Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

A refusal of a send the mesh never recorded went only to stderr; it is now kept
with its sender said to be unknown, and raised. A counter behind the machine (a
store put back) is raised and the condition names push, since the receive loop
must not push. The node's digest and generation are one transaction, and a send
record that fails is said loudly without failing the send. The trigger ignores
an update that changes nothing, and the put-back mark is dropped: a put-back is
composed afresh with the current generation.

internal/inventory/sends_test.go

@@ -1,6 +1,7 @@
 package inventory
 
 import (
+	"errors"
 	"slices"
 	"testing"
 	"time"
@@ -75,8 +76,8 @@ func TestTheGenerationIsRaisedPastWhatAMachineApplied(t *testing.T) {
 }
 
 // **Every send is recorded: its sequence, its sender, the generation it came from and the modules it
-// named** — and the machine's last send is what `plan` reads, the would-send is stamped with its
-// generation and put-back mark, and a refusal is kept on the send it refused, naming its sender.
+// named** — and the machine's last send is what `plan` reads, the would-send is stamped with the generation
+// written with the digest, and a refusal is kept on the send it refused, naming its sender.
 func TestASendIsRecordedWithItsSenderGenerationAndModules(t *testing.T) {
 	inv, node := aNodeWithModules(t)
 	ctx := t.Context()
@@ -84,42 +85,110 @@ func TestASendIsRecordedWithItsSenderGenerationAndModules(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	first := Send{Node: record.ID, Sequence: 11, Epoch: 57, Sender: "the controller's daemon (pid 7 on anchor)",
+	first := Send{Sequence: 11, Epoch: 57, Sender: "the controller's daemon (pid 7 on anchor)",
 		Generation: 40, Digest: "d11", Modules: []string{"docker", "pacman", "sudo"}}
-	if err := inv.RecordSend(ctx, first); err != nil {
+	if err := inv.RecordSentWith(ctx, record.ID, "d11", nil, 57, 40, first); err != nil {
 		t.Fatal(err)
 	}
-	stale := Send{Node: record.ID, Sequence: 12, Epoch: 57, Sender: "a one-shot push by jochen at a shell on anchor",
-		Generation: 38, ToldGeneration: 38, Digest: "d12", Modules: []string{"docker"}}
-	if err := inv.RecordSend(ctx, stale); err != nil {
+	stale := Send{Sequence: 12, Epoch: 57, Sender: "a one-shot push by jochen at a shell on anchor",
+		Generation: 38, Digest: "d12", Modules: []string{"docker"}}
+	if err := inv.RecordSentWith(ctx, record.ID, "d12", nil, 57, 38, stale); err != nil {
 		t.Fatal(err)
 	}
 	last, found, err := inv.LastSend(ctx, node)
 	if err != nil || !found {
 		t.Fatalf("the last send is not kept: %v", err)
 	}
-	if last.Sequence != 12 || last.Sender != stale.Sender || last.Generation != 38 ||
+	if last.Sequence != 12 || last.Sender != stale.Sender || last.Generation != 38 || !last.Recorded ||
 		!slices.Equal(last.Modules, []string{"docker"}) || last.SentAt.IsZero() {
 		t.Fatalf("the last send reads %+v", last)
 	}
-	generation, putBack, err := inv.SentGeneration(ctx, record.ID)
-	if err != nil || generation != 38 || putBack {
-		t.Fatalf("what the machine was last sent of it reads %d, %v (%v)", generation, putBack, err)
+	if generation, err := inv.SentGeneration(ctx, record.ID); err != nil || generation != 38 {
+		t.Fatalf("what the machine was last sent of it reads %d (%v)", generation, err)
 	}
 
-	refused, found, err := inv.RefusedSend(ctx, record.ID, 12, 40)
-	if err != nil || !found || refused.Sender != stale.Sender || refused.RefusedApplied != 40 {
+	refused, found, err := inv.RefusedSend(ctx, record.ID, 12, 40, 0)
+	if err != nil || !found || refused.Sender != stale.Sender || refused.RefusedApplied != 40 ||
+		refused.CounterRaisedTo != 0 {
 		t.Fatalf("the refusal is not kept on the send it refused: %+v, %v, %v", refused, found, err)
 	}
 	since, err := inv.RefusedSendsSince(ctx, time.Now().Add(-time.Hour))
 	if err != nil || len(since) != 1 || since[0].NodeName != node || since[0].Sequence != 12 {
 		t.Fatalf("the refused sends within the hour read %+v (%v)", since, err)
 	}
-	if _, found, err := inv.RefusedSend(ctx, record.ID, 99, 40); err != nil || found {
+	if _, found, err := inv.RefusedSend(ctx, record.ID, 99, 40, 0); err != nil || found {
 		t.Errorf("a refusal of a send never recorded was found: %v, %v", found, err)
 	}
 }
 
+// **A refusal of a sequence the mesh has no send for is kept too, its sender unknown**, so S20 raises it;
+// it is not the machine's last send, and it says what the counter was raised to.
+func TestARefusalOfASendNeverRecordedIsKeptWithAnUnknownSender(t *testing.T) {
+	inv, node := aNodeWithModules(t)
+	ctx := t.Context()
+	record, err := inv.NodeByName(ctx, node)
+	if err != nil {
+		t.Fatal(err)
+	}
+	kept, err := inv.RecordUnrecordedRefusal(ctx, Send{Node: record.ID, Sequence: 99, Epoch: 57, Generation: 41,
+		Digest: "d99", RefusedApplied: 44, CounterRaisedTo: 45})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if kept.Recorded || kept.Sender != unknownSender || kept.RefusedAt == nil || kept.CounterRaisedTo != 45 ||
+		kept.NodeName != node {
+		t.Fatalf("the refusal reads %+v", kept)
+	}
+	since, err := inv.RefusedSendsSince(ctx, time.Now().Add(-time.Hour))
+	if err != nil || len(since) != 1 || since[0].Sequence != 99 {
+		t.Fatalf("the refused sends within the hour read %+v (%v)", since, err)
+	}
+	if _, found, err := inv.LastSend(ctx, node); err != nil || found {
+		t.Errorf("a refusal of a send never recorded reads as the machine's last send: %v, %v", found, err)
+	}
+}
+
+// **The machine's record and the send's are written together, and a send record that cannot be written
+// leaves the machine's record standing and says so**: the digest and generation are the machine's, and a
+// send that is away must not read as failed, nor the machine as behind.
+func TestASendRecordThatCannotBeWrittenLeavesTheMachinesRecord(t *testing.T) {
+	inv, node := aNodeWithModules(t)
+	ctx := t.Context()
+	record, err := inv.NodeByName(ctx, node)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A NUL byte is text PostgreSQL refuses: the send's own row cannot be written.
+	broken := Send{Sequence: 13, Sender: "a test", Generation: 42, Digest: "d\x0013"}
+	err = inv.RecordSentWith(ctx, record.ID, "d13", nil, 0, 42, broken)
+	var unrecorded *SendNotRecordedError
+	if !errors.As(err, &unrecorded) {
+		t.Fatalf("a send record that could not be written read as %v", err)
+	}
+	if generation, err := inv.SentGeneration(ctx, record.ID); err != nil || generation != 42 {
+		t.Fatalf("the machine's generation was not written with its digest: %d (%v)", generation, err)
+	}
+	if sent, err := inv.Outstanding(ctx, node); err != nil || sent != "d13" {
+		t.Fatalf("the machine's digest was not written: %q (%v)", sent, err)
+	}
+}
+
+// **An update that leaves an assignment as it was raises nothing** (the trigger's WHEN).
+func TestAnUpdateThatChangesNoAssignmentRaisesNothing(t *testing.T) {
+	inv, node := aNodeWithModules(t, "web")
+	ctx := t.Context()
+	if _, err := inv.Assign(ctx, node, "web"); err != nil {
+		t.Fatal(err)
+	}
+	before := generationNow(t, inv)
+	if _, err := inv.store.Pool().Exec(ctx, `update assignment set module = module`); err != nil {
+		t.Fatal(err)
+	}
+	if after := generationNow(t, inv); after != before {
+		t.Errorf("an update that changed nothing moved the generation from %d to %d", before, after)
+	}
+}
+
 // **A machine that reads a generation is recorded from its reports**, and one rolled back says so no longer.
 func TestWhetherAMachineReadsAGenerationIsItsLatestWord(t *testing.T) {
 	inv, node := aNodeWithModules(t)