Establish the repo for the completed Phase 0-3 build

Settles the design repository now that the self-upgrade build is on main:
- Records the two decisions that shipped without a record — ADR 0077 (the
  controller/foundation/node vocabulary) and ADR 0078 (the store and broker are
  ordinary modules); accepts ADR 0075 and 0076, which shipped work rests on.
- Fills issue 051's amended-design and wires ADR 0078 into 07-the-foundation.
- Sweeps the repo rename (mesh-control -> mesh-controller) into the mutable docs
  now that the forge repo is renamed; updates the glossary note and repos.md.
- Fixes the six broken links from the design-doc renames, indexes the glossary,
  regenerates the decisions reading order.

Both checks (records.py, index.py) are green. Statuses stay honest: the build is
on main and lab-proven but not deployed as the production mesh, so the to-be docs
remain in-progress and the as-is layer (the hal mesh) is unchanged — graduation
to implemented + as-is belongs to deployment, not merge.

https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

00-META/README.md

@@ -9,6 +9,7 @@ works — plus the engineering practice that holds across everything Novox build
 | [`context.md`](context.md) | The environment — conditions, not aspirations |
 | [`effect.md`](effect.md) | What is different when the work is done |
 | [`how-we-build.md`](how-we-build.md) | The rules that hold across the mesh, each one earned. **The source of the mesh constitution** — the governed page the mesh injects into design sessions is derived from it. |
+| [`glossary.md`](glossary.md) | One name per thing — the authority on vocabulary, and the words that were retired |
 | [`repos.md`](repos.md) | Where implementation lives, and what each repository owns |
 | [`process/`](process/) | The playbooks — how work moves through this repository, for engineers and agents alike |
 

00-META/checks/records.py

@@ -293,7 +293,7 @@ def check_status_against_code(failures):
 
     Deliberately weak, and that is the point of it being mechanical. It cannot tell whether the
     prose is true, only that a document has stopped claiming to be unbuilt once it points at
-    something. `code: [mesh-control]` — a repository with no path — is a plan and stays
+    something. `code: [mesh-controller]` — a repository with no path — is a plan and stays
     `designed`.
     """
     for path in markdown_files():

00-META/glossary.md

@@ -23,7 +23,7 @@ another — and a mesh you cannot name precisely is a mesh two people describe d
   control-plane/data-plane, and opaque here).
 - **mesh-controller** — the module that runs the controller. It **claims** the `the-controller`
   seat at mesh scope, which is what makes it singular. Replaces the module name **`mesh-control`**.
-  (The git repository is still named `mesh-control` until it is renamed on the forge; the module,
+  (The git repository has been renamed `mesh-control` -> `mesh-controller` on the forge; the module,
   container and image it produces are `mesh-controller`.)
 - **foundation** — the store and the broker, raised at genesis before any module system exists.
   Replaces **"substrate"** (a biology metaphor that landed for no one). The foundation is not a

00-META/process/06-writing-a-module.md

@@ -58,7 +58,7 @@ Three questions, answered from the machine:
    A **provisioner** is the exception: it reads a password file, so it mounts the `.secret`
    directly.
 
-   Every example module in `mesh-control` had this wrong and shipped: `own-secrets` pointing at a
+   Every example module in `mesh-controller` had this wrong and shipped: `own-secrets` pointing at a
    path *named* `.env`, mounted as `env-file`, holding a bare password. Docker reads that as a
    malformed line and the container starts **with no password set at all** — not a failure to
    start, a service running on the wrong credential. They parsed and they resolved. Two tests in

00-META/process/07-feature-branches.md

@@ -1,7 +1,7 @@
 # Playbook 07 — Feature branches across repos
 
 **Trigger.** Work that changes code — in one code repo or in several at once (`mesh-sdk`,
-`mesh-control`, `mesh-catalog`, `mesh-host`, `mesh-lab`, and `hq` when a decision rides along).
+`mesh-controller`, `mesh-catalog`, `mesh-host`, `mesh-lab`, and `hq` when a decision rides along).
 
 **Who runs it.** Anyone who writes code, engineers and agents alike. Agents follow it exactly —
 it is the guard against the failure it was written for.

00-META/repos.md

@@ -21,15 +21,17 @@ and a forge address is an operational detail (see [`README`](../README.md)).
 ## What the mesh becomes
 
 [ADR 0019](../02-DECISIONS/0019-how-this-repository-works.md) records the repositories the
-monorepo decomposes into. **`mesh-lab`, `mesh-host` and `mesh-control` exist so far** — the lab is built first
-([ADR 0016](../02-DECISIONS/0016-the-lab.md)); the rest are the
-target, not the present.
+monorepo decomposes into. **`mesh-host`, `mesh-controller`, `mesh-catalog`, `mesh-lab`, `mesh-sdk` and `mesh-tools` exist
+so far** — the lab was built first ([ADR 0016](../02-DECISIONS/0016-the-lab.md)). The tiered
+decomposition below is the planned shape; the repositories built to date do not map onto it
+one-for-one — `mesh-catalog`, `mesh-sdk` and `mesh-tools` exist where the table names
+`mesh-foundation` and `mesh-surfaces`, and reconciling the two is itself still ahead.
 
 | Repository | Tier | Holds |
 |---|---|---|
 | `mesh-host` | 0 | **exists.** The node host — one statically linked binary, requiring nothing present ([ADR 0005](../02-DECISIONS/0005-the-node-host.md)) |
 | `mesh-foundation` | 1 | the four pinned services, as declarations |
-| `mesh-control` | 2 | **exists.** The controller and its contexts — one of seven built ([ADR 0006](../02-DECISIONS/0006-the-substrate-and-the-control-plane.md)) |
+| `mesh-controller` | 2 | **exists.** The controller and its contexts — one of seven built ([ADR 0006](../02-DECISIONS/0006-the-substrate-and-the-control-plane.md)) |
 | `mesh-surfaces` | 3 | tools, web, cli |
 | `mesh-sdk` | — | the stable spine modules build against — the tool-serving harness, the messaging/event framework, the contracts and core primitives. Holds nothing per-module and nothing volatile ([ADR 0039](../02-DECISIONS/0039-what-the-sdk-holds-and-refuses.md)). |
 | `mesh-lab` | — | **exists.** The lab — scenario lifecycle, networking, placement. Ships to nobody; runs on a workstation. |