Say a secret given in plain words, and log words the keeper refuses

The secret-given condition's explanation carried a clock time, which the
plain rule refuses, so the operator read the scope's fallback ("needs a
look") instead of what changed. Its words now carry no time and say the
secret's name as words; a test holds them to the rule through a keeper.
With no test hook set, the keeper logs a refused or missing wording once
per kind and reason, so a fallback is never silent again (hq issue 359).

cmd/mesh-controller/desk_secret.go

@@ -221,20 +221,34 @@ func giveAtDesk(ctx context.Context, node, module, name, desk string) error {
 const kindSecretGiven = "secret-given"
 
 // secretGivenObservation is that condition: which secret, of which module on which machine, how and when.
+// The summary, for whoever looks closer, names the secret and the time. The words the operator reads are
+// held to the plain rule (conditions.PlainWords): no clock time — the channel says when, in the operator's
+// time — and the secret's name said as words. Words that broke the rule were replaced by the keeper with
+// "needs a look … a problem it calls secret given" (hq issue 359), which told the operator nothing.
 func secretGivenObservation(node, module, name, how string, at time.Time) conditions.Observation {
 	key := node + "." + module + "." + name
+	where := module + " on " + node
+	headline := "New secret given for " + where
+	if len(headline) > conditions.HeadlineMax {
+		headline = "New secret given for " + module
+	}
 	return conditions.Observation{Scope: conditions.ScopeMachine, ID: key, Token: kindSecretGiven, Kind: kindSecretGiven,
 		Machine: node, Severity: conditions.Urgent, Source: kindSecretGiven,
 		Summary: fmt.Sprintf("%s of %s on %s was given %s at %s", name, module, node, how,
 			at.Local().Format("2006-01-02 15:04")),
-		Headline: "Secret of " + module + " changed",
-		Explanation: fmt.Sprintf("The secret %s of %s on %s was given %s at %s. If you did not do this, "+
-			"somebody else holds what %s acts with.", name, module, node, how, at.Local().Format("15:04"), module),
-		Needs:    "silence this if you gave it; if you did not, give the secret again yourself and unlink what it serves.",
-		Resolved: "You saw that " + name + " of " + module + " was changed",
+		Headline: headline,
+		Explanation: fmt.Sprintf("The secret %s of %s was given %s. If you gave it, nothing else is needed. If you "+
+			"did not, somebody else now holds what %s acts with.", secretNameWords(name), where, how, module),
+		Needs:    "silence this if you just gave it; if you did not, give it again yourself so that only you hold it.",
+		Resolved: "You saw that " + module + " was given a new secret",
 		Actions:  []conditions.Action{conditions.SilenceAction(conditions.Key(conditions.ScopeMachine, key, kindSecretGiven))}}
 }
 
+// secretNameWords is a secret's name as the operator reads it: "telegram-token" is "telegram token".
+func secretNameWords(name string) string {
+	return strings.Join(strings.FieldsFunc(name, func(r rune) bool { return r == '-' || r == '_' || r == '.' }), " ")
+}
+
 // announceSecretGiven raises it on this controller's keeper.
 func announceSecretGiven(ctx context.Context, node, module, name, how string) error {
 	return withKeeper(ctx, func(k *conditions.Keeper) error {