No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

A send carries the machine's whole declaration, so at the switch to roll the next send of
anything would have carried the old default's backlog, unjudged, to every machine. A gated
send now carries and judges everything waiting on its machine; every other send is refused
or leaves the machine; a release plan walks what waits one machine at a time, the control
node last, and one that fails holds the next until a person releases it.

cmd/mesh-controller/bus_step.go

@@ -218,7 +218,7 @@ func busCommand(ctx context.Context, args []string) error {
 	fmt.Printf("bus upgrade %d: %s %s → %s on %s; streams snapshotted at %s; %s\n", step.ID, b.module, step.From,
 		short(b.to), strings.Join(moving, ", "), where, map[bool]string{true: "reversible: putting the old build back undoes it",
 			false: "NOT reversible: the snapshot is the only way back"}[*reversible])
-	sent, err := sendRollout(withBusStep(ctx), open, moving)
+	sent, err := sendRollout(withBusStep(withScope(ctx, sendScope{person: true})), open, moving)
 	if err != nil {
 		_ = inv.EndBusStep(ctx, step.ID, "failed", "the send was refused: "+err.Error())
 		return fmt.Errorf("the bus's machine could not be sent its new build: %w — nothing was replaced", err)