Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

cmd/mesh-controller/module_health.go

@@ -492,17 +492,12 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 		return healthNotYet, fmt.Sprintf("%s has not said how what %s runs is since it was sent", machine, module)
 	}
 	wait, waits := personWait(module, machine, h.Resources)
-	// **Only the build whose own send put the account into its wait is excused** (issue 318 review): an
-	// account already waiting before this send was not brought to it by this build, and a later build of
-	// the module sent while the login is still owed is judged as before. Two seconds of skew between the
-	// machine's clock and the controller's, as the witness allows.
-	if waits {
-		for _, r := range h.Resources {
-			if r.Module == module && r.Kind == link.KindAccount && r.State == link.StateUnhealthy &&
-				strings.HasPrefix(r.Reason, link.ReasonRelogin) && r.Since.Before(since.Add(-2*time.Second)) {
-				waits = false
-			}
-		}
+	// **Only a build whose own send put the account in a new group is excused** (issue 318 review): read from
+	// what the controller sent, never from when the machine says the wait began — that time is the engine's
+	// memory, reset by its restart and moved by a change of words. A build that adds no account group cannot
+	// have brought a wait, so a later build sent while the login is still owed is judged as before.
+	if waits && !f.groupsAdded[module] {
+		waits = false
 	}
 	for _, r := range h.Resources {
 		if r.Module != module {
@@ -565,3 +560,38 @@ func healthLines(h inventory.NodeHealth, had bool, now time.Time) []string {
 	}
 	return out
 }
+
+// accountGroups is every account group a manifest declares, as "<account>/<group>": a user resource's
+// groups (ADR 0252).
+func accountGroups(m catalogue.Manifest) map[string]bool {
+	out := map[string]bool{}
+	for _, r := range m.Resources {
+		if t, _ := r["type"].(string); t != "user" {
+			continue
+		}
+		name, _ := r["name"].(string)
+		groups, _ := r["groups"].([]any)
+		for _, g := range groups {
+			if group, ok := g.(string); ok && group != "" {
+				out[name+"/"+group] = true
+			}
+		}
+	}
+	return out
+}
+
+// addsAccountGroups is whether a move from one manifest of a module to another puts an account in a group the
+// earlier one did not (issue 318 review): the only send that can bring a wait for a new login. A module new to
+// the machine (no earlier manifest) adds every group it declares.
+func addsAccountGroups(from catalogue.Manifest, hadFrom bool, to catalogue.Manifest) bool {
+	before := map[string]bool{}
+	if hadFrom {
+		before = accountGroups(from)
+	}
+	for g := range accountGroups(to) {
+		if !before[g] {
+			return true
+		}
+	}
+	return false
+}