Leave a kept core move out of what a gate judges (issue 201, review 91)

gatedSend took its judged moves from the record, so on a machine kept at
a newer controller the gate judged the controller moving back to the
record, read its own send's kept controller as a later build there, and
was superseded with nothing judged. The kept moves are now left out
there as in ungatedIn (withoutKept). The doc says the bus step keeps
too, and the three store tests are listed.

cmd/mesh-controller/core_downgrade.go

@@ -11,8 +11,10 @@ import (
 	"github.com/novox/mesh-controller/internal/lease"
 )
 
-// **No send but a person's push and a gate's own put-back moves the mesh's own core to a build older than the
-// one its machine was last sent** (novox/hq issue 201). On 2026-10-02 two merges a minute apart made two plans;
+// **No send but a person's `push <node>` and a gate's own put-back moves the mesh's own core to a build older
+// than the one its machine was last sent** (novox/hq issue 201). Every send made through sendToEach keeps it — a
+// plan's, a release's, a healer's, a rotation's, and the bus step too, which is a person's act but composes under
+// sendKeeps like the rest. On 2026-10-02 two merges a minute apart made two plans;
 // the controller's plan rolled the new controller, which widened its seat's row, and the node-engine's plan then
 // sent the control node the controller build before it. The older binary read the row it could not serve and the
 // mesh lost its voice for ten minutes — the thing that would have corrected it was the thing that was down. ADR
@@ -21,7 +23,8 @@ import (
 //
 // **Kept, not refused.** The send composes the controller or the node-engine at the build the machine was last
 // sent, as a recorded module is kept (ADR 0245), and carries everything else: no other module, secret, healer or
-// walk waits on it, and nothing is retried. A plan whose own build is the older one finds its gate superseded by
+// walk waits on it, and nothing is retried. The kept move is no move for a gate either: ungatedIn and gatedSend
+// leave it out (withoutKept), so a gate judges the other moves of its send. A plan whose own build is the older one finds its gate superseded by
 // the build kept there (issue 352) and ends. The mesh's record stays older, and a warning condition says so until
 // a send carries the record — a person's `push <node>` accepts the older build — or the record moves forward: a
 // newer merge, or `rebuild mesh-controller`.