condition names push, since the receive loop
must not push. The node's digest and generation are one transaction, and a send
record that fails is said loudly without failing the send. The trigger ignores
an update that changes nothing, and the put-back mark is dropped: a put-back is
composed afresh with the current generation.

cmd/mesh-controller/push.go

@@ -359,14 +359,12 @@ func declare(ctx context.Context, args []string) error {
 		Epoch      uint64 `json:"epoch"`
 		Sequence   int64  `json:"sequence"`
 		Generation int64  `json:"generation"`
-		PutBack    bool   `json:"put_back"`
 	}
 	_ = json.Unmarshal(raw, &carried)
 	// And recorded as every send is (novox/hq issue 234): by hand, from what it carried; the modules it
 	// named are not known, since the mesh did not compose it.
 	if _, err := recordSent(ctx, inv, node, raw, nil, carried.Epoch, sentRecord{sequence: carried.Sequence,
-		epoch: carried.Epoch, generation: carried.Generation, putBack: carried.PutBack,
-		toldGeneration: carried.Generation, toldPutBack: carried.PutBack,
+		epoch: carried.Epoch, generation: carried.Generation, toldGeneration: carried.Generation,
 		sender: senderOf(callerOf(ctx)) + ", a declaration sent by hand"}); err != nil {
 		return err
 	}
@@ -1402,9 +1400,9 @@ func wouldSendFrom(ctx context.Context, open *stores,
 		if declared.Epoch, err = open.inventory.SentEpoch(ctx, n.ID); err != nil {
 			return nil, err
 		}
-		// And the generation and put-back mark it was last sent, for the same reason (novox/hq issue 234):
-		// an assignment elsewhere in the mesh is not a change of this machine.
-		if declared.Generation, declared.PutBack, err = open.inventory.SentGeneration(ctx, n.ID); err != nil {
+		// And the generation it was last sent, for the same reason (novox/hq issue 234): an assignment
+		// elsewhere in the mesh is not a change of this machine.
+		if declared.Generation, err = open.inventory.SentGeneration(ctx, n.ID); err != nil {
 			return nil, err
 		}
 		body, err := declared.Body()
@@ -1551,8 +1549,6 @@ type order struct {
 	generation      int64
 	readsGeneration bool
 	acting          uint64
-	// putBack is a gate's put-back (sendScope.putBack), read from the send's context.
-	putBack bool
 }
 
 // allot takes the next sequence for a machine — the number its next declaration carries — under the
@@ -1593,7 +1589,7 @@ func allot(ctx context.Context, inv *inventory.Inventory, node string) (order, e
 		return order{}, err
 	}
 	return order{sequence: seq, epoch: epoch, generation: generation, readsGeneration: readsGeneration,
-		acting: acting, putBack: scopeOf(ctx).putBack}, nil
+		acting: acting}, nil
 }
 
 // recordSent writes down what a machine was just sent, and returns the digest.
@@ -1616,17 +1612,23 @@ func recordSent(ctx context.Context, inv *inventory.Inventory, node string, body
 		return "", err
 	}
 	digest := digestOf(body)
-	if err := inv.RecordSentUnder(kept, record.ID, digest, builds, epoch); err != nil {
+	// The digest and the generation it carried are written in one transaction (novox/hq issue 234), so the
+	// would-send is never stamped with a generation the machine was not sent; and the send itself, who sent
+	// it and from which generation, beside them. A record of the send that cannot be written does not make a
+	// send that is away look failed: it is said, loudly, and the machine's own record stands.
+	err = inv.RecordSentWith(kept, record.ID, digest, builds, epoch, sent.toldGeneration, inventory.Send{
+		Sequence: sent.sequence, Epoch: int64(sent.epoch), Sender: sent.sender, Generation: sent.generation,
+		Digest: digest, Modules: sent.modules})
+	var unrecorded *inventory.SendNotRecordedError
+	switch {
+	case errors.As(err, &unrecorded):
+		fmt.Fprintf(os.Stderr, "mesh-controller: SEND NOT RECORDED: %s was sent declaration %s (sequence %d), and who "+
+			"sent it and from which generation could not be written down, so a refusal of it will name no sender "+
+			"(novox/hq issue 234): %v\n", node, short(digest), sent.sequence, unrecorded.Err)
+		fmt.Printf("%s: sent, and the record of who sent it could NOT be written: %v\n", node, unrecorded.Err)
+	case err != nil:
 		return "", err
 	}
-	// And the send itself, who sent it and from which generation (novox/hq issue 234): what the machine
-	// was last told, by whom, is read back from here — and what the would-send is stamped with.
-	if err := inv.RecordSend(kept, inventory.Send{Node: record.ID, Sequence: sent.sequence,
-		Epoch: int64(sent.epoch), Sender: sent.sender, Generation: sent.generation, PutBack: sent.putBack,
-		ToldGeneration: sent.toldGeneration, ToldPutBack: sent.toldPutBack, Digest: digest,
-		Modules: sent.modules}); err != nil {
-		return "", fmt.Errorf("%s was sent its declaration, and the send could not be recorded: %w", node, err)
-	}
 	// And what it was, summarised, so the next push can be compared with it (novox/hq ADR 0217).
 	// Never a reason to fail a send that is already away: a summary that cannot be kept means the
 	// next comparison has nothing to hold against, which is how every machine starts.