Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

A build that reported applied was sent everywhere; one that then did nothing, served
no tools or broke its machine's word reached every machine. Now the first machine is
judged by the component's health (the core's definitions, as doctor probes H-*, or a
module's own) three times over two minutes within ten; a failing gate puts the previous
build back there once, marks the build, and says it as a condition and an event.
Upgrades roll out by default; the bus is a planned step; a module deleted at its
source is not built (the public-acme plan failure).

internal/catalogue/verbs.go

@@ -267,6 +267,31 @@ var ControllerVerbs = []Verb{
 			"probes":  "\"true\": the registry — what each probe asserts, and the condition it raises",
 			"signals": "\"true\": the signals table, each row with the age of its newest signal",
 		}, nil, "run", "probes", "signals")},
+	// How a module's new builds reach its machines, and the bus's planned step (novox/hq ADR 0235).
+	{Name: "upgrade", Description: "How each module's new builds reach its machines (novox/hq ADR 0235): rolled " +
+		"out one machine first and judged there at the gate, then the rest — or recorded, waiting for a person's " +
+		"push — with where that comes from (a person, the module, the bus, its irreplaceable data, the default) and " +
+		"why. With module, that one; with policy, a person's choice for it — roll-out, record (with why) or default " +
+		"to take the choice back. The bus is never rolled out.",
+		Input: schema(map[string]string{
+			"module":   "one module",
+			"policy":   "with module: roll-out, record or default",
+			"together": "\"true\": with roll-out, every machine at once instead of one machine first",
+			"why":      "with policy: why — required for record, kept and said with the policy",
+		}, nil, "together")},
+	{Name: "bus", Description: "The bus as a planned step (novox/hq to-be 45 §8, ADR 0235): what a bus upgrade " +
+		"would do — the bus's build on each machine against the one the mesh holds — and how the last step went. " +
+		"With upgrade, start one: a person's act with why, after the streams are snapshotted (snapshot-taken says " +
+		"where, while the mesh takes none itself), saying first whether it can be reverted; bus-maintenance is open " +
+		"while it runs and every stream, consumer and a round trip are checked after.",
+		Input: schema(map[string]string{
+			"upgrade":        "\"true\": start the bus's upgrade",
+			"why":            "with upgrade: why — required, recorded in the hand-act log",
+			"cause":          "with upgrade: the cause in a word (default bus-upgrade)",
+			"reversible":     "\"true\": with upgrade, the new version can be undone by putting the old one back",
+			"irreversible":   "\"true\": with upgrade, it cannot — your explicit word that it runs anyway",
+			"snapshot-taken": "with upgrade: where the streams' snapshot you took is",
+		}, nil, "upgrade", "reversible", "irreversible")},
 	// A consumer the mesh stopped asking for: retired, waiting for a person, deleted only by one
 	// (novox/hq ADR 0230).
 	{Name: "retire", Description: "A consumer the mesh stops asking for is retired by its provider — access " +