Give the forge's merges a durable consumer of their own: no max-deliver, no reset, a growing delay while held (issue 973)

internal/link/serve.go

@@ -636,8 +636,19 @@ func short(commit string) string {
 	return commit
 }
 
-// mergeHeldFor is how long a merge the controller could not record yet waits before the bus hands it over again.
-const mergeHeldFor = 5 * time.Second
+// MergeHeldFirst is how long a merge the controller could not record yet waits before the bus hands it over
+// again, and MergeHeldMost the longest it ever waits: the delay grows with how long the merge has been held, from
+// the first to the most (novox/hq ADR 0407 decision 3). Variables so a test need not wait.
+var (
+	MergeHeldFirst = 5 * time.Second
+	MergeHeldMost  = 5 * time.Minute
+)
+
+// MergeRedeliverAfter is the delay for a merge held for the time given: that time, so the delay about doubles
+// with each hold, between MergeHeldFirst and MergeHeldMost.
+func MergeRedeliverAfter(heldFor time.Duration) time.Duration {
+	return min(max(heldFor, MergeHeldFirst), MergeHeldMost)
+}
 
 // sourceMoved acts on the forge's announcement of a merge. **A merge is never dropped** (issue 921, novox/hq ADR
 // 0407 decision 3): one the controller could not record for now (the plans held by another controller, the store
@@ -663,13 +674,14 @@ func (s *Server) sourceMoved(ctx context.Context, m Control) {
 		if ctx.Err() != nil {
 			return
 		}
-		if held := m.Hold(mergeHeldFor); held != nil {
+		delay := MergeRedeliverAfter(m.HeldFor())
+		if held := m.Hold(delay); held != nil {
 			s.log.Printf("%s/%s moved to %.8s and could not be held (%v): %v; left for the bus to hand over again",
 				moved.Owner, moved.Repo, moved.Commit, held, err)
 			return
 		}
 		s.log.Printf("%s/%s moved to %.8s and is held: %v; handed over again in %s", moved.Owner, moved.Repo,
-			moved.Commit, err, mergeHeldFor)
+			moved.Commit, err, delay)
 		return
 	}
 	if err != nil {