Write a removal after a restart from the declaration the apply replaced (issue 1369)

The set of modules this process wrote lives in memory, so a node-engine restarted before the apply that drops a module never wrote that module's removal. The report now names the modules the kept declaration held before, and they are removal candidates.

cmd/mesh-host/main.go

@@ -2314,7 +2314,17 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
 	}
 	// Kept whichever way it went, so a node that is disconnected next minute still knows what it
 	// was told. Saved after applying rather than before: what is kept is what this node acted on.
+	var before []string
 	if signed != nil {
+		// The modules the declaration kept until now held, so a have key written for one the new declaration no longer
+		// holds is written removed even by a node-engine that started since (issue 1369).
+		if kept, keptErr := store.ReadDeclared(store.DeclaredPath(opts.state)); keptErr == nil {
+			if old, parseErr := declaration.ParseTrusted(kept.Declaration); parseErr == nil {
+				for _, f := range moduleFacts(old, apply.Report{}, nil) {
+					before = append(before, f.Module)
+				}
+			}
+		}
 		if err := store.SaveDeclared(store.DeclaredPath(opts.state), *signed); err != nil {
 			report.Failed = map[string]string{"keeping the declaration": err.Error()}
 		}
@@ -2326,6 +2336,7 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
 	// And how each module of the declaration came out, for the have keys written beside this report (novox/hq ADR 0429
 	// §4, issue 1132): not on the wire.
 	report.Modules = moduleFacts(declared, outcome, applyErr)
+	report.Before = before
 	// Which resources did not apply, for whether a reconcile's account is news (issue 233): not said on the wire.
 	report.Unapplied = unapplied(declared, outcome, applyErr)
 	return report