011: the provider shape generalises, and two things differ inside it

The broker has all nine properties the store has. So do the object store and the
image registry. A substrate service is a SERVICE PLUS A FACTORY, there are four
of them, and the pattern generalises past the substrate: anything granting
something per consumer has this shape.

Two differences matter more than the similarity.

The broker cannot be managed over the broker. ADR 0001 makes it the channel
every node takes work from and ADR 0039 makes it the security boundary, so the
module providing it is also the way modules are managed — a declaration cannot
be delivered to it over itself. Nothing else has that property; the store is
consumed by the control plane but is not how the control plane REACHES anything.
This is what the carried bundle exists for: the broker is raised from what the
host carries because there is no other way to raise it. A constraint on one
module, not a general rule, and a schema with no way to say so hides it.

And two modules of identical shape want opposite instance counts. The broker is
one per mesh by decision. The store cannot be, because a node that must keep
working while disconnected cannot depend on a database elsewhere. Which settles
what cases.md left open: how many instances is NOT derivable from what a module
is. It is a per-module decision, it has to be declared, and nothing in provides,
requires or excludes says it.

Revocation differs in consequence too. Dropping a database leaves data until
something removes it — a leak, recoverable. Dropping a virtual host loses
whatever was undelivered — silent, and not. Same relation, different blast
radius, which argues for the provider deciding what revocation means rather than
the mesh applying one rule.

File renamed: it was never really about postgres.

01-RESEARCH/011-the-module-graph/proposal.md

@@ -1,6 +1,6 @@
 # One kind of edge
 
-> **Superseded in part by [`worked-postgres.md`](worked-postgres.md).** Working postgres through
+> **Superseded in part by [`worked-provider.md`](worked-provider.md).** Working postgres through
 > completely shows there are **two** kinds of edge, not one: *presence* — the thing exists and is
 > reachable, nothing created — and *instantiation* — the provider is asked to make something for
 > this consumer and hands back credentials. Instantiation implies presence; presence does not