The move mints every credential and tells each machine its membership

`rollout mint` gives every principal the new bus will have a credential it does
not yet have and puts each where its owner reads it: a machine's as a membership
— bus address, fingerprint, password, transport — sealed into its declaration
(migration 0041, the `bus-membership` resource the host reads after applying); a
module's as its broker secret, through the same delivery `module issue` uses; the
control plane's own as its `bus` secret. Idempotent, and worked out from where the
bus's module is assigned rather than from this process's environment, because this
process is still on the old bus when it runs and must be.

This is the half of design 28 task 5.2 the first live attempt found missing: a
credential was minted only at enrolment, at `module issue` and for a person, so no
machine already enrolled could ever be moved. `rollout check` was right to refuse;
now there is something to run first.

internal/inventory/bususers.go

@@ -230,3 +230,35 @@ func (i *Inventory) ForgetPerson(ctx context.Context, name string) error {
 	}
 	return i.ForgetBusUser(ctx, "person."+name)
 }
+
+// PutBusMembership records a machine's membership for the new bus, sealed to it (design 28, 5.2).
+// Replaces any earlier one: a machine has one membership per bus, and re-minting is re-telling.
+func (i *Inventory) PutBusMembership(ctx context.Context, nodeName, sealed string) error {
+	node, err := i.NodeByName(ctx, nodeName)
+	if err != nil {
+		return err
+	}
+	_, err = i.store.Pool().Exec(ctx,
+		`insert into bus_membership (node, sealed) values ($1, $2)
+		 on conflict (node) do update set sealed = excluded.sealed, since = now()`, node.ID, sealed)
+	return err
+}
+
+// BusMemberships is every machine's sealed membership for the new bus, by node name.
+func (i *Inventory) BusMemberships(ctx context.Context) (map[string]string, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select n.name, b.sealed from bus_membership b join node n on n.id = b.node`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]string{}
+	for rows.Next() {
+		var name, sealed string
+		if err := rows.Scan(&name, &sealed); err != nil {
+			return nil, err
+		}
+		out[name] = sealed
+	}
+	return out, rows.Err()
+}

internal/inventory/holdings_test.go

@@ -80,3 +80,20 @@ func TestUnassigningTheHolderTakesTheHoldingWithIt(t *testing.T) {
 		t.Fatalf("the holding outlived the assignment it pointed at: %+v", held)
 	}
 }
+
+func TestAMachinesMembershipIsOneRowReplacedAndGoesWithTheMachine(t *testing.T) {
+	inv, ctx := twoBrokersOnTwoNodes(t)
+	if err := inv.PutBusMembership(ctx, "anchor", "first"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.PutBusMembership(ctx, "anchor", "second"); err != nil {
+		t.Fatal(err)
+	}
+	got, err := inv.BusMemberships(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["anchor"] != "second" || len(got) != 1 {
+		t.Fatalf("a re-told membership did not replace the first: %v", got)
+	}
+}

internal/inventory/migrations/0041-a-machine-is-told-its-membership-for-the-new-bus.sql

@@ -0,0 +1,11 @@
+-- A machine already enrolled is moved to the new bus by being told its membership for it
+-- (novox/hq design 28, task 5.2). Until this, a membership — bus address, fingerprint, password,
+-- transport — existed only in the enrolment reply, and nothing could hand one to a machine that
+-- had already joined. The row is the membership sealed to that machine, composed into its
+-- declaration as a file it reads after applying; the plaintext exists once, at minting, and then
+-- only on the machine. One per node: the mesh moves to one bus.
+create table bus_membership (
+  node   uuid        primary key references node(id) on delete cascade,
+  sealed text        not null,
+  since  timestamptz not null default now()
+);