Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

A build that reported applied was sent everywhere; one that then did nothing, served
no tools or broke its machine's word reached every machine. Now the first machine is
judged by the component's health (the core's definitions, as doctor probes H-*, or a
module's own) three times over two minutes within ten; a failing gate puts the previous
build back there once, marks the build, and says it as a condition and an event.
Upgrades roll out by default; the bus is a planned step; a module deleted at its
source is not built (the public-acme plan failure).

internal/inventory/plans.go

@@ -67,6 +67,42 @@ type PlanModule struct {
 	// its module's name included. Empty in a plan from before it was kept, which is matched by
 	// module, or by repository and path, as before.
 	Build string `json:"build,omitempty"`
+	// Previous is the build the first machine ran of this module before the plan sent it the new one —
+	// the commit its last send carried (ADR 0221) — kept at the first send: what a rollback puts back
+	// (novox/hq ADR 0235). Empty when the machine had never been sent the module, or what it was sent
+	// is not known.
+	Previous string `json:"previous,omitempty"`
+	// Gate is the new build's judging on its first machine (novox/hq ADR 0235, to-be 45 §8), kept so a
+	// controller replaced mid-judging resumes it, and read back through `plans` as the rollout's record.
+	Gate *PlanGate `json:"gate,omitempty"`
+}
+
+// PlanGate is one module's rollout record at its gate (to-be 45 §8): the component, the first machine,
+// from and to which build, the verdict, how long it took to reach it, and whether it was rolled back.
+type PlanGate struct {
+	// Component is the core component the module is — mesh-controller, mesh-host, node-tools — or empty
+	// for any other module, judged by its own health.
+	Component string   `json:"component,omitempty"`
+	Machines  []string `json:"machines"`
+	From      string   `json:"from,omitempty"`
+	To        string   `json:"to,omitempty"`
+	// Since is when the judging began: the first machine reported the new build applied.
+	Since *time.Time `json:"since,omitempty"`
+	// Passes counts the consecutive judgings that found it healthy, LastPass the newest; a judging that
+	// does not resets them.
+	Passes   int        `json:"passes,omitempty"`
+	LastPass *time.Time `json:"last_pass,omitempty"`
+	// Last is what the newest judging found wanting, while it still may pass.
+	Last string `json:"last,omitempty"`
+	// Verdict is empty while judging, then passed or failed, with Why, at JudgedAt, Took after Since.
+	Verdict  string     `json:"verdict,omitempty"`
+	Why      string     `json:"why,omitempty"`
+	JudgedAt *time.Time `json:"judged_at,omitempty"`
+	Took     string     `json:"took,omitempty"`
+	// Rollback is how a failed build was put back: rolled-back, or not-rolled-back with why.
+	Rollback string `json:"rollback,omitempty"`
+	// Kept says a passing verdict was written to the gate's records.
+	Kept bool `json:"kept,omitempty"`
 }
 
 // The states a plan passes through.