Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

The third review of #170 (hq issue 339): a setting overrides any key a
provider serves, so any caller of the settings verb could move a database's
port, a registry's port or an issuer to a listener of its own and collect
what consumers present. TerminalKeys now derives from the manifest: places,
accesses, every served key and every setting a served value asks for, and
every setting a file marked `trusted` asks for. `trusted` is the catalogue's
word, taken out before the declaration; `module check` warns of a file that
asks for a setting without saying, and refuses it from 2026-10-30. The hand
list is gone. A directory used as found is now its own condition kind, the
operator's, never urgent, and the gate exempts it where it exempts a relogin.

cmd/mesh-controller/module_health.go

@@ -135,7 +135,8 @@ func judgeModuleHealth(ctx context.Context, inv *inventory.Inventory, k *conditi
 	}
 	standing := map[string]conditions.Condition{}
 	for _, c := range open {
-		if (c.Kind == kindModuleUnhealthy || c.Kind == kindReloginNeeded) && c.Subject.Machine == node {
+		if (c.Kind == kindModuleUnhealthy || c.Kind == kindReloginNeeded || c.Kind == kindUsedAsFound) &&
+			c.Subject.Machine == node {
 			standing[c.Key] = c
 		}
 	}
@@ -158,6 +159,21 @@ func judgeModuleHealth(ctx context.Context, inv *inventory.Inventory, k *conditi
 	heldOn := map[string]string{}
 	providers := map[catalogue.Chosen]bool{}
 	for _, m := range modules {
+		// **A directory used as found is said as that** (novox/hq issue 339): the operator's to hand over at the
+		// machine, never urgent — nothing is broken by the wait that a person was not told of — and its own kind,
+		// so the gate never reads it as a fault of the build that happened to be sent beside it.
+		if said, waits := foundWait(m, node, unhealthy[m]); waits {
+			o := usedAsFoundObservation(m, node, said, unhealthy[m])
+			seen[o.Key()] = true
+			became[m] = kindUsedAsFound
+			if _, isOpen := standing[o.Key()]; streaks[m] < moduleUnhealthyAfter && !isOpen {
+				continue
+			}
+			if _, err := k.Observe(ctx, o); err != nil {
+				problems = append(problems, err.Error())
+			}
+			continue
+		}
 		// **A wait for a person's new login is said as that** (novox/hq ADR 0254): one plain sentence to the
 		// operator, never urgent, cleared on the first statement that no longer says it.
 		if said, waits := personWait(m, node, unhealthy[m]); waits {
@@ -209,6 +225,9 @@ func judgeModuleHealth(ctx context.Context, inv *inventory.Inventory, k *conditi
 		if c.Kind == kindReloginNeeded {
 			why = fmt.Sprintf("%s says %s no longer waits for a new login", node, module)
 		}
+		if c.Kind == kindUsedAsFound {
+			why = fmt.Sprintf("%s says no directory of %s is used as found any more", node, module)
+		}
 		if on, held := heldOn[key]; held {
 			why = fmt.Sprintf("what %s finds on %s waits on %s, which is unhealthy: held under its condition", module, node, on)
 		}
@@ -617,3 +636,49 @@ func addsAccountGroups(from catalogue.Manifest, hadFrom bool, to catalogue.Manif
 	}
 	return false
 }
+
+// kindUsedAsFound is a module's condition while the node-engine uses one of its directories as found (novox/hq
+// issue 339): its own kind, the operator's, never urgent, and never read by the gate as a fault of a build.
+const kindUsedAsFound = "directory-used-as-found"
+
+// usedAsFoundKey is a module's used-as-found condition on a machine.
+func usedAsFoundKey(module, node string) string {
+	return conditions.Key(conditions.ScopeModule, module+"."+node, kindUsedAsFound)
+}
+
+// foundWait is whether everything unhealthy of a module on a machine is a directory used as found, and that in
+// one sentence. Anything else unhealthy beside it is judged as a fault, with the directory among its resources.
+func foundWait(module, node string, rs []inventory.ResourceHealth) (string, bool) {
+	var ids, why []string
+	for _, r := range rs {
+		if r.Module != module || r.State != link.StateUnhealthy {
+			continue
+		}
+		if !usedAsFound(r) {
+			return "", false
+		}
+		ids = append(ids, r.Resource)
+		why = append(why, strings.TrimSpace(strings.TrimPrefix(r.Reason, link.ReasonUsedAsFound)))
+	}
+	if len(ids) == 0 {
+		return "", false
+	}
+	return fmt.Sprintf("%s on %s uses %s as found: %s", module, node, strings.Join(ids, ", "),
+		strings.Join(why, "; ")), true
+}
+
+// usedAsFoundObservation is a module whose directory the node-engine uses as found, in words: the operator's, a
+// warning however long it stays, its summary naming the directories and their owners; the paths are evidence.
+func usedAsFoundObservation(module, node, said string, rs []inventory.ResourceHealth) conditions.Observation {
+	o := moduleUnhealthyObservation(module, node, rs)
+	o.Token, o.Kind, o.Resolver, o.Severity, o.Summary = kindUsedAsFound, kindUsedAsFound, conditions.ResolverOperator,
+		conditions.Warning, said
+	o.Headline = fmt.Sprintf("%s waits for a directory on %s", module, node)
+	o.Explanation = fmt.Sprintf("A directory of %s was already on %s, with another owner or mode than %s declares. "+
+		"The mesh left it as it was rather than hand it to an account, so %s may not be able to use it.",
+		module, node, module, module)
+	o.Needs = fmt.Sprintf("on %s, run mesh-host hand-over with the directory's path as root.", node)
+	o.Resolved = fmt.Sprintf("%s's directory on %s is the mesh's", module, node)
+	o.Actions = nil
+	return o
+}