Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

The third review of #170 (hq issue 339): a setting overrides any key a
provider serves, so any caller of the settings verb could move a database's
port, a registry's port or an issuer to a listener of its own and collect
what consumers present. TerminalKeys now derives from the manifest: places,
accesses, every served key and every setting a served value asks for, and
every setting a file marked `trusted` asks for. `trusted` is the catalogue's
word, taken out before the declaration; `module check` warns of a file that
asks for a setting without saying, and refuses it from 2026-10-30. The hand
list is gone. A directory used as found is now its own condition kind, the
operator's, never urgent, and the gate exempts it where it exempts a relogin.

cmd/mesh-controller/found_wait_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -65,6 +66,12 @@ func TestAFixGoesThroughPastADirectoryFoundBefore(t *testing.T) {
 			backlogFacts := gatherGateFacts
 			gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
 				f, err := backlogFacts(ctx, open, component)
+				// The used-as-found condition, raised after the send (its second statement): its own kind, never a
+				// fault the gate reads as the build's.
+				f.judged, f.openErr = true, nil
+				f.open = append(f.open, conditions.Condition{Key: usedAsFoundKey("app", "anchor"), Kind: kindUsedAsFound,
+					Subject: conditions.Subject{Scope: conditions.ScopeModule, ID: "app.anchor", Machine: "anchor"},
+					Raised:  time.Now()})
 				f.health = map[string]inventory.NodeHealth{}
 				for _, n := range []string{"anchor", "laptop"} {
 					f.health[n] = inventory.NodeHealth{Node: n, HeardAt: time.Now(), Resources: []inventory.ResourceHealth{
@@ -102,3 +109,48 @@ func TestAFixGoesThroughPastADirectoryFoundBefore(t *testing.T) {
 		})
 	}
 }
+
+// The condition says the wait in its own kind: the operator's, never urgent, and cleared once handed over.
+func TestADirectoryUsedAsFoundIsItsOwnCondition(t *testing.T) {
+	k, _ := withConditionsInMemory(t)
+	ctx := t.Context()
+	rs := map[string][]inventory.ResourceHealth{"notes": {foundDirectory("notes", time.Now().Add(-time.Hour))}}
+	for i := 0; i < 2; i++ {
+		if err := judgeModuleHealth(ctx, nil, k, "laptop", rs, map[string]int{"notes": i + 1}, time.Now()); err != nil {
+			t.Fatal(err)
+		}
+	}
+	open, _ := k.Open(ctx)
+	var got *conditions.Condition
+	for i, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") {
+			got = &open[i]
+		}
+		if c.Kind == kindModuleUnhealthy {
+			t.Fatalf("raised as a fault: %+v", c)
+		}
+	}
+	if got == nil || got.Resolver != conditions.ResolverOperator || got.Severity == conditions.Urgent ||
+		!strings.Contains(got.Summary, "notes.data") {
+		t.Fatalf("the condition: %+v", got)
+	}
+	// Long open is still not urgent: only a person can hand it over, and nothing is broken by the wait.
+	if err := judgeModuleHealth(ctx, nil, k, "laptop", rs, map[string]int{"notes": 3}, time.Now().Add(48*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	open, _ = k.Open(ctx)
+	for _, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") && c.Severity == conditions.Urgent {
+			t.Fatal("a directory used as found became urgent")
+		}
+	}
+	if err := judgeModuleHealth(ctx, nil, k, "laptop", map[string][]inventory.ResourceHealth{}, nil, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	open, _ = k.Open(ctx)
+	for _, c := range open {
+		if c.Key == usedAsFoundKey("notes", "laptop") {
+			t.Fatal("not cleared once handed over")
+		}
+	}
+}