Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

A piece whose shows the holder's template does not know rendered as nothing and failed
the whole machine's declaration; it is now left out and named, for push, plan and the
merge gate. quote escapes DEL, which TOML refuses bare. An if-capability nothing
detects, or on a kind a holder depends on, would drop a piece silently, so both are
refused.

cmd/mesh-controller/merge_gate.go

@@ -135,6 +135,7 @@ type mergeComposed struct {
 	Problems  []string          `json:"problems,omitempty"`
 	Withheld  []string          `json:"withheld,omitempty"`
 	Unbound   []string          `json:"unbound,omitempty"`
+	Unplaced  []string          `json:"unplaced,omitempty"`
 	LeftOut   map[string]string `json:"left-out,omitempty"`
 	Resources []string          `json:"resources,omitempty"`
 }
@@ -372,6 +373,12 @@ func judgeChange(ctx context.Context, in mergeCheckInput) (mergeVerdict, error)
 			v.Failures = append(v.Failures, fmt.Sprintf("%s: the change leaves a credential bound elsewhere — %s",
 				gm.Described, u))
 		}
+		// A contribution its holder's template renders nothing for (novox/hq ADR 0255): the machine
+		// would be sent without it, so a change that adds one is refused, naming it.
+		for _, u := range newOnly(gm.Change.Unplaced, gm.Base.Unplaced) {
+			v.Failures = append(v.Failures, fmt.Sprintf("%s: the change leaves a contribution unplaced — %s",
+				gm.Described, u))
+		}
 		for module, why := range gm.Change.LeftOut {
 			if _, was := gm.Base.LeftOut[module]; !was {
 				v.Failures = append(v.Failures, fmt.Sprintf("%s: the change leaves %s out of its declaration — %s",
@@ -780,6 +787,7 @@ func composeEveryMachine(ctx context.Context, in mergeCheckInput, shelf map[stri
 			for _, u := range declared.unbound {
 				c.Unbound = append(c.Unbound, u.String())
 			}
+			c.Unplaced = declared.unplaced
 			sort.Strings(c.Withheld)
 			sort.Strings(c.Unbound)
 			out[m.Name] = c

cmd/mesh-controller/plan.go

@@ -419,7 +419,7 @@ func declarationWith(ctx context.Context, open *stores, node string,
 	out := sendable{Resources: composed.Resources, Adoption: adoption,
 		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
 		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
-		unbound: with.Unbound, foreseen: composed.Foreseen}
+		unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced}
 	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
 	// 0221). Read only on the send path: a question about what would be sent records nothing.
 	if choosing == Allocating {
@@ -528,6 +528,11 @@ func reportLeftOut(node string, declared sendable) {
 	for _, u := range declared.unbound {
 		fmt.Printf("%s: %s\n", node, u)
 	}
+	// And every contribution its holder could not render, which the machine is sent without (novox/hq
+	// ADR 0255).
+	for _, u := range declared.unplaced {
+		fmt.Printf("%s: %s\n", node, u)
+	}
 }
 
 // busCredentialIssued refuses an own secret called `broker` whose bus account nobody issued.

cmd/mesh-controller/sendable.go

@@ -58,6 +58,9 @@ type sendable struct {
 	// make (Foreseeing, novox/hq issue 275). Never on the wire, and a declaration that has any is never
 	// sent.
 	foreseen []string
+	// unplaced is every contribution its holder's template could not render, naming its module and
+	// why (novox/hq ADR 0255): left out of this declaration, for push and plan to say, never on the wire.
+	unplaced []string
 	// Builds is the build of each module this declaration carries — module to the commit its build
 	// was made from — recorded with the send and never on the wire (novox/hq issue 259, ADR 0221).
 	// Composed only on the send path; nil records that it is not known.