Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

A build that reported applied was sent everywhere; one that then did nothing, served
no tools or broke its machine's word reached every machine. Now the first machine is
judged by the component's health (the core's definitions, as doctor probes H-*, or a
module's own) three times over two minutes within ten; a failing gate puts the previous
build back there once, marks the build, and says it as a condition and an event.
Upgrades roll out by default; the bus is a planned step; a module deleted at its
source is not built (the public-acme plan failure).

internal/link/events.go

@@ -70,6 +70,9 @@ const (
 	// is spent and the condition is the operator's (novox/hq to-be 45 §7). Never a person's act: those
 	// are the hand-act log's.
 	KeyHealerActed = "healer-acted"
+	// KeyRolledBack: a build failed its gate on its first machine and was put back there, or could not
+	// be (novox/hq ADR 0235, to-be 45 §8); or a witness on a machine put a core component back.
+	KeyRolledBack = "rolled-back"
 )
 
 // Applied is what a machine now runs, as the mesh states it.
@@ -180,6 +183,11 @@ type SourceMoved struct {
 	// rather than inferred from a round number, because "this is all of it" and "this is as much as
 	// I asked for" are the difference between rebuilding a module and leaving it stale.
 	PathsTruncated bool `json:"paths_truncated,omitempty"`
+
+	// Removed are the files among Paths the merge deleted. A module whose manifest is among them was
+	// deleted at its source: it is forgotten, or said, and never built (novox/hq ADR 0235). Empty from an
+	// announcer that does not say which files went, and then a build that finds no manifest says it.
+	Removed []string `json:"removed,omitempty"`
 }
 
 type Upgraded struct {

internal/link/protocol.go

@@ -11,6 +11,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/novox/mesh-controller/internal/lease"
 )
 
 // Exchange is where nodes publish everything they have to say.
@@ -251,6 +253,15 @@ type Report struct {
 	// and the mesh's up in its place, and where the found configuration's original was kept.
 	Tunnel *CarriedTunnel `json:"tunnel,omitempty"`
 
+	// Rollbacks is what this machine's witnesses decided about a core build that was not healthy in
+	// bound (novox/hq to-be 45 §8, ADR 0236; the contract is lease/witness.go and mesh-host's
+	// internal/witness): the node-engine's launcher about the engine, the engine about the controller and
+	// the node tools. Said on every report while it stands; absent from a host that witnesses nothing.
+	Rollbacks []lease.Rollback `json:"rollbacks,omitempty"`
+	// Witness is the witness contract version the host keeps (lease.WitnessContract): a process's
+	// `witness` and `not-reversible` are sent only to a machine whose report carries it.
+	Witness int `json:"witness,omitempty"`
+
 	// Rekey is a node taking a found tunnel's key as its overlay key after enrolment (novox/hq
 	// ADR 0105). A report carrying one is not an account of the machine: it moves the node's
 	// overlay key and tunnel and nothing else.