What the console exposes, and how it is protected verifiedcriticalWritten by the Hub
The console can pause sending, rewrite messages, read message bodies and change every limit — and by default it is reachable from anywhere, unencrypted, behind a password it displays to whoever is already inside.
In detail
Three defaults compound here, and each is defensible alone. The panel binds to every address because that is convenient. It runs without TLS because a certificate is work. It shows the full configuration because an administrator should be able to read it. Together they mean: a public port, a password crossing the network in clear text on every login, and that same password printed on a screen behind the login. What sits behind that door is not read-only. From the console one can pause a customer's sending cluster-wide, force errors, suppress addresses, rewrite messages in flight, change every delivery limit, and read the content of live mail through the preview module. Hub does part of the work already: it generates a unique console password per node instead of the vendor's mailerq:mailerq, and stores it where the operator can find it. What it does not do is narrow the binding or issue a certificate — both of which it already knows how to do elsewhere. That is the gap this concept exists to name.