A merge rebuilds what it changed, and what packages it

Three faults in one path. A merge rebuilt every module built from the repository, so one change in
a repository holding twenty-six of them meant twenty-six builds. A merge into a repository a module
only *packages* source from rebuilt nothing — two modules are built from the control plane's own
repository and neither had ever been rebuilt when it moved — because the manifest the mesh keeps
carries no build section, so a build now says which repositories it read and the mesh keeps that
beside what it stood on. And a module handed over by hand could record a repository with no
directory inside it, which is a module nothing can ever rebuild (novox/hq 04-ISSUES/131, /132).

A change inside no module's own directory is a change to what they share, and everything built from
that repository is rebuilt: rebuilding too much is the safe direction, because the fault this whole
path exists for is a mesh that believes it is current and is not.

internal/link/build.go

@@ -88,10 +88,23 @@ type BuildResult struct {
 	// (novox/hq ADR 0009). The catalogue turns these into edges; nothing else need care.
 	Against []string `json:"against,omitempty"`
 
+	// Read is every repository this build read source from besides the module's own. A module whose
+	// recipe packages source that lives elsewhere is affected when that repository moves, and the
+	// manifest the mesh keeps says nothing about it (novox/hq 04-ISSUES/131).
+	Read []ReadRepository `json:"read,omitempty"`
+
 	// Failed is why, when it did.
 	Failed string `json:"failed,omitempty"`
 }
 
+// ReadRepository is a repository a build read source from besides the module's own, at the branch,
+// tag or commit it read. Spelled here as well as in the catalogue and the inventory, for the reason
+// MadeArtifact is: one direction of dependency.
+type ReadRepository struct {
+	Repository string `json:"repository"`
+	Ref        string `json:"ref,omitempty"`
+}
+
 // MadeArtifact is one thing a build produced, as a person would want it reported.
 type MadeArtifact struct {
 	Name      string `json:"name"`

internal/link/events.go

@@ -130,6 +130,16 @@ type SourceMoved struct {
 	HTMLURL  string `json:"html_url"`
 	// MergedAt is when the forge merged it, RFC 3339. What decides whether this is news.
 	MergedAt string `json:"merged_at"`
+
+	// Paths are the files the merge changed, from the repository's root. Empty means the forge said
+	// nothing about them, and every module built from the repository is treated as affected.
+	Paths []string `json:"paths,omitempty"`
+
+	// PathsTruncated says the merge changed more files than the forge was asked to list, so Paths is
+	// a beginning rather than the whole change — and again, everything is treated as affected. Said
+	// rather than inferred from a round number, because "this is all of it" and "this is as much as
+	// I asked for" are the difference between rebuilding a module and leaving it stale.
+	PathsTruncated bool `json:"paths_truncated,omitempty"`
 }
 
 type Upgraded struct {