Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

Two controllers could both act (issue 204), a reconcile's report could
overtake the apply after it and the digest decided (issue 267), and a grant
could make a second writer of a machine's report.

- The lease (internal/lease, ADR 0229): mesh-controller_lease key `holder`,
  15 s age, renewed every 5 s by compare-and-set; the epoch is the revision
  it was taken at. The gate is the clock (stops 3 s before expiry); a refused
  renewal is a loss and the process exits; a holder that stops gives it back.
  serve takes it before asserting the bus. Epochs kept in the store
  (migration 0068 controller_epoch) as a floor: a bucket raised from nothing
  is compacted past it. Unleased (no epoch, S12 urgent) only when nobody
  holds it and the bus will not let it be written. A shell command acts
  under the holder's epoch, or its own lease when none.
- Declarations carry `epoch` inside the signed envelope, only to a machine
  whose latest account carried a report_sequence (mesh-host #35); would-send
  is composed with the epoch last sent. Allot and the send both pass the gate.
- Reports: contract in internal/link/order.go (epoch, sequence,
  report_sequence, older_than, refused_older). Accounts kept by epoch, then
  sequence, then report sequence; older refused, counted; unordered reports
  keep the digest rule. Plans by compare-and-set on a revision, with epoch.
  Conditions and calls carry the epoch and are not written off the lease.
- S12 and S13 (naming the writer by epoch) watched, D5 run; reset of the
  bucket said. Writers table compiled in and enforced in PermissionsFor; the
  controller no longer publishes mesh.control.>. A contract per consumed
  kind, and the empty-on-error lint over the repository.
- mesh-host pinned to its main with the epoch in the validator (D1 validates
  the envelope as sent).

Needs mesh-host's genesis lock with the lease grant (mesh-host PR) for
TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose.

cmd/mesh-controller/source.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"os"
 	"strconv"
 	"strings"
 
@@ -134,19 +135,28 @@ func seatBase(world catalogue.World, seatName string) (string, error) {
 // seatBases is the clone base of every seat a recipe's context may name, for a build request
 // (novox/hq ADR 0155). A seat nobody holds is left out rather than refused here: the build may not
 // name it at all, and if it does the builder refuses with the seat's name.
+//
+// **What cannot be read is said, not passed over as no seats** (novox/hq to-be 45 Phase 2, the
+// empty-on-error lint): the build still goes ahead — one that names no seat needs none — and one that
+// does is refused naming it, but the reason is the store, and that is said here where it is known.
 func seatBases(ctx context.Context) map[string]string {
+	unread := func(what string, err error) map[string]string {
+		fmt.Fprintf(os.Stderr, "could not read %s, so a build naming a seat's clone base will be told that "+
+			"seat is not held: %v\n", what, err)
+		return nil
+	}
 	open, err := openStores(ctx)
 	if err != nil {
-		return nil
+		return unread("the mesh's store", err)
 	}
 	defer open.Close()
 	shelf, err := open.inventory.Catalogue(ctx)
 	if err != nil {
-		return nil
+		return unread("the catalogue", err)
 	}
 	world, err := theRestOfTheMesh(ctx, open.inventory, shelf, "")
 	if err != nil {
-		return nil
+		return unread("who holds which seat", err)
 	}
 	bases := map[string]string{}
 	for _, seatName := range []string{gitSeat} {