Design 28: the move needs a credential and a membership for machines already enrolled

The first live attempt at 5.2 found the half nobody had built. With the seat
handed over on record and the new bus's module assigned beside the old one, the
push was refused: not one user has a credential for the new bus. The check is
right. A credential is minted only at enrolment, at `module issue` and for a
person; nothing mints one for a machine already enrolled or for the control plane
itself, and on the host the membership is written once at enrolment and never
rewritten. So "move each machine" had no mechanism under it on either side.

Written into 5.2 as the mechanism to build before anything moves: the control
plane mints what is missing and delivers each plaintext where its owner reads it —
a machine's as a sealed membership in its declaration, a module's as its broker
secret, its own as its module secret — and the host saves a delivered membership
and re-dials on it through the reconnect path it already has. 5.3 is ticked as
built; 5.4's catalogue half is done and its live half waits on 5.2.

00-META/glossary.md

@@ -40,7 +40,7 @@ another — and a mesh you cannot name precisely is a mesh two people describe d
 - **the deprecated broker** — the lavinmq module. It was the mesh's bus and is not any more. It
   keeps running as an **ordinary provider** of the `amqp` provision, for modules that need a
   message broker of their own the way something needs a database
-  ([ADR 0127](../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md)) — no seat, not foundation,
+  ([ADR 0127](../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md))) — no seat, not foundation,
   never raised at genesis, and a mesh that never installs it is complete.
 
   Say *the deprecated broker*, not "the compatibility broker" (it serves the mesh's own modules,

02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md

@@ -1,6 +1,7 @@
 ---
 topic: the mesh
-status: accepted
+status: superseded
+superseded-by: 0131-everything-on-the-mesh-speaks-to-the-broker-seat.md
 date: 2026-09-26
 deciders: jochen
 reconstructed: false

02-DECISIONS/0128-the-mesh-bus-is-required-not-ambient.md

@@ -4,11 +4,18 @@ status: accepted
 date: 2026-09-26
 deciders: jochen
 reconstructed: false
-extends: 02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md
+extends: 02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md
 ---
 
 # 128. The mesh bus is required, not ambient
 
+
+> **Pointer repointed, 2026-09-27.** This record was written extending
+> [ADR 0127](0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](0131-everything-on-the-mesh-speaks-to-the-broker-seat.md)), which
+> [ADR 0131](0131-everything-on-the-mesh-speaks-to-the-broker-seat.md) has since superseded — AMQP is
+> not a provision at all. Nothing decided here changes; the frontmatter now rests on the live record,
+> and the citations below are read with that in mind.
+
 ## Context
 
 [Design 29](../03-DESIGN/01-to-be/32-what-a-module-declares.md) opened by saying the bus is
@@ -72,7 +79,7 @@ process in the path and nothing waiting on a bus account to create bus accounts.
 whose provider is the mesh itself.
 
 **A module may also provide a NATS server of its own, and that is a different interface.** Exactly
-as the AMQP broker provides `amqp` ([ADR 0127](0127-amqp-is-a-provision-not-the-bus.md)), a module
+as the AMQP broker provides `amqp` ([ADR 0127](0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](0131-everything-on-the-mesh-speaks-to-the-broker-seat.md))), a module
 may run its own NATS and offer it as a backing service. That interface is **`nats`**; the mesh's
 own bus is **`mesh-bus`**; the two are never the same name, because a manifest that said `nats`
 could mean either and the difference is the whole architecture. The rule from 0119 decides which
@@ -109,7 +116,7 @@ is legitimate: a private bus is a backing service, never a channel to another mo
 
 - [ADR 0125](0125-the-bus-is-the-only-broker.md) — superseded by 0119; its bootstrap argument is
   narrowed here to the case it supports.
-- [ADR 0127](0127-amqp-is-a-provision-not-the-bus.md) — a broker as a backing service; this
+- [ADR 0127](0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](0131-everything-on-the-mesh-speaks-to-the-broker-seat.md)) — a broker as a backing service; this
   applies the same shape to the mesh's own bus and separates the two names.
 - [ADR 0043](0043-a-module-broker-account-is-scoped-by-emits-and-consumes.md) — authority from
   declarations, which this leaves untouched.

02-DECISIONS/0130-the-predecessor-is-ending-and-its-broker-goes-with-it.md

@@ -4,14 +4,21 @@ status: accepted
 date: 2026-09-27
 deciders: jochen
 reconstructed: false
-extends: 02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md
+extends: 02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md
 ---
 
 # 130. The predecessor is ending, and its broker goes with it
 
+
+> **Pointer repointed, 2026-09-27.** This record was written extending
+> [ADR 0127](0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](0131-everything-on-the-mesh-speaks-to-the-broker-seat.md)), which
+> [ADR 0131](0131-everything-on-the-mesh-speaks-to-the-broker-seat.md) has since superseded — AMQP is
+> not a provision at all. Nothing decided here changes; the frontmatter now rests on the live record,
+> and the citations below are read with that in mind.
+
 ## Context
 
-[ADR 0127](0127-amqp-is-a-provision-not-the-bus.md) settled that the old broker is an ordinary
+[ADR 0127](0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](0131-everything-on-the-mesh-speaks-to-the-broker-seat.md)) settled that the old broker is an ordinary
 provider of the `amqp` provision rather than a compatibility module with an end date. It rejected
 giving it a retirement condition, and said why: *"its clients are not only the predecessor's, so the
 retirement condition describes a day that will not come."*

02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md

@@ -0,0 +1,94 @@
+---
+topic: the mesh
+status: accepted
+date: 2026-09-27
+deciders: jochen
+reconstructed: false
+supersedes: 0127-amqp-is-a-provision-not-the-bus.md
+---
+
+# 131. Everything on the mesh speaks to the broker seat, and AMQP is not a provision
+
+## Context
+
+[ADR 0127](0127-amqp-is-a-provision-not-the-bus.md) settled the old broker as an ordinary provider
+of an ordinary provision, `amqp`, kept for whatever wanted a message broker of its own. The day the
+bus moved was the day that framing was tested, and it failed in a way that took the control plane
+down for an evening.
+
+Three things came out of the wreckage. **The protocol had leaked into the seat's contract**: for a
+module to hold `mesh-broker`, it had to provide what the seat delivers, and what it delivered was
+`amqp` — so the module that will carry the bus on NATS could not hold the seat that names the bus,
+while the module the mesh was leaving could. **A consumer of `amqp` is not asking for AMQP.** The two
+modules requiring it wanted the mesh's messaging — to emit an event, to hear a topic — and named the
+wire protocol only because that was the word available. **And AMQP and NATS are not interchangeable
+at the wire.** A provision named after a protocol can only ever be answered by that protocol, so once
+the bus is NATS an `amqp` provision has one possible provider, and it is the thing being retired.
+
+The operator's position, stated during the outage: modules depend on the broker *seat*, not on a
+protocol; AMQP is obsolete as anything the mesh's core knows about; a module that depends on `amqp`
+is wrong; and everything should reach the mesh's bus and be able to emit events and consume topics
+through it.
+
+## Decision
+
+**A module that needs messaging uses the mesh's bus, and the mesh's bus is whatever holds
+`mesh-broker`.** Emitting an event and consuming a topic go through the sdk, which is handed the
+bus by the mesh with the module's own credential. No manifest names a wire protocol to get it.
+
+**`amqp` is neither a provision nor a requirement.** Registration refuses a manifest that provides
+it or requires it. The `mesh-broker` seat delivers `mesh-bus`, and its holder is the module that
+provides `mesh-bus` — today the nats module, and only it.
+
+**The old broker's module and the two modules that required it leave the catalogue.** They are
+removed, not converted: one was a proof that a grant worked end to end, the other forwards mail off a
+queue, and both are re-done against the bus if wanted, as new modules under this record.
+
+**The controller's AMQP transport is deleted once every node reports on the new bus**, and the
+switch that selects a transport goes with it — one bus, so nothing to select.
+
+The predecessor's own broker is outside the mesh and not this record's concern
+([ADR 0130](0130-the-predecessor-is-ending-and-its-broker-goes-with-it.md)): what the predecessor's
+tooling loses when it stops is accepted there.
+
+## Options considered
+
+1. **Keep 0127: AMQP stays an ordinary provision with the old broker as its provider.** Rejected. It
+   is what put the protocol into the seat's contract, it is why the seat could be left with no valid
+   holder mid-change, and it keeps two transports in the control plane indefinitely for the benefit of
+   two modules that did not want AMQP in the first place.
+2. **Bridge it: the old broker's module also provides `mesh-bus`, so both can hold the seat during the
+   change.** Rejected. It makes the retiring broker a legitimate mesh bus for exactly as long as
+   nobody removes the line, which in practice is forever, and it leaves `amqp` as a thing the core
+   still knows the name of.
+3. **The seat is the dependency; the protocol is nobody's business but the holder's.** Adopted.
+
+## Consequences
+
+- **The change of holder is a handover, and it needs a command.** Nothing today moves a seat from
+  one assignment to another as one act, and a seat the control plane dereferences cannot be empty
+  in between — that emptiness is the outage this record comes from. The command takes a seat and the
+  assignment taking it over. Designed and built before the cutover, under
+  [28 — Building the bus](../03-DESIGN/01-to-be/28-building-the-bus.md).
+- **The seat's row moves to `mesh-bus` before the new holder registers, and that is safe.** The
+  control plane composes its own bus address through the seat *by name*
+  (`${seat:mesh-broker:…}`), and the overview derives holders by name; only registration and the
+  provision-to-seat resolution read what a seat delivers. So the row can change under the current
+  holder without unseating it, the new holder can then register its claim, and the handover happens
+  when both are running. Verified in the code during the outage, not assumed.
+- **Registration gains two refusals**: a manifest providing `amqp`, and one requiring it.
+- **The `rollout check` stops saying the old broker stays.** It said so under 0127; it now lists
+  unassigning it as the last step of the move.
+- **What got harder**: a third party that genuinely wants an AMQP broker on a mesh node runs one as
+  any application module, with no provision and no seat, and nothing on the mesh routes to it. That
+  is the cost of the mesh not knowing the word.
+
+## How this is checked
+
+| Rule | Checked by |
+|---|---|
+| No manifest provides or requires `amqp` | a registration test refusing each, naming this record; and a whole-catalogue test asserting no registered manifest names it |
+| `mesh-broker` delivers `mesh-bus`, and only a `mesh-bus` provider may hold it | the existing registration test for a delivering seat, with the row's value read from the store (mesh-controller#89) |
+| The seat's row can change without unseating the holder | a test composing the control plane's own address and the overview under a row that the current holder does not satisfy |
+| The rollout does not leave the old broker running | `rollout check` output, asserted in its test |
+| The AMQP transport is gone | the package does not compile with it referenced; the switch variable is refused as unknown at start |

02-DECISIONS/README.md

@@ -135,10 +135,11 @@ python3 00-META/checks/index.py            fail if stale
 - **0116** — [The bus is built in five steps, and the protocol moves with it](0116-the-bus-is-built-in-five-steps.md)
 - **0119** — [A taken tunnel's predecessor is retired once the take is proven](0119-a-taken-tunnels-predecessor-is-retired.md)
 - **0125** — [The bus is the only broker](0125-the-bus-is-the-only-broker.md)  *(superseded)*
-- **0127** — [AMQP is a provision, not the bus](0127-amqp-is-a-provision-not-the-bus.md)
+- **0127** — [AMQP is a provision, not the bus](0127-amqp-is-a-provision-not-the-bus.md)  *(superseded)*
 - **0128** — [The mesh bus is required, not ambient](0128-the-mesh-bus-is-required-not-ambient.md)
 - **0129** — [A seat carries the protocol of its role](0129-a-seat-carries-the-protocol-of-its-role.md)
 - **0130** — [The predecessor is ending, and its broker goes with it](0130-the-predecessor-is-ending-and-its-broker-goes-with-it.md)
+- **0131** — [Everything on the mesh speaks to the broker seat, and AMQP is not a provision](0131-everything-on-the-mesh-speaks-to-the-broker-seat.md)
 
 ### Its tiers, from the bottom up
 

03-DESIGN/01-to-be/25-the-bus-on-nats.md

@@ -10,7 +10,7 @@ code:
 updated: 2026-09-27
 decisions:
   - 02-DECISIONS/0106-the-bus-is-nats.md
-  - 02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md
+  - 02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md
   - 02-DECISIONS/0116-the-bus-is-built-in-five-steps.md
   - 02-DECISIONS/0074-the-wire-is-specified-not-the-types.md
   - 02-DECISIONS/0079-the-foundation-seats-are-named-after-their-servers.md
@@ -303,7 +303,7 @@ the private network. It is raised at genesis like the store, adopted as a module
 phase.
 
 **The deprecated broker is an ordinary module, not a compatibility layer.** Revision, second review
-([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md)): earlier text here, and
+([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md): AMQP is not a provision, and everything speaks to the `mesh-broker` seat)): earlier text here, and
 ADR 0106 before it, called it `lavinmq-compat` — one purpose, the predecessor's clients, and a
 retirement condition of no client connected for a period the operator sets. It is none of those.
 A module may legitimately need an AMQP broker as a **backing service**, the way it needs a
@@ -534,7 +534,7 @@ find what changed and why.
 **Still open:**
 
 - ~~Whether EVENTS should be one stream or one per emitting module.~~ **Closed**
-  ([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseding [ADR 0125](../../02-DECISIONS/0125-the-bus-is-the-only-broker.md))): one stream, and not as a
+  ([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md): AMQP is not a provision, and everything speaks to the `mesh-broker` seat) (superseding [ADR 0125](../../02-DECISIONS/0125-the-bus-is-the-only-broker.md))): one stream, and not as a
   preference — the streams the bus is made of are composed as configuration before any module
   runs, because a provisioner is itself a module that needs a bus account to start. Bootstrapping
   decides it.

03-DESIGN/01-to-be/26-the-seats.md

@@ -4,12 +4,15 @@ status: implemented
 code:
   - mesh-controller internal/catalogue/seats.go
   - mesh-controller internal/catalogue/resolve.go
+  - mesh-controller internal/inventory/seats.go
+  - mesh-controller internal/inventory/migrations/0039-a-seat-is-held-by-one-assignment-on-record.sql
   - mesh-controller cmd/mesh-controller/seats.go
   - mesh-controller cmd/mesh-controller/source.go
   - mesh-controller internal/inventory/migrations/0032-a-source-may-live-on-a-seat.sql
   - mesh-catalog modules/gitea/module.json
 updated: 2026-09-27
 decisions:
+  - 02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md
   - 02-DECISIONS/0126-a-module-declares-its-own-seats.md
   - 02-DECISIONS/0128-the-mesh-bus-is-required-not-ambient.md
   - 02-DECISIONS/0111-a-build-source-is-on-the-git-seat-or-external.md
@@ -42,6 +45,31 @@ is refused. A seat makes a role singular, never a module.
 **The seat points at the assignment.** Everything the mesh knows about the holder is what it knows
 about that assignment: the node, the node's settings for the module, and what the module serves.
 
+**Which assignment holds a seat is a fact on record, and changes as one act.** Revision, 2026-09-27
+([ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md)). Until
+then the holder was derived — the module that is assigned and claims the seat holds it, and a second
+eligible assignment was refused. That has no way to pass a seat from one holder to the next without a
+moment in which nobody holds it, and the controller finds its own bus through one of these seats: that
+moment took the control plane down for an evening. So the holder is now one row the controller keeps,
+written by a handover — `seat <name> --to <node>/<module>` — that names the seat and the assignment
+taking it over and replaces the previous holder in the same write. Between two handovers the seat has
+exactly one holder, and it is never none.
+
+Three consequences follow. **A seat with no row is held as it always was**: the sole eligible
+assignment holds it, and two eligible ones are refused — so a mesh that has never handed a seat over
+behaves exactly as before, and the row appears the first time somebody does. **With a row, any other
+assignment whose module could hold the seat is eligible and silent**: neither refused nor holding.
+That is what lets the next holder run beside the current one until the handover, which the bus's move
+needs ([28](28-building-the-bus.md), task 5.3). **And a holding is the assignment's**: unassigning the
+holder takes the row with it, so a seat never points at something that is not running anywhere, and
+the seat falls back to derivation rather than to nothing.
+
+The handover refuses what would make the new holder wrong before anything is written: the seat must
+exist, the assignment must exist, and the module must be able to hold the seat — claim it at its scope
+and provide what it delivers, judged against the store's row and not against anything compiled into a
+binary. It does not check that the module is running yet; `push` confirms that afterwards, and a
+handover that could only be recorded after the new holder was up could not be the switch.
+
 **The set is closed.** A seat the mesh does not define is refused wherever it is named, and so is one
 named at the wrong scope. Adding a seat is a decision, recorded, for the reason every addition to the
 host's vocabulary is one: the set is what a person reads to learn what a mesh can have, and an entry
@@ -207,7 +235,9 @@ checked as their tables say:
 | `mesh-*` is the mesh's, and a module may not declare one | 0118: a registration test refusing a manifest that declares any `mesh-*` seat, naming the prefix. |
 | Two modules cannot declare the same seat | 0118: a registration test; the second is refused and the first untouched. |
 | A holder satisfies the seat's protocol | 0118: a claim whose module does not serve what the seat declares is refused at assignment. |
-| A seat is held by one assignment, and only by one whose module can hold it | 0118: resolution tests for a second holder and for a seat the definition does not name. |
+| A seat is held by one assignment, and only by one whose module can hold it | 0118: resolution tests for a second holder and for a seat the definition does not name. 0131: `CanHold` is the one judgement, shared by registration and the handover, and its test follows the store's row. |
+| A holder on record settles the seat; another eligible assignment is silent, not refused | 0131: resolution tests with a recorded holder on the same machine, on another machine, and under a seat's former name; without a record, the old rule's tests still pass unchanged. |
+| A handover replaces the holder as one write, needs an assignment to point at, and goes with it | 0131: store tests — a second handover leaves one row; a handover to a module not assigned where named is refused; unassigning the holder removes the row. |
 | A requirement naming a seat is answered by its holder; a foundation seat cannot be named | 0118: resolution tests with a second provider on the consumer's node, with the seat unheld, and naming `mesh-store`. |
 | Several providers and none local is a person's choice | 0118: an assignment test listing candidates with the seat's holder first and recording the pin. |
 | `secret` is reserved | 0118: the parser and resolution refusals for another provider and a pin. |

03-DESIGN/01-to-be/28-building-the-bus.md

@@ -9,7 +9,7 @@ updated: 2026-09-27
 decisions:
   - 02-DECISIONS/0116-the-bus-is-built-in-five-steps.md
   - 02-DECISIONS/0106-the-bus-is-nats.md
-  - 02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md
+  - 02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md
   - 02-DECISIONS/0126-a-module-declares-its-own-seats.md
   - 02-DECISIONS/0074-the-wire-is-specified-not-the-types.md
   - 02-DECISIONS/0079-the-foundation-seats-are-named-after-their-servers.md
@@ -673,37 +673,73 @@ healthy while reacting to nothing.
       the question it depends on has ever been asked of something real is how the plan's own rule about
       beds gets broken by another route.
 
-      > **What this costs if it goes wrong, measured rather than assumed.** On the installation this is
-      > for, the old broker is also what a whole automation layer outside the mesh connects to — so it
-      > stays, as an ordinary provider of `amqp` ([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md)),
-      > and this step is not its retirement. Nothing in a served request's path goes over the mesh's own
-      > bus: modules serve from their own containers. What a failed move costs is the mesh's ability to
-      > *change* anything — pushes, tool calls, new provisioning — until it is finished or undone. That
-      > is worth knowing before rather than after, and it is why the operator's "as long as my services
-      > keep running" is a reasonable position rather than a gamble.
-- [ ] 5.3 the mesh's own accounts removed from the deprecated broker, and then the broker itself:
-      after the rollout nothing of the mesh speaks to it, and an account nothing uses is one nobody
-      rotates. **It finishes now** ([ADR 0130](../../02-DECISIONS/0130-the-predecessor-is-ending-and-its-broker-goes-with-it.md)):
-      the predecessor is deprecated rather than kept, so once its remnants have stopped the module is
-      unassigned and the port is free. No retirement machinery — a provision with no consumers has its
-      provider unassigned, which is ADR 0127 being paid off rather than revised.
+      > **What this costs if it goes wrong, measured rather than assumed.** Nothing in a served
+      > request's path goes over the mesh's own bus: modules serve from their own containers. What a
+      > failed move costs is the mesh's ability to *change* anything — pushes, tool calls, new
+      > provisioning — until it is finished or undone. That is worth knowing before rather than
+      > after, and it is why the operator's "as long as my services keep running" is a reasonable
+      > position rather than a gamble. **Measured on 2026-09-27**, when a seat emptied itself
+      > mid-change: 52 containers stayed up and the broker never stopped; the control plane
+      > crash-looped for two hours and nothing could be deployed until it was repaired by hand.
+      > An earlier version of this note said the old broker stays as an ordinary provider of
+      > `amqp` ([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md)); that is withdrawn by [ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md) — see 5.4.
 
+      **What the first live attempt found, 2026-09-27.** With the seat handed over on record and the
+      new bus's module registered and assigned beside the old one, `push` refused the control node:
+      *not one user has a credential for the new bus*. The check is right — a bus whose user list is
+      empty refuses every connection in the mesh — and it exposed the half of this task nobody had
+      built. A credential is minted at three moments only: a machine's at enrolment, a module's at
+      `module issue`, a person's at `operator`. **Nothing mints one for a machine already enrolled, or
+      for the control plane itself.** And on the host, the membership — bus address, fingerprint,
+      password, transport — is written once, at enrolment, and nothing ever rewrites it. So "move
+      each machine and confirm it reports" had no mechanism under it on either side.
+
+      The mechanism, to build before anything moves:
+      - **the control plane mints what is missing** — every user the records derive with no hash —
+        and delivers each plaintext where its owner reads it: a machine's inside its declaration, as a
+        sealed *membership* for the new bus (address, fingerprint, password, transport); a module's as
+        its broker secret, the path `module issue` already uses; the control plane's own as its module
+        secret, so it reads it the way any module does;
+      - **the host saves a delivered membership and re-dials on it** — the same file enrolment wrote,
+        the same reconnect path a lost connection takes, so a machine moved this way is a machine
+        that came back, and nothing new has to be right for it to work;
+      - **the switch is then two acts in one push**: `MESH_BUS_NATS` on the control plane, and
+        `seat mesh-broker --to <node>/<the new bus's module>` — the seat never empty, every machine
+        already holding a credential that works on the other side.
+
+      Until the first bullet exists the check keeps refusing, and it should: a machine moved without
+      a credential cannot come back, and afterwards there is no bus to tell it anything over.
+- [x] 5.3 **the seat changes hands as one act.** A command takes a seat and the assignment taking it
+      over, and the seat is never empty in between — the emptiness is the outage of 2026-09-27, when
+      the control plane, which finds its own bus through this seat, lost the address and looped.
+      **Built 2026-09-27** (mesh-controller `seat_holding`, migration 0039; design 26 says how it is
+      checked). Its first live use recorded the standing holder — which the row moving under it had
+      made unable to satisfy what the seat delivers, so the first handover on a mesh that predates the
+      record writes down who holds without re-judging them. This is what 5.2 uses to move
+      `mesh-broker` from the old broker's assignment to the new one's ([ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md)).
+- [~] 5.4 **the old broker and everything that named AMQP leave the mesh** — the catalogue half done
+      2026-09-27 (three modules removed; registration refuses the word; the seat's row delivers
+      `mesh-bus`, migration 0040); the live half — unassigning the old broker — waits on 5.2 ([ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md),
+      superseding [ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md)): the two modules that
+      required `amqp` are removed, the broker's module is unassigned and removed, registration refuses
+      a manifest that provides or requires `amqp`, and a whole-catalogue check asserts none does. Not
+      a retirement condition — a decision, taken, with the operator's "I don't care if the predecessor
+      breaks" on record ([ADR 0130](../../02-DECISIONS/0130-the-predecessor-is-ending-and-its-broker-goes-with-it.md)).
       Retiring with it: the build outcome's second announcement under the module's own name, which
-      exists only so a catalogue deployed before the rename and one deployed after both hear it.
+      existed only so a catalogue deployed before the rename and one after both heard it.
 
       > **The remote tooling goes with it too.** The predecessor's own mesh talks over that broker, so
       > shutting it down ends the path that reaches this installation's machines from a workstation.
-      > The rollout has to be driven from the node, or driven before the broker stops — which is a
-      > sequencing constraint on 5.2 and not an afterthought.
+      > The rollout is driven from the node, or before the broker stops — a sequencing constraint on
+      > 5.2, not an afterthought.
+- [ ] 5.5 **the AMQP transport is deleted from the control plane and the hosts**, and the variable
+      that selected a transport is refused at start as unknown. One bus, nothing to select ([ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md)).
 
-> **5.4 is gone, and was wrong from ADR 0127 onward.** It read "the deprecated broker retires
-> when its condition holds — no client connected for the period the operator sets", which is
-> ADR 0106's framing of it as a compatibility module with an end date.
-> [ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) settled that it is an
-> **ordinary provider** of the `amqp` provision, like any module answering a backing service:
-> no seat, not foundation, and **no retirement condition**, because the day its last client
-> disappears is not a day anything is waiting for. Removed rather than reworded — a step that
-> waits for a condition nobody set would sit open forever.
+> **The old 5.4 note is history.** It recorded that a retirement *condition* was wrong from
+> [ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) onward, which framed the old broker
+> as an ordinary provider with no end. [ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md) ends that
+> framing in turn: the broker is not kept as a provider either, because AMQP is not a provision. Both
+> readings are kept here so the two reversals can be read in order.
 
 **Done when.** Every node reports on NATS, and nothing of the mesh's own is left connected to the
 deprecated broker.

03-DESIGN/01-to-be/32-what-a-module-declares.md

@@ -357,7 +357,7 @@ controller — because the bus's accounts are configuration rather than somethin
 creates, so there is no provisioner process in the path and nothing waiting on a bus account in
 order to make bus accounts. A module that runs a NATS server of its own and offers it as a
 backing service provides **`nats`**, exactly as the deprecated broker provides `amqp`
-([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md)).
+([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md): AMQP is not a provision, and everything speaks to the `mesh-broker` seat)).
 
 They are never the same name. A manifest saying `nats` could otherwise mean either the mesh's
 nervous system or a private queue, and the difference between those is the whole architecture.
@@ -427,7 +427,7 @@ it as an ordinary module once the registry exists.
 
 So there are exactly two things the normal path cannot make, both at genesis, both ending the
 moment the mesh can mint for itself: **the bus's own accounts** (§the bootstrap argument in
-[ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseding [ADR 0125](../../02-DECISIONS/0125-the-bus-is-the-only-broker.md)) — a provisioner is a module and
+[ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseded by [ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md): AMQP is not a provision, and everything speaks to the `mesh-broker` seat) (superseding [ADR 0125](../../02-DECISIONS/0125-the-bus-is-the-only-broker.md)) — a provisioner is a module and
 needs an account before it can run) and **the vault's own credential**. Any third exception is a
 design failure, and naming these two is what makes a third one visible.
 

03-DESIGN/01-to-be/README.md

@@ -40,7 +40,7 @@ document is written and this one's status becomes `implemented`.
 | [`28-building-the-bus.md`](28-building-the-bus.md) | **Proposed.** The five steps of the bus work in the order their dependencies allow, each ending at a bed — with the surface measured, so no step's size is a guess | [ADR 0116](../../02-DECISIONS/0116-the-bus-is-built-in-five-steps.md), [ADR 0106](../../02-DECISIONS/0106-the-bus-is-nats.md), [ADR 0074](../../02-DECISIONS/0074-the-wire-is-specified-not-the-types.md) |
 | [`29-a-node-has-operator-accounts.md`](29-a-node-has-operator-accounts.md) | **Proposed.** The mesh models machines but not the humans on them: a node gains operator accounts, and a resource may live under a home owned by its account — what would own ~/.ssh, dotfiles and ~/.config when HAL retires | [ADR 0112](../../02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md), [ADR 0051](../../02-DECISIONS/0051-shared-data-is-the-operators.md) |
 
-| [`32-what-a-module-declares.md`](32-what-a-module-declares.md) | **Proposed.** What a module declares and what the bus derives from it: three namespaces, subjects from local names, queues never declared, the five relationships, and the build-publish-deploy lifecycle on one bus | [ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md), [ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseding [ADR 0125](../../02-DECISIONS/0125-the-bus-is-the-only-broker.md)), [ADR 0041](../../02-DECISIONS/0041-events-are-a-relationship.md) |
+| [`32-what-a-module-declares.md`](32-what-a-module-declares.md) | **Proposed.** What a module declares and what the bus derives from it: three namespaces, subjects from local names, queues never declared, the five relationships, and the build-publish-deploy lifecycle on one bus | [ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md), [ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md), superseded by [ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md) (superseding [ADR 0125](../../02-DECISIONS/0125-the-bus-is-the-only-broker.md)), [ADR 0041](../../02-DECISIONS/0041-events-are-a-relationship.md) |
 
 ## Not yet written