Establish the repo for the completed Phase 0-3 build

Settles the design repository now that the self-upgrade build is on main:
- Records the two decisions that shipped without a record — ADR 0077 (the
  controller/foundation/node vocabulary) and ADR 0078 (the store and broker are
  ordinary modules); accepts ADR 0075 and 0076, which shipped work rests on.
- Fills issue 051's amended-design and wires ADR 0078 into 07-the-foundation.
- Sweeps the repo rename (mesh-control -> mesh-controller) into the mutable docs
  now that the forge repo is renamed; updates the glossary note and repos.md.
- Fixes the six broken links from the design-doc renames, indexes the glossary,
  regenerates the decisions reading order.

Both checks (records.py, index.py) are green. Statuses stay honest: the build is
on main and lab-proven but not deployed as the production mesh, so the to-be docs
remain in-progress and the as-is layer (the hal mesh) is unchanged — graduation
to implemented + as-is belongs to deployment, not merge.

https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

03-DESIGN/01-to-be/06-the-controller.md

@@ -2,7 +2,7 @@
 layer: to-be
 status: in-progress
 code:
-  - mesh-control
+  - mesh-controller
 updated: 2026-08-31
 decisions:
   - 02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md

03-DESIGN/01-to-be/07-the-foundation.md

@@ -4,10 +4,15 @@ status: in-progress
 code:
   - mesh-host examples/foundation-first-node.lock
   - mesh-host internal/apply
+  - mesh-host internal/bootstrap/phase3.go
+  - mesh-catalog modules/postgres
+  - mesh-catalog modules/lavinmq
   - mesh-lab test/integration/mesh.test.ts (a bare machine becomes a mesh)
-updated: 2026-08-31
+updated: 2026-09-16
 decisions:
   - 02-DECISIONS/0004-a-node-and-how-it-joins.md
+  - 02-DECISIONS/0078-the-store-and-broker-are-modules.md
+  - 02-DECISIONS/0077-the-controller-and-the-foundation.md
   - 02-DECISIONS/0005-the-node-host.md
   - 02-DECISIONS/0006-the-substrate-and-the-control-plane.md
   - 02-DECISIONS/0007-connectivity.md

03-DESIGN/01-to-be/08-connectivity.md

@@ -2,9 +2,9 @@
 layer: to-be
 status: in-progress
 code:
-  - mesh-control internal/catalogue/filtering.go
-  - mesh-control examples/route-proxy
-  - mesh-control internal/identity/authority.go
+  - mesh-controller internal/catalogue/filtering.go
+  - mesh-controller examples/route-proxy
+  - mesh-controller internal/identity/authority.go
   - mesh-host internal/identity/serving.go
   - mesh-host internal/apply (the service that reflects a rule set)
 updated: 2026-09-09

03-DESIGN/01-to-be/09-the-node-lifecycle.md

@@ -6,8 +6,8 @@ code:
   - mesh-host internal/link/enrol.go
   - mesh-host packaging/nox-mesh-host-resume.service
   - mesh-host packaging/nox-mesh-host-network.sh
-  - mesh-control internal/token
-  - mesh-control internal/inventory/nodes.go
+  - mesh-controller internal/token
+  - mesh-controller internal/inventory/nodes.go
 updated: 2026-08-31
 decisions:
   - 02-DECISIONS/0004-a-node-and-how-it-joins.md
@@ -223,7 +223,7 @@ The same path, with the mesh built in the middle of it.
 nox-mesh-host reconcile
 
 # 2 — the controller now exists, and issues the first token
-mesh-control token issue
+mesh-controller token issue
 
 # 3 — the machine joins the mesh it just raised
 nox-mesh-host enrol --token <token>
@@ -548,8 +548,8 @@ rather than left to be worked out.
 **A token is issued *for* a node record**, and that is where a re-enrolment is decided.
 
 ```
-mesh-control token issue --node workstation   # this machine is that node again
-mesh-control token issue --new                # a machine the mesh has not seen
+mesh-controller token issue --node workstation   # this machine is that node again
+mesh-controller token issue --new                # a machine the mesh has not seen
 ```
 
 The host does not need to know which it is. It presents a token and receives an identity; what
@@ -629,7 +629,7 @@ keeps cataloguing.
 
 ### Where the enrolment token comes from
 
-**`mesh-control token issue` prints it once**, to the person running it. Single-use, and it
+**`mesh-controller token issue` prints it once**, to the person running it. Single-use, and it
 expires whether used or not ([ADR 0004](../../02-DECISIONS/0004-a-node-and-how-it-joins.md)).
 
 It is carried by hand — read off a screen, pasted into a terminal. That is the design rather than

03-DESIGN/01-to-be/10-delivery.md

@@ -2,9 +2,9 @@
 layer: to-be
 status: in-progress
 code:
-  - mesh-control internal/builder
-  - mesh-control cmd/mesh-control (build, build --behind, push, status)
-  - mesh-control internal/inventory/builds.go
+  - mesh-controller internal/builder
+  - mesh-controller cmd/mesh-controller (build, build --behind, push, status)
+  - mesh-controller internal/inventory/builds.go
 updated: 2026-08-31
 decisions:
   - 02-DECISIONS/0010-delivery.md

03-DESIGN/01-to-be/11-a-board.md

@@ -2,8 +2,8 @@
 layer: to-be
 status: in-progress
 code:
-  - mesh-control cmd/mesh-control/board.go
-  - mesh-control cmd/mesh-control/readable.go
+  - mesh-controller cmd/mesh-controller/board.go
+  - mesh-controller cmd/mesh-controller/readable.go
 updated: 2026-08-31
 decisions:
   - 02-DECISIONS/0008-a-context-owns-its-store.md

03-DESIGN/01-to-be/12-a-module-repository.md

@@ -3,10 +3,10 @@ layer: to-be
 status: in-progress
 code:
   - mesh-catalog modules/builder
-  - mesh-control internal/builder
-  - mesh-control internal/catalogue/build.go
-  - mesh-control internal/inventory/secrets.go
-  - mesh-control cmd/mesh-builder
+  - mesh-controller internal/builder
+  - mesh-controller internal/catalogue/build.go
+  - mesh-controller internal/inventory/secrets.go
+  - mesh-controller cmd/mesh-builder
 updated: 2026-09-12
 decisions:
   - 02-DECISIONS/0069-a-module-is-a-repository-and-a-path.md

03-DESIGN/01-to-be/13-credentials-and-their-rotation.md

@@ -2,9 +2,9 @@
 layer: to-be
 status: in-progress
 code:
-  - mesh-control internal/inventory/secrets.go
-  - mesh-control cmd/mesh-control/rotate.go
-  - mesh-control examples/postgres-provisioner
+  - mesh-controller internal/inventory/secrets.go
+  - mesh-controller cmd/mesh-controller/rotate.go
+  - mesh-controller examples/postgres-provisioner
 updated: 2026-09-01
 decisions:
   - 02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md

03-DESIGN/01-to-be/14-model-access.md

@@ -2,8 +2,8 @@
 layer: to-be
 status: in-progress
 code:
-  - mesh-control internal/licences
-  - mesh-control cmd/mesh-control/licence.go
+  - mesh-controller internal/licences
+  - mesh-controller cmd/mesh-controller/licence.go
 updated: 2026-09-05
 decisions:
   - 02-DECISIONS/0024-model-access-is-a-provision.md

03-DESIGN/01-to-be/15-the-agent-session.md

@@ -1,7 +1,7 @@
 ---
 layer: to-be
 status: designed
-code: [mesh-control, mesh-host]
+code: [mesh-controller, mesh-host]
 updated: 2026-08-31
 decisions:
   - 02-DECISIONS/0004-a-node-and-how-it-joins.md

03-DESIGN/01-to-be/18-building-a-module.md

@@ -2,8 +2,8 @@
 layer: to-be
 status: proposed
 code:
-  - mesh-control cmd/mesh-builder
-  - mesh-control internal/builder
+  - mesh-controller cmd/mesh-builder
+  - mesh-controller internal/builder
   - mesh-catalog modules/builder
 updated: 2026-09-15
 decisions:

03-DESIGN/01-to-be/19-the-module-protocol.md

@@ -4,7 +4,7 @@ status: proposed
 code:
   - mesh-sdk src
   - mesh-tools src/broker-amqp.ts
-  - mesh-control internal/link
+  - mesh-controller internal/link
 updated: 2026-09-15
 decisions:
   - 02-DECISIONS/0074-the-wire-is-specified-not-the-types.md

03-DESIGN/01-to-be/20-writing-a-module.md

@@ -3,7 +3,7 @@ layer: to-be
 status: proposed
 code:
   - mesh-catalog modules/showcase
-  - mesh-control internal/builder
+  - mesh-controller internal/builder
   - mesh-sdk src
 updated: 2026-09-15
 decisions:

03-DESIGN/01-to-be/21-the-installation-in-full.md

@@ -131,7 +131,7 @@ two.
 |---|---|---|---|
 | 1 | `postgres` | `postgres-database` | **the controller's own records and every module's.** One server, not two |
 | 2 | `lavinmq` | `amqp` | the broker every node dials, and what modules are granted vhosts on |
-| 3 | `mesh-control` | *claims* `the-controller` | decides what runs where |
+| 3 | `mesh-controller` | *claims* `the-controller` | decides what runs where |
 | 4 | `distribution` | `artifact-store` | what the mesh built, pinned by digest — the module is the software (Distribution), the provision is the job |
 | 5 | `builder` | — | turns source into artifacts |
 | 6 | `mesh-tools` | build inputs | the base everything with code compiles against. **Runs nowhere** |