Order the records the way the system is learned

Jochen asked whether the order made sense. It did not -- it followed when things happened to be decided, which after consolidation is fictional anyway since record 5 alone folds decisions taken across a week. Concretely wrong before: the domain statement sat at 8, after five engineering rules; the constitution was scattered across 5, 12 and 17; the tiers landed at 15, 16, 21 and 22 with process records in between. Now it walks: what the mesh is (1-3), its tiers from the bottom up (4-8), what runs on them and how it gets there (9-10), how it is built (11-16), how it is checked (17-18), how we work (19-23). Two things made this safe rather than free. It is a permutation, not a compaction, so the renames go through temporary names -- otherwise two files want one slot and one is lost. And the reference rewrite is a single simultaneous pass, because almost every number moved into a slot another number was vacating; replacing one at a time would have cascaded and pointed things at the wrong record while still resolving. Verified: 284 [ADR NNNN](path) links across the repository, all with matching text and target. The ordering principle is now stated in 19 rather than left implicit -- the repository already said "the numbering is the flow" about its folders, and there was no reason for the records to be the exception.
2026-08-28 23:30:42 +02:00
parent e1febe8e0f
commit 333356cff3
85 changed files with 471 additions and 465 deletions
@@ -2,8 +2,8 @@
 status: active
 initiated: 2026-08-23
 touches:
-  - 02-DECISIONS/0008-mesh-brokers-nodes-host-agents-think.md
-  - 02-DECISIONS/0019-modules-and-the-graph.md
+  - 02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md
+  - 02-DECISIONS/0009-modules-and-the-graph.md
  - 03-DESIGN/00-as-is/00-overview.md
  - 03-DESIGN/01-to-be/00-work-breakdown.md
 became: []
@@ -24,9 +24,9 @@ disk, and where today's catalogue lands.
 ## Why

 Every structural decision so far has been a **correction**: eight contexts replacing thirty-three
-modules ([ADR 0008](../../02-DECISIONS/0008-mesh-brokers-nodes-host-agents-think.md)), domains
+modules ([ADR 0001](../../02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md)), domains
 replacing single-function modules
-([ADR 0019](../../02-DECISIONS/0019-modules-and-the-graph.md)). A
+([ADR 0009](../../02-DECISIONS/0009-modules-and-the-graph.md)). A
 correction inherits the frame of the thing it corrects, and two of the mesh's oldest problems
 look unsolvable from inside that frame:

@@ -68,7 +68,7 @@ against taste:
   circle, self-hosted. Personal cloud infrastructure.
 8. **Agents make it self-improving and self-healing.**
 9. It is **end-to-end testable on one machine**
-   ([ADR 0009](../../02-DECISIONS/0009-the-lab.md)).
+   ([ADR 0016](../../02-DECISIONS/0016-the-lab.md)).

 ## Status

@@ -76,7 +76,7 @@ A first skeleton exists, with four design moves that the current shape does not
 `active` because two of them are unproven and one contradicts a record that is already
 accepted.

-**Finding worth stating up front:** [ADR 0008](../../02-DECISIONS/0008-mesh-brokers-nodes-host-agents-think.md)
+**Finding worth stating up front:** [ADR 0001](../../02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md)
 names nine bounded contexts and **none of them owns connectivity** — no overlay, no resolution,
 no firewall, no ingress. Requirement 4 has no home in the accepted decomposition, while
 [research 005](../005-domain-grouping/analysis.md) found reachability to be the *only* part of
@@ -87,8 +87,8 @@ the catalogue where modules genuinely change together under one intent. The skel
 | Question | Why it is open |
 |---|---|
 | Does the record — the event log contexts integrate through — belong to the substrate or the control plane? | It is infrastructure by shape and domain by content. Placing it wrong reintroduces a circularity. |
-| One repository per tier, or per context? | Already open from ADR 0008 as "catalogue destination — one repository or many". The skeleton assumes per tier and does not settle it. |
-| ~~Does an unprivileged node earn a place in the inventory, or only a presence?~~ | **Answered 2026-08-25** by the operator: a node is a *managed machine inside the mesh*, not an unprivileged something — and a disconnected node is still a node, in a different situation. The question posed a class distinction; the answer is that there is none, and what varies is **state**. Recorded as [ADR 0015](../../02-DECISIONS/0015-a-node-and-how-it-joins.md). |
-| ~~Does absorbing overlay, filtering, packages, supervision and the container runtime make the host too large?~~ | **Answered 2026-08-25** — [`host-size.md`](host-size.md). Measured: the absorption is smaller than the machinery that already applies state, and eight of ten adapters already carry no dependency. The risk is not size but direction, and it is two modules wide. The claim survives with its scope corrected — the host carries one concern, *apply declared state on this machine*, of which the six are instances. Recorded as [ADR 0016](../../02-DECISIONS/0016-the-node-host.md), designed in [`05-the-node-host.md`](../../03-DESIGN/01-to-be/05-the-node-host.md). |
+| One repository per tier, or per context? | Already open from ADR 0001 as "catalogue destination — one repository or many". The skeleton assumes per tier and does not settle it. |
+| ~~Does an unprivileged node earn a place in the inventory, or only a presence?~~ | **Answered 2026-08-25** by the operator: a node is a *managed machine inside the mesh*, not an unprivileged something — and a disconnected node is still a node, in a different situation. The question posed a class distinction; the answer is that there is none, and what varies is **state**. Recorded as [ADR 0004](../../02-DECISIONS/0004-a-node-and-how-it-joins.md). |
+| ~~Does absorbing overlay, filtering, packages, supervision and the container runtime make the host too large?~~ | **Answered 2026-08-25** — [`host-size.md`](host-size.md). Measured: the absorption is smaller than the machinery that already applies state, and eight of ten adapters already carry no dependency. The risk is not size but direction, and it is two modules wide. The claim survives with its scope corrected — the host carries one concern, *apply declared state on this machine*, of which the six are instances. Recorded as [ADR 0005](../../02-DECISIONS/0005-the-node-host.md), designed in [`05-the-node-host.md`](../../03-DESIGN/01-to-be/05-the-node-host.md). |
 | ~~Four substrate services or five?~~ | **Answered conditionally**, which is the honest form — [`07-the-substrate.md`](../../03-DESIGN/01-to-be/07-the-substrate.md). The substrate is *what the control plane consumes and cannot grant itself*. The identity provider qualifies only if the control plane delegates authentication; if it authenticates natively it is an ordinary hosted service. The count follows from a decision not yet taken, and asserting four was asserting that decision. |
 | Does `feature` survive? | The skeleton splits it in two and argues the conflation is what makes the delivery pipeline hard to reason about. Unproven. |