The mesh acts on what the catalogue decided a build meant

The builder says what it built and the catalogue decides whether that was an
upgrade. Only the control plane knows which machines run the thing, so it is
the one that acts — and what it does is a choice somebody recorded, not a
behaviour compiled in: record that they are behind, or send it, one machine at
a time or together.

Recording is the absence of an action rather than a second path: a machine not
running what the mesh would send it is already something the mesh reports.

Defaulted to recording. A mesh that rolls out everything it builds the moment
it builds it is reasonable to want and a bad thing to arrive by default — the
first module to inherit it would be the control plane, upgrading itself out
from under the push applying it.

cmd/mesh-control/push.go

@@ -86,6 +86,12 @@ func serve(ctx context.Context) error {
 	// And build results nobody was waiting for. A build triggered any other way than `build`
 	// would otherwise be reported into the void, which is the same as not reporting it.
 	server.Records(builds{inv})
+	// And what the catalogue decided a build meant. The builder's own result is already handled
+	// above; this is the other half — the control plane is the only one of the three that knows
+	// which machines run the thing, so it is the one that acts (novox/hq ADR 0072).
+	if err := server.Follows(following{open}); err != nil {
+		return err
+	}
 
 	return server.Serve(ctx)
 }