The control plane is a module too, and its broker secret is the old bus's credential it is still using while the mint runs. Writing the new bus's blob there cut the mesh off from its own old bus mid-move. Its new-bus credential is the controller principal's bus secret; the module principal is skipped.