Only CONSUMER.INFO was missing from a machine's grants; the rest was already there

Binding to a consumer asks the server about it and hears the answer on the
client's inbox; hearing a declaration acknowledges it. A machine's user was granted
none of that and was refused the first time one dialled a permissioned server:
"this node cannot read its declarations". Its inbox is its own prefix, which the
host now sets.

cmd/mesh-controller/network.go

@@ -537,6 +537,15 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 	if err != nil {
 		return nil, err
 	}
+	// **With the seat holders on record**, or a machine running the next holder of a seat beside
+	// the current one resolves as two holders, is refused, and drops out of the map — taking the
+	// address every other machine composes for what it offers (novox/hq ADR 0131). Found live:
+	// the control node vanished from the private network the moment the new bus was assigned
+	// beside the old one.
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		return nil, err
+	}
 	var out []inventory.Overlay
 	for _, p := range places {
 		if p.Address == "" {
@@ -549,7 +558,7 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 		caps, _ := inv.ProfileOf(ctx, p.Name)
 		got, err := catalogue.Resolve(shelf, assigned,
 			catalogue.Node{Name: p.Name, Site: p.Site, Capabilities: caps},
-			catalogue.World{Unchecked: true})
+			catalogue.World{Unchecked: true, Holdings: holdings})
 		if err != nil {
 			continue
 		}

cmd/mesh-controller/rollout.go

@@ -33,14 +33,19 @@ import (
 // ability to change things, not the services its modules are serving — measured on 2026-09-27, when
 // a seat emptied mid-change and the control plane looped for two hours while every service stayed up.
 
-const rolloutUsage = "rollout check | rollout mint | rollout --confirm"
+const rolloutUsage = "rollout check | rollout mint [--again] | rollout --confirm"
 
 func rolloutCommand(ctx context.Context, args []string) error {
 	switch {
 	case len(args) == 1 && args[0] == "check":
 		return rolloutCheck(ctx)
 	case len(args) == 1 && args[0] == "mint":
-		return rolloutMint(ctx)
+		return rolloutMint(ctx, false)
+	case len(args) == 2 && args[0] == "mint" && args[1] == "--again":
+		// Every credential minted afresh, whether or not one exists — for a mint that was wrong
+		// before anything was pushed. Afterwards nothing that received the old one still works,
+		// which is fine exactly when nothing received it.
+		return rolloutMint(ctx, true)
 	case len(args) == 1 && args[0] == "--confirm":
 		return errors.New(
 			"the rollout itself is not built yet: `rollout check` answers whether it could run, and " +
@@ -205,7 +210,7 @@ func notReadyOf(state broker.Readiness) []string { return broker.NotReady(state)
 // why `rollout check` refuses until this has run. The bus's address is worked out here, from where
 // the module that provides it is assigned, rather than read from this process's environment: this
 // process is still on the old bus when this runs, and must be.
-func rolloutMint(ctx context.Context) error {
+func rolloutMint(ctx context.Context, again bool) error {
 	open, err := openStores(ctx)
 	if err != nil {
 		return err
@@ -243,11 +248,33 @@ func rolloutMint(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	if onNetwork[busNode] == "" {
-		return fmt.Errorf("%s runs the new bus and has no address on the private network, so no machine "+
-			"could be told where it is", busNode)
+	busHost := onNetwork[busNode]
+	if busHost == "" {
+		// **The hub is not in that map.** The machine that took over the tunnel is where the current
+		// bus already answers, and every machine dials it at the address the mesh handed them — so
+		// when the new bus runs on the same machine, that address is the one to tell them, with the
+		// new port. Found live: the control node is the hub, and the map lists the machines placed
+		// around it.
+		// The host alone: no scheme (BareAddress adds one where none was, which is the wrong
+		// direction here — every URL built below adds its own) and no port.
+		_, _, host := broker.CredentialIn(known.Address)
+		if host == "" {
+			host = known.Address
+		}
+		if _, after, hasScheme := strings.Cut(host, "://"); hasScheme {
+			host = after
+		}
+		host = strings.TrimSpace(host)
+		if i := strings.LastIndex(host, ":"); i > 0 && !strings.Contains(host[i:], "]") {
+			host = host[:i]
+		}
+		if host == "" {
+			return fmt.Errorf("%s runs the new bus and has no address on the private network, and the "+
+				"current bus's address is unknown too, so no machine could be told where it is", busNode)
+		}
+		busHost = host
 	}
-	busAddress := onNetwork[busNode] + ":4222"
+	busAddress := busHost + ":4222"
 
 	records, err := inv.BusRecords(ctx)
 	if err != nil {
@@ -273,7 +300,7 @@ func rolloutMint(ctx context.Context) error {
 
 	var machines, modules, skipped int
 	for _, p := range users {
-		if !wanted[p.Username()] {
+		if !again && !wanted[p.Username()] {
 			continue
 		}
 		switch p.Kind {
@@ -313,6 +340,14 @@ func rolloutMint(ctx context.Context) error {
 			machines++
 
 		case broker.KindModule:
+			if p.Module == "mesh-controller" {
+				// The control plane is a module too, and its `broker` secret is the old bus's
+				// credential it is still using while this runs. Writing the new bus's blob there
+				// cut the mesh off from its own old bus mid-move (2026-09-28). Its new-bus credential
+				// is the controller principal's `bus` secret above; nothing else is needed here.
+				skipped++
+				continue
+			}
 			m, inShelf := shelf[p.Module]
 			if !inShelf {
 				skipped++

internal/broker/nats.go

@@ -244,7 +244,14 @@ func PermissionsFor(p Principal) (Permissions, error) {
 	case KindNode:
 		// A host publishes its own node's control traffic and subscribes its own declaration —
 		// and nothing of any other node's.
-		pub = []string{"mesh.control." + p.Node + ".>"}
+		// And binding to its consumer, which asks the server about it (CONSUMER.INFO) — the one
+		// thing the host does that nothing granted. Found the first time a machine dialled a
+		// permissioned server: "this node cannot read its declarations" (2026-09-28). The ack and
+		// the inbox are granted below with every principal's.
+		pub = []string{
+			"mesh.control." + p.Node + ".>",
+			"$JS.API.CONSUMER.INFO.NODES." + p.Node,
+		}
 		sub = []string{"mesh.node." + p.Node + ".declare"}
 
 	case KindModule:

internal/broker/testdata/composed.conf

@@ -32,7 +32,7 @@ accounts {
         subscribe: { allow: ["_INBOX.enrol.one.>"] }
       } }
       { user: "node.one", password: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn", permissions: {
-        publish: { allow: ["$JS.ACK.NODES.one.>", "mesh.control.one.>"] }
+        publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.INFO.NODES.one", "mesh.control.one.>"] }
         subscribe: { allow: ["_INBOX.node.one.>", "mesh.node.one.declare"] }
       } }
       { user: "one.telegram", password: "$2a$11$tttttttttttttttttttttt", permissions: {

module.json

@@ -47,15 +47,14 @@
         "MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
         "MESH_STORE_IDENTITY_FILE": "/run/secrets/identity",
         "MESH_STORE_LICENCES_FILE": "/run/secrets/licences",
-        "MESH_BROKER_AMQP_FILE": "/run/secrets/broker",
         "MESH_BROKER_MANAGEMENT_FILE": "/run/secrets/broker-management",
         "MESH_BROKER_ADDRESS_FILE": "/run/secrets/broker-address",
         "MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}",
         "MESH_STORE_IDENTITY_PORT": "${seat:mesh-store:5432}",
         "MESH_STORE_LICENCES_PORT": "${seat:mesh-store:5432}",
-        "MESH_BROKER_AMQP_PORT": "${seat:mesh-broker:5672}",
         "MESH_BROKER_MANAGEMENT_PORT": "${seat:mesh-broker:15672}",
-        "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}"
+        "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}",
+        "MESH_BUS_NATS_FILE": "/run/secrets/bus"
       },
       "volumes": [
         "/var/lib/mesh-broker-tls:/broker-tls:ro",
@@ -63,6 +62,7 @@
         "/var/lib/mesh/mesh-controller/identity:/run/secrets/identity:ro",
         "/var/lib/mesh/mesh-controller/licences:/run/secrets/licences:ro",
         "/var/lib/mesh/mesh-controller/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mesh-controller/bus:/run/secrets/bus:ro",
         "/var/lib/mesh/mesh-controller/broker-management:/run/secrets/broker-management:ro",
         "/var/lib/mesh/mesh-controller/broker-address:/run/secrets/broker-address:ro"
       ],