The mint names the bus by bare host, and can mint again

BareAddress adds a scheme where none was, so the host it yielded carried one and
every URL built from it carried two. Caught before a push: the host is now taken
with no scheme and no port, and every URL adds its own. `rollout mint --again`
mints every credential afresh for exactly this case — a mint that was wrong before
anything received it.

cmd/mesh-controller/rollout.go

@@ -33,14 +33,19 @@ import (
 // ability to change things, not the services its modules are serving — measured on 2026-09-27, when
 // a seat emptied mid-change and the control plane looped for two hours while every service stayed up.
 
-const rolloutUsage = "rollout check | rollout mint | rollout --confirm"
+const rolloutUsage = "rollout check | rollout mint [--again] | rollout --confirm"
 
 func rolloutCommand(ctx context.Context, args []string) error {
 	switch {
 	case len(args) == 1 && args[0] == "check":
 		return rolloutCheck(ctx)
 	case len(args) == 1 && args[0] == "mint":
-		return rolloutMint(ctx)
+		return rolloutMint(ctx, false)
+	case len(args) == 2 && args[0] == "mint" && args[1] == "--again":
+		// Every credential minted afresh, whether or not one exists — for a mint that was wrong
+		// before anything was pushed. Afterwards nothing that received the old one still works,
+		// which is fine exactly when nothing received it.
+		return rolloutMint(ctx, true)
 	case len(args) == 1 && args[0] == "--confirm":
 		return errors.New(
 			"the rollout itself is not built yet: `rollout check` answers whether it could run, and " +
@@ -205,7 +210,7 @@ func notReadyOf(state broker.Readiness) []string { return broker.NotReady(state)
 // why `rollout check` refuses until this has run. The bus's address is worked out here, from where
 // the module that provides it is assigned, rather than read from this process's environment: this
 // process is still on the old bus when this runs, and must be.
-func rolloutMint(ctx context.Context) error {
+func rolloutMint(ctx context.Context, again bool) error {
 	open, err := openStores(ctx)
 	if err != nil {
 		return err
@@ -243,11 +248,33 @@ func rolloutMint(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	if onNetwork[busNode] == "" {
+	busHost := onNetwork[busNode]
-		return fmt.Errorf("%s runs the new bus and has no address on the private network, so no machine "+
+	if busHost == "" {
-			"could be told where it is", busNode)
+		// **The hub is not in that map.** The machine that took over the tunnel is where the current
+		// bus already answers, and every machine dials it at the address the mesh handed them — so
+		// when the new bus runs on the same machine, that address is the one to tell them, with the
+		// new port. Found live: the control node is the hub, and the map lists the machines placed
+		// around it.
+		// The host alone: no scheme (BareAddress adds one where none was, which is the wrong
+		// direction here — every URL built below adds its own) and no port.
+		_, _, host := broker.CredentialIn(known.Address)
+		if host == "" {
+			host = known.Address
+		}
+		if _, after, hasScheme := strings.Cut(host, "://"); hasScheme {
+			host = after
+		}
+		host = strings.TrimSpace(host)
+		if i := strings.LastIndex(host, ":"); i > 0 && !strings.Contains(host[i:], "]") {
+			host = host[:i]
+		}
+		if host == "" {
+			return fmt.Errorf("%s runs the new bus and has no address on the private network, and the "+
+				"current bus's address is unknown too, so no machine could be told where it is", busNode)
+		}
+		busHost = host
 	}
-	busAddress := onNetwork[busNode] + ":4222"
+	busAddress := busHost + ":4222"
 
 	records, err := inv.BusRecords(ctx)
 	if err != nil {
@@ -273,7 +300,7 @@ func rolloutMint(ctx context.Context) error {
 
 	var machines, modules, skipped int
 	for _, p := range users {
-		if !wanted[p.Username()] {
+		if !again && !wanted[p.Username()] {
 			continue
 		}
 		switch p.Kind {