Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

Every one of the 48 core failures of research 031 was found by a person
looking; the mesh's answers carried the fact for whoever asked and told
nobody.

- The condition store (to-be 45 §2): mesh-controller_conditions, one key
  per open condition, written by compare-and-set so a person's silence
  and the watchdogs never lose each other's word; every transition kept
  ninety days in mesh-controller_condition-history and said as the
  seat's events condition-raised / condition-changed / condition-cleared
  (the condition at the top level, with event, at, change, why, show),
  offered again while the bus is away. Raised and cleared by observation
  only; a clearing reopened within ten minutes is the same condition with
  its count up, its silence kept. Verbs: conditions, conditions show,
  conditions silence (a hand act, at most a week), conditions history.
- ADR 0224's provider standing is the first kind, provider-failing, held
  by the provider's events; the provider_standing table is no longer read
  or written (left in place: dropping it is the operator's word).
- status leads with the open conditions, urgent first, and says all well
  only with none open; conditions it cannot read are said and not well.
- The signals table compiled in, one watchdog loop over it every 30s: S1
  heartbeat (3 intervals, asleep machines excepted, control node urgent
  after 30 min), S2 report after a send, S3 plan tier, S4 event loop deaf,
  S5 merge not acted, S6 ask lost, S7 call hung, S8 provider silent, S9
  advisories, S10 self-check silent, S11 node tools silent, S13 stale
  refusals; S12, S14, S15 deferred with their reasons. A row that cannot
  see raises probe-failed and clears nothing. A test generated from the
  table suppresses each signal inside and past its bound.
- The bus's advisories (maximum deliveries, a mesh consumer deleted) and
  the controller's own slow consumer and refused subjects, said in the
  mesh's words.
- doctor: the probe registry D1-D10 (D5 deferred) and DW, every five
  minutes, each in thirty seconds; a probe that cannot run is never a
  pass. D1 validates with mesh-host's own validator. Every run ends with
  the doctor-heartbeat event mesh-watcher listens for.
- The controller is granted its new buckets, events, the two advisories
  and $SRV.INFO; the node tools their tools-alive heartbeat. The streams
  and consumers the controller asserts and the ones D6/D7 expect are one
  derivation.

cmd/mesh-controller/push.go

@@ -8,6 +8,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"github.com/novox/mesh-controller/internal/conditions"
 	"io"
 	"log"
 	"os"
@@ -142,7 +143,7 @@ func serve(ctx context.Context) error {
 	}
 	// And what providers say about consumers they keep failing, kept for `status` (novox/hq ADR
 	// 0224): a provider's journal must not be the only place that says so.
-	if err := server.Watches(standings{inv}); err != nil {
+	if err := server.Watches(standings{keeper: func() *conditions.Keeper { return conditionsFrom }}); err != nil {
 		return err
 	}
 
@@ -178,6 +179,13 @@ func serve(ctx context.Context) error {
 	} else if err := link.Calls.Durably(ctx, keeper, controllerProcess(), said); err != nil {
 		fmt.Printf("calls are kept on the bus from now on; the ones kept before could not be read: %v\n", err)
 	}
+	// What is wrong, kept and said (novox/hq to-be 45 §2): the condition store, the watchdogs of the
+	// signals table, what the bus says about itself, and the self-check. A store that cannot be opened
+	// is said and the controller serves on: status then says the conditions cannot be read, and is
+	// not well — louder than not serving at all, and the push that repairs the bus still runs.
+	if stopWatching := watchTheMesh(ctx, open, server, bus); stopWatching != nil {
+		defer stopWatching()
+	}
 	stopServing, err := bus.ServeSeatTools(catalogue.ControllerSeatName, handlers, log.New(os.Stdout, "", log.LstdFlags))
 	if err != nil {
 		return err
@@ -1150,30 +1158,12 @@ func raiseTheBus(ctx context.Context, inv *inventory.Inventory, address string)
 		}
 	}
 
-	nodes, err := inv.Nodes(ctx)
+	// The mesh's own streams and consumers, the seats' work queues and their workers, and how every
+	// machine hears its declaration — one derivation, which the self-check reads as well (D6, D7).
+	names, err := assertBusObjects(ctx, inv, js)
 	if err != nil {
 		return err
 	}
-	names := make([]string, 0, len(nodes))
-	for _, n := range nodes {
-		names = append(names, n.Name)
-	}
-	if err := broker.Raise(js, names); err != nil {
-		return err
-	}
-	// The work queues of the mesh's own roles (novox/hq ADR 0121). The queue before the holder,
-	// deliberately: work queues until somebody arrives to do it, so assigning a build machine a week
-	// after something started asking for builds flushes the backlog instead of having lost it.
-	// With the seats' holders, so each role's work queue gets the consumer its holder takes
-	// work from. Passed as nil until the first live raise, which left the build machine bound to a
-	// consumer nothing had created (2026-09-28).
-	holders, err := seatHolders(ctx, inv)
-	if err != nil {
-		return err
-	}
-	if err := broker.RaiseSeats(js, inventory.MeshSeats(), holders); err != nil {
-		return err
-	}
 	// And each work queue's cancelled set (novox/hq ADR 0219), so a holder taking an ask can ask
 	// whether it was cancelled the moment it took it.
 	if err := broker.RaiseCancelledSets(js, inventory.MeshSeats()); err != nil {
@@ -1199,25 +1189,11 @@ func raiseTheBus(ctx context.Context, inv *inventory.Inventory, address string)
 		fmt.Printf("the bus holds state nothing declares any more, kept because it is data: %s — "+
 			"removing it is a person's act\n", strings.Join(undeclared, ", "))
 	}
-	// And how every module hears what it consumes. Derived from the same records the user list is
-	// composed from, so a module the mesh grants a consumer's subjects has that consumer waiting.
-	// Done on every raise, not only when a credential is issued: every module moved onto this bus
-	// by the rollout was issued on the old one, and came up with nothing to bind to (2026-09-28).
-	records, err := inv.BusRecords(ctx)
+	// And how every module hears what it consumes: asserted with the rest above, counted here.
+	hearing, err := moduleConsumerCount(ctx, inv)
 	if err != nil {
 		return err
 	}
-	users, err := broker.Users(records)
-	if err != nil {
-		return err
-	}
-	hearing := 0
-	for _, c := range broker.ConsumersOf(users) {
-		if err := js.EnsureConsumer(c.Consumer); err != nil {
-			return fmt.Errorf("how %s on %s hears what it consumes: %w", c.Module, c.Node, err)
-		}
-		hearing++
-	}
 	fmt.Printf("the bus at %s has its streams, %d machine(s) can hear a declaration, %d module(s) "+
 		"can hear what they consume, and %d bucket(s) of state\n", broker.BareAddress(address), len(names), hearing, len(buckets))
 	return nil