A newly shipped module version is adopted within minutes, and a fallback re-examines every new build #3650

Rule (maintainer, 2026-09-07): as soon as a new module version ships, the instance starts using it

RegistryUpdateReconciler.ReconcileModules already adopts unattended when the registry's bundle version is newer than the landed one, or the same version was rebuilt against a different framework build (ModuleUpdateDecision, Plugins#931/#723). Two gaps remain against the rule:

1. A module running its previous generation (the keep-the-old fallback) is not re-examined when a build that WOULD load appears under the same version: SkipUpToDate fires on Compare(bundleVersion, landed.Version) == 0 with an equal served MVID. Change: when the entry is in fallback (newest generation unloadable), an index entry with the same version but a frameworkMvid different from the unloadable generation's is a Land ("a build for this platform appeared").
2. The reconcile runs once per boot and on catalog opens (PluginUpdateOnGreenBuild: "a consumer learns on its next boot"). Change: the registry's ProposeModuleSet / publish path already raises a ModulePublished event locally; the platform-release broadcast (FrameworkReleaseBroadcaster) exists for images. Add a ModulePublished broadcast to consumers (same inbox as the release broadcast), which triggers ReconcileModules for that package only, so "ships" → "used" is minutes, not the next boot. Without the broadcast, a scheduled reconcile (every 30 min, SelfUpdate:MinRollInterval cadence) is the floor.
3. A landed-but-not-loaded newer generation still needs a restart to load (PendingRestart). Keep that contract (a module swap is a restart) but make the restart happen: SetPendingRestart(true) → the self-updater's tick treats a pending restart like a roll of the same image (respecting MinRollInterval), instead of waiting for the next unrelated roll.

Tests

ModuleUpdateIdentityTest: fallback + same version + new identity → Land; RegistryUpdateReconcilerTest: broadcast triggers one package's reconcile; SelfUpdateVerdictTest: pending restart rolls the same image within the interval rules.

Part of the module-adoption policy (Doc/Architecture/ModuleAdoptionPolicy).