A built-by edge orders and gates a plan; it never widens it — and plans stop

The first live plan took seventy-five modules along for a controller change: the builder packages the
controller's source, everything is built by the builder, so everything was reachable. A module built by
the build machine is not changed by a new build machine. Reachability now follows the code and build
edges only; built-by still orders a tier after the build machine and gates it on the machine's roll-out.
plans stop <id> ends a plan by hand: what was asked still builds and registers, nothing further is asked.

cmd/mesh-controller/release_plan.go

@@ -111,7 +111,9 @@ func isBaseOf(base, to string, edges []inventory.Edge, in map[string]bool) bool
 }
 
 // reachableFrom is the moved modules plus everything that depends on them, through every layer:
-// what a merge rebuilds.
+// what a merge rebuilds. Along the code and build edges only: a module *built by* the build machine
+// is not changed by a new build machine, so a built-by edge orders and gates a plan and never
+// widens it — the first plan of 2026-10-01 took the whole catalogue along for a controller change.
 func reachableFrom(moved []string, edges []inventory.Edge) []string {
 	in := map[string]bool{}
 	for _, m := range moved {
@@ -120,6 +122,9 @@ func reachableFrom(moved []string, edges []inventory.Edge) []string {
 	for grew := true; grew; {
 		grew = false
 		for _, e := range edges {
+			if e.Kind == inventory.EdgeBuiltBy {
+				continue
+			}
 			if in[e.To] && !in[e.From] {
 				in[e.From] = true
 				grew = true
@@ -571,6 +576,23 @@ func plansCommand(ctx context.Context, args []string) error {
 		}
 		return nil
 	}
+	if len(positionals) == 2 && positionals[0] == "stop" {
+		p, err := inv.PlanByID(ctx, positionals[1])
+		if err != nil {
+			return err
+		}
+		if !p.Open() {
+			return fmt.Errorf("%s is already %s", p.ID, p.State)
+		}
+		p.State = inventory.PlanFailed
+		p.Note = "stopped by hand at tier " + fmt.Sprint(p.Tier)
+		if err := inv.SavePlan(ctx, p); err != nil {
+			return err
+		}
+		fmt.Printf("%s stopped at tier %d of %d; what was asked still builds and registers, nothing further is asked\n",
+			p.ID, p.Tier, len(p.Tiers))
+		return nil
+	}
 	plans, err := inv.RecentPlans(ctx, *limit)
 	if err != nil {
 		return err