Count the login shell where its execute is served, not where its seat is held (hq ADR 0268)

The control-node withholds execute through its holder's setting since ADR 0268, so probe D-root read a
closed path as open. It now counts the verb as served while the holder's setting for that machine is
serve, or the bus hears execute answered there, or the bus could not be asked: a withheld value not yet
pushed, or a holder answering against its setting, is never taken for closed.

cmd/mesh-controller/probe_agent_root.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -24,7 +25,12 @@ import (
 //     that machine names (`agent_account`), and the operator's account while it names none;
 //  2. can an agent run a command it chooses, through the mesh's own tools, as an account that can — the login
 //     shell's `execute` runs as the machine's runtime account, which the mesh's acting tools give passwordless
-//     sudo?
+//     sudo? **Only where `execute` is served** (novox/hq ADR 0268): `execute` is an optional verb its holder
+//     withholds on a machine whose `execute` setting is not `serve`. The holder's seat being held there says
+//     nothing; whether the verb is served does. It counts as served while either says so — the holder's
+//     setting as the controller resolves it for that machine (a withheld value not yet pushed is still served),
+//     or the bus's discovery hearing the verb answered there — so a withheld setting the machine has not acted
+//     on yet, or a holder answering against its setting, is never taken for closed.
 //
 // The measurement is the sudo module's on that machine (`sudo_escalation`); a machine it does not run on, or
 // that does not answer, is a probe that could not run — said, never taken for "no".
@@ -39,8 +45,45 @@ const (
 	sudoModule      = "sudo"
 	sudoEscalation  = "sudo_escalation"
 	loginShellSeat  = "node-login-shell"
+	// loginShellVerb is the seat's verb that runs a command, and the name of the setting its holder withholds
+	// it by (novox/hq ADR 0268).
+	loginShellVerb = "execute"
+	// executeServes is the one value of that setting that serves the verb; anything else withholds it.
+	executeServes = "serve"
 )
 
+// loginShellServed judges whether the login shell's execute is served on a machine, failing closed (novox/hq
+// ADR 0268): served while the holder's setting there is `serve` (or the holder has no such setting and claims
+// the verb), or while the bus heard the verb answered there, or while the bus could not be asked. why says
+// which, in words, for the condition.
+func loginShellServed(holder string, claims bool, setting *any, heard, asked bool) (bool, string) {
+	var why []string
+	switch {
+	case setting != nil:
+		if v, _ := (*setting).(string); v == executeServes {
+			why = append(why, holder+"'s execute setting there is "+executeServes)
+		}
+	case claims:
+		why = append(why, holder+" claims execute and has no setting that withholds it")
+	}
+	if heard {
+		why = append(why, "the bus hears execute answered there")
+	} else if !asked {
+		why = append(why, "the bus could not be asked whether execute is answered there")
+	}
+	return len(why) > 0, strings.Join(why, "; ")
+}
+
+// claimServes says whether a manifest's claim of a seat names a verb among those it serves.
+func claimServes(m catalogue.Manifest, seat, verb string) bool {
+	for _, c := range m.Claims {
+		if c.Name == seat && slices.Contains(c.Serves, verb) {
+			return true
+		}
+	}
+	return false
+}
+
 // escalation is the sudo module's answer for one account.
 type escalation struct {
 	Account string `json:"account"`
@@ -55,8 +98,10 @@ type agentRootFacts struct {
 	Agent      string   // the account agents run as there; "" when none run there
 	AgentNamed bool     // the coding-agent module named it, rather than it being taken for the operator's
 	Runtime    string   // the account the machine's runtime runs as
-	LoginShell bool     // the login shell seat is held there, running commands as the runtime's account
-	Answers    map[string]escalation
+	LoginShell bool     // the login shell's execute is served there, running commands as the runtime's account
+	// LoginShellWhy is why execute counts as served there, in words: its holder's setting, the bus, or both.
+	LoginShellWhy string
+	Answers       map[string]escalation
 }
 
 // agentRootObservations judges one machine's facts: an urgent condition while an agent can become root there
@@ -74,8 +119,12 @@ func agentRootObservations(f agentRootFacts) []conditions.Observation {
 	}
 	if f.LoginShell && f.Runtime != "" {
 		if e := f.Answers[f.Runtime]; e.Root {
-			ways = append(ways, fmt.Sprintf("the login shell runs any command an agent gives it as %s, which can "+
-				"become root without a person: %s", f.Runtime, e.Why))
+			served := ""
+			if f.LoginShellWhy != "" {
+				served = " (" + f.LoginShellWhy + ")"
+			}
+			ways = append(ways, fmt.Sprintf("the login shell runs any command an agent gives it as %s%s, which can "+
+				"become root without a person: %s", f.Runtime, served, e.Why))
 		}
 	}
 	if len(ways) == 0 {
@@ -121,15 +170,6 @@ func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, e
 			}
 		}
 	}
-	for _, e := range entries {
-		if e.Manifest.ClaimsSeat(loginShellSeat) {
-			for _, node := range e.On {
-				if f := facts[node]; f != nil {
-					f.LoginShell = true
-				}
-			}
-		}
-	}
 	machines := make([]string, 0, len(facts))
 	for m := range facts {
 		machines = append(machines, m)
@@ -137,6 +177,44 @@ func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, e
 	sort.Strings(machines)
 	var out []conditions.Observation
 	var unread []string
+	if len(machines) == 0 {
+		return nil, nil
+	}
+	// Whether the login shell's execute is served where a trusted party runs (novox/hq ADR 0268): the
+	// holder's setting for that machine, and what the bus hears answered there. A discovery that could not be
+	// asked leaves only the setting, which is said: the probe then cannot show the verb withheld.
+	heard, derr := discoverSeatVerbs(ctx, d.js.Conn())
+	if derr != nil {
+		unread = append(unread, "the bus's discovery could not be asked whether the login shell's execute is served: "+derr.Error())
+	}
+	for _, e := range entries {
+		if !e.Manifest.ClaimsSeat(loginShellSeat) {
+			continue
+		}
+		for _, node := range e.On {
+			f := facts[node]
+			if f == nil {
+				continue
+			}
+			var setting *any
+			if _, declared := e.Manifest.Settings[loginShellVerb]; declared {
+				layers, err := inv.SettingsFor(ctx, node, e.Manifest.Module)
+				if err != nil {
+					unread = append(unread, node+": "+e.Manifest.Module+"'s settings could not be read: "+err.Error())
+					f.LoginShell, f.LoginShellWhy = true, "its holder's setting could not be read"
+					continue
+				}
+				for _, s := range catalogue.Effective(e.Manifest, layers) {
+					if s.Key == loginShellVerb {
+						v := s.Value
+						setting = &v
+					}
+				}
+			}
+			f.LoginShell, f.LoginShellWhy = loginShellServed(e.Manifest.Module, claimServes(e.Manifest, loginShellSeat, loginShellVerb),
+				setting, heard[loginShellSeat][loginShellVerb][node], derr == nil)
+		}
+	}
 	for _, m := range machines {
 		f := facts[m]
 		record, err := inv.NodeByName(ctx, m)