Order the records the way the system is learned

Jochen asked whether the order made sense. It did not -- it followed when
things happened to be decided, which after consolidation is fictional anyway
since record 5 alone folds decisions taken across a week.

Concretely wrong before: the domain statement sat at 8, after five engineering
rules; the constitution was scattered across 5, 12 and 17; the tiers landed at
15, 16, 21 and 22 with process records in between.

Now it walks: what the mesh is (1-3), its tiers from the bottom up (4-8), what
runs on them and how it gets there (9-10), how it is built (11-16), how it is
checked (17-18), how we work (19-23).

Two things made this safe rather than free. It is a permutation, not a
compaction, so the renames go through temporary names -- otherwise two files
want one slot and one is lost. And the reference rewrite is a single
simultaneous pass, because almost every number moved into a slot another number
was vacating; replacing one at a time would have cascaded and pointed things at
the wrong record while still resolving.

Verified: 284 [ADR NNNN](path) links across the repository, all with matching
text and target.

The ordering principle is now stated in 19 rather than left implicit -- the
repository already said "the numbering is the flow" about its folders, and
there was no reason for the records to be the exception.

03-DESIGN/01-to-be/02-scenario-declaration.md

@@ -4,9 +4,9 @@ status: in-progress
 code: [mesh-lab]
 updated: 2026-08-25
 decisions:
-  - 02-DECISIONS/0009-the-lab.md
-  - 02-DECISIONS/0009-the-lab.md
-  - 02-DECISIONS/0009-the-lab.md
+  - 02-DECISIONS/0016-the-lab.md
+  - 02-DECISIONS/0016-the-lab.md
+  - 02-DECISIONS/0016-the-lab.md
 ---
 
 # The scenario declaration
@@ -15,7 +15,7 @@ A scenario is a **declaration of an underlay**, plus what to put on it. It is th
 everything in the lab hangs off, so it is worth getting small.
 
 It states what a hosting provider and a home router would provide, and nothing the mesh is
-responsible for ([ADR 0009](../../02-DECISIONS/0009-the-lab.md)).
+responsible for ([ADR 0016](../../02-DECISIONS/0016-the-lab.md)).
 
 ## Public networks are unrelated, and routed rather than bridged
 
@@ -87,7 +87,7 @@ Four consequences follow, and every one of them shapes this design:
    address stop corresponding.
 
 This is why the mesh dials outward and never inward
-([ADR 0001](../../02-DECISIONS/0001-nodes-communicate-over-a-broker.md)), why a hub exists at
+([ADR 0002](../../02-DECISIONS/0002-nodes-communicate-over-a-broker.md)), why a hub exists at
 all, and why a node's endpoint is something a peer **learns** from arriving packets rather than
 something anyone configures.
 
@@ -258,7 +258,7 @@ otherwise explicit declaration, and it exists because NAT has to run somewhere.
 
 It is a **container, not a virtual machine** — a router is scenery rather than something under
 test, so the fidelity argument that makes a node a virtual machine does not reach it
-([ADR 0009](../../02-DECISIONS/0009-the-lab.md)). What a router must
+([ADR 0016](../../02-DECISIONS/0016-the-lab.md)). What a router must
 reproduce is kernel behaviour, and a container has the same kernel.
 
 **`machines[].at`** — segment and addresses, or a **list** of them for a machine on several
@@ -299,7 +299,7 @@ belongs to a router it does not control, and asleep.
 
 Whether the overlay survives that, re-forms, and is noticed to have changed endpoint is
 **observed**, never arranged
-([ADR 0009](../../02-DECISIONS/0009-the-lab.md)).
+([ADR 0016](../../02-DECISIONS/0016-the-lab.md)).
 
 ## Why the addresses are load-bearing
 
@@ -320,13 +320,13 @@ it must be.
 The format should make getting this wrong hard rather than merely documented: a segment without
 a `gateway:` is a public segment, and an address in it — including a gateway's `address:` — that
 is not documentation space is a declaration error, refused before anything is raised. That is
-[ADR 0023](../../02-DECISIONS/0023-delivery.md) applied to a configuration
+[ADR 0010](../../02-DECISIONS/0010-delivery.md) applied to a configuration
 file: the failure it prevents is silent, so the check has to be loud.
 
 ## The same declaration serves both classes
 
 The bootstrap and full scenarios differ **only in `place:`**
-([ADR 0009](../../02-DECISIONS/0009-the-lab.md)). Everything
+([ADR 0016](../../02-DECISIONS/0016-the-lab.md)). Everything
 about the underlay is identical, which is what makes one a strict subset of the other rather
 than a fork.
 
@@ -354,7 +354,7 @@ not first.
 ## What a scenario deliberately cannot say
 
 - **Overlay addresses, the hub, peer configuration.** Outcomes, not inputs
-  ([ADR 0009](../../02-DECISIONS/0009-the-lab.md)).
+  ([ADR 0016](../../02-DECISIONS/0016-the-lab.md)).
 - **What a machine is in mesh terms** — server or workstation, its site, its names. Mesh
   configuration, established by the mesh.
 - **A host's capability profile.** Detected, never declared.
@@ -543,7 +543,7 @@ cannot yet express.
 
 Nothing here mentions overlay addresses, which node is the hub, who peers with whom, any name,
 or any certificate. Research 004 recorded all of those for this topology, and **a scenario must
-not state them** ([ADR 0009](../../02-DECISIONS/0009-the-lab.md)): they
+not state them** ([ADR 0016](../../02-DECISIONS/0016-the-lab.md)): they
 are what the mesh does, and a scenario that supplied them would be certifying its own work.
 
 The absence is the point. Given the declaration above, whether a hub is elected, whether the