The mesh acts on what the catalogue decided a build meant

The builder says what it built and the catalogue decides whether that was an
upgrade. Only the control plane knows which machines run the thing, so it is
the one that acts — and what it does is a choice somebody recorded, not a
behaviour compiled in: record that they are behind, or send it, one machine at
a time or together.

Recording is the absence of an action rather than a second path: a machine not
running what the mesh would send it is already something the mesh reports.

Defaulted to recording. A mesh that rolls out everything it builds the moment
it builds it is reasonable to want and a bad thing to arrive by default — the
first module to inherit it would be the control plane, upgrading itself out
from under the push applying it.

internal/link/events.go

@@ -70,3 +70,23 @@ func eventID() (string, error) {
 // KeyModuleBuilt is what the builder announces when it has built something. The catalogue places
 // it in the module graph; nothing else need care.
 const KeyModuleBuilt = "module.builder.built"
+
+// KeyModuleUpgraded is the catalogue saying a module's current version has moved.
+//
+// **The control plane hooks the meaning, not the build.** The builder says what it built; the
+// catalogue decides whether that was an upgrade — a rebuild producing the commit already current
+// is not one — and only this says anything the control plane can act on. Consuming the build
+// directly would make the control plane re-derive a decision another module already made, and the
+// two would eventually disagree (novox/hq ADR 0072).
+const KeyModuleUpgraded = "module.mesh-catalog.upgraded"
+
+// UpgradeQueue is where those land. Durable and named, not a temporary queue: an upgrade announced
+// while the control plane is restarting is exactly the one that must not be missed.
+const UpgradeQueue = "control.upgrades"
+
+// Upgraded is what the catalogue says when a module's current version moves.
+type Upgraded struct {
+	Module   string `json:"module"`
+	Commit   string `json:"commit"`
+	Previous string `json:"previous"`
+}