issue 800: keep notify's health as unit; the gate refuses a one-process module judged only by its own tool

ADR 0227 rule 8 / ADR 0240 rule 2 refuse a module with no health check of
another kind beside a tool check. mesh-mail-notifier has one process
(notify); wiring mail_notifier_health as its manifest health, as the review
note's wording suggested (mirroring mesh-mail's watch/mail_health), trips
that rule because mesh-mail also has keep (kind unit) beside watch.
mail_notifier_health stays built, tested and callable; notify's manifest
health stays kind unit until the lead decides how a one-process module
gets this automatically.

modules/mesh-mail-notifier/README.md

@@ -37,4 +37,4 @@ accounts it announces, in mesh-mail's trusted setting `grants` (`mail-store`'s s
 | tool | does |
 |---|---|
 | `mail-notifier.status` | every account it is granted, when it last showed each one a notice, and any notice still failing to send (its count, last error, since when). Read-only |
-| `mail_notifier_health` | how it is: unhealthy once a notice has failed to show for more than ten minutes, healthy otherwise, even mid-retry. Read-only |
+| `mail_notifier_health` | how it is: unhealthy once a notice has failed to show for more than ten minutes, healthy otherwise, even mid-retry. Not (yet) the node-engine's own check of `notify` — one process cannot be judged only by its own tool (ADR 0227 rule 8); `notify`'s manifest health stays `unit` until the lead decides how a one-process module gets this automatically. Read-only |

modules/mesh-mail-notifier/cmd/mesh-mail-notifier/health.go

@@ -3,11 +3,20 @@ package main
 // mesh-mail-notifier's own health (review round 1 of issue 800, which added this tool beside mail-notifier's
 // seat verb status, as mesh-mail's own health tool is mail_health beside its seat tools). A notice that fails
 // to send stays pending and is retried, at most once a minute (Flush, notifier.go); the account's
-// failing-since stays in the Store, so this tool — its own process, asked separately by the node-engine —
-// sees the same account the live notifier does, with no state of its own to lose between asks.
+// failing-since stays in the Store, so this tool — its own process, asked separately by the node-engine or by
+// mesh_call — sees the same account the live notifier does, with no state of its own to lose between asks.
 //
 // Unhealthy once an account's notice has failed to show for more than UnhealthyAfter; healthy otherwise, even
 // while a notice is mid-retry.
+//
+// STOP (review round 1 of issue 800, not decided by its note): this tool is served and tested, but module.json
+// does not name it as the notify process's own health check — mesh-mail-notifier has one process (notify), and
+// the catalogue's gate refuses a module judged only by its own tool, with no check of another kind beside it
+// (ADR 0227 rule 8, ADR 0240 rule 2; internal/catalogue/health.go ~297 in mesh-controller). mesh-mail avoids
+// this because it has two processes — keep (kind unit) beside watch (kind tool, mail_health); mesh-mail-notifier
+// has only notify, so wiring this tool the same way trips the gate. notify's health stays kind unit (liveness,
+// as it was before this round) until the lead decides how a one-process module gets an automatic, node-engine
+// enforced health of this kind: a second process judged some other way, or a change to the gate's rule.
 
 import (
 	"fmt"

modules/mesh-mail-notifier/module.json

@@ -58,12 +58,7 @@
         "notify"
       ],
       "health": {
-        "kind": "tool",
-        "tool": "mail_notifier_health",
-        "interval": "60s",
-        "timeout": "10s",
-        "looks": 2,
-        "grace": "120s"
+        "kind": "unit"
       }
     }
   ],