ADR 0236: no send reaches the bus's machine while a new bus build waits

Found live the same day: a plan's send of the catalogue carried the bus's rebuilt image
to the control node and restarted the bus unasked.

02-DECISIONS/0236-a-build-is-judged-on-its-first-machine-and-put-back-by-something-other-than-itself-and-so-it-rolls-out-unattended.md

@@ -158,8 +158,13 @@ held field for field:
 
 **6. The bus is never rolled out; its upgrade is a step a person starts.** Its policy is `record`
 whatever is said, `upgrade` refuses it a roll-out, a plan builds it and sends nothing, a cascade holds its
-machine (ADR 0221), and **a push naming its machine is refused while a new bus build waits for it**, with
-the remedy. The step is `bus upgrade --why …`: refused unless the person says whether the new version can
+machine (ADR 0221), and **no send reaches its machine while a new bus build waits for it** — a push naming
+it, a plan's send for another module there, a healer's, a rollback's — each refused with the remedy. On
+2026-10-06 a plan's send of the catalogue to the control node carried the bus's rebuilt image with it,
+and the bus restarted under every machine with nobody having asked (`record` held a cascade, not the
+machine a send was for). A rebuild that made the same artifacts from the same manifest is no move. A
+change of the bus's **user list** is not a restart: the bus's image reloads its server in place when the
+list it is written changes, and that stays the ordinary path. The step is `bus upgrade --why …`: refused unless the person says whether the new version can
 be reverted (`--reversible`, or `--irreversible` as their explicit word that it runs anyway); the bus
 machine's backup holder snapshots the streams first (ADR 0235) — a person who took one by hand says where
 — and only then is the machine sent; recorded as a hand act; `bus-maintenance` (the probe DB) is open
@@ -181,6 +186,12 @@ not say which files went, marks the module deleted in its plan, which goes on.
   tier.
 - **The controller's grant gains one verb that acts**, `node-backup now`, used only by the bus step, and
   an event, `rolled-back`; the installer's first user list carries both (mesh-host).
+- **A new bus build stalls every send to the bus's machine until a person runs the step.** A plan whose
+  first machine is that machine waits, said in the plan and, past its bound, as `stalled`. That is the
+  point: the bus is replaced when a person is there, not as a side effect.
+- **A change to the build agent rebuilds most of the catalogue** (its modules are built on what it
+  builds), which is how the bus came to be rebuilt by a merge that did not touch it. Whether that tiering
+  is right is left open here; a rebuild that changes nothing is at least no longer a move of the bus.
 - **Thirteen modules still wait for a person**, each saying why in the catalogue or by its data; `status`
   lists the machines behind them and `push <machine>` walks them, as before. A person who wants another
   held says `upgrade <module> record --why …`.
@@ -205,7 +216,7 @@ not say which files went, marks the module deleted in its plan, which goes on.
 | the bound | the controller's test: a first machine never healthy fails at the bound and is put back |
 | the health definitions | the controller's test per component: tools not served, a condition since the send, a witness's verdict, node tools not answering, a lease held by an older controller or one not ready |
 | the policy | the catalogue's test: default roll, a module's word, irreplaceable data, the bus whatever it says; a record without why refused; the store's test: the current builds read the derived policy |
-| the bus is never rolled out | the controller's test: the bus records whatever it says, a person's roll-out is refused, a plan sends nothing, a push may not send its machine, the step refuses without its word on reversibility and without its snapshot, and starts with both |
+| the bus is never rolled out | the controller's test: the bus records whatever it says, a person's roll-out is refused, a plan sends nothing, no send may reach its machine while a new bus build waits — a rebuild with the same artifacts and manifest excepted — the step refuses without its word on reversibility and without its snapshot, and starts with both |
 | a deleted module is not built | the controller's test: a merge deleting a module's manifest asks no build and forgets it; a build finding no manifest leaves the plan going |
 | the witness's contract | the lease package's test of the host's rule; the broker's test of the grants (the ping on every machine, the lease's key where the controller runs, no write); the controller's test that a witness's verdict is its condition while reports carry it and cleared after |
 | live | the next merge to the catalogue sends one machine first and the rest after its gate, with no push; `plans <id>` shows the gate's record; the next week's hand-act log has no push for a build that rolled out |

03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md

@@ -459,8 +459,10 @@ bus becomes a cluster that can be upgraded live is left to its own effort.
 
 As built (ADR 0236): the verb is `bus upgrade --why … --reversible|--irreversible`; the snapshot is the
 bus machine's backup holder backing the bus module up now ([ADR 0235](../../02-DECISIONS/0235-the-bus-is-backed-up-by-its-own-snapshot-of-each-stream.md)),
-or one a person took and names with `--snapshot-taken`; the step's bound is fifteen minutes; a push
-naming the bus's machine is refused while a new bus build waits for it. *2026-10-06:* the snapshot
+or one a person took and names with `--snapshot-taken`; the step's bound is fifteen minutes; **no send
+reaches the bus's machine while a new bus build waits for it** — a push, a plan's send for another
+module, a healer's — after a plan's send restarted the bus unasked on 2026-10-06; a change of the bus's
+user list is reloaded in place, not a restart. *2026-10-06:* the snapshot
 and the way back from it exist — the bus image's own snapshot program, the same one the night's backup
 runs, and a restore that builds a new store beside the live one for a person to swap in
 ([ADR 0235](../../02-DECISIONS/0235-the-bus-is-backed-up-by-its-own-snapshot-of-each-stream.md),