Recreate a container when the content of a file it reads at creation changes

The host decided whether a container was still the one declared by a digest
of its declaration, and the declaration names an env-file's path and a
mount's path — never what is in them. So when the store was given a new
port, the host rewrote the forge's and the analytics service's environment
files, correctly, and left both containers running with the old port in
their environment: a container reads its env-file when it is CREATED, and
`docker restart` hands it the same environment again. Both looked healthy
until they answered 502.

What a running container takes in at creation is now part of its spec, by
content: every env-file, a file bind-mounted into it, and every file this
host wrote at or under a directory bind-mounted into it — the secrets,
bindings and configs under a module's state directories. The digest is the
one the store already records for a file the host wrote (`wrote`), read
from the state as it stands when the container is reached, so a file
rewritten earlier in the same apply is already the new one; a file the host
has no record of — an env-file a predecessor left, the superuser secret
genesis writes before any declaration names it — is read from disk, which
is what keeps adopting a running store in place a reconcile and not a
recreate.

Deliberately not part of it: what else is in a bind-mounted directory,
which is the service's own data and changes while it runs; a named volume;
a seed created once, which digests as the seed the host wrote and not as
what has grown in it; and a step — a run-once or scheduled container reads
its files when it runs and runs fresh each time. On an adopted node a held
container is held before any of this is looked at.

The host records what each container was created reading, per file, so
the recreate can say which file changed — "recreated: <file> changed" in
the report and, now with its detail, in the log. A container made before
this record existed is recreated once and says so.

novox/hq 04-ISSUES/103

internal/store/store.go

@@ -18,6 +18,7 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+	"strings"
 	"time"
 )
 
@@ -74,6 +75,14 @@ type Applied struct {
 	// each of the mesh's keys held before it set them, which of them were absent, and whether the
 	// file itself was — so undeclaring it gives the machine back exactly what it had.
 	Into *Into `json:"into,omitempty"`
+
+	// Reads is, for a container, the digest of each file it was created reading — its env-files
+	// and the files mounted into it — by path (novox/hq 04-ISSUES/103).
+	//
+	// A container takes those in once, when it is created, and the digest of the whole is in the
+	// container's spec label; this is the same information kept per file, so that when the spec
+	// no longer matches the host can say WHICH file changed rather than only that something did.
+	Reads map[string]string `json:"reads,omitempty"`
 }
 
 // Into is what a file written into held before the mesh's keys.
@@ -172,6 +181,26 @@ func (s State) Recorded(kind, target string) bool {
 	return false
 }
 
+// FilesUnder returns every file this host has a record of writing at a path or beneath it, of any
+// origin and under any id, in path order.
+//
+// By path rather than by id because a container names what it reads by path: the id a file was
+// declared under may change — the bundle's, then a module's, for the same file — and the container
+// reading it does not care which.
+func (s State) FilesUnder(path string) []Applied {
+	var out []Applied
+	for _, r := range s.Resources {
+		if r.Type != "file" {
+			continue
+		}
+		if r.Target == path || strings.HasPrefix(r.Target, strings.TrimSuffix(path, "/")+"/") {
+			out = append(out, r)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Target < out[j].Target })
+	return out
+}
+
 // HeldAt returns what is held under a resource id.
 func (s State) HeldAt(id string) (Held, bool) {
 	for _, h := range s.Held {