Say a read error of a silent rest, and keep the node-engine one at a time in a kept step (hq ADR 0353)

An empty answer on a read error would clear release-silent unseen.

cmd/mesh-controller/release.go

@@ -1103,6 +1103,10 @@ func keptStepGrew(ctx context.Context, open *stores, r *inventory.PlanRelease, p
 	if err != nil {
 		return "", err
 	}
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return "", err
+	}
 	for _, node := range pending {
 		moves, err := gatedMoves(ctx, open, node, nil)
 		if errors.Is(err, errWalkedElsewhere) {
@@ -1113,12 +1117,13 @@ func keptStepGrew(ctx context.Context, open *stores, r *inventory.PlanRelease, p
 		}
 		kept := r.Gates[node].Carried
 		for _, mv := range moves {
-			if f.gated(mv.Module, mv.To) || slices.ContainsFunc(kept, func(c inventory.CarriedMove) bool {
+			// The node-engine and the resolver keep one machine at a time, passed or not (ADR 0353 §9).
+			if (f.gated(mv.Module, mv.To) && !oneAtATime(mv.Module, shelf[mv.Module])) || slices.ContainsFunc(kept, func(c inventory.CarriedMove) bool {
 				return c.Module == mv.Module && sameCommit(c.To, mv.To)
 			}) {
 				continue
 			}
-			return fmt.Sprintf("%s's build %s, which passed no gate, came to wait on %s", mv.Module, short(mv.To), node), nil
+			return fmt.Sprintf("%s's build %s, which this step did not keep for it, came to wait on %s", mv.Module, short(mv.To), node), nil
 		}
 	}
 	return "", nil
@@ -1262,17 +1267,17 @@ func restStep(nodes []string, waiting map[string][]inventory.CarriedMove, passed
 
 // silentObservation is what the gate's probe says of the newest release whose rest went silent (novox/hq ADR 0353
 // §4): machines that never reported on their send, left as they were — loud, never a success said by nothing.
-func silentObservation(ctx context.Context, inv *inventory.Inventory) []conditions.Observation {
+func silentObservation(ctx context.Context, inv *inventory.Inventory) ([]conditions.Observation, error) {
 	recent, err := inv.RecentPlans(ctx, 20)
 	if err != nil {
-		return nil
+		return nil, err
 	}
 	for _, p := range recent {
 		if p.Release == nil || p.Release.Settings != nil || p.Open() {
 			continue
 		}
 		if len(p.Release.Silent) == 0 {
-			return nil
+			return nil, nil
 		}
 		machines := append([]string(nil), p.Release.Silent...)
 		sort.Strings(machines)
@@ -1282,9 +1287,9 @@ func silentObservation(ctx context.Context, inv *inventory.Inventory) []conditio
 				"left as they were", p.ID, strings.Join(machines, ", "), inventory.ApplySilentAfter)}
 		w := releaseSilentWords(machines)
 		o.Headline, o.Explanation, o.Resolved, o.Needs = w.Headline, w.Explanation, w.Resolved, w.Needs
-		return []conditions.Observation{o}
+		return []conditions.Observation{o}, nil
 	}
-	return nil
+	return nil, nil
 }
 
 // backlogObservation is what the gate's probe says of a release held after a failure.