Order the records the way the system is learned

Jochen asked whether the order made sense. It did not -- it followed when
things happened to be decided, which after consolidation is fictional anyway
since record 5 alone folds decisions taken across a week.

Concretely wrong before: the domain statement sat at 8, after five engineering
rules; the constitution was scattered across 5, 12 and 17; the tiers landed at
15, 16, 21 and 22 with process records in between.

Now it walks: what the mesh is (1-3), its tiers from the bottom up (4-8), what
runs on them and how it gets there (9-10), how it is built (11-16), how it is
checked (17-18), how we work (19-23).

Two things made this safe rather than free. It is a permutation, not a
compaction, so the renames go through temporary names -- otherwise two files
want one slot and one is lost. And the reference rewrite is a single
simultaneous pass, because almost every number moved into a slot another number
was vacating; replacing one at a time would have cascaded and pointed things at
the wrong record while still resolving.

Verified: 284 [ADR NNNN](path) links across the repository, all with matching
text and target.

The ordering principle is now stated in 19 rather than left implicit -- the
repository already said "the numbering is the flow" about its folders, and
there was no reason for the records to be the exception.

03-DESIGN/01-to-be/04-lab-installation.md

@@ -4,15 +4,15 @@ status: designed
 code: [mesh-lab]
 updated: 2026-08-24
 decisions:
-  - 02-DECISIONS/0009-the-lab.md
-  - 02-DECISIONS/0023-delivery.md
+  - 02-DECISIONS/0016-the-lab.md
+  - 02-DECISIONS/0010-delivery.md
 ---
 
 # Installing the lab on a clean machine
 
 The lab has prerequisites — a virtualisation daemon, copy-on-write storage, a pool, an identity
 permitted to talk to it — and it cannot get them from the mesh, because it is where the mesh is
-built ([ADR 0009](../../02-DECISIONS/0009-the-lab.md)).
+built ([ADR 0016](../../02-DECISIONS/0016-the-lab.md)).
 
 So the lab needs an install path of its own. This describes it, and the shape it has to take is
 determined by two failures observed while measuring
@@ -55,7 +55,7 @@ and unbounded at worst.
 
 **The lab refuses to run degraded.** It does not warn and continue: a warning about a slow inner
 loop is read once and ignored forever, and the loop stays slow. This is
-[ADR 0023](../../02-DECISIONS/0023-delivery.md) applied where the failure is
+[ADR 0010](../../02-DECISIONS/0010-delivery.md) applied where the failure is
 performance rather than an error.
 
 ## Two ways the prerequisites arrive