Tell the operator at once when sends wait for the bus's planned step, and say it before the merge (hq issue 336)

For 28 minutes on 2026-10-08 every send to the control-node was refused for a new bus build that only a
person's bus upgrade moves, and no condition said so: the refusal lived only in each walk's note, and S3
would have called it lateness after half an hour, in words that named neither the bus nor the verb.

- Row S17, bus.<module>.step-waiting: raised on the first watchdog tick after a walk's send is refused for
  the bus, for the operator, naming the machines, what waits, the bus build from and to, since when and
  mesh-controller.bus upgrade. It clears once the bus's machine runs the build the mesh holds.
- S3 leaves out a walk held only by the bus's step.
- A change that builds the bus says in its delivery plan and summary (which mesh/merge-gate carries) that
  merging it needs a person's bus upgrade, and that nothing else reaches its machine until then.
- TestReplay336 fails on the commit before and passes on this one.

cmd/mesh-controller/watchdogs.go

@@ -97,6 +97,9 @@ type signalFacts struct {
 
 	// facts is the snapshot this controller keeps for merge checks (S14).
 	facts factsFacts
+
+	bus    busFacts
+	busErr error
 }
 
 // factsFacts is when the newest facts snapshot was taken, when this controller began keeping it, and
@@ -147,6 +150,7 @@ type planFacts struct {
 	bound                  time.Duration
 	waiting                string
 	paused                 bool
+	bus                    bool
 }
 
 // waitFacts is one walk waiting for its delivery's word: since its merge opened it.
@@ -320,7 +324,8 @@ func (w *watchdogs) gather(ctx context.Context) *signalFacts {
 		}
 	}
 	f.machines, f.machinesErr = w.gatherMachines(ctx, inv, now)
-	f.plans, f.waits, f.plansErr = gatherPlans(ctx, inv, now)
+	f.bus, f.busErr = gatherBus(ctx, inv)
+	f.plans, f.waits, f.plansErr = gatherPlans(ctx, inv, now, f.bus.heldByTheBus())
 	f.loop, f.loopErr = w.gatherLoop()
 	f.mergesPassed, f.merges, f.mergesErr = watchedMerges.last()
 	if f.mergesErr == nil && !f.mergesPassed.IsZero() && now.Sub(f.mergesPassed) > 3*mergeCatchUpEvery {
@@ -438,8 +443,24 @@ func (w *watchdogs) gatherMachines(ctx context.Context, inv *inventory.Inventory
 	return out, nil
 }
 
-// gatherPlans is every open plan, its tier's bound from what was measured, and what it waits on.
-func gatherPlans(ctx context.Context, inv *inventory.Inventory, now time.Time) ([]planFacts, []waitFacts, error) {
+// gatherBus is a new bus build waiting for its step and the walks refused for it (S17, novox/hq issue 336).
+func gatherBus(ctx context.Context, inv *inventory.Inventory) (busFacts, error) {
+	b, err := pendingBus(ctx, inv)
+	if err != nil {
+		return busFacts{}, fmt.Errorf("what a bus upgrade would do cannot be read: %w", err)
+	}
+	plans, err := inv.OpenPlans(ctx)
+	if err != nil {
+		return busFacts{}, fmt.Errorf("the open plans cannot be read: %w", err)
+	}
+	f := busWaitsOf(plans, b, busRefusedFirst.of)
+	busRefusedFirst.keepOnly(f.heldByTheBus())
+	return f, nil
+}
+
+// gatherPlans is every open plan, its tier's bound from what was measured, and what it waits on; byTheBus are
+// the walks held only by the bus's planned step, which S3 leaves to S17.
+func gatherPlans(ctx context.Context, inv *inventory.Inventory, now time.Time, byTheBus map[string]bool) ([]planFacts, []waitFacts, error) {
 	plans, err := inv.OpenPlans(ctx)
 	if err != nil {
 		return nil, nil, fmt.Errorf("the open plans cannot be read: %w", err)
@@ -466,7 +487,7 @@ func gatherPlans(ctx context.Context, inv *inventory.Inventory, now time.Time) (
 		bound := bounds.of(p.Repository)
 		out = append(out, planFacts{id: p.ID, repository: p.Repository, commit: p.Commit, tier: p.Tier,
 			tiers: len(p.Tiers), entered: inTierSince(p), bound: bound,
-			waiting: planLineWith(p, now, pause, bound), paused: paused})
+			waiting: planLineWith(p, now, pause, bound), paused: paused, bus: byTheBus[p.ID]})
 	}
 	return out, waits, nil
 }