Bound the read of bus-module events, keep S9 seeing when it fails, count the controller's own slow consumer once (hq issue 270, review of #326)

A storm of closures must not spend a watchdog tick, so the read stops at 2000
events and says the count is a floor. A failed read is its own condition
rather than blinding S9, so the controller's own signals are still said. The
controller's fall behind, told to its client and closed by the server, is one
fault, counted once.

cmd/mesh-controller/bus_users_closed_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"errors"
 	"strings"
 	"testing"
 	"time"
@@ -67,3 +68,25 @@ func TestAUserTheBusClosedAsASlowConsumerIsOneConditionNamingItsModuleAndMachine
 		}
 	}
 }
+
+// **A read of the bus module's events that fails does not blind S9** (review of #326): the controller's own
+// signals are still said, and the failed read is a condition of its own.
+func TestABusModuleReadThatFailsKeepsTheControllersOwnSignals(t *testing.T) {
+	at := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	f := &signalFacts{now: at.Add(time.Minute), host: "anchor",
+		advisories: []link.Advisory{{Kind: link.AdvisorySlowConsumer, ID: "controller", Said: "the controller fell behind",
+			First: at, Last: at, Count: 1}},
+		busFaultsErr: errors.New("nats: timeout")}
+	keys := map[string]bool{}
+	for _, o := range watchAdvisories(f) {
+		keys[o.Key()] = true
+	}
+	if !keys["bus.controller.slow-consumer"] || !keys["bus.bus-module.bus-faults-unread"] {
+		t.Fatalf("observed %v: the controller's own slow consumer and the unread events, both", keys)
+	}
+	for _, row := range signalsTable {
+		if row.Row == "S9" && row.needs(f) != nil {
+			t.Fatal("the S9 row went blind for a read of the bus module's events")
+		}
+	}
+}

cmd/mesh-controller/plain_words.go

@@ -620,6 +620,12 @@ var plainWordings = map[string]func(conditions.Observation) words{
 			Explanation: "The bus reports a listener too slow to keep up, so messages to it are late.",
 			Resolved:    "The listener keeps up again"}
 	}),
+	kindBusFaultsUnread: worded(func(o conditions.Observation) words {
+		return words{Headline: "Slow clients of the bus cannot be checked",
+			Explanation: "The controller could not read what the bus said about its clients' connections, so a " +
+				"client the bus cut off would go unnoticed. It tries again at every check.",
+			Resolved: "Resolved: the bus's clients are checked again"}
+	}),
 	"connection-closed": worded(func(o conditions.Observation) words {
 		return words{Headline: "The bus cut a client off",
 			Explanation: "The bus closed a client's connection because it broke the bus's rules, so what it was " +

cmd/mesh-controller/signals.go

@@ -586,9 +586,24 @@ func watchAdvisories(f *signalFacts) []conditions.Observation {
 		}
 		out = append(out, o)
 	}
+	if f.busFaultsErr != nil {
+		out = append(out, busFaultsUnread(f.busFaultsErr))
+	}
 	return append(out, watchDeadLetters(f)...)
 }
 
+// kindBusFaultsUnread is the bus module's events not read back (novox/hq ADR 0357): every other user's
+// slow consumer is unheard while it lasts, and the controller's own signals are still said.
+const kindBusFaultsUnread = "bus-faults-unread"
+
+func busFaultsUnread(err error) conditions.Observation {
+	return conditions.Observation{Scope: conditions.ScopeBus, ID: "bus-module", Kind: kindBusFaultsUnread,
+		Severity: conditions.Warning, Confirm: true,
+		Summary: "what the bus module said of its users' connections could not be read back, so a slow consumer " +
+			"or a connection the bus closed is not said until it can",
+		Said: firstLine(err.Error())}
+}
+
 // busUserClosed words an advisory about a bus user's connection the server closed (novox/hq ADR 0357): the
 // user as the operator says it and the machine it is on, the dotted user name kept in the evidence only.
 func busUserClosed(o *conditions.Observation, a link.Advisory, host string) {

cmd/mesh-controller/watchdogs.go

@@ -92,6 +92,8 @@ type signalFacts struct {
 	// consumers: the condition counts the messages given up on, not the looks (novox/hq issue 440).
 	deadLettersNewest map[string]time.Time
 	advisoriesErr     error
+	// busFaultsErr is why the bus module's events could not be read this tick (novox/hq ADR 0357).
+	busFaultsErr error
 
 	selfCheck selfCheckFacts
 
@@ -360,9 +362,10 @@ func (w *watchdogs) gather(ctx context.Context) *signalFacts {
 	f.lostConsumers, f.advisoriesErr = w.lostConsumers(ctx, f.advisories)
 	// And what the bus did to every other user's connection, as the bus module said it (novox/hq ADR 0357):
 	// read back for the same hour, and one advisory with the controller's own where both are its.
-	if f.advisoriesErr == nil && w.server != nil && w.js != nil {
+	// A read that fails is its own condition, never S9 blind: the controller's own signals are still said.
+	if w.server != nil && w.js != nil {
 		var faults []link.Advisory
-		if faults, f.advisoriesErr = w.server.BusFaults(ctx, now.Add(-advisoryQuiet)); f.advisoriesErr == nil {
+		if faults, f.busFaultsErr = w.server.BusFaults(ctx, now.Add(-advisoryQuiet)); f.busFaultsErr == nil {
 			f.advisories = link.MergeAdvisories(f.advisories, faults)
 		}
 	}