Seats held by assignments, one assignment per module per node, and 0113's bottom of the stack

Decided with the author:
- A seat is held by one assignment, not claimed by a definition. A definition says which seats a module
  can hold; an assignment says which it does. The store module can run on every node and one assignment
  holds mesh-store; moving a role changes an assignment, never a definition. The foundation's seats name
  what the mesh itself uses and route no consumer — database and amqp consumers use co-location, the
  holder included. This replaces the wrong rationale that the foundation's store is "provider to nobody",
  which contradicted ADR 0078 and to-be 21. 0079's one-postgres rule becomes one mesh-store holder.
- A module is assigned at most once to a node. The instance identity in 0112 and 27 is withdrawn, and the
  login-length problem with it.

Review fixes to 0113:
- The bottom of the stack: the vault is installed as soon as the shared runtime base exists, and genesis
  generates everything needed until then — including the permanent controller's, the control-node
  agent's, the builder's and the broker provisioner's bus accounts, and the controller's store login.
  Genesis creates those accounts until the broker's provisioner runs and adopts them.
- Genesis's values are delivered recorded as the mesh's own, so 0092's never-replace rule for operator
  values does not make them unrotatable.
- Backend-issued secrets (a forge's once-only API token) enter through the vault. Non-module parties
  (the controller's logins, node agents' accounts) are answered the same way, the controller asking on
  their behalf; an enrolment token reaches the controller only as what verifies it.
- A secret with no provisioner to apply it is marked not rotatable by the mesh and refused, instead of
  a restart reported as done. Unused password generators in six provider clients are removed, and a
  catalogue scan checks no module mints.
- Rotation's lock-out cases (offline reader, bus account owner, restarted provisioner) are recorded as
  open, with overlap and re-confirm-with-safeguards as the two answers, to be chosen before acceptance.

0110, 0111 and 26 are marked proposed: they changed in meaning and are under review, and an accepted
record must not rest on proposed ones. To-be 23 and the glossary are restored to main; they change when
these records are accepted.

03-DESIGN/01-to-be/23-choosing-a-provider.md

@@ -2,11 +2,10 @@
 layer: to-be
 status: designed
 code: []
-updated: 2026-09-25
+updated: 2026-09-20
 decisions:
   - 02-DECISIONS/0084-which-provider-serves-a-consumer.md
   - 02-DECISIONS/0027-a-provision-names-what-the-consumer-is-coupled-to.md
-  - 02-DECISIONS/0110-a-seat-is-a-module-assignment-from-a-closed-set.md
 ---
 
 # 23 — Choosing a provider
@@ -51,20 +50,9 @@ provider on a different node. That coupling is exactly what may not be guessed,
 names the provider. Naming it is also what makes a later move safe — the mesh knows the binding is
 to that provider and not to whichever one is nearest.
 
-**Some provisions have one provider for the whole mesh, and a seat names it.** Where a seat delivers
-the provision, its holder answers for it, **and co-location does not apply**: a second provider on the
-consumer's own machine does not take over for that consumer. That is not picking: the choice was made
-once, mesh-wide, by assigning the holder, rather than once per consumer by naming it
-([ADR 0110](../../02-DECISIONS/0110-a-seat-is-a-module-assignment-from-a-closed-set.md),
-[26 — The seats](26-the-seats.md)). A named provider still wins over the seat, because a consumer
-coupled to particular contents has said so, except for `secret`, which only the vault may provide.
-Only provisions the design makes one-per-mesh are delivered by a seat: the broker, the artifact store,
-a package registry, git and the vault. A database is not. Node-local stores, served by co-location,
-are the rule above.
-
 **Ambiguity is refused, never resolved by picking.** If several providers of a kind exist, none is
-named, none is co-located, and no seat delivers it, the requirement is unsatisfiable and is refused
-with the candidates shown — the same stance
+named, and none is co-located, the requirement is unsatisfiable and is refused with the candidates
+shown — the same stance
 [ADR 0027](../../02-DECISIONS/0027-a-provision-names-what-the-consumer-is-coupled-to.md) took
 against a confidently-wrong match, applied to the instance rather than the dialect. A wrong answer
 delivered quietly costs more than a refusal.