Offer only acknowledgements as answers, keep a refused verdict, and say a change of words

Review found that a desk click proves nothing about who chose, that refused words
could turn "Needs you" into "Nothing for you to do", that sound words were refused,
and that a quiet warning whose words came to need the operator was never said
(hq ADR 0258).

cmd/mesh-controller/handacts.go

@@ -15,6 +15,7 @@ import (
 	"github.com/nats-io/nats.go"
 
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -65,8 +66,10 @@ var handActVerbs = []handActVerb{
 	// not trusted with it — either is a repair the owner should have made.
 	{Verb: "plans go"},
 	{Verb: "broker consumer-reset"},
-	// Silencing the same condition twice says the condition, or what it watches, wants mending.
-	{Verb: "conditions silence"},
+	// Silencing the same condition twice says the condition, or what it watches, wants mending — unless
+	// it is the operator's answer on a notification: a decision to live with it (novox/hq ADR 0258).
+	{Verb: "conditions silence", Decision: "the operator's answer on a notification is their decision, " +
+		"not a repair (ADR 0258)", DecidedFor: []string{conditions.CauseOperatorAnswer}},
 	// An act done outside the mesh: the mesh cannot tell a repair from a decision there, so it counts —
 	// except a drill recorded through it before `hand-act drill` existed (2026-10-07). It refuses the
 	// cause since, so no act recorded through it now carries it.

cmd/mesh-controller/module_health.go

@@ -281,7 +281,7 @@ func reloginWords(module, node string) words {
 // the machine and what is wrong with each resource; the detail — targets, streaks, since — is evidence.
 func moduleUnhealthyObservation(module, node string, rs []inventory.ResourceHealth) conditions.Observation {
 	var words, said, plain []string
-	needs, actions := moduleNeeds(node, rs)
+	needs := moduleNeeds(node, rs)
 	for _, r := range rs {
 		plain = append(plain, resourcePlainWords(r))
 		if r.Kind == link.KindUnit {
@@ -305,7 +305,6 @@ func moduleUnhealthyObservation(module, node string, rs []inventory.ResourceHeal
 		Explanation: fmt.Sprintf("%s on %s is not healthy: %s. It clears as soon as it runs again.", module, node,
 			namesWords(plain, 3)),
 		Needs:    needs,
-		Actions:  actions,
 		Resolved: fmt.Sprintf("%s works again on %s", module, node)}
 }
 

cmd/mesh-controller/plain_words.go

@@ -642,43 +642,28 @@ func waitingNeeds(severity conditions.Severity) string {
 	return ""
 }
 
-// waitingActions are the answers to a walk waiting past its urgent bound: the controller's own verb, since
-// the module that should have said go is the one not answering.
-func waitingActions(w waitFacts, severity conditions.Severity) []conditions.Action {
-	if severity != conditions.Urgent {
-		return nil
-	}
-	return []conditions.Action{
-		{Label: "Start", Verb: "mesh-controller.plans", Arguments: map[string]string{"go": w.id, "why": ""}},
-		{Label: "Stop", Verb: "mesh-controller.plans", Arguments: map[string]string{"stop": w.id, "why": ""}},
-	}
-}
-
 // moduleNeeds is what the operator can do about a module unhealthy on a machine: log in again where its
 // account's groups wait for it (ADR 0252), restart a failed service, or nothing where the mesh restarts it.
-func moduleNeeds(node string, rs []inventory.ResourceHealth) (string, []conditions.Action) {
-	var actions []conditions.Action
+// No answer is offered for a restart: a desk click performs only an acknowledgement (ADR 0258).
+func moduleNeeds(node string, rs []inventory.ResourceHealth) string {
+	unit := ""
 	for _, r := range rs {
 		if strings.Contains(r.Reason, "relogin needed") {
-			return fmt.Sprintf("log out of every session on %s and log in again.", node), nil
+			return reloginNeeds(node)
 		}
-		if r.Kind == link.KindUnit && len(actions) < 2 {
-			scope := "system"
-			if strings.Contains(r.Reason, "account's own") {
-				scope = "user"
-			}
-			label := "Restart"
-			if len(actions) > 0 {
-				label = "Restart " + unitPlainWords(r.Target)
-			}
-			actions = append(actions, conditions.Action{Label: label, Verb: "node-service-manager.restart",
-				Machine: node, Arguments: map[string]string{"unit": r.Target, "scope": scope}})
+		if r.Kind == link.KindUnit && unit == "" {
+			unit = unitPlainWords(r.Target)
 		}
 	}
-	if len(actions) > 0 {
-		return "restart it; if it fails again, the details say why.", actions
+	if unit != "" {
+		return fmt.Sprintf("restart its service %s on %s; if it fails again, the details say why.", unit, node)
 	}
-	return "", nil
+	return ""
+}
+
+// reloginNeeds is what an account waiting for its groups needs (ADR 0252).
+func reloginNeeds(node string) string {
+	return fmt.Sprintf("log out of every session on %s and log in again.", node)
 }
 
 // stalledWords are the plain words of a delivery held past its bound, as mesh-delivery says it.
@@ -695,18 +680,15 @@ func stalledWords(l stalledLine, o conditions.Observation) (headline, explanatio
 		long = "for " + humanDuration(d)
 	}
 	if o.Resolver == conditions.ResolverOperator {
+		// Words only: releasing or stopping a delivery is not an acknowledgement, so no desk click
+		// performs it (ADR 0258).
 		switch held {
 		case "held":
 			needs = "release it, or stop it."
-			actions = []conditions.Action{
-				{Label: "Release", Verb: "mesh-delivery.release", Arguments: map[string]string{"id": l.ID, "why": ""}},
-				{Label: "Stop", Verb: "mesh-delivery.stop", Arguments: map[string]string{"id": l.ID, "why": ""}},
-			}
 		case "ready", "checked":
 			needs = "merge its pull request, or close it."
 		default:
 			needs = "stop it, or read the details to see what it waits for."
-			actions = []conditions.Action{{Label: "Stop", Verb: "mesh-delivery.stop", Arguments: map[string]string{"id": l.ID, "why": ""}}}
 		}
 	}
 	return fmt.Sprintf("Delivery of %s %s %s", name, held, long),

cmd/mesh-controller/plain_words_test.go

@@ -70,13 +70,7 @@ func TestADeliveryWaitingNeedsNothingUntilItsBoundThenOffersStartAndStop(t *test
 	plainExample(t, got[0], "openrazer delivery waiting to start",
 		"Needs you: start it, or stop it. The change to openrazer is merged and built, and mesh-delivery (the "+
 			"module that decides when a delivery goes out) has not let it start for 5 hours, so mesh-delivery may "+
-			"be stuck.", "Start", "Stop")
-	if a := got[0].Actions[0]; a.Verb != "mesh-controller.plans" || a.Arguments["go"] != "plan-1791454185265004861" {
-		t.Errorf("start: %+v", a)
-	}
-	if a := got[0].Actions[1]; a.Verb != "mesh-controller.plans" || a.Arguments["stop"] != "plan-1791454185265004861" {
-		t.Errorf("stop: %+v", a)
-	}
+			"be stuck.")
 
 	// Many modules are counted, not listed in the headline.
 	f.waits[0].modules = []string{"a", "b", "c", "d"}
@@ -87,24 +81,32 @@ func TestADeliveryWaitingNeedsNothingUntilItsBoundThenOffersStartAndStop(t *test
 }
 
 // **A module unhealthy**: "openrazer on g14 is not healthy: its unit openrazer-daemon.service failed in the
-// account's own service manager (exit-code)". The operator restarts it from the notification.
-func TestAModuleUnhealthyOffersARestartOfItsService(t *testing.T) {
+// account's own service manager (exit-code)". Restarting is not an acknowledgement, so it is said in words
+// and offered as no answer (ADR 0258).
+func TestAModuleUnhealthyAsksForARestartInWords(t *testing.T) {
 	o := moduleUnhealthyObservation("openrazer", "g14", []inventory.ResourceHealth{{Kind: link.KindUnit,
 		Resource: "openrazer-daemon", Target: "openrazer-daemon.service",
 		Reason: "failed in the account's own service manager (exit-code)", Since: time.Now()}})
 	plainExample(t, o, "openrazer not working on g14",
-		"Needs you: restart it; if it fails again, the details say why. openrazer on g14 is not healthy: its "+
-			"service openrazer-daemon stopped with an error. It clears as soon as it runs again.", "Restart")
-	if a := o.Actions[0]; a.Verb != "node-service-manager.restart" || a.Machine != "g14" ||
-		a.Arguments["unit"] != "openrazer-daemon.service" || a.Arguments["scope"] != "user" {
-		t.Errorf("restart: %+v", a)
-	}
-	// An account waiting for a new login (ADR 0252) asks for the login, which no button can give.
+		"Needs you: restart its service openrazer-daemon on g14; if it fails again, the details say why. "+
+			"openrazer on g14 is not healthy: its service openrazer-daemon stopped with an error. It clears as soon "+
+			"as it runs again.")
+	// An account waiting for a new login (ADR 0252) asks for the login, held to the plain rule.
 	o = moduleUnhealthyObservation("openrazer", "g14", []inventory.ResourceHealth{{Kind: "account",
 		Resource: "operator-in-group", Target: "jochen", Reason: "relogin needed: the account is in the group"}})
 	if o.Needs != "log out of every session on g14 and log in again." || len(o.Actions) != 0 {
 		t.Errorf("relogin: %q %+v", o.Needs, o.Actions)
 	}
+	w := conditions.Words{Headline: o.Headline, Explanation: o.Explanation, Resolved: o.Resolved, Needs: o.Needs}
+	if why, ok := conditions.PlainWords(w, "g14"); !ok {
+		t.Errorf("the relogin words are not plain: %s", why)
+	}
+	// And the kind issue 318 raises for it (ADR 0254).
+	rw := plainWordings["relogin-needed"](conditions.Observation{Scope: conditions.ScopeModule, ID: "openrazer.g14",
+		Machine: "g14", Kind: "relogin-needed", Severity: conditions.Warning})
+	if why, ok := conditions.PlainWords(rw, "g14"); !ok || rw.Needs == "" || len(rw.Actions) != 0 {
+		t.Errorf("relogin-needed: %s %+v", why, rw)
+	}
 }
 
 // **Failed units on a machine**: "shanks's service manager is degraded: 3 failed unit(s) no module places —
@@ -143,15 +145,12 @@ func TestAHealerWantedNeedsNothingFromTheOperator(t *testing.T) {
 
 // **A delivery held past its bound**, as mesh-delivery says it: "the delivery novox/hq@055550802096 has been
 // held for 36h2m6s, past its bound of 24h0m0s (it waits for the operator): healer H2 may none: …".
-func TestADeliveryHeldOffersReleaseAndStop(t *testing.T) {
+func TestADeliveryHeldAsksForReleaseOrStopInWords(t *testing.T) {
 	got := stalledObservations([]stalledLine{{ID: "novox/hq@055550802096", State: "held", For: "36h2m6s",
 		Bound: "24h0m0s", H2: "none: the state is the operator's", Says: "it waits for the operator"}})
 	plainExample(t, got[0], "Delivery of hq held for 36 hours",
 		"Needs you: release it, or stop it. A delivery of hq has been held for 36 hours, past its limit.",
-		"Release", "Stop")
-	if a := got[0].Actions[0]; a.Verb != "mesh-delivery.release" || a.Arguments["id"] != "novox/hq@055550802096" {
-		t.Errorf("release: %+v", a)
-	}
+	)
 }
 
 // **Every kind the controller raises has plain words**, and its words are plain for a subject of every
@@ -184,3 +183,24 @@ func TestEveryWordingIsPlain(t *testing.T) {
 		}
 	}
 }
+
+// **An answer on a notification is no repair** (novox/hq ADR 0258): silencing chosen by the operator on the
+// desk does not count toward a healer wanted; the same silence by hand for another cause still does.
+func TestAnOperatorsAnswerIsNoHandRepair(t *testing.T) {
+	now := time.Date(2026, 10, 8, 12, 0, 0, 0, time.UTC)
+	f := calm(now)
+	for i := 0; i < 3; i++ {
+		a := actByHand(now.Add(-time.Duration(i+1)*time.Hour), conditions.CauseOperatorAnswer)
+		a.Verb = "conditions silence"
+		f.handActs = append(f.handActs, a)
+	}
+	if got := watchHandActs(f); len(got) != 0 {
+		t.Fatalf("an answer counted as a repair: %+v", got)
+	}
+	for i := range f.handActs {
+		f.handActs[i].Cause = "machine-units"
+	}
+	if got := watchHandActs(f); len(got) != 1 {
+		t.Fatalf("a silence by hand stopped counting: %+v", got)
+	}
+}

cmd/mesh-controller/signals.go

@@ -361,7 +361,6 @@ func watchWaits(f *signalFacts) []conditions.Observation {
 			Headline:    deliveryName(w.modules, w.repository) + " waiting to start",
 			Explanation: walkWaitingWords(w, in, severity),
 			Needs:       waitingNeeds(severity),
-			Actions:     waitingActions(w, severity),
 			Resolved:    deliveryName(w.modules, w.repository) + " no longer waiting"})
 	}
 	return out