The first handover records the standing holder without re-judging it

On a mesh that predates the record, every handover has to begin by writing down who
already holds the seat — otherwise the next holder cannot be assigned beside it,
because two eligible claimants with nothing on record are refused. Found on the
live mesh minutes after 0040 moved the bus seat's row: the standing holder no
longer satisfies what the seat delivers, on purpose, and so could not be recorded,
and so nothing could stand beside it.

Recording who already holds is not making a new holder. Derivation never read
what the seat delivers, so the standing holder holds regardless; when nothing is
on record and the named assignment claims the seat at its scope, only that claim
is checked. Every change of holder is still judged in full.

cmd/mesh-controller/rollout.go

@@ -25,11 +25,11 @@ import (
 // against a mesh that is serving. It answers from records: what is missing, and what would happen.
 // `rollout` itself refuses unless the check is clean.
 //
-// **The old broker is not switched off by this.** It stays an ordinary provider of `amqp` for whatever
-// else uses it — on this installation, a whole automation layer that has nothing to do with the mesh
-// ([ADR 0119](../../02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md)). Only the mesh's own
-// traffic moves, which is why this is survivable at all: what breaks if it goes wrong is the mesh's
-// ability to change things, not the services its modules are serving.
+// **The old broker goes with the move, and goes last** (novox/hq ADR 0131): AMQP is not a provision,
+// so once every machine reports on the new bus its module is unassigned. Only the mesh's own traffic
+// is what moves, which is why this is survivable at all: what breaks if it goes wrong is the mesh's
+// ability to change things, not the services its modules are serving — measured on 2026-09-27, when
+// a seat emptied mid-change and the control plane looped for two hours while every service stayed up.
 
 const rolloutUsage = "rollout check | rollout --confirm"
 
@@ -105,7 +105,6 @@ func readinessOf(ctx context.Context, inv *inventory.Inventory) (broker.Readines
 		ModuleCredentialled: map[string]bool{},
 		// The old broker keeps its other clients on this installation, and saying so is how the plan
 		// stops reading as a retirement.
-		OldBusHasOtherClients: true,
 	}
 
 	address, _, err := broker.OnNATS()

cmd/mesh-controller/seats.go

@@ -156,18 +156,37 @@ func handOver(ctx context.Context, seatName, to string) error {
 	if m == nil {
 		return fmt.Errorf("%s is assigned but not in the catalogue, which should not happen", module)
 	}
-	if err := catalogue.CanHold(*m, seat); err != nil {
-		return fmt.Errorf("%s cannot hold %s: %w", module, seat.Name, err)
+	var was string
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		return err
+	}
+	for _, h := range holdings {
+		if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name {
+			was = h.Node
+		}
 	}
 
-	var was string
-	if holdings, err := inv.Holdings(ctx); err == nil {
-		for _, h := range holdings {
-			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name {
-				was = h.Node
-			}
+	// **Recording who already holds the seat is not making a new holder, and is not judged like
+	// one.** On a mesh that predates the record, the first handover has to begin by writing down
+	// the standing holder — otherwise the next holder cannot be assigned beside it, because two
+	// eligible claimants with nothing on record are refused. That standing holder may no longer
+	// satisfy what the seat delivers (the row moved under it, on purpose, as ADR 0131's first step),
+	// and it holds regardless: derivation never read that column. So when nothing is on record and
+	// the named assignment is the one holding by derivation, only the claim itself is checked here.
+	// Every *change* of holder is judged in full.
+	claimsIt := false
+	for _, c := range m.Claims {
+		if cs, ok := catalogue.SeatNamed(c.Name); ok && cs.Name == seat.Name && c.At() == seat.Scope {
+			claimsIt = true
 		}
 	}
+	if was == "" && claimsIt {
+		fmt.Printf("nothing was on record for %s; recording %s on %s as its standing holder\n",
+			seat.Name, module, nodeName)
+	} else if err := catalogue.CanHold(*m, seat); err != nil {
+		return fmt.Errorf("%s cannot hold %s: %w", module, seat.Name, err)
+	}
 	if err := inv.HoldSeat(ctx, seat.Name, seat.Scope, nodeName, module); err != nil {
 		return err
 	}

internal/broker/readiness.go

@@ -35,10 +35,6 @@ type Readiness struct {
 	Modules []string
 	// ModuleCredentialled is which of those has one.
 	ModuleCredentialled map[string]bool
-	// StillOnTheOldBus is whether anything of the mesh's own still needs the bus it is leaving —
-	// which is not a reason to stop, because that broker stays as an ordinary provider of `amqp`
-	// (ADR 0119). Recorded so nobody reads the move as a retirement.
-	OldBusHasOtherClients bool
 }
 
 // NotReady is every reason this mesh cannot move its bus yet, in the order somebody would fix them.
@@ -120,10 +116,11 @@ func WhatMoves(r Readiness) []string {
 		out = append(out, fmt.Sprintf("move %d module runtime(s), and confirm each answers",
 			len(r.Modules)))
 	}
-	if r.OldBusHasOtherClients {
-		out = append(out, "leave the old broker running: it stays an ordinary provider of `amqp` for "+
-			"whatever else uses it (ADR 0119), and this move is not its retirement")
-	}
+	// **The old broker goes, and it goes last** (novox/hq ADR 0131). AMQP is not a provision, so once
+	// every machine reports on the new bus nothing of the mesh is left speaking to it, and its module
+	// is unassigned. Said as a step so nobody reads the move as leaving a second bus behind.
+	out = append(out, "then unassign the old broker's module: AMQP is not a provision (ADR 0131), and "+
+		"once every machine reports on the new bus nothing of the mesh speaks to it")
 	return out
 }
 

internal/broker/readiness_test.go

@@ -79,9 +79,8 @@ func TestEachThingMissingNamesItsOwnRemedy(t *testing.T) {
 
 // What the move would do is written out rather than summarised, because this is the one step with
 // nothing to inspect afterwards — so reading it is the last chance to disagree.
-func TestWhatMovesNamesEveryMachineAndSaysTheOldBrokerStays(t *testing.T) {
+func TestWhatMovesNamesEveryMachineAndEndsWithTheOldBrokerGoing(t *testing.T) {
 	r := aMeshReadyToMove()
-	r.OldBusHasOtherClients = true
 	steps := strings.Join(WhatMoves(r), "\n")
 
 	for _, want := range []string{"anchor", "laptop", "user list", "module runtime"} {
@@ -89,9 +88,11 @@ func TestWhatMovesNamesEveryMachineAndSaysTheOldBrokerStays(t *testing.T) {
 			t.Errorf("the plan does not mention %q:\n%s", want, steps)
 		}
 	}
-	// Said explicitly, so nobody reads the move as switching the old broker off — it stays serving
-	// whatever else uses it, and that is a decision already taken.
-	if !strings.Contains(steps, "not its retirement") {
-		t.Errorf("the plan does not say the old broker stays:\n%s", steps)
+	// Said explicitly, and last: AMQP is not a provision (novox/hq ADR 0131), so the move ends with
+	// the old broker's module unassigned, not left behind as a second bus. An earlier version of this
+	// test pinned the opposite, under a record 0131 superseded.
+	lines := WhatMoves(r)
+	if last := lines[len(lines)-1]; !strings.Contains(last, "unassign the old broker") {
+		t.Errorf("the plan does not end with the old broker going:\n%s", steps)
 	}
 }

internal/catalogue/amqp_is_not_a_provision_test.go

@@ -0,0 +1,48 @@
+package catalogue
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// **The word does not come back through a manifest** (novox/hq ADR 0131). A module that wants
+// messaging wants the mesh's bus, reached through the sdk and named by the `mesh-broker` seat. Naming
+// the old wire protocol asks for the one server being retired, so both directions are refused at the
+// parser — this is judged from the manifest alone, no store needed.
+
+func TestAManifestProvidingAmqpIsRefused(t *testing.T) {
+	raw := []byte(`{"module":"old-broker","version":"1","provides":[{"name":"amqp","scope":"mesh"}]}`)
+	_, err := ParseManifest(raw)
+	if err == nil || !strings.Contains(err.Error(), `provides "amqp", which is not a provision`) {
+		t.Fatalf("a module providing amqp was not refused, or not for the reason: %v", err)
+	}
+}
+
+func TestAManifestRequiringAmqpIsRefused(t *testing.T) {
+	raw := []byte(`{"module":"forwarder","version":"1","requires":["amqp"]}`)
+	_, err := ParseManifest(raw)
+	if err == nil || !strings.Contains(err.Error(), `requires "amqp", which is not a provision`) {
+		t.Fatalf("a module requiring amqp was not refused, or not for the reason: %v", err)
+	}
+}
+
+// And the catalogue as checked out beside this repository names it nowhere — the three modules that
+// did are removed under design 28 task 5.4, not converted.
+func TestNoCatalogueManifestNamesAmqp(t *testing.T) {
+	modules, err := filepath.Glob("../../../mesh-catalog/modules/*/module.json")
+	if err != nil || len(modules) == 0 {
+		t.Skip("the catalogue is not checked out beside this repository")
+	}
+	for _, path := range modules {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.Contains(string(raw), `"amqp"`) {
+			t.Errorf("%s names amqp, which is not a provision (novox/hq ADR 0131)",
+				filepath.Base(filepath.Dir(path)))
+		}
+	}
+}

internal/catalogue/broker_seat_test.go

@@ -46,41 +46,9 @@ func TestTheSeatRefusesADifferentBusToo(t *testing.T) {
 	}
 }
 
-// **The old broker claims the seat until the seat is handed over, and stands beside the new one
-// while it waits** (novox/hq ADR 0131, superseding the record this test used to pin). Whoever is on
-// record holds it; the other eligible claimant is neither refused nor holding. This is the shape the
-// handover needs: both brokers assigned, one bus, no moment with nobody in the seat.
-func TestTheOldBrokerStandsBesideTheNewOneUntilTheHandover(t *testing.T) {
-	was := Seats()
-	t.Cleanup(func() { UseSeats(was) })
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
-
-	lavinmq := catalogueManifest(t, "lavinmq")
-	if !lavinmq.ClaimsSeat("mesh-broker") {
-		t.Skip("the old broker no longer claims the seat: design 28 task 5.4 has removed it")
-	}
-	nats := catalogueManifest(t, "nats")
-	onRecord := World{Holdings: []Held{{Claim: "mesh-broker", Scope: ScopeMesh,
-		Node: "anchor", Module: "nats"}}}
-
-	// The same machine runs both. Without the record this is two holders and refused; with it, the
-	// recorded one holds and the other is silent.
-	anchor := workstation()
-	anchor.Name = "anchor"
-	got, err := Resolve(shelf(lavinmq, nats), []string{"lavinmq", "nats"}, anchor, onRecord)
-	if err != nil {
-		t.Fatalf("the old broker beside the recorded holder was refused: %v", err)
-	}
-	var holders []string
-	for _, h := range got.Claims {
-		if h.Claim == "mesh-broker" {
-			holders = append(holders, h.Module)
-		}
-	}
-	if len(holders) != 1 || holders[0] != "nats" {
-		t.Fatalf("the seat is held by %v, not by the holder on record alone", holders)
-	}
-}
+// The old broker is gone from the catalogue (novox/hq ADR 0131, design 28 task 5.4), so it is no
+// longer a fixture here. That two eligible holders stand beside each other with one on record is
+// pinned in holdings_test.go against manifests this package owns.
 
 // **A seat and the interface it delivers are different names, and renaming one must not rename
 // the other** (novox/hq ADR 0118). This nearly went wrong: the seats were renamed to the `mesh-*`

internal/catalogue/foundation_manifests_test.go

@@ -28,8 +28,10 @@ func TestTheStoreAndTheBrokerSayWhatTheMeshGuards(t *testing.T) {
 	if got := catalogueManifest(t, "postgres").Guards; !reflect.DeepEqual(got, []int{5432}) {
 		t.Errorf("postgres guards %v; the store's port must be refused from outside", got)
 	}
-	if got := catalogueManifest(t, "lavinmq").Guards; !reflect.DeepEqual(got, []int{15672}) {
-		t.Errorf("lavinmq guards %v; the management port must be refused from outside", got)
+	// The bus's monitoring port, not its client port: a node reaches the bus, nobody outside
+	// reads its state (novox/hq ADR 0131 — the broker that guarded 15672 has left the catalogue).
+	if got := catalogueManifest(t, "nats").Guards; !reflect.DeepEqual(got, []int{8222}) {
+		t.Errorf("nats guards %v; the monitoring port must be refused from outside", got)
 	}
 }
 

internal/catalogue/manifest.go

@@ -1027,6 +1027,28 @@ func ParseManifest(raw []byte) (Manifest, error) {
 		problems = append(problems, fmt.Sprintf(
 			"%q is not a usable slug: lower-case letters, digits, dashes and dots", m.Slug))
 	}
+	// **`amqp` is not a provision, and not a requirement** (novox/hq ADR 0131). A module that wants
+	// messaging wants the mesh's bus — it emits and consumes through the sdk, which the mesh hands the
+	// bus with the module's own credential — and the bus is whatever holds `mesh-broker`, spoken in
+	// whatever that holder speaks. Naming the old wire protocol asks for a specific server, and the
+	// only one that could answer is the one being retired. Refused here so the word cannot come back
+	// through a manifest.
+	for _, offer := range m.Provides {
+		if offer.Name == "amqp" {
+			problems = append(problems, fmt.Sprintf(
+				"%s provides %q, which is not a provision: the mesh's bus is whatever holds "+
+					"mesh-broker, and a module provides mesh-bus to be it (novox/hq ADR 0131)",
+				m.Module, offer.Name))
+		}
+	}
+	for _, r := range m.Requires {
+		if r == "amqp" {
+			problems = append(problems, fmt.Sprintf(
+				"%s requires %q, which is not a provision: a module reaches the mesh's bus through "+
+					"the sdk, and depends on the mesh-broker seat, not on a protocol (novox/hq ADR 0131)",
+				m.Module, r))
+		}
+	}
 	for _, offer := range m.Provides {
 		p := offer.Name
 		if !name.MatchString(p) {

internal/catalogue/seats_declared_test.go

@@ -121,9 +121,9 @@ func TestTheParserDoesNotJudgeWhatOnlyTheStoreKnows(t *testing.T) {
 	t.Cleanup(func() { UseSeats(was) })
 
 	// A store whose bus seat delivers something this module does provide.
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "amqp", Decision: "test"}})
-	raw := []byte(`{"module":"lavinmq","version":"1",` +
-		`"provides":[{"name":"amqp","scope":"mesh"}],` +
+	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
+	raw := []byte(`{"module":"a-bus","version":"1",` +
+		`"provides":[{"name":"mesh-bus","scope":"mesh"}],` +
 		`"claims":[{"name":"mesh-broker","scope":"mesh"}]}`)
 
 	m, err := ParseManifest(raw)
@@ -135,12 +135,12 @@ func TestTheParserDoesNotJudgeWhatOnlyTheStoreKnows(t *testing.T) {
 	}
 
 	// And with the store saying the seat delivers something else, registration is what refuses it.
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
+	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "other-bus", Decision: "test"}})
 	if _, err := ParseManifest(raw); err != nil {
 		t.Fatalf("the parser judged it the second time: %v", err)
 	}
 	got := strings.Join(CatalogueProblems(Shelf{m.Module: m}), "; ")
-	if !strings.Contains(got, `does not provide "mesh-bus"`) {
+	if !strings.Contains(got, `does not provide "other-bus"`) {
 		t.Fatalf("registration did not refuse a holder that cannot answer for the seat: %q", got)
 	}
 }

internal/inventory/migrations/0040-the-broker-seat-delivers-the-bus.sql

@@ -0,0 +1,12 @@
+-- The bus seat's holder answers for the mesh's bus, not for a wire protocol (novox/hq ADR 0131).
+--
+-- The row said `amqp`, which is the protocol the old broker spoke, and so only that broker could hold
+-- the seat that names the mesh's bus — while the module that will carry the bus could not. The seat
+-- delivers `mesh-bus`; whichever module provides that may hold it, and today that is one module.
+--
+-- Safe under the current holder: the control plane composes its own bus address through the seat by
+-- name, and the overview derives holders by name. Only registration and provision-to-seat resolution
+-- read this column. So the row changes, the current holder keeps holding by derivation, the next one
+-- can register its claim, and the handover (0039) moves the seat when both are running. What must
+-- not happen in between is re-registering the current holder — registration would now refuse it.
+update seat set delivers = 'mesh-bus' where name = 'mesh-broker' and delivers = 'amqp';