S15: a hand act a person decides by design is no repair, read from the verb that recorded it

Two planned bus upgrades raised healer-wanted, though ADR 0236 never lets
the mesh roll the bus. Instead of naming one more cause, the hand-act
verbs are one table saying which record a person's decision (retire
approve/reject, cleanup delete, bus upgrade, upgrade release-backlog, and
secret rotate after a leak); S15 and `hand-acts` skip those, push and the
other repairs keep counting. Conditions already open for them clear on the
next tick.

cmd/mesh-controller/handacts.go

@@ -7,6 +7,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -27,6 +28,62 @@ import (
 // step of a procedure is not a repair. `conditions silence` joins them when the condition store does
 // (Phase 1).
 
+// handActVerb is one verb that writes the hand-act log, and whether what it records is a repair.
+type handActVerb struct {
+	Verb string
+	// Decision says why an act of this verb is a person's decision by design rather than a repair a
+	// healer could take over; empty for a repair.
+	Decision string
+	// DecidedFor limits Decision to these causes; empty, it holds for every act of the verb.
+	DecidedFor []string
+}
+
+// causeLeakedInLogs is the cause a rotation after a value was printed into a log gives.
+const causeLeakedInLogs = "leaked-in-logs"
+
+// handActVerbs is every verb that writes the hand-act log (novox/hq to-be 45 §7). **S15 reads it**:
+// an act recorded by a verb whose entry names a decision is the mesh working as decided, never a
+// repair, and does not count toward `healer-wanted` — whatever cause it gives. A verb not listed, or
+// listed without a decision, counts, so a new verb is a repair until its entry says otherwise.
+var handActVerbs = []handActVerb{
+	// Repairs: each repeated is a healer the mesh lacks. A push by hand is exactly what roll-out by
+	// default (ADR 0236) exists to end.
+	{Verb: "push"},
+	{Verb: "plans stop"},
+	{Verb: "plans close"},
+	{Verb: "broker consumer-reset"},
+	// Silencing the same condition twice says the condition, or what it watches, wants mending.
+	{Verb: "conditions silence"},
+	// An act done outside the mesh: the mesh cannot tell a repair from a decision there, so it counts.
+	{Verb: "hand-act record"},
+	// A person's decisions by design.
+	{Verb: "retire approve", Decision: "nothing is retired past its bound without a person (ADR 0230)"},
+	{Verb: "retire reject", Decision: "keeping a consumer active is a person's word (ADR 0230)"},
+	{Verb: "cleanup delete", Decision: "nothing retired is deleted without a person (ADR 0230)"},
+	{Verb: "bus upgrade", Decision: "the bus is never rolled by the mesh: replacing it is a planned step a " +
+		"person starts (ADR 0236)"},
+	{Verb: "upgrade release-backlog", Decision: "after a release plan failed, the next opens only when a " +
+		"person releases it (ADR 0236)"},
+	// A leak is judged by a person — which value was exposed, to whom — and its rotation is the answer
+	// to that judgement. Several values rotate for one leak, and a leak that recurs is a defect of the
+	// module that prints them, an issue against it, not a healer that rotates. A rotation for any other
+	// cause — a credential that stopped working — counts: a schedule or a healer could take it over.
+	{Verb: "secret rotate", Decision: "a value a person judged disclosed is replaced on their word",
+		DecidedFor: []string{causeLeakedInLogs}},
+}
+
+// personsDecision is whether an act in the log is a person's decision by design, by the verb that
+// recorded it (handActVerbs).
+func personsDecision(a link.HandAct) bool {
+	for _, v := range handActVerbs {
+		if v.Verb != a.Verb {
+			continue
+		}
+		return v.Decision != "" && (len(v.DecidedFor) == 0 || slices.Contains(v.DecidedFor, a.Cause))
+	}
+	return false
+}
+
 // handActFlags are the flags every repairing verb takes.
 type handActFlags struct {
 	why, cause, condition *string
@@ -144,7 +201,7 @@ func handActCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		repeated := link.RepeatedCauses(acts, now)
+		repeated := link.RepeatedCauses(repairs(acts), now)
 		if *asJSON {
 			body, err := json.MarshalIndent(map[string]any{"acts": acts, "repeated": repeated}, "", "  ")
 			if err != nil {
@@ -179,6 +236,17 @@ func handActCommand(ctx context.Context, args []string) error {
 	})
 }
 
+// repairs are the acts that are not a person's decision by design: what S15 counts.
+func repairs(acts []link.HandAct) []link.HandAct {
+	out := make([]link.HandAct, 0, len(acts))
+	for _, a := range acts {
+		if !personsDecision(a) {
+			out = append(out, a)
+		}
+	}
+	return out
+}
+
 // handActsThisWeek is how many acts were done by hand in the last seven days, for `status`; -1 when
 // the log could not be read, which status says rather than reading as none.
 func handActsThisWeek(ctx context.Context) (int, string) {