Tell the operator at once when sends wait for the bus's planned step, and say it before the merge (hq issue 336)

For 28 minutes on 2026-10-08 every send to the control-node was refused for a new bus build that only a
person's bus upgrade moves, and no condition said so: the refusal lived only in each walk's note, and S3
would have called it lateness after half an hour, in words that named neither the bus nor the verb.

- Row S17, bus.<module>.step-waiting: raised on the first watchdog tick after a walk's send is refused for
  the bus, for the operator, naming the machines, what waits, the bus build from and to, since when and
  mesh-controller.bus upgrade. It clears once the bus's machine runs the build the mesh holds.
- S3 leaves out a walk held only by the bus's step.
- A change that builds the bus says in its delivery plan and summary (which mesh/merge-gate carries) that
  merging it needs a person's bus upgrade, and that nothing else reaches its machine until then.
- TestReplay336 fails on the commit before and passes on this one.

cmd/mesh-controller/changeplan.go

@@ -5,6 +5,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -50,7 +51,12 @@ func changePlanOf(repository, base, head string, r mergeReach, entries []invento
 				}
 			}
 			switch {
-			case name == "nats":
+			case (name == "nats" || catalogue.ProvidesBus(e.Manifest)) && len(e.On) > 0:
+				// Said before the merge (novox/hq issue 336): a new bus build holds every send to the bus's machine
+				// until a person takes the step, so merging it is a promise to take it.
+				p.Steps = append(p.Steps, fmt.Sprintf("%s: %s is never sent by an ordinary send, and until %s runs, "+
+					"nothing else is sent to %s either", busUpgradeNeeded, name, busUpgradeVerb, strings.Join(e.On, ", ")))
+			case name == "nats" || catalogue.ProvidesBus(e.Manifest):
 				p.Steps = append(p.Steps, "a planned bus step: the bus is upgraded by `bus upgrade`, never by an ordinary send")
 			case waits && len(e.On) > 0:
 				p.Steps = append(p.Steps, fmt.Sprintf("%s waits for a person: its policy records (%s)", name,
@@ -81,6 +87,9 @@ func changePlanOf(repository, base, head string, r mergeReach, entries []invento
 	return p
 }
 
+// busUpgradeNeeded is how a change plan says that merging it holds the bus's machine for a person's step.
+const busUpgradeNeeded = "merging this needs a person's bus upgrade"
+
 // summaryOf is a change plan in one line: what it builds, where it goes, and whether the bus moves.
 func summaryOf(p link.ChangePlan) string {
 	if len(p.Moved) == 0 && len(p.New) == 0 {
@@ -110,7 +119,10 @@ func summaryOf(p link.ChangePlan) string {
 	}
 	bus := "no bus step"
 	for _, s := range p.Steps {
-		if strings.HasPrefix(s, "a planned bus step") {
+		switch {
+		case strings.HasPrefix(s, busUpgradeNeeded):
+			bus = busUpgradeNeeded
+		case strings.HasPrefix(s, "a planned bus step") && bus == "no bus step":
 			bus = "a bus step"
 		}
 	}