🚧 WIP

broker-control/control.py

@@ -125,23 +125,24 @@ def _broker_pid_alive() -> bool:
 
 
 def _post_broker_health() -> bool:
-    """Cheap post-signal health probe: subscribe to $SYS/broker/version."""
+    """Post-signal health probe: a real dynsec roundtrip as the admin user.
+
+    Uses mosquitto_ctrl rather than a $SYS subscription, because the 2.1
+    auto-generated admin role set is not guaranteed to include $SYS read
+    access — but it must always be able to administer dynamic security.
+    """
     username = os.environ.get("MOSQUITTO_DYNSEC_USERNAME", "admin")
     token_pw = os.environ.get("MOSQUITTO_DYNSEC_PASSWORD", "")
     cmd = [
-        "mosquitto_sub",
+        "mosquitto_ctrl",
         "-h",
         "127.0.0.1",
         "-u",
         username,
         "-P",
         token_pw,
-        "-t",
-        "$SYS/broker/version",
-        "-C",
-        "1",
-        "-W",
-        "3",
+        "dynsec",
+        "listClients",
     ]
     try:
         proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10)