Answer the review of hq issues 348 and 349: gaps, parts, the newest merge in any state

- A reopened fault keeps its gaps: it was there at a send unless the send
  fell in one, so a send that breaks a machine recovered before it still
  fails its gate (A2).
- An undecided part holds only the conditions that name it (A4).
- D2 holds a silent resolver for the next run again, refused or not: a
  burst of refusals is also a restart (A3).
- A late merge is planned at the newest planned merge of its branch in any
  state, not only an open one (A1); merge times to the nanosecond (A5).

cmd/mesh-controller/machine_network.go

@@ -98,9 +98,9 @@ func judgeNetworks(ctx context.Context, inv *inventory.Inventory, k *conditions.
 			problems = append(problems, err.Error())
 		}
 	}
-	undecided := undecidedMachines(f)
+	undecided := undecidedParts(f)
 	for _, c := range open {
-		if !slices.Contains(networkKinds, c.Kind) || said[c.Key] || undecided[c.Subject.Machine] {
+		if !slices.Contains(networkKinds, c.Kind) || said[c.Key] || heldUndecided(c, undecided) {
 			continue
 		}
 		why := "no machine says it any more"
@@ -117,36 +117,59 @@ func judgeNetworks(ctx context.Context, inv *inventory.Inventory, k *conditions.
 	return nil
 }
 
-// undecidedMachines is every machine whose newest statement has a part not yet judged: starting, or
-// unknown — one look failed and a second decides (novox/hq issue 348). Such a statement does not say a
-// fault is gone, so an open network condition about that machine is kept until a statement decides.
+// undecidedParts is, per machine, every part of its newest statement not yet judged: starting, or unknown
+// — one look failed and a second decides (novox/hq issue 348). Such a part does not say its fault is gone.
+// A statement whose parts are all decided but whose whole is unknown or starting holds every part. Pure.
 //
 // On 2026-10-09 the control node's resolver refused every question from 10:58 to 11:18 UTC. A build of
-// the node-engine sent at 10:59:34 restarted it; its first statement after the restart judged the names
-// once (unknown, "one look failed; a second decides"), and that statement cleared the control node's
-// network condition while its last evidence still said "connection refused". The second look raised it
-// again forty seconds later — after the send — and the gate failed the build for a fault from before it.
-// Pure.
-func undecidedMachines(f networkFacts) map[string]bool {
-	out := map[string]bool{}
+// the node-engine sent at 10:59:34 restarted it; its first statement judged the names once (unknown, "one
+// look failed; a second decides"), and that statement cleared the control node's network condition while
+// its last evidence still said "connection refused". The second look raised it again forty seconds later —
+// after the send — and the gate failed the build for a fault from before it.
+func undecidedParts(f networkFacts) map[string]map[string]bool {
+	out := map[string]map[string]bool{}
 	for m, h := range f.healths {
 		if h.Network == nil {
 			continue
 		}
-		if h.Network.State == link.StateUnknown || h.Network.State == link.StateStarting {
-			out[m] = true
-			continue
-		}
+		parts := map[string]bool{}
 		for _, p := range h.Network.Parts {
 			if p.State == link.StateUnknown || p.State == link.StateStarting {
-				out[m] = true
-				break
+				parts[p.Part] = true
 			}
 		}
+		if len(parts) == 0 && (h.Network.State == link.StateUnknown || h.Network.State == link.StateStarting) {
+			parts["*"] = true
+		}
+		if len(parts) > 0 {
+			out[m] = parts
+		}
 	}
 	return out
 }
 
+// heldUndecided says an open network condition is kept rather than cleared: a part its newest evidence
+// names is undecided in the newest statement of a machine it is about. A condition about other parts
+// clears as before. Pure.
+func heldUndecided(c conditions.Condition, undecided map[string]map[string]bool) bool {
+	said := ""
+	if len(c.Evidence) > 0 {
+		said = c.Evidence[0].Said
+	}
+	for _, m := range append([]string{c.Subject.Machine}, c.Subject.Also...) {
+		parts := undecided[m]
+		if parts["*"] {
+			return true
+		}
+		for part := range parts {
+			if strings.Contains(said, part+" since ") || strings.Contains(said, part+": ") {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // pointed is one machine's failing part that points at another machine.
 type pointed struct {
 	from string