Let failed join the seat optional, and let a seeded row carry both changes

failed was required, so the controller refused the systemd module running
today and the module serving it was refused by the controller running
today: neither could land first. It is now optional (Verb.Optional, #117).

Two things kept either change from reaching a mesh whose seat rows already
exist: re-seeding added a verb but never an argument to one, and the
console refuses an argument the row does not name, so the journal window
would stay unreachable; and the optional mark is never stored, so a verb
seeded into a row came back required. A row's verb now gains the arguments
the binary names, and the working set takes the optional mark from the
compiled seat, which also keeps mesh-delivery's checks optional once seeded.

internal/catalogue/operators_machine_test.go

@@ -58,3 +58,53 @@ func TestTheServiceManagerSeatServesTheUnitVerbs(t *testing.T) {
 		t.Fatalf("the seat serves %v, not %v", got, want)
 	}
 }
+
+// **`failed` joins the seat optional** (the operator's direction 2026-10-07): the holder running today,
+// which does not serve it, still holds the seat; the holder that serves it is not refused; and a verb
+// the seat does not promise is still refused, and one it requires is still required.
+func TestFailedIsAnOptionalVerbOfTheServiceManager(t *testing.T) {
+	seat, _ := SeatNamed(ServiceManagerSeat)
+	holder := func(serves ...string) Manifest {
+		return Manifest{Module: "systemd", Version: "1", Claims: []Claim{{Name: ServiceManagerSeat, Scope: ScopeNode, Serves: serves}}}
+	}
+	eight := []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal"}
+	if err := CanHold(holder(eight...), seat); err != nil {
+		t.Fatalf("today's holder, without failed, is refused: %v", err)
+	}
+	if err := CanHold(holder(append(eight, "failed")...), seat); err != nil {
+		t.Fatalf("a holder serving failed is refused: %v", err)
+	}
+	if err := CanHold(holder(append(eight, "fail")...), seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
+		t.Fatalf("a verb the seat does not promise was accepted: %v", err)
+	}
+	if err := CanHold(holder(eight[1:]...), seat); err == nil || !strings.Contains(err.Error(), "does not serve units") {
+		t.Fatalf("a holder missing a required verb was accepted: %v", err)
+	}
+	for _, v := range seat.Serves {
+		if v.Optional != (v.Name == "failed") {
+			t.Errorf("%s optional: %v", v.Name, v.Optional)
+		}
+	}
+}
+
+// The optional mark is not stored, so a seat set read back from the store's rows takes it from the
+// compiled seat: otherwise `failed`, seeded into the row, would come back required.
+func TestAnOptionalVerbStaysOptionalInASetReadFromTheStore(t *testing.T) {
+	defer UseSeats(DefaultSeats())
+	var rows []Seat
+	for _, s := range DefaultSeats() {
+		row := s
+		row.Serves = nil
+		for _, v := range s.Serves {
+			row.Serves = append(row.Serves, Verb{Name: v.Name, Description: v.Description, Input: v.Input})
+		}
+		rows = append(rows, row)
+	}
+	UseSeats(rows)
+	seat, _ := SeatNamed(ServiceManagerSeat)
+	holder := Manifest{Module: "systemd", Version: "1", Claims: []Claim{{Name: ServiceManagerSeat, Scope: ScopeNode,
+		Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal"}}}}
+	if err := CanHold(holder, seat); err != nil {
+		t.Fatalf("a set read from rows refuses today's holder: %v", err)
+	}
+}

internal/catalogue/seats.go

@@ -338,12 +338,35 @@ func UseSeats(s []Seat) {
 		if d, known := byName[row.Name]; known {
 			row.Receives = d.Receives
 			row.Replicated = d.Replicated
+			row.Serves = optionalAsCompiled(row.Serves, d.Serves)
 		}
 		merged = append(merged, row)
 	}
 	seats = merged
 }
 
+// optionalAsCompiled is a row's verbs with each one the compiled seat marks optional marked so. The mark
+// is never stored (Verb.Optional), and a row is what the working set holds once the store is read: a verb
+// the seeding added to the row — `failed`, `checks` — would otherwise come back required, and every holder
+// not serving it yet would be refused at registration and at handover, which the mark exists to prevent.
+func optionalAsCompiled(row, compiled []Verb) []Verb {
+	optional := map[string]bool{}
+	for _, v := range compiled {
+		if v.Optional {
+			optional[v.Name] = true
+		}
+	}
+	if len(optional) == 0 {
+		return row
+	}
+	out := make([]Verb, len(row))
+	for i, v := range row {
+		v.Optional = optional[v.Name]
+		out[i] = v
+	}
+	return out
+}
+
 // aliases maps a seat's former names to its current canonical name (novox/hq ADR 0122). Loaded from
 // the store alongside the set, so a reference to a name a seat used to have — a manifest's claim, a
 // held record — still resolves to it after a rename, and nothing downstream has to change.
@@ -562,7 +585,7 @@ func SeatsWithAProtocol() []Seat {
 // 0177): the units on the machine in both scopes, read and acted on by name. Every verb takes an
 // optional scope — "system" when absent, "user" for the operator account's own manager — so a
 // caller asks for a user unit the way it asks for a system one; `failed` alone reads both managers
-// when none is named.
+// when none is named, and is optional (Verb.Optional).
 func serviceManagerVerbs() []Verb {
 	scoped := func(more map[string]string, required []string) map[string]any {
 		props := map[string]string{"scope": "\"system\" (the default) or \"user\": the operator account's own manager"}
@@ -603,8 +626,10 @@ func serviceManagerVerbs() []Verb {
 				"priority": "only entries this severe or more: 0-7 or emerg, alert, crit, err, warning, notice, info, debug (optional)",
 			}, []string{"unit"})},
 		// What has failed, on the seat rather than as one holder's own tool: whatever holds the role answers
-		// it, so a caller asks every machine the same way.
-		{Name: "failed", Description: "Every failed unit on this machine, in the system manager and in the operator " +
+		// it, so a caller asks every machine the same way. **Optional while its holders catch up**: the
+		// systemd module running today serves it as its own systemd_failed, and a required verb would
+		// refuse it before the version serving `failed` could be delivered.
+		{Name: "failed", Optional: true, Description: "Every failed unit on this machine, in the system manager and in the operator " +
 			"account's; a manager that does not answer is reported with its error, never as nothing failed.",
 			Input: schema(map[string]string{"scope": "\"system\" or \"user\": only that manager (both when absent)"}, nil)},
 	}