The control plane mounts the bus secret it reads

MESH_BUS_NATS_FILE named /run/secrets/bus and nothing put a file there: the
manifest binds each secret explicitly, and the switch added the secret and the
variable but not the bind. Found live — the control plane came up on the new bus
and could not read its own credential.

cmd/mesh-controller/network.go

@@ -537,6 +537,15 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 	if err != nil {
 		return nil, err
 	}
+	// **With the seat holders on record**, or a machine running the next holder of a seat beside
+	// the current one resolves as two holders, is refused, and drops out of the map — taking the
+	// address every other machine composes for what it offers (novox/hq ADR 0131). Found live:
+	// the control node vanished from the private network the moment the new bus was assigned
+	// beside the old one.
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		return nil, err
+	}
 	var out []inventory.Overlay
 	for _, p := range places {
 		if p.Address == "" {
@@ -549,7 +558,7 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 		caps, _ := inv.ProfileOf(ctx, p.Name)
 		got, err := catalogue.Resolve(shelf, assigned,
 			catalogue.Node{Name: p.Name, Site: p.Site, Capabilities: caps},
-			catalogue.World{Unchecked: true})
+			catalogue.World{Unchecked: true, Holdings: holdings})
 		if err != nil {
 			continue
 		}

module.json

@@ -47,15 +47,14 @@
         "MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
         "MESH_STORE_IDENTITY_FILE": "/run/secrets/identity",
         "MESH_STORE_LICENCES_FILE": "/run/secrets/licences",
-        "MESH_BROKER_AMQP_FILE": "/run/secrets/broker",
         "MESH_BROKER_MANAGEMENT_FILE": "/run/secrets/broker-management",
         "MESH_BROKER_ADDRESS_FILE": "/run/secrets/broker-address",
         "MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}",
         "MESH_STORE_IDENTITY_PORT": "${seat:mesh-store:5432}",
         "MESH_STORE_LICENCES_PORT": "${seat:mesh-store:5432}",
-        "MESH_BROKER_AMQP_PORT": "${seat:mesh-broker:5672}",
         "MESH_BROKER_MANAGEMENT_PORT": "${seat:mesh-broker:15672}",
-        "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}"
+        "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}",
+        "MESH_BUS_NATS_FILE": "/run/secrets/bus"
       },
       "volumes": [
         "/var/lib/mesh-broker-tls:/broker-tls:ro",
@@ -63,6 +62,7 @@
         "/var/lib/mesh/mesh-controller/identity:/run/secrets/identity:ro",
         "/var/lib/mesh/mesh-controller/licences:/run/secrets/licences:ro",
         "/var/lib/mesh/mesh-controller/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mesh-controller/bus:/run/secrets/bus:ro",
         "/var/lib/mesh/mesh-controller/broker-management:/run/secrets/broker-management:ro",
         "/var/lib/mesh/mesh-controller/broker-address:/run/secrets/broker-address:ro"
       ],