The broker credential resolves the mesh-broker seat, not the hub (issue 059)

An adversarial review of the 055 fix found it encoded the wrong invariants, latent while
every mesh keeps its broker on the hub. Now: the address is the overlay name of the node
ASSIGNED a module claiming the mesh-broker seat (the hub stands in only while nothing holds
the seat — genesis); "on the overlay" is what whereEveryoneIs answers (resolved the
networking module), not "has an address"; a portless genesis address defaults to 5671
instead of silently disabling the path; a second `overlay place --hub` is refused rather
than last-write-wins; and `overlay place` says that earlier credentials keep their old
address. A test now binds the controller's own module.json to its seat, so deleting the
claim fails the suite.

https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

cmd/mesh-controller/network.go

@@ -93,6 +93,23 @@ func overlayPlace(ctx context.Context, inv *inventory.Inventory, args []string)
 			"and the mesh will not choose between them", node)
 	}
 
+	// One hub per mesh, refused rather than last-write-wins: with two flagged, which one the
+	// graph and the broker address pick is order-dependent — the silent-election fault ADR 0007
+	// exists to avoid, one flag over (novox/hq issue 059). Moving the hub is explicit: re-place
+	// the old one without --hub first.
+	if *hub {
+		placed, err := inv.Overlays(ctx)
+		if err != nil {
+			return err
+		}
+		for _, p := range placed {
+			if p.Hub && p.Name != node {
+				return fmt.Errorf("%s is already the hub; a mesh has one. Re-place %s without "+
+					"--hub first if the hub is moving", p.Name, p.Name)
+			}
+		}
+	}
+
 	// Declared, all three. The address is evidence of reachability and is not the fact, and hub
 	// election by address prefix fails silently (novox/hq ADR 0007).
 	if err := inv.SetPlace(ctx, node, *endpoint, *site, *hub, ""); err != nil {
@@ -108,6 +125,8 @@ func overlayPlace(ctx context.Context, inv *inventory.Inventory, args []string)
 	}
 
 	fmt.Printf("%s is at %s on the overlay\n", node, address)
+	fmt.Println("  credentials issued for it before this placement keep their old broker address —" +
+		" `module issue` them again and push (novox/hq issue 059)")
 	switch {
 	case *hub:
 		fmt.Println("  the hub — every node not sharing a site routes through it")