Let failed join the seat optional, and let a seeded row carry both changes

failed was required, so the controller refused the systemd module running
today and the module serving it was refused by the controller running
today: neither could land first. It is now optional (Verb.Optional, #117).

Two things kept either change from reaching a mesh whose seat rows already
exist: re-seeding added a verb but never an argument to one, and the
console refuses an argument the row does not name, so the journal window
would stay unreachable; and the optional mark is never stored, so a verb
seeded into a row came back required. A row's verb now gains the arguments
the binary names, and the working set takes the optional mark from the
compiled seat, which also keeps mesh-delivery's checks optional once seeded.

internal/catalogue/seats.go

@@ -338,12 +338,35 @@ func UseSeats(s []Seat) {
 		if d, known := byName[row.Name]; known {
 			row.Receives = d.Receives
 			row.Replicated = d.Replicated
+			row.Serves = optionalAsCompiled(row.Serves, d.Serves)
 		}
 		merged = append(merged, row)
 	}
 	seats = merged
 }
 
+// optionalAsCompiled is a row's verbs with each one the compiled seat marks optional marked so. The mark
+// is never stored (Verb.Optional), and a row is what the working set holds once the store is read: a verb
+// the seeding added to the row — `failed`, `checks` — would otherwise come back required, and every holder
+// not serving it yet would be refused at registration and at handover, which the mark exists to prevent.
+func optionalAsCompiled(row, compiled []Verb) []Verb {
+	optional := map[string]bool{}
+	for _, v := range compiled {
+		if v.Optional {
+			optional[v.Name] = true
+		}
+	}
+	if len(optional) == 0 {
+		return row
+	}
+	out := make([]Verb, len(row))
+	for i, v := range row {
+		v.Optional = optional[v.Name]
+		out[i] = v
+	}
+	return out
+}
+
 // aliases maps a seat's former names to its current canonical name (novox/hq ADR 0122). Loaded from
 // the store alongside the set, so a reference to a name a seat used to have — a manifest's claim, a
 // held record — still resolves to it after a rename, and nothing downstream has to change.
@@ -562,7 +585,7 @@ func SeatsWithAProtocol() []Seat {
 // 0177): the units on the machine in both scopes, read and acted on by name. Every verb takes an
 // optional scope — "system" when absent, "user" for the operator account's own manager — so a
 // caller asks for a user unit the way it asks for a system one; `failed` alone reads both managers
-// when none is named.
+// when none is named, and is optional (Verb.Optional).
 func serviceManagerVerbs() []Verb {
 	scoped := func(more map[string]string, required []string) map[string]any {
 		props := map[string]string{"scope": "\"system\" (the default) or \"user\": the operator account's own manager"}
@@ -603,8 +626,10 @@ func serviceManagerVerbs() []Verb {
 				"priority": "only entries this severe or more: 0-7 or emerg, alert, crit, err, warning, notice, info, debug (optional)",
 			}, []string{"unit"})},
 		// What has failed, on the seat rather than as one holder's own tool: whatever holds the role answers
-		// it, so a caller asks every machine the same way.
-		{Name: "failed", Description: "Every failed unit on this machine, in the system manager and in the operator " +
+		// it, so a caller asks every machine the same way. **Optional while its holders catch up**: the
+		// systemd module running today serves it as its own systemd_failed, and a required verb would
+		// refuse it before the version serving `failed` could be delivered.
+		{Name: "failed", Optional: true, Description: "Every failed unit on this machine, in the system manager and in the operator " +
 			"account's; a manager that does not answer is reported with its error, never as nothing failed.",
 			Input: schema(map[string]string{"scope": "\"system\" or \"user\": only that manager (both when absent)"}, nil)},
 	}