The user list is composed before anything moves onto the bus

Found by reading the live mesh's own notes before touching it, which is where this
was heading next.

Composing the bus's user list was gated on the controller already being on the new
bus. That cannot work: the server needs its user list *before* anything moves onto
it. Step 2 of the whole change is exactly that — the server stands in the mesh
carrying nothing, on its own ports, while every node stays where it is. Under the
old gating that step was impossible: the module would come up, find no accounts
file, and its entrypoint would wait for one the controller had decided not to write.

So the only question is whether this machine runs the module that asked for the
file. A mesh that never moves has written a user list nothing reads, costing a few
hundred bytes on one node. The reverse cost a step that could not be taken.

Pinned by a test over the records of a mesh mid-change: everything running, nothing
on the new bus, and a user list that contains the controller — because a file
without it is a bus its own writer cannot connect to.

cmd/mesh-controller/plan.go

@@ -1160,13 +1160,19 @@ func portsOn(
 func composeBusUsers(ctx context.Context, inv *inventory.Inventory,
 	onThisNode []catalogue.Manifest) (string, error) {
 
-	_, onNATS, err := broker.OnNATS()
-	if err != nil || !onNATS {
-		return "", err
-	}
-	// Only for the machine holding the bus. Asked of what this push resolves to rather than of the
-	// seat's holder mesh-wide: the file is a resource of that module, so the question is whether it
-	// is here.
+	// **Not gated on which bus the controller is on, and that was a bug.** It read "compose this only
+	// once the mesh is on the new bus" — which cannot work, because the server needs its user list
+	// *before* anything moves onto it. Step 2 of the change is exactly that: the server stands in the
+	// mesh carrying nothing, on its own ports, while every node is still on the old bus (novox/hq
+	// ADR 0116). Under the old gating that step could not happen: the module would come up, find no
+	// accounts file, and its entrypoint would wait for one the controller had decided not to write.
+	//
+	// So the question is only whether this machine runs the module that asked for the file. A mesh
+	// that never moves has written a user list nothing reads, which costs a few hundred bytes on one
+	// node; the reverse cost a step that cannot be taken.
+	//
+	// Asked of what this push resolves to rather than of the seat's holder mesh-wide: the file is a
+	// resource of that module, so the question is whether it is here.
 	holdsTheBus := false
 	for _, m := range onThisNode {
 		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {