Refuse every send that would replace the bus outside its planned step (hq ADR 0236)

A plan's send to the bus's machine for another module carried the bus's new build and
restarted it under every machine with nobody asking (2026-10-06). The guard is in the one
send everything uses; only the bus step passes it. A rebuild that made the same artifacts
is no move.

cmd/mesh-controller/push.go

@@ -1001,6 +1001,21 @@ func sendTo(ctx context.Context, open *stores, names []string) error {
 // the machines it sent waits for that one too.
 func sendToEach(ctx context.Context, open *stores, names []string) ([]string, error) {
 	inv := open.inventory
+	// **No send replaces the bus but its planned step** (novox/hq ADR 0236). A plan's send to the bus's
+	// machine for some other module carried the bus's new build with it on 2026-10-06, and the bus
+	// restarted under every machine with nobody having asked. Refused whole — the send cannot leave the
+	// bus behind and carry the rest (ADR 0221 option 2) — and said with the remedy; the plan tries again.
+	if !busStepSending(ctx) {
+		held, err := busHeld(ctx, inv, names)
+		if err != nil {
+			return nil, err
+		}
+		for _, n := range names {
+			if why, h := held[n]; h {
+				return nil, fmt.Errorf("%w: %s", errBusWaits, why)
+			}
+		}
+	}
 	ident, err := openIdentity(ctx)
 	if err != nil {
 		return nil, err