The token says what the mesh calls this machine

Found by raising a mesh end to end for the first time. Enrolment's own
help says the token "is the only thing it needs", and it also needed
--name, with no default. Without it the failure is:

  cannot reach the broker at 192.0.2.10:5671 as : username or password
  not allowed

An empty username, and nothing about the cause.

The node cannot work its own name out. The broker account it
authenticates as is named after it and exists before this machine has
been told anything, so the name has to arrive with the rest. It is not a
secret and the issuer already knows it.

--name stays, as an override for a token issued before the name
travelled in one, and says so when it is needed rather than failing at
the broker.

Also corrects the bundle example, which claimed to stop before the
control plane runs and has raised one for some time. A comment about what
something does not do is a comment nobody updates.

cmd/mesh-host/main.go

@@ -108,7 +108,7 @@ func parseArgs(args []string) (string, options, error) {
 	set.StringVar(&opts.state, "state", opts.state, "where this node keeps what it knows")
 	set.BoolVar(&opts.dryRun, "dry-run", false, "read and check the declaration, change nothing")
 	set.StringVar(&opts.token, "token", "", "enrol: the one-time token, carried here by a person")
-	set.StringVar(&opts.nodeName, "name", "", "enrol: what this machine is called in the mesh")
+	set.StringVar(&opts.nodeName, "name", "", "enrol: override the name the token carries")
 
 	// Parsed in a loop, because the standard library stops at the FIRST non-flag argument.
 	// `mesh-host inventory --json` hit that once, and taking the subcommand off the front
@@ -405,6 +405,19 @@ func enrol(ctx context.Context, opts options) error {
 		return err
 	}
 
+	// The name comes from the token, because the node cannot work it out: the broker account it
+	// authenticates as is named after it, and that account exists before this machine has been
+	// told anything. --name remains for a token issued before the name travelled in one, and
+	// saying so beats a connection refused with an empty username — which is what this was.
+	if strings.TrimSpace(*name) == "" {
+		*name = token.Node
+	}
+	if strings.TrimSpace(*name) == "" {
+		return errors.New(
+			"this token does not say what the mesh calls this machine, and no --name was given. " +
+				"A token issued by a current control plane carries the name")
+	}
+
 	// Before anything else: an already-enrolled machine must not quietly acquire a second
 	// identity. The mesh believes the first one, and re-enrolling is a deliberate act that
 	// starts with a person issuing a new token for that node record.