Keep what each machine did, so status can say what is wrong

A node reports back after applying a declaration: it worked, some of it
failed, or the whole thing was refused. A refusal or a failure moved
last_seen and the reason went to a log line — so "which machine is not
doing what it was told" had no answer the next morning, which is the
question a mesh exists to answer.

Refused and failed are kept as different things, because they are
different situations with different remedies: refused means the machine
is exactly as it was and what is wrong is in what was sent; failed means
it is in a state nobody declared and what is wrong is on the machine. One
word for both would make the record say less than the node did.

One row per node, replaced. The question is the machine's current state —
"this failed an hour ago and then succeeded" is not a machine anybody
needs to look at, and a table of every report would bury the ones that
matter under the ones that do not.

`status` now answers three questions in the order somebody asks them: is
anything broken, is anything not answering, is anything out of date. The
first has consequences now, the third is a plan for later, and a status
leading with the third would bury the first. A machine that has never
spoken is reported as quiet rather than as broken — new, switched off and
unreachable are not the same as tried and could not.

The mapping from a report to an outcome had no test at all, which the
injection caught: it is the code deciding which of those situations a
machine is in. It has four now, including that a partial report never
becomes the account of what the machine holds — the fault that destroyed
a substrate once.

internal/inventory/nodes.go

@@ -408,3 +408,108 @@ func (i *Inventory) SetPlace(ctx context.Context, name, endpoint, site string, h
 		   where id = $1`, node.ID, endpoint, site, hub, addr)
 	return err
 }
+
+// Outcomes a node's last report can have.
+const (
+	// OutcomeApplied is everything the declaration asked for.
+	OutcomeApplied = "applied"
+	// OutcomeFailed is some of it. The machine is in a state nobody declared.
+	OutcomeFailed = "failed"
+	// OutcomeRefused is none of it: the host would not accept the declaration at all, so the
+	// machine is exactly as it was. A different situation from failing, with a different remedy —
+	// one is fixed on the machine and the other in what was sent.
+	OutcomeRefused = "refused"
+)
+
+// Doing is what one machine did with what it was last sent.
+type Doing struct {
+	Node    string
+	Outcome string
+	Refused string
+	Failed  []FailedResource
+	Applied int
+	At      time.Time
+}
+
+// FailedResource is one thing a node could not do.
+type FailedResource struct {
+	ID    string `json:"id"`
+	Error string `json:"error"`
+}
+
+// Wrong reports whether this machine needs somebody to look at it.
+func (d Doing) Wrong() bool { return d.Outcome != OutcomeApplied }
+
+// RecordDoing keeps what a node said it did.
+//
+// One row per node, replaced. The question is the machine's current state — "this failed an hour
+// ago and then succeeded" is not something anybody needs to look at, and a table of every report
+// would bury the ones that matter.
+func (i *Inventory) RecordDoing(ctx context.Context, node string, d Doing) error {
+	failed, err := json.Marshal(d.Failed)
+	if err != nil {
+		return err
+	}
+	_, err = i.store.Pool().Exec(ctx,
+		`insert into node_report (node, outcome, refused, failed, applied, at)
+		 values ($1, $2, $3, $4, $5, now())
+		 on conflict (node) do update set outcome = excluded.outcome, refused = excluded.refused,
+		   failed = excluded.failed, applied = excluded.applied, at = excluded.at`,
+		node, d.Outcome, d.Refused, failed, d.Applied)
+	return err
+}
+
+// NotDoingWhatTheyWereTold is every machine whose last report was not a clean apply.
+//
+// The list somebody wants when they ask what is wrong. A machine that has never reported is
+// absent rather than listed: it may be new, or switched off, and "never said anything" is a
+// different situation from "said it could not" — which is what `node list` reports as last heard
+// from.
+func (i *Inventory) NotDoingWhatTheyWereTold(ctx context.Context) ([]Doing, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select n.name, r.outcome, r.refused, r.failed, r.applied, r.at
+		 from node_report r join node n on n.id = r.node
+		 where r.outcome <> $1 order by r.at desc`, OutcomeApplied)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []Doing
+	for rows.Next() {
+		var d Doing
+		var failed []byte
+		if err := rows.Scan(&d.Node, &d.Outcome, &d.Refused, &failed, &d.Applied, &d.At); err != nil {
+			return nil, err
+		}
+		if err := json.Unmarshal(failed, &d.Failed); err != nil {
+			return nil, err
+		}
+		out = append(out, d)
+	}
+	return out, rows.Err()
+}
+
+// DoingOf is what one machine last did, and whether it has said anything at all.
+func (i *Inventory) DoingOf(ctx context.Context, name string) (Doing, bool, error) {
+	node, err := i.NodeByName(ctx, name)
+	if err != nil {
+		return Doing{}, false, err
+	}
+	var d Doing
+	var failed []byte
+	err = i.store.Pool().QueryRow(ctx,
+		`select outcome, refused, failed, applied, at from node_report where node = $1`, node.ID).
+		Scan(&d.Outcome, &d.Refused, &failed, &d.Applied, &d.At)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return Doing{}, false, nil
+	}
+	if err != nil {
+		return Doing{}, false, err
+	}
+	d.Node = name
+	if err := json.Unmarshal(failed, &d.Failed); err != nil {
+		return Doing{}, false, err
+	}
+	return d, true, nil
+}