Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

A build that reported applied was sent everywhere; one that then did nothing, served
no tools or broke its machine's word reached every machine. Now the first machine is
judged by the component's health (the core's definitions, as doctor probes H-*, or a
module's own) three times over two minutes within ten; a failing gate puts the previous
build back there once, marks the build, and says it as a condition and an event.
Upgrades roll out by default; the bus is a planned step; a module deleted at its
source is not built (the public-acme plan failure).

cmd/mesh-controller/doctor.go

@@ -113,6 +113,27 @@ var probeRegistry = []probe{
 		Asks: []broker.SeatVerb{{Seat: "node-backup", Verb: "backed-up"}}},
 	{ID: "DW", Asserts: "the watchdogs of the signals table ran within three of their intervals",
 		From: "ADR 0227 rule 6: the watchers are watched", Kind: "watchdogs-silent", Phase: 1, run: probeWatchdogs},
+	// The core's health definitions (novox/hq to-be 45 §8, ADR 0235): what a core component's new build is
+	// judged by on its first machine, run against every machine between upgrades too.
+	{ID: "H-controller", Asserts: "the controller lease is held, renewed in time, by a controller that says it is " +
+		"ready: its self-check ran and status answered in full within ten seconds", From: "ADR 0235, to-be 45 §8",
+		Kind: kindCoreUnhealthy, Phase: 4, run: probeControllerHealth},
+	{ID: "H-engine", Asserts: "every machine heard from has reported its current declaration, under a node-engine " +
+		"build it names", From: "ADR 0235, to-be 45 §8", Kind: kindCoreUnhealthy, Phase: 4, run: probeEngineHealth},
+	{ID: "H-tools", Asserts: "every machine heard from that runs the node tools has them answering the bus",
+		From: "ADR 0235, to-be 45 §8", Kind: kindCoreUnhealthy, Phase: 4, run: probeToolsHealth},
+	{ID: "H-bus", Asserts: "every stream and durable consumer the mesh defines is on the bus, and a request crosses " +
+		"it to the machines' node tools and back", From: "ADR 0235, to-be 45 §8", Kind: kindCoreUnhealthy, Phase: 4,
+		run: probeBusHealth},
+	// The gate's verdicts and the witnesses' rollbacks (ADR 0235): each build that failed its gate keeps its
+	// condition until a newer build passes; each rollback a witness stands by is said.
+	{ID: gateProbe, Asserts: "no build that failed its gate, and no core component a witness put back, goes unsaid; " +
+		"a newer build that passes its gate clears it", From: "ADR 0235, to-be 45 §8", Kind: kindRolledBack,
+		Raises: []string{kindRollbackFailed}, Phase: 4, run: probeGates},
+	// The bus's planned step (ADR 0235): open while a person's bus upgrade runs, then checked by H-bus.
+	{ID: busStepProbe, Asserts: "a bus upgrade a person started is said while it runs, and is followed by the bus's " +
+		"health within its bound — or is said failed, with its snapshot as the way back", From: "ADR 0235, to-be 45 §8",
+		Kind: kindBusMaintenance, Raises: []string{kindBusUpgradeFailed}, Phase: 4, run: probeBusStep},
 }
 
 // probeVerdict is one probe's outcome in a run.