A module's runtime waits for its broker credential and its account at a start, bounded, instead of exiting (issue 1496)

The node-engine starts a module's runtime before the provisioner's client fills
its broker file, and the bus carries a new account only after it reloads its
users. The runtime exited on both and was restarted until they were there (ace,
2026-10-26 21:19: mesh-build-node's and mesh-build-image's runtimes exited twice).
It now waits up to five minutes from its start, said once: the file is read again
each time its directory changes (the bundles' inotify watch, a 30 s backstop),
and an authorization refusal is asked again with the backoff. Past the bound it
gives up loudly; a file with no url, a pin mismatch and a bad URL stay final.

node-tools/internal/bus/bus.go

@@ -129,12 +129,19 @@ func Fatal(err error) string {
 		strings.Contains(msg, "nats: invalid url") {
 		return "the bus address is not a usable URL"
 	}
-	if regexp.MustCompile(`(?i)authorization violation|user authentication expired|permissions violation`).MatchString(msg) {
+	if Refused(err) || regexp.MustCompile(`(?i)user authentication expired|permissions violation`).MatchString(msg) {
 		return "the bus refused this account"
 	}
 	return ""
 }
 
+// Refused says whether the bus refused the account a connection named (an authorization violation): final for a running
+// runtime, but at a start possibly only "not yet", since the bus carries a new account after it reloads its users (issue
+// 1496). Fatal still names it; the caller decides how long a start waits.
+func Refused(err error) bool {
+	return err != nil && regexp.MustCompile(`(?i)authorization violation`).MatchString(err.Error())
+}
+
 func normalizeFingerprint(f string) string {
 	f = strings.TrimSpace(f)
 	if len(f) > 7 && strings.EqualFold(f[:7], "sha256:") {

node-tools/internal/runtime/watch.go

@@ -37,6 +37,14 @@ type bundleWatch struct {
 	done    chan struct{}
 }
 
+// WatchFile hears, as the bundles are heard, the directory of the file at path, or the nearest directory above it that
+// exists, and calls changed once at its start and once after each burst of changes there has settled: a runtime waiting
+// for its broker credential reads it again when the node-engine writes it, never on a clock (issue 1496). It answers its
+// stop.
+func WatchFile(path string, changed func(), logf func(string, ...any)) (func(), error) {
+	return watchBundles([]string{path}, changed, logf)
+}
+
 // watchBundles starts the watch of the entrypoints at paths. It answers its stop.
 func watchBundles(paths []string, changed func(), logf func(string, ...any)) (func(), error) {
 	fd, err := unix.InotifyInit1(unix.IN_CLOEXEC | unix.IN_NONBLOCK)