Archived
The broker credential handed to a module named the genesis MESH_BROKER_ADDRESS — the broker's public endpoint. That is reachable from the control-node itself but not routed to another node, whose firewall admits only the overlay (from:mesh); a consumer on a joined node timed out fetching the broker's certificate and never connected. brokerReachableAt returns the broker's address as the given node can reach it: a node on the overlay gets the hub's `.internal` name (which every node resolves and the firewall admits, the fingerprint pin making the host swap safe for TLS); a node not yet on the overlay — at genesis, before any `overlay place`, when the builder's account is issued — keeps the genesis address, so bring-up is unchanged. Both credential paths (module issue and builder issue) use it. This is the reachability half of novox/hq issue 055. https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx