Take an older bus module's allowed as held, and name only remedies that work (review 31 of PR 188, hq issue 353)

After mesh-catalog #166 merges and before the bus upgrade, the bus's
machine cannot be pushed, so any change to the composed list made the
list check read behind for good: every ask was withheld and the condition
named a push that is refused. An older module's allowed now counts as
held, the unconfirmed reload said once; the worst case is one ask refused
in the seconds before a reload, which is asked again (issue 369).

The list check stays for a module that says not allowed or cannot answer,
and its remedy is the plan's own reason when the list cannot be composed,
the bus upgrade while sends there wait on it, and a push otherwise. An
in_force false is a wait only when the module gives both times; otherwise
what is not known is named.

cmd/mesh-controller/push.go

@@ -1084,26 +1084,33 @@ func brokerFirst(names []string, holder string, behind bool) []string {
 // send anywhere, and a module running there always put it in its first wave. A digest of the list
 // last sent is kept for this (ADR 0043: the list is composed on each push, never kept itself).
 func brokerBehind(ctx context.Context, open *stores, names []string) (string, bool, error) {
+	s, err := brokerListState(ctx, open, names)
+	return s.Machine, s.Behind, err
+}
+
+// brokerListState is brokerBehind with why the list could not be composed, when it could not: the plan's own
+// reason, which a remedy names rather than a push that would fail on it (the review of hq issue 353).
+func brokerListState(ctx context.Context, open *stores, names []string) (busListState, error) {
 	inv := open.inventory
 	holders, err := seatHolders(ctx, inv)
 	if err != nil {
-		return "", false, err
+		return busListState{}, err
 	}
 	h, held := holders[theBrokerSeat]
 	if !held || h.Node == "" {
-		return "", false, nil
+		return busListState{}, nil
 	}
 	shelf, err := inv.Catalogue(ctx)
 	if err != nil {
-		return "", false, err
+		return busListState{}, err
 	}
 	if m, known := shelf[h.Module]; !known || m.BusUsers == "" {
 		// A holder that is sent no user list carries no grant: nothing to send first.
-		return "", false, nil
+		return busListState{}, nil
 	}
 	for _, n := range names {
 		if n == h.Node {
-			return h.Node, false, nil
+			return busListState{Machine: h.Node}, nil
 		}
 	}
 	// **What cannot be worked out is behind** (the review of hq issue 353). The list it would be sent cannot be
@@ -1120,9 +1127,9 @@ func brokerBehind(ctx context.Context, open *stores, names []string) (string, bo
 	}
 	sent, err := inv.SentBusUsers(ctx, h.Node)
 	if err != nil {
-		return "", false, err
+		return busListState{}, err
 	}
-	return h.Node, listBehind(list, composeErr, sent), nil
+	return busListState{Machine: h.Node, Behind: listBehind(list, composeErr, sent), Uncomposed: composeErr}, nil
 }
 
 // listBehind is whether the bus's machine is behind: the list composed now is not the one last sent, or it