Give the controller lease back at the stop signal and say a takeover once, so a controller delivery raises no urgent alarm (issue 906, ADR 0558)

The 2026-10-26 replacements showed the lease was given back, but last: the
shutdown took 10 s, the gate had closed at half the key's age, and the release
recorded the epoch released only through the gate, so the next holder found
it expired and S12 said it, urgent, for an hour.

Now the stop signal gives the key back first and records the epoch released
whenever the delete succeeded; a candidate reads the key's delete marker on
the bus to tell a handover from an expiry; and a real takeover (lost or
expired) is raised and cleared once by the controller that took it, instead
of an hour of S12 observation.

Research 072 piece moved: the lease's takeover read from its own key on the
bus and said as an event (03-domains, mesh-controller row; 04-findings 2,
the watchdogs' age reading).
Quick fix weighed: drop the gate check from the release record only; it
leaves the release last in the shutdown and the hour-long alarm for a real
takeover.

cmd/mesh-controller/lease_integration_test.go

@@ -89,15 +89,28 @@ func TestTwoControllersOneActs(t *testing.T) {
 		t.Fatalf("B, waiting, may act: %v", err)
 	}
 
-	// A hands over, as a controller being replaced does: B takes the lease at once, at a higher epoch.
+	// A is stopped, as its service manager stops a controller being replaced (novox/hq issue 906): the stop
+	// alone gives the lease back, before anything else of A is taken down, and B takes it within a second, at
+	// a higher epoch — no wait for the key's age, and no condition said.
 	stopA()
-	a.release()
+	stopped := time.Now()
 	var lostB <-chan struct{}
 	select {
 	case lostB = <-tookB:
 	case <-time.After(10 * time.Second):
 		t.Fatal("B did not take the lease A gave back")
 	}
+	if waited := time.Since(stopped); waited > time.Second {
+		t.Fatalf("B took the lease %s after A was stopped: the stop did not give it back first", waited)
+	}
+	a.release() // what serve's own end does after: waits for the release under way, gives nothing twice
+	conditionsOfB := conditions.NewInMemory()
+	keeperOfB := conditions.NewKeeper(ctx, conditions.Options{Store: conditionsOfB, History: conditionsOfB})
+	b.watchTakeovers(ctx, inv, keeperOfB)
+	keeperOfB.Close(ctx)
+	if said, err := conditionsOfB.Since(ctx, stopped.Add(-time.Minute)); err != nil || len(said) != 0 {
+		t.Fatalf("a lease given back is said as a condition: %+v, %v", said, err)
+	}
 	select {
 	case <-lostA:
 	default: