The network map resolves each machine with the seat holders on record

Without them, a machine running the next holder of a seat beside the current one
resolves as two holders, is refused, and drops out of the map — and with it the
address every other machine composes for what it offers. Found live: the control
node vanished from the private network the moment the new bus was assigned beside
the old one, and nothing on any machine could be composed.

cmd/mesh-controller/modules.go

@@ -614,6 +614,15 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 	if err != nil {
 		return err
 	}
+	return issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password)
+}
+
+// issueWith is the delivery half: the minted password sealed to the machine as the module's broker
+// secret, and the module's consumer created where the bus can be reached. Split from the minting
+// so the move can issue every module against a bus whose address it worked out itself
+// (`rollout mint`, design 28 task 5.2) rather than the one in this process's environment.
+func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest,
+	node, busAddress string, known broker.Broker, reachable, user, password string) error {
 	held, err := json.Marshal(struct {
 		URL         string `json:"url"`
 		Fingerprint string `json:"fingerprint,omitempty"`
@@ -639,14 +648,19 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 		Kind: broker.KindModule, Node: node, Module: m.Module,
 		Emits: m.Emits, Consumes: m.Consumes, Serves: m.Tools,
 	}); needed {
-		js, err := broker.Dial(busAddress)
-		if err != nil {
-			return fmt.Errorf("the credential is minted and the mesh cannot reach the bus to create "+
-				"how %s hears what it consumes: %w", m.Module, err)
-		}
-		defer js.Close()
-		if err := js.EnsureConsumer(consumer); err != nil {
-			return err
+		if busAddress == "" {
+			fmt.Printf("  %s consumes; its consumer is created when the bus is reachable (`push`, then "+
+				"`rollout mint` again is harmless)\n", m.Module)
+		} else {
+			js, err := broker.Dial(busAddress)
+			if err != nil {
+				return fmt.Errorf("the credential is minted and the mesh cannot reach the bus to create "+
+					"how %s hears what it consumes: %w", m.Module, err)
+			}
+			defer js.Close()
+			if err := js.EnsureConsumer(consumer); err != nil {
+				return err
+			}
 		}
 	}
 

cmd/mesh-controller/network.go

@@ -537,6 +537,15 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 	if err != nil {
 		return nil, err
 	}
+	// **With the seat holders on record**, or a machine running the next holder of a seat beside
+	// the current one resolves as two holders, is refused, and drops out of the map — taking the
+	// address every other machine composes for what it offers (novox/hq ADR 0131). Found live:
+	// the control node vanished from the private network the moment the new bus was assigned
+	// beside the old one.
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		return nil, err
+	}
 	var out []inventory.Overlay
 	for _, p := range places {
 		if p.Address == "" {
@@ -549,7 +558,7 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 		caps, _ := inv.ProfileOf(ctx, p.Name)
 		got, err := catalogue.Resolve(shelf, assigned,
 			catalogue.Node{Name: p.Name, Site: p.Site, Capabilities: caps},
-			catalogue.World{Unchecked: true})
+			catalogue.World{Unchecked: true, Holdings: holdings})
 		if err != nil {
 			continue
 		}

cmd/mesh-controller/plan.go

@@ -636,8 +636,13 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
+	memberships, err := inv.BusMemberships(ctx)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
 	return catalogue.Rendering{
-		Settings: settings, Generators: gens, Grants: grants, Needed: needed, Ports: ports,
+		BusMembership: memberships[node],
+		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
 		Machines: machines,
 		Suffix:   overlay.Suffix(), MeshRange: meshRange, Accounts: accounts, Foundation: foundation,

cmd/mesh-controller/rollout.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"strings"
@@ -12,6 +13,7 @@ import (
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/secrets"
 )
 
 // Moving the mesh's own traffic to the bus being built (novox/hq ADR 0116 step 5).
@@ -25,18 +27,25 @@ import (
 // against a mesh that is serving. It answers from records: what is missing, and what would happen.
 // `rollout` itself refuses unless the check is clean.
 //
-// **The old broker is not switched off by this.** It stays an ordinary provider of `amqp` for whatever
-// else uses it — on this installation, a whole automation layer that has nothing to do with the mesh
-// ([ADR 0119](../../02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md)). Only the mesh's own
-// traffic moves, which is why this is survivable at all: what breaks if it goes wrong is the mesh's
-// ability to change things, not the services its modules are serving.
+// **The old broker goes with the move, and goes last** (novox/hq ADR 0131): AMQP is not a provision,
+// so once every machine reports on the new bus its module is unassigned. Only the mesh's own traffic
+// is what moves, which is why this is survivable at all: what breaks if it goes wrong is the mesh's
+// ability to change things, not the services its modules are serving — measured on 2026-09-27, when
+// a seat emptied mid-change and the control plane looped for two hours while every service stayed up.
 
-const rolloutUsage = "rollout check | rollout --confirm"
+const rolloutUsage = "rollout check | rollout mint [--again] | rollout --confirm"
 
 func rolloutCommand(ctx context.Context, args []string) error {
 	switch {
 	case len(args) == 1 && args[0] == "check":
 		return rolloutCheck(ctx)
+	case len(args) == 1 && args[0] == "mint":
+		return rolloutMint(ctx, false)
+	case len(args) == 2 && args[0] == "mint" && args[1] == "--again":
+		// Every credential minted afresh, whether or not one exists — for a mint that was wrong
+		// before anything was pushed. Afterwards nothing that received the old one still works,
+		// which is fine exactly when nothing received it.
+		return rolloutMint(ctx, true)
 	case len(args) == 1 && args[0] == "--confirm":
 		return errors.New(
 			"the rollout itself is not built yet: `rollout check` answers whether it could run, and " +
@@ -105,7 +114,6 @@ func readinessOf(ctx context.Context, inv *inventory.Inventory) (broker.Readines
 		ModuleCredentialled: map[string]bool{},
 		// The old broker keeps its other clients on this installation, and saying so is how the plan
 		// stops reading as a retirement.
-		OldBusHasOtherClients: true,
 	}
 
 	address, _, err := broker.OnNATS()
@@ -191,3 +199,183 @@ func wasSentTheUserList(ctx context.Context, inv *inventory.Inventory, node stri
 // notReadyOf is the readiness reasoning, named here so a test can reach it without the command's
 // printing. The reasoning itself is the broker package's, where it is pure.
 func notReadyOf(state broker.Readiness) []string { return broker.NotReady(state) }
+
+// rolloutMint gives every principal the new bus will have a credential it does not yet have, and
+// puts each where its owner reads it (novox/hq design 28, task 5.2): a machine's as a membership
+// sealed into its declaration, a module's as its broker secret, the control plane's own as its
+// `bus` secret. Idempotent: what already has a hash is left alone, so running it again is harmless.
+//
+// **Before anything moves, and it is what makes moving possible.** A machine moved without a
+// credential cannot come back, and afterwards there is no bus to tell it anything over — which is
+// why `rollout check` refuses until this has run. The bus's address is worked out here, from where
+// the module that provides it is assigned, rather than read from this process's environment: this
+// process is still on the old bus when this runs, and must be.
+func rolloutMint(ctx context.Context, again bool) error {
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	inv := open.inventory
+
+	known, err := broker.FromEnvironment()
+	if err != nil {
+		return fmt.Errorf("the bus's certificate is not known to this process, and every membership "+
+			"must carry its fingerprint: %w", err)
+	}
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return err
+	}
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	var busNode, controllerNode string
+	for _, e := range entries {
+		switch {
+		case e.Manifest.ClaimsSeat("mesh-broker") && providesBus(e.Manifest) && len(e.On) > 0:
+			busNode = e.On[0]
+		case e.Manifest.Module == "mesh-controller" && len(e.On) > 0:
+			controllerNode = e.On[0]
+		}
+	}
+	if busNode == "" {
+		return errors.New("no assigned module provides mesh-bus and claims mesh-broker, so there is no " +
+			"bus to mint credentials for — register and assign it first")
+	}
+	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
+	if err != nil {
+		return err
+	}
+	busHost := onNetwork[busNode]
+	if busHost == "" {
+		// **The hub is not in that map.** The machine that took over the tunnel is where the current
+		// bus already answers, and every machine dials it at the address the mesh handed them — so
+		// when the new bus runs on the same machine, that address is the one to tell them, with the
+		// new port. Found live: the control node is the hub, and the map lists the machines placed
+		// around it.
+		// The host alone: no scheme (BareAddress adds one where none was, which is the wrong
+		// direction here — every URL built below adds its own) and no port.
+		_, _, host := broker.CredentialIn(known.Address)
+		if host == "" {
+			host = known.Address
+		}
+		if _, after, hasScheme := strings.Cut(host, "://"); hasScheme {
+			host = after
+		}
+		host = strings.TrimSpace(host)
+		if i := strings.LastIndex(host, ":"); i > 0 && !strings.Contains(host[i:], "]") {
+			host = host[:i]
+		}
+		if host == "" {
+			return fmt.Errorf("%s runs the new bus and has no address on the private network, and the "+
+				"current bus's address is unknown too, so no machine could be told where it is", busNode)
+		}
+		busHost = host
+	}
+	busAddress := busHost + ":4222"
+
+	records, err := inv.BusRecords(ctx)
+	if err != nil {
+		return err
+	}
+	users, err := broker.Users(records)
+	if err != nil {
+		return err
+	}
+	kept, err := inv.BusUsers(ctx)
+	if err != nil {
+		return err
+	}
+	hashes := make(map[string]string, len(kept))
+	for name, u := range kept {
+		hashes[name] = u.PasswordHash
+	}
+	_, missing := broker.WithPasswords(users, hashes)
+	wanted := map[string]bool{}
+	for _, m := range missing {
+		wanted[m] = true
+	}
+
+	var machines, modules, skipped int
+	for _, p := range users {
+		if !again && !wanted[p.Username()] {
+			continue
+		}
+		switch p.Kind {
+		case broker.KindController:
+			if controllerNode == "" {
+				return errors.New("the control plane is not assigned anywhere, so its credential has nowhere to go")
+			}
+			password, err := inv.MintBusPassword(ctx, inventory.BusUser{Username: p.Username(), Kind: inventory.BusController})
+			if err != nil {
+				return err
+			}
+			url := "nats://" + p.Username() + ":" + password + "@" + busAddress
+			if err := inv.AcceptSecretForModule(ctx, controllerNode, "mesh-controller", "bus", url); err != nil {
+				return fmt.Errorf("the control plane's credential is minted and could not be sealed to %s: %w", controllerNode, err)
+			}
+			fmt.Printf("control plane: credential minted, sealed to %s as its `bus` secret\n", controllerNode)
+
+		case broker.KindNode:
+			password, err := inv.MintBusPassword(ctx, inventory.BusUser{Username: p.Username(), Kind: inventory.BusNode, Node: p.Node})
+			if err != nil {
+				return err
+			}
+			membership, _ := json.Marshal(map[string]string{
+				"broker": busAddress, "fingerprint": known.Fingerprint, "password": password, "transport": "nats",
+			})
+			key, err := inv.SealingKeyOf(ctx, p.Node)
+			if err != nil {
+				return fmt.Errorf("%s has no sealing key, so its membership cannot be sealed to it: %w", p.Node, err)
+			}
+			sealed, err := secrets.Seal(key, membership)
+			if err != nil {
+				return err
+			}
+			if err := inv.PutBusMembership(ctx, p.Node, sealed); err != nil {
+				return err
+			}
+			machines++
+
+		case broker.KindModule:
+			m, inShelf := shelf[p.Module]
+			if !inShelf {
+				skipped++
+				continue
+			}
+			if _, reads := m.OwnSecrets["broker"]; !reads {
+				fmt.Printf("  %s on %s speaks on the bus but declares no `broker` secret to receive a credential in; skipped\n", p.Module, p.Node)
+				skipped++
+				continue
+			}
+			password, err := inv.MintBusPassword(ctx, inventory.BusUser{Username: p.Username(), Kind: inventory.BusModule, Node: p.Node, Module: p.Module})
+			if err != nil {
+				return err
+			}
+			if err := issueWith(ctx, inv, m, p.Node, "", known, busAddress, p.Username(), password); err != nil {
+				return err
+			}
+			modules++
+
+		default:
+			skipped++
+		}
+	}
+	fmt.Printf("minted for %d machine(s) and %d module runtime(s); %d skipped; the bus is at %s\n",
+		machines, modules, skipped, busAddress)
+	fmt.Println("  each machine's membership and each module's credential arrive with the next push of its machine;")
+	fmt.Println("  push the machine running the bus first, so the bus stands with its user list before anything dials it")
+	return nil
+}
+
+// providesBus is whether a manifest provides the mesh's bus.
+func providesBus(m catalogue.Manifest) bool {
+	for _, o := range m.Provides {
+		if o.Name == "mesh-bus" {
+			return true
+		}
+	}
+	return false
+}

cmd/mesh-controller/seats.go

@@ -156,18 +156,37 @@ func handOver(ctx context.Context, seatName, to string) error {
 	if m == nil {
 		return fmt.Errorf("%s is assigned but not in the catalogue, which should not happen", module)
 	}
-	if err := catalogue.CanHold(*m, seat); err != nil {
-		return fmt.Errorf("%s cannot hold %s: %w", module, seat.Name, err)
+	var was string
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		return err
+	}
+	for _, h := range holdings {
+		if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name {
+			was = h.Node
+		}
 	}
 
-	var was string
-	if holdings, err := inv.Holdings(ctx); err == nil {
-		for _, h := range holdings {
-			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name {
-				was = h.Node
-			}
+	// **Recording who already holds the seat is not making a new holder, and is not judged like
+	// one.** On a mesh that predates the record, the first handover has to begin by writing down
+	// the standing holder — otherwise the next holder cannot be assigned beside it, because two
+	// eligible claimants with nothing on record are refused. That standing holder may no longer
+	// satisfy what the seat delivers (the row moved under it, on purpose, as ADR 0131's first step),
+	// and it holds regardless: derivation never read that column. So when nothing is on record and
+	// the named assignment is the one holding by derivation, only the claim itself is checked here.
+	// Every *change* of holder is judged in full.
+	claimsIt := false
+	for _, c := range m.Claims {
+		if cs, ok := catalogue.SeatNamed(c.Name); ok && cs.Name == seat.Name && c.At() == seat.Scope {
+			claimsIt = true
 		}
 	}
+	if was == "" && claimsIt {
+		fmt.Printf("nothing was on record for %s; recording %s on %s as its standing holder\n",
+			seat.Name, module, nodeName)
+	} else if err := catalogue.CanHold(*m, seat); err != nil {
+		return fmt.Errorf("%s cannot hold %s: %w", module, seat.Name, err)
+	}
 	if err := inv.HoldSeat(ctx, seat.Name, seat.Scope, nodeName, module); err != nil {
 		return err
 	}

internal/broker/readiness.go

@@ -35,10 +35,6 @@ type Readiness struct {
 	Modules []string
 	// ModuleCredentialled is which of those has one.
 	ModuleCredentialled map[string]bool
-	// StillOnTheOldBus is whether anything of the mesh's own still needs the bus it is leaving —
-	// which is not a reason to stop, because that broker stays as an ordinary provider of `amqp`
-	// (ADR 0119). Recorded so nobody reads the move as a retirement.
-	OldBusHasOtherClients bool
 }
 
 // NotReady is every reason this mesh cannot move its bus yet, in the order somebody would fix them.
@@ -120,10 +116,11 @@ func WhatMoves(r Readiness) []string {
 		out = append(out, fmt.Sprintf("move %d module runtime(s), and confirm each answers",
 			len(r.Modules)))
 	}
-	if r.OldBusHasOtherClients {
-		out = append(out, "leave the old broker running: it stays an ordinary provider of `amqp` for "+
-			"whatever else uses it (ADR 0119), and this move is not its retirement")
-	}
+	// **The old broker goes, and it goes last** (novox/hq ADR 0131). AMQP is not a provision, so once
+	// every machine reports on the new bus nothing of the mesh is left speaking to it, and its module
+	// is unassigned. Said as a step so nobody reads the move as leaving a second bus behind.
+	out = append(out, "then unassign the old broker's module: AMQP is not a provision (ADR 0131), and "+
+		"once every machine reports on the new bus nothing of the mesh speaks to it")
 	return out
 }
 

internal/broker/readiness_test.go

@@ -79,9 +79,8 @@ func TestEachThingMissingNamesItsOwnRemedy(t *testing.T) {
 
 // What the move would do is written out rather than summarised, because this is the one step with
 // nothing to inspect afterwards — so reading it is the last chance to disagree.
-func TestWhatMovesNamesEveryMachineAndSaysTheOldBrokerStays(t *testing.T) {
+func TestWhatMovesNamesEveryMachineAndEndsWithTheOldBrokerGoing(t *testing.T) {
 	r := aMeshReadyToMove()
-	r.OldBusHasOtherClients = true
 	steps := strings.Join(WhatMoves(r), "\n")
 
 	for _, want := range []string{"anchor", "laptop", "user list", "module runtime"} {
@@ -89,9 +88,11 @@ func TestWhatMovesNamesEveryMachineAndSaysTheOldBrokerStays(t *testing.T) {
 			t.Errorf("the plan does not mention %q:\n%s", want, steps)
 		}
 	}
-	// Said explicitly, so nobody reads the move as switching the old broker off — it stays serving
-	// whatever else uses it, and that is a decision already taken.
-	if !strings.Contains(steps, "not its retirement") {
-		t.Errorf("the plan does not say the old broker stays:\n%s", steps)
+	// Said explicitly, and last: AMQP is not a provision (novox/hq ADR 0131), so the move ends with
+	// the old broker's module unassigned, not left behind as a second bus. An earlier version of this
+	// test pinned the opposite, under a record 0131 superseded.
+	lines := WhatMoves(r)
+	if last := lines[len(lines)-1]; !strings.Contains(last, "unassign the old broker") {
+		t.Errorf("the plan does not end with the old broker going:\n%s", steps)
 	}
 }

internal/catalogue/amqp_is_not_a_provision_test.go

@@ -0,0 +1,48 @@
+package catalogue
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// **The word does not come back through a manifest** (novox/hq ADR 0131). A module that wants
+// messaging wants the mesh's bus, reached through the sdk and named by the `mesh-broker` seat. Naming
+// the old wire protocol asks for the one server being retired, so both directions are refused at the
+// parser — this is judged from the manifest alone, no store needed.
+
+func TestAManifestProvidingAmqpIsRefused(t *testing.T) {
+	raw := []byte(`{"module":"old-broker","version":"1","provides":[{"name":"amqp","scope":"mesh"}]}`)
+	_, err := ParseManifest(raw)
+	if err == nil || !strings.Contains(err.Error(), `provides "amqp", which is not a provision`) {
+		t.Fatalf("a module providing amqp was not refused, or not for the reason: %v", err)
+	}
+}
+
+func TestAManifestRequiringAmqpIsRefused(t *testing.T) {
+	raw := []byte(`{"module":"forwarder","version":"1","requires":["amqp"]}`)
+	_, err := ParseManifest(raw)
+	if err == nil || !strings.Contains(err.Error(), `requires "amqp", which is not a provision`) {
+		t.Fatalf("a module requiring amqp was not refused, or not for the reason: %v", err)
+	}
+}
+
+// And the catalogue as checked out beside this repository names it nowhere — the three modules that
+// did are removed under design 28 task 5.4, not converted.
+func TestNoCatalogueManifestNamesAmqp(t *testing.T) {
+	modules, err := filepath.Glob("../../../mesh-catalog/modules/*/module.json")
+	if err != nil || len(modules) == 0 {
+		t.Skip("the catalogue is not checked out beside this repository")
+	}
+	for _, path := range modules {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.Contains(string(raw), `"amqp"`) {
+			t.Errorf("%s names amqp, which is not a provision (novox/hq ADR 0131)",
+				filepath.Base(filepath.Dir(path)))
+		}
+	}
+}

internal/catalogue/broker_seat_test.go

@@ -46,41 +46,9 @@ func TestTheSeatRefusesADifferentBusToo(t *testing.T) {
 	}
 }
 
-// **The old broker claims the seat until the seat is handed over, and stands beside the new one
-// while it waits** (novox/hq ADR 0131, superseding the record this test used to pin). Whoever is on
-// record holds it; the other eligible claimant is neither refused nor holding. This is the shape the
-// handover needs: both brokers assigned, one bus, no moment with nobody in the seat.
-func TestTheOldBrokerStandsBesideTheNewOneUntilTheHandover(t *testing.T) {
-	was := Seats()
-	t.Cleanup(func() { UseSeats(was) })
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
-
-	lavinmq := catalogueManifest(t, "lavinmq")
-	if !lavinmq.ClaimsSeat("mesh-broker") {
-		t.Skip("the old broker no longer claims the seat: design 28 task 5.4 has removed it")
-	}
-	nats := catalogueManifest(t, "nats")
-	onRecord := World{Holdings: []Held{{Claim: "mesh-broker", Scope: ScopeMesh,
-		Node: "anchor", Module: "nats"}}}
-
-	// The same machine runs both. Without the record this is two holders and refused; with it, the
-	// recorded one holds and the other is silent.
-	anchor := workstation()
-	anchor.Name = "anchor"
-	got, err := Resolve(shelf(lavinmq, nats), []string{"lavinmq", "nats"}, anchor, onRecord)
-	if err != nil {
-		t.Fatalf("the old broker beside the recorded holder was refused: %v", err)
-	}
-	var holders []string
-	for _, h := range got.Claims {
-		if h.Claim == "mesh-broker" {
-			holders = append(holders, h.Module)
-		}
-	}
-	if len(holders) != 1 || holders[0] != "nats" {
-		t.Fatalf("the seat is held by %v, not by the holder on record alone", holders)
-	}
-}
+// The old broker is gone from the catalogue (novox/hq ADR 0131, design 28 task 5.4), so it is no
+// longer a fixture here. That two eligible holders stand beside each other with one on record is
+// pinned in holdings_test.go against manifests this package owns.
 
 // **A seat and the interface it delivers are different names, and renaming one must not rename
 // the other** (novox/hq ADR 0118). This nearly went wrong: the seats were renamed to the `mesh-*`

internal/catalogue/declaration.go

@@ -103,6 +103,11 @@ type Rendering struct {
 	// **Only the users, never the server's own settings**: those are the module's, in its image and
 	// its mounts (Manifest.BusUsers).
 	BusUsers string
+	// BusMembership is this machine's membership for the bus the mesh is moving to, sealed to it
+	// (design 28, task 5.2). Empty for a machine not being moved. Written as a file the host reads
+	// after the declaration has applied, so the bus it names is standing before the machine leaves
+	// the one it is on.
+	BusMembership string
 
 	// MeshRange is the private network's CIDR (the range node addresses are allocated from), for a
 	// module that must name the whole mesh rather than one machine — an intrusion filter that must
@@ -238,9 +243,23 @@ func (r Resolution) Compose(with Rendering) (Composed, error) {
 	if err != nil {
 		return Composed{}, err
 	}
+	if with.BusMembership != "" {
+		// The machine's own, not any module's: how it reaches the mesh from now on. Sealed like a
+		// secret and placed where the host looks for exactly this (design 28, task 5.2).
+		resources = append(resources, map[string]any{
+			"id": BusMembershipID(), "type": "file", "path": BusMembershipPath,
+			"sealed": with.BusMembership, "mode": "0600",
+		})
+	}
 	return Composed{Resources: resources, Owner: owner}, nil
 }
 
+// BusMembershipID names the resource carrying a machine's membership for the new bus, and
+// BusMembershipPath is where the host reads it — the same constant on both sides.
+func BusMembershipID() string { return "bus-membership" }
+
+const BusMembershipPath = "/var/lib/mesh/membership-next.json"
+
 func (r Resolution) compose(with Rendering, owner map[string]string) ([]map[string]any, error) {
 	// Every manifest is placed first (novox/hq ADR 0112): the maps naming where its bindings,
 	// credentials and contributions land are resolved against this node's directories, so every

internal/catalogue/foundation_manifests_test.go

@@ -28,8 +28,10 @@ func TestTheStoreAndTheBrokerSayWhatTheMeshGuards(t *testing.T) {
 	if got := catalogueManifest(t, "postgres").Guards; !reflect.DeepEqual(got, []int{5432}) {
 		t.Errorf("postgres guards %v; the store's port must be refused from outside", got)
 	}
-	if got := catalogueManifest(t, "lavinmq").Guards; !reflect.DeepEqual(got, []int{15672}) {
-		t.Errorf("lavinmq guards %v; the management port must be refused from outside", got)
+	// The bus's monitoring port, not its client port: a node reaches the bus, nobody outside
+	// reads its state (novox/hq ADR 0131 — the broker that guarded 15672 has left the catalogue).
+	if got := catalogueManifest(t, "nats").Guards; !reflect.DeepEqual(got, []int{8222}) {
+		t.Errorf("nats guards %v; the monitoring port must be refused from outside", got)
 	}
 }
 

internal/catalogue/holdings_test.go

@@ -114,3 +114,32 @@ func TestCanHoldJudgesClaimScopeAndWhatTheSeatDelivers(t *testing.T) {
 		t.Fatalf("with the row saying amqp, an amqp provider was refused: %v", err)
 	}
 }
+
+// A machine being moved is handed its membership for the new bus as a sealed file in its own
+// declaration — the machine's, not any module's (design 28, task 5.2).
+func TestAMembershipForTheNewBusIsComposedAsASealedFile(t *testing.T) {
+	r := Resolution{Node: "anchor"}
+	got, err := r.Compose(Rendering{BusMembership: "sealed-blob"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var found map[string]any
+	for _, res := range got.Resources {
+		if res["id"] == BusMembershipID() {
+			found = res
+		}
+	}
+	if found == nil {
+		t.Fatalf("no membership resource in %v", got.Resources)
+	}
+	if found["path"] != BusMembershipPath || found["sealed"] != "sealed-blob" || found["mode"] != "0600" {
+		t.Fatalf("the membership is not a sealed 0600 file where the host reads it: %v", found)
+	}
+	// And a machine not being moved is handed nothing.
+	got, _ = r.Compose(Rendering{})
+	for _, res := range got.Resources {
+		if res["id"] == BusMembershipID() {
+			t.Fatal("a machine with no membership on record was handed one")
+		}
+	}
+}

internal/catalogue/manifest.go

@@ -1027,6 +1027,28 @@ func ParseManifest(raw []byte) (Manifest, error) {
 		problems = append(problems, fmt.Sprintf(
 			"%q is not a usable slug: lower-case letters, digits, dashes and dots", m.Slug))
 	}
+	// **`amqp` is not a provision, and not a requirement** (novox/hq ADR 0131). A module that wants
+	// messaging wants the mesh's bus — it emits and consumes through the sdk, which the mesh hands the
+	// bus with the module's own credential — and the bus is whatever holds `mesh-broker`, spoken in
+	// whatever that holder speaks. Naming the old wire protocol asks for a specific server, and the
+	// only one that could answer is the one being retired. Refused here so the word cannot come back
+	// through a manifest.
+	for _, offer := range m.Provides {
+		if offer.Name == "amqp" {
+			problems = append(problems, fmt.Sprintf(
+				"%s provides %q, which is not a provision: the mesh's bus is whatever holds "+
+					"mesh-broker, and a module provides mesh-bus to be it (novox/hq ADR 0131)",
+				m.Module, offer.Name))
+		}
+	}
+	for _, r := range m.Requires {
+		if r == "amqp" {
+			problems = append(problems, fmt.Sprintf(
+				"%s requires %q, which is not a provision: a module reaches the mesh's bus through "+
+					"the sdk, and depends on the mesh-broker seat, not on a protocol (novox/hq ADR 0131)",
+				m.Module, r))
+		}
+	}
 	for _, offer := range m.Provides {
 		p := offer.Name
 		if !name.MatchString(p) {

internal/catalogue/seats_declared_test.go

@@ -121,9 +121,9 @@ func TestTheParserDoesNotJudgeWhatOnlyTheStoreKnows(t *testing.T) {
 	t.Cleanup(func() { UseSeats(was) })
 
 	// A store whose bus seat delivers something this module does provide.
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "amqp", Decision: "test"}})
-	raw := []byte(`{"module":"lavinmq","version":"1",` +
-		`"provides":[{"name":"amqp","scope":"mesh"}],` +
+	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
+	raw := []byte(`{"module":"a-bus","version":"1",` +
+		`"provides":[{"name":"mesh-bus","scope":"mesh"}],` +
 		`"claims":[{"name":"mesh-broker","scope":"mesh"}]}`)
 
 	m, err := ParseManifest(raw)
@@ -135,12 +135,12 @@ func TestTheParserDoesNotJudgeWhatOnlyTheStoreKnows(t *testing.T) {
 	}
 
 	// And with the store saying the seat delivers something else, registration is what refuses it.
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
+	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "other-bus", Decision: "test"}})
 	if _, err := ParseManifest(raw); err != nil {
 		t.Fatalf("the parser judged it the second time: %v", err)
 	}
 	got := strings.Join(CatalogueProblems(Shelf{m.Module: m}), "; ")
-	if !strings.Contains(got, `does not provide "mesh-bus"`) {
+	if !strings.Contains(got, `does not provide "other-bus"`) {
 		t.Fatalf("registration did not refuse a holder that cannot answer for the seat: %q", got)
 	}
 }

internal/inventory/bususers.go

@@ -230,3 +230,35 @@ func (i *Inventory) ForgetPerson(ctx context.Context, name string) error {
 	}
 	return i.ForgetBusUser(ctx, "person."+name)
 }
+
+// PutBusMembership records a machine's membership for the new bus, sealed to it (design 28, 5.2).
+// Replaces any earlier one: a machine has one membership per bus, and re-minting is re-telling.
+func (i *Inventory) PutBusMembership(ctx context.Context, nodeName, sealed string) error {
+	node, err := i.NodeByName(ctx, nodeName)
+	if err != nil {
+		return err
+	}
+	_, err = i.store.Pool().Exec(ctx,
+		`insert into bus_membership (node, sealed) values ($1, $2)
+		 on conflict (node) do update set sealed = excluded.sealed, since = now()`, node.ID, sealed)
+	return err
+}
+
+// BusMemberships is every machine's sealed membership for the new bus, by node name.
+func (i *Inventory) BusMemberships(ctx context.Context) (map[string]string, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select n.name, b.sealed from bus_membership b join node n on n.id = b.node`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]string{}
+	for rows.Next() {
+		var name, sealed string
+		if err := rows.Scan(&name, &sealed); err != nil {
+			return nil, err
+		}
+		out[name] = sealed
+	}
+	return out, rows.Err()
+}

internal/inventory/holdings_test.go

@@ -80,3 +80,20 @@ func TestUnassigningTheHolderTakesTheHoldingWithIt(t *testing.T) {
 		t.Fatalf("the holding outlived the assignment it pointed at: %+v", held)
 	}
 }
+
+func TestAMachinesMembershipIsOneRowReplacedAndGoesWithTheMachine(t *testing.T) {
+	inv, ctx := twoBrokersOnTwoNodes(t)
+	if err := inv.PutBusMembership(ctx, "anchor", "first"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.PutBusMembership(ctx, "anchor", "second"); err != nil {
+		t.Fatal(err)
+	}
+	got, err := inv.BusMemberships(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["anchor"] != "second" || len(got) != 1 {
+		t.Fatalf("a re-told membership did not replace the first: %v", got)
+	}
+}

internal/inventory/migrations/0040-the-broker-seat-delivers-the-bus.sql

@@ -0,0 +1,12 @@
+-- The bus seat's holder answers for the mesh's bus, not for a wire protocol (novox/hq ADR 0131).
+--
+-- The row said `amqp`, which is the protocol the old broker spoke, and so only that broker could hold
+-- the seat that names the mesh's bus — while the module that will carry the bus could not. The seat
+-- delivers `mesh-bus`; whichever module provides that may hold it, and today that is one module.
+--
+-- Safe under the current holder: the control plane composes its own bus address through the seat by
+-- name, and the overview derives holders by name. Only registration and provision-to-seat resolution
+-- read this column. So the row changes, the current holder keeps holding by derivation, the next one
+-- can register its claim, and the handover (0039) moves the seat when both are running. What must
+-- not happen in between is re-registering the current holder — registration would now refuse it.
+update seat set delivers = 'mesh-bus' where name = 'mesh-broker' and delivers = 'amqp';

internal/inventory/migrations/0041-a-machine-is-told-its-membership-for-the-new-bus.sql

@@ -0,0 +1,11 @@
+-- A machine already enrolled is moved to the new bus by being told its membership for it
+-- (novox/hq design 28, task 5.2). Until this, a membership — bus address, fingerprint, password,
+-- transport — existed only in the enrolment reply, and nothing could hand one to a machine that
+-- had already joined. The row is the membership sealed to that machine, composed into its
+-- declaration as a file it reads after applying; the plaintext exists once, at minting, and then
+-- only on the machine. One per node: the mesh moves to one bus.
+create table bus_membership (
+  node   uuid        primary key references node(id) on delete cascade,
+  sealed text        not null,
+  since  timestamptz not null default now()
+);

module.json

@@ -23,7 +23,8 @@
     "licences": "/var/lib/mesh/mesh-controller/licences",
     "broker": "/var/lib/mesh/mesh-controller/broker",
     "broker-management": "/var/lib/mesh/mesh-controller/broker-management",
-    "broker-address": "/var/lib/mesh/mesh-controller/broker-address"
+    "broker-address": "/var/lib/mesh/mesh-controller/broker-address",
+    "bus": "/var/lib/mesh/mesh-controller/bus"
   },
   "secrets-owner": "65534:65534",
   "resources": [
@@ -46,15 +47,14 @@
         "MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
         "MESH_STORE_IDENTITY_FILE": "/run/secrets/identity",
         "MESH_STORE_LICENCES_FILE": "/run/secrets/licences",
-        "MESH_BROKER_AMQP_FILE": "/run/secrets/broker",
         "MESH_BROKER_MANAGEMENT_FILE": "/run/secrets/broker-management",
         "MESH_BROKER_ADDRESS_FILE": "/run/secrets/broker-address",
         "MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}",
         "MESH_STORE_IDENTITY_PORT": "${seat:mesh-store:5432}",
         "MESH_STORE_LICENCES_PORT": "${seat:mesh-store:5432}",
-        "MESH_BROKER_AMQP_PORT": "${seat:mesh-broker:5672}",
         "MESH_BROKER_MANAGEMENT_PORT": "${seat:mesh-broker:15672}",
-        "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}"
+        "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}",
+        "MESH_BUS_NATS_FILE": "/run/secrets/bus"
       },
       "volumes": [
         "/var/lib/mesh-broker-tls:/broker-tls:ro",