The bus's system account exports MESH's connect and disconnect events and connections request, heard only by the watchman (issue 1147)

internal/broker/nats.go

@@ -823,6 +823,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		}
 
 	case KindModule:
+		// 0. The watchman alone hears who connects and disconnects, and asks who is connected (ADR 0431 §2).
+		if p.Module == WatchmanModule {
+			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
+			pub = append(pub, BusConnzSubject)
+		}
 		// 1. Its own namespace: it publishes its events there and serves its tools there. Nothing
 		//    else may publish into it, so an event's source is a fact the server enforces rather
 		//    than a claim in the body (design 29 §2).
@@ -1447,7 +1452,9 @@ func ComposeAccounts(principals []Principal) (string, error) {
 	// JetStream is enabled per account once accounts exist at all: with only the global block set,
 	// a user in MESH is told "JetStream not enabled for account" the first time it binds a
 	// consumer, which is the first thing every host does (2026-09-28).
-	b.WriteString("accounts {\n  MESH {\n    jetstream: enabled\n    users = [\n")
+	b.WriteString("accounts {\n  MESH {\n    jetstream: enabled\n")
+	b.WriteString(meshSystemImports)
+	b.WriteString("    users = [\n")
 	for _, p := range sorted {
 		perms, err := PermissionsFor(p)
 		if err != nil {
@@ -1468,10 +1475,45 @@ func ComposeAccounts(principals []Principal) (string, error) {
 		}
 		b.WriteString("      } }\n")
 	}
-	b.WriteString("    ]\n  }\n}\n")
+	b.WriteString("    ]\n  }\n")
+	b.WriteString(systemAccount)
+	b.WriteString("}\n")
 	return b.String(), nil
 }
 
+// WatchmanModule is the one module whose principal hears the bus's connect and disconnect events and asks its list of
+// connections (novox/hq ADR 0431 §2, issue 1147): the watchman of the repository mesh-delivery, which writes presence
+// from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
+const WatchmanModule = "mesh-delivery-watchman"
+
+// The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
+// (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
+// account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody
+// gains its other requests and events; it exports exactly these three, to MESH alone.
+const (
+	BusConnectSubject    = "mesh.bus.connect"
+	BusDisconnectSubject = "mesh.bus.disconnect"
+	BusConnzSubject      = "mesh.bus.connz"
+)
+
+// meshSystemImports is what MESH imports from $SYS: the two event streams and the one service.
+const meshSystemImports = "    imports = [\n" +
+	"      { stream: { account: \"$SYS\", subject: \"$SYS.ACCOUNT.MESH.CONNECT\" }, to: \"" + BusConnectSubject + "\" }\n" +
+	"      { stream: { account: \"$SYS\", subject: \"$SYS.ACCOUNT.MESH.DISCONNECT\" }, to: \"" + BusDisconnectSubject + "\" }\n" +
+	"      { service: { account: \"$SYS\", subject: \"$SYS.REQ.ACCOUNT.MESH.CONNZ\" }, to: \"" + BusConnzSubject + "\" }\n" +
+	"    ]\n"
+
+// systemAccount is the account `$SYS`, the server's default system account by its own name (a config that declares an
+// account of that name makes it the system account), with no user and the three exports to MESH. Quoted, because an
+// unquoted `$` begins a variable in the server's config grammar.
+const systemAccount = "  \"$SYS\" {\n" +
+	"    exports = [\n" +
+	"      { stream: \"$SYS.ACCOUNT.MESH.CONNECT\", accounts: [\"MESH\"] }\n" +
+	"      { stream: \"$SYS.ACCOUNT.MESH.DISCONNECT\", accounts: [\"MESH\"] }\n" +
+	"      { service: \"$SYS.REQ.ACCOUNT.MESH.CONNZ\", accounts: [\"MESH\"] }\n" +
+	"    ]\n" +
+	"  }\n"
+
 // unique is a sorted list with each subject once. Two carried modules holding seats with the same
 // verb, or the runtime module itself carried beside the others, would otherwise write a grant twice
 // — harmless to the server, and noise in a file that is read as the mesh's authority model.