Adopt the glossary's vocabulary in the mutable design docs

"control plane" -> controller and "substrate" -> foundation throughout
03-DESIGN, 00-META and the README, with 06-the-control-plane.md and
07-the-substrate.md renamed to 06-the-controller.md and 07-the-foundation.md.
The immutable 02-DECISIONS records keep their original wording (and links to
them are unchanged) — a term retired here may still appear there, which the
glossary explains how to read.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

03-DESIGN/01-to-be/15-the-agent-session.md

@@ -22,7 +22,7 @@ so, and the differences are few enough to list here:
 | **context root** | the node's | the mesh's |
 | **engram** | that node's | the mesh's |
 | **licence** | bound in its own right | bound in its own right |
-| **runs on** | that node | the node holding the control plane |
+| **runs on** | that node | the node holding the controller |
 | **how many** | one per node | one |
 
 Everything below applies to both unless it says otherwise.
@@ -64,9 +64,9 @@ as it reports anything else.
 **A node's session runs on that node**, and cannot be moved. Moved, one machine is answering as
 another (ADR 0004).
 
-**The mesh's session runs on the node holding the control plane.** The reasoning is in ADR 0026
+**The mesh's session runs on the node holding the controller.** The reasoning is in ADR 0026
 and is worth carrying here because it is easy to get backwards: this is not *the important agent
-goes on the important machine*. It is that the control-plane node is already the one place
+goes on the important machine*. It is that the controller node is already the one place
 excepted from *compromise of a node is compromise of that node*, and an agent able to reach
 everything, placed anywhere else, would create a second such place.
 
@@ -102,7 +102,7 @@ machine*.
 
 That is not sufficient here, and the shortfall is concrete rather than theoretical:
 
-- the control-plane node hosts **two** sessions, which must be able to hold **different**
+- the controller node hosts **two** sessions, which must be able to hold **different**
   licences — a per-machine binding cannot express it at all;
 - *this node's session uses the personal licence, the mesh's uses the company one* is the ordinary
   case, not an exotic one.
@@ -125,7 +125,7 @@ session a different agent from another, and memory is part of what makes it *tha
 and it is not a view over theirs. What the mesh has been asked, and what it worked out, is held
 in the mesh's root — not in the root of the node that happens to host it.
 
-**That distinction is the point of putting it there.** The control-plane node runs two sessions
+**That distinction is the point of putting it there.** The controller node runs two sessions
 on one machine. If memory belonged to the machine rather than to the root, they would share it,
 and the mesh's recollection of a fortnight of questions would be indistinguishable from that
 node's own — which is the collision ADR 0026 exists to avoid, arriving through the back door.
@@ -188,7 +188,7 @@ here so the shape is not rediscovered.
 
 ## Consequences
 
-**Two sessions on one node, and no ambiguity.** The control-plane node hosts its own node session
+**Two sessions on one node, and no ambiguity.** The controller node hosts its own node session
 and the mesh session. ADR 0004's *one per node* forbids ambiguity about who answers when a **node**
 is addressed; these answer to different addresses.
 
@@ -207,7 +207,7 @@ and these run in the lab on real machines:
 | Check | Defends |
 |---|---|
 | a node is asked something and its session answers | ADR 0004 |
-| the mesh is asked something and the mesh session answers, on the control-plane node | ADR 0026 |
+| the mesh is asked something and the mesh session answers, on the controller node | ADR 0026 |
 | both sessions on that node answer, to their own addresses, without ambiguity | ADR 0026 |
 | a session switched off replies saying so, rather than timing out | ADR 0004 |
 | a session whose engram was changed reports having applied it, like any declared file | ADR 0005 |