mesh-issues: take every condition key the controller raises, a delivery's with its slash among them (hq issue 475)

The tracker's own pattern refused the slash a delivery's id carries, so no issue
could track a delivery's condition and the operator's alert kept saying no issue
tracks it. Mirror the controller's key rule instead of a pattern of our own; a
router test proves a slashed key is matched and named end to end.

modules/mesh-issues/cmd/mesh-issues/check.go

@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"regexp"
+	"slices"
 	"strings"
 	"unicode"
 	"unicode/utf8"
@@ -219,13 +220,42 @@ const (
 var LinkKinds = []string{LinkDuplicates, LinkRelatesTo, LinkDependsOn, LinkPullRequest, LinkDecision, LinkDesign, LinkCondition, LinkDelivery}
 
 var (
-	pullRequest  = regexp.MustCompile(`^[a-z0-9][a-z0-9._-]{0,99}#[1-9][0-9]{0,6}$`)
-	decision     = regexp.MustCompile(`^[0-9]{4}$`)
-	conditionKey = regexp.MustCompile(`^[a-z0-9][a-z0-9._:=@-]{0,199}$`)
-	deliveryID   = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$`)
-	issueNumber  = regexp.MustCompile(`^[1-9][0-9]{0,8}$`)
+	pullRequest = regexp.MustCompile(`^[a-z0-9][a-z0-9._-]{0,99}#[1-9][0-9]{0,6}$`)
+	decision    = regexp.MustCompile(`^[0-9]{4}$`)
+	deliveryID  = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$`)
+	issueNumber = regexp.MustCompile(`^[1-9][0-9]{0,8}$`)
 )
 
+// The controller's rule for a condition's key, mirrored (novox/hq issue 475): mesh-controller's
+// internal/conditions/condition.go composes every key in `Key` as `<scope>.<id>.<kind>`, the id split on its dots,
+// each token made of the bus's safe characters `A-Za-z0-9_=/-` (anything else becomes `_`, an empty token `_`),
+// and `Observation.check` refuses a scope not in its `Scopes`. A delivery's id carries its repository as
+// owner/name, so its keys hold a slash: the narrower shape this replaced refused every one of them, and no issue
+// could track a delivery's condition. Mirroring the rule, rather than widening a pattern, keeps the tracker taking
+// exactly what the controller can raise.
+var (
+	conditionScopes = []string{"machine", "plan", "call", "build", "merge", "provider", "seat", "bus", "core",
+		"probe", "mesh", "delivery", "module"}
+	conditionKeyToken = regexp.MustCompile(`^[A-Za-z0-9_=/-]+$`)
+)
+
+// MostConditionKey is the longest key a link takes: the controller sets no bound, the tracker keeps a link one line.
+const MostConditionKey = 255
+
+// isConditionKey says whether k is a key the controller could raise.
+func isConditionKey(k string) bool {
+	parts := strings.Split(k, ".")
+	if len(k) > MostConditionKey || len(parts) < 3 || !slices.Contains(conditionScopes, parts[0]) {
+		return false
+	}
+	for _, p := range parts {
+		if !conditionKeyToken.MatchString(p) {
+			return false
+		}
+	}
+	return true
+}
+
 // checkTarget is a link's target, as its kind takes it, said the one way it is kept.
 func checkTarget(kind, target string) (string, error) {
 	t := strings.TrimSpace(target)
@@ -241,7 +271,8 @@ func checkTarget(kind, target string) (string, error) {
 	case LinkDesign:
 		ok, shape = designPath.MatchString(t), "a design document, such as 03-DESIGN/01-to-be/53-the-issue-tracker.md"
 	case LinkCondition:
-		ok, shape = conditionKey.MatchString(t), "a condition's key as the controller names it"
+		ok, shape = isConditionKey(t), "a condition's key as the controller names it: <scope>.<id>.<kind>, "+
+			"the scope one of "+strings.Join(conditionScopes, ", ")+", each part of letters, digits and _=/-"
 	case LinkDelivery:
 		ok, shape = deliveryID.MatchString(t), "a delivery's id as the controller names it"
 	default:

modules/mesh-issues/cmd/mesh-issues/conditionkey_test.go

@@ -0,0 +1,55 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+// A condition link takes every key the controller raises (novox/hq issue 475). The keys are real: the delivery's
+// as `mesh-controller.status` named it when the link was refused, the others as `mesh-controller.conditions`
+// answered on 2026-10-11.
+var realConditionKeys = []string{
+	"delivery.novox/mesh-controller_d2e9dc61590f.stalled", // a delivery's id carries its repository, owner/name
+	"machine.novox.telegram.telegram-token.secret-given",
+	"module.openrazer.shanks.relogin-needed",
+	"mesh.hand-acts.plans_go.healer-wanted", // a space in the id, made `_` by the controller
+	"delivery.leaf.over-budget",
+}
+
+func TestAConditionLinkTakesEveryKeyTheControllerRaises(t *testing.T) {
+	h := newHarness(t)
+	n := h.open(t, "a delivery stalls", "mesh-catalog")
+	for _, k := range realConditionKeys {
+		if _, err := h.Link(LinkAsk{Number: n, Kind: LinkCondition, Target: k}); err != nil {
+			t.Errorf("%s: %v", k, err)
+		}
+	}
+	got, err := h.Tracking([]string{realConditionKeys[0]})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if is := got.Conditions[realConditionKeys[0]]; len(is) != 1 || is[0].Number != n || got.Said != "Issues track 1 condition." {
+		t.Fatalf("the delivery's condition is not said tracked: %+v", got)
+	}
+}
+
+// What the controller never raises is refused, so a link never names a condition that cannot exist.
+func TestAConditionLinkRefusesWhatTheControllerNeverRaises(t *testing.T) {
+	for _, k := range []string{
+		"",
+		"delivery.stalled",             // no id: a key is scope, id and kind
+		"weather.novox.rain",           // no scope the controller knows
+		"machine..secret-given",        // an empty token
+		"machine.novox.secret given",   // a space the controller makes `_`
+		"machine.novox:1.secret-given", // a colon the controller makes `_`
+		"delivery.novox/mesh-controller@d2e9dc61590f.stalled", // `@` too
+		"machine.*.silent",         // a wildcard on the bus
+		"machine.>",                // a wildcard on the bus
+		"machine.ace.silent\nmore", // a second line
+		"machine." + strings.Repeat("a", 300) + ".silent",
+	} {
+		if _, err := checkTarget(LinkCondition, k); err == nil {
+			t.Errorf("%q was taken as a condition's key", k)
+		}
+	}
+}

modules/mesh-issues/cmd/mesh-issues/tracker_test.go

@@ -473,7 +473,7 @@ func TestLinksAreTypedAddedOnceAndRemoved(t *testing.T) {
 		{Kind: LinkPullRequest, Target: "mesh-controller#246"},
 		{Kind: LinkDecision, Target: "0275"},
 		{Kind: LinkDesign, Target: "03-DESIGN/01-to-be/53-the-issue-tracker.md"},
-		{Kind: LinkCondition, Target: "healer-wanted.ace.backup"},
+		{Kind: LinkCondition, Target: "mesh.hand-acts.backup.healer-wanted"},
 		{Kind: LinkDelivery, Target: "d-2026-10-10.3"},
 	}
 	for _, l := range good {
@@ -494,7 +494,7 @@ func TestLinksAreTypedAddedOnceAndRemoved(t *testing.T) {
 		{LinkAsk{Kind: LinkDecision, Target: "275"}, "four-digit"},
 		{LinkAsk{Kind: LinkDesign, Target: "03-DESIGN/../../etc/passwd"}, "design document"},
 		{LinkAsk{Kind: LinkCondition, Target: "a key\nwith a line"}, "condition"},
-		{LinkAsk{Kind: LinkCondition, Target: "token=abcdefgh123"}, "secret"},
+		{LinkAsk{Kind: LinkCondition, Target: "machine.ace.token=abcdefgh123.leaked"}, "secret"},
 		{LinkAsk{Kind: LinkRelatesTo, Target: keyOf(b), Remove: true}, ""},
 		{LinkAsk{Kind: LinkRelatesTo, Target: keyOf(b), Remove: true}, "no relates-to link"},
 	}

modules/messenger/cmd/messenger/tracking_delivery_test.go

@@ -0,0 +1,42 @@
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// A delivery's condition, whose key holds its repository as owner/name, is matched to the issue that tracks it and
+// its message names that issue (novox/hq issue 475). The key is the real one `mesh-controller.status` named; the
+// event is decoded as the controller says it, so the key travels as it does on the bus.
+func TestADeliverysConditionWithASlashInItsKeyNamesTheIssueThatTracksIt(t *testing.T) {
+	const key = "delivery.novox/mesh-controller_d2e9dc61590f.stalled"
+	h, tg, _, c, _ := newHolder(t)
+	h.Ask = func(address string, body any) (json.RawMessage, error) {
+		if address != TrackingVerb {
+			return json.RawMessage(`{"ok":true}`), nil
+		}
+		return json.RawMessage(`{"conditions":{"` + key + `":[{"number":475,"status":"open"}]}}`), nil
+	}
+	k, err := DecodeCondition(EventRaised, []byte(`{"key":"`+key+`","kind":"stalled","severity":"urgent",`+
+		`"subject":{"scope":"delivery","id":"novox/mesh-controller_d2e9dc61590f"},`+
+		`"headline":"Delivery of mesh-controller stalled",`+
+		`"explanation":"Needs you: let the walk go or drop it. The delivery of mesh-controller waits for a walk that never starts.",`+
+		`"needs":"let the walk go or drop it.","summary":"the delivery of mesh-controller waits for its walk"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if k.Key != key {
+		t.Fatalf("the key was read as %q", k.Key)
+	}
+	k.Raised = c.now()
+	h.Condition(EventRaised, k)
+	settle(h, c)
+	if len(tg.sends) != 1 {
+		t.Fatalf("telegram %d", len(tg.sends))
+	}
+	body := tg.sends[0].Body
+	if !strings.Contains(body, "Tracked as issue 475") || strings.Contains(body, "No issue tracks this yet.") {
+		t.Fatalf("body: %q", body)
+	}
+}