Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

A module waiting for the operator's secret failed its first-node gate, held
every later walk and was said as 'nothing for you to do'. The node-engine's
new waiting state is checked against the manifest and the secrets given,
read by the gate as a wait for a person, and raised as needs-operator naming
the act. A secret family gives each part its own one-line secret, which the
mesh never makes, so the desk prompt can take each password.

cmd/mesh-controller/gate.go

@@ -125,6 +125,9 @@ type gateFacts struct {
 	// groupsAdded is, per module, whether the move judged puts an account in a group its previous build did
 	// not (issue 318 review): the only move whose wait for a new login is excused.
 	groupsAdded map[string]bool
+	// waits is what the controller holds to check a module's wait for the operator (novox/hq ADR 0283): the
+	// manifest of each module's build judged, and the secrets given on each machine.
+	waits operatorWaitFacts
 	// sent is, per machine, the declaration the gate's own send carried there (novox/hq issue 352): a
 	// report is held against it, never against the send made last. sentBuilds is what each machine was
 	// last sent of every module, and judged the commit of each module this gate judges: a machine last
@@ -257,10 +260,11 @@ func judgeHealth(module, component string, m catalogue.Manifest, machine string,
 				firstLine(f.openErr.Error())
 		}
 		for _, c := range f.open {
-			// A wait for a person's new login, or for a directory used as found to be handed over, is the module's
-			// reading, not a fault raised since the send: the gate reads it from the statement below (ADR 0254,
-			// novox/hq issue 339).
-			if c.Source == gateProbe || c.OpenAt(since) || c.Kind == kindReloginNeeded || c.Kind == kindUsedAsFound {
+			// A wait for a person's new login, for a directory used as found to be handed over, or for the
+			// operator's secret or setting, is the module's reading, not a fault raised since the send: the gate
+			// reads it from the statement below (ADR 0254, novox/hq issue 339, ADR 0283).
+			if c.Source == gateProbe || c.OpenAt(since) || c.Kind == kindReloginNeeded || c.Kind == kindUsedAsFound ||
+				c.Kind == kindNeedsOperator {
 				continue
 			}
 			onIt := c.Subject.Machine == machine || slices.Contains(c.Subject.Also, machine) ||
@@ -477,6 +481,7 @@ func judgeMoves(ctx context.Context, open *stores, g *inventory.PlanGate, pairs
 		return "", err
 	}
 	facts.groupsAdded = movesAddingGroups(ctx, open.inventory, g, pairs, shelf)
+	facts.waits = gateWaitFacts(ctx, open.inventory, g, pairs, shelf, facts.health)
 	facts.sent = g.Sent
 	facts.commits, facts.sentBuilds = judgedCommits(g, pairs), map[string]map[string]string{}
 	// A module this gate put back at once (putBackBroken) was sent its earlier build by the gate itself:
@@ -751,6 +756,47 @@ func movesAddingGroups(ctx context.Context, inv *inventory.Inventory, g *invento
 	return out
 }
 
+// gateWaitFacts reads what checks the waits for the operator of the modules a gate judges (novox/hq ADR 0283): the
+// manifest of the build judged — the one it moves to, else the catalogue's — and the secrets given on each machine
+// that says a module of them waits.
+func gateWaitFacts(ctx context.Context, inv *inventory.Inventory, g *inventory.PlanGate, pairs []judged,
+	shelf map[string]catalogue.Manifest, health map[string]inventory.NodeHealth) operatorWaitFacts {
+	var f operatorWaitFacts
+	judgedManifests := map[string]catalogue.Manifest{}
+	byMachine := map[string][]string{}
+	for _, j := range pairs {
+		waiting := false
+		for _, r := range health[j.node].Resources {
+			if r.Module == j.module && r.State == link.StateWaiting {
+				waiting = true
+			}
+		}
+		if !waiting {
+			continue
+		}
+		byMachine[j.node] = append(byMachine[j.node], j.module)
+		if _, done := judgedManifests[j.module]; done {
+			continue
+		}
+		to := g.To
+		for _, c := range g.Carried {
+			if c.Module == j.module {
+				to = c.To
+				break
+			}
+		}
+		if m, found, err := inv.ManifestAt(ctx, j.module, to); err == nil && found {
+			judgedManifests[j.module] = m
+		} else if m, known := shelf[j.module]; known {
+			judgedManifests[j.module] = m
+		}
+	}
+	for machine, modules := range byMachine {
+		readWaitFacts(ctx, inv, machine, modules, judgedManifests, &f)
+	}
+	return f
+}
+
 // decide sets a gate's verdict.
 func decide(g *inventory.PlanGate, verdict, why string, now time.Time) {
 	g.Verdict, g.Why, g.JudgedAt = verdict, why, &now