Name the substrate's actual products

The design layer described every service by role and never once by name:
Postgres appeared in zero design documents. That was over-application of the
research rule "never identify the mesh it observed", which is about node names
and domains, not software.

Two things were actually broken by it. substrate.lock pins images by digest and
a digest belongs to a named image, so the bundle could not be written from the
design. And a reader could not tell a settled choice from an unexamined one --
"a relational store" reads identically either way.

ADR 0048 names them: PostgreSQL, LavinMQ, MinIO, an OCI registry, Docker. The
argument for each is continuity, which is a real argument -- replacing a
substrate service migrates the mesh's own state. Role and product are now both
written, because the design depends on the protocol while the installer needs
the product.

Also separates two questions the substrate doc had merged: being substrate and
being in the bundle. Only Postgres must precede the control plane; the rest are
substrate by role and ordinary by delivery. Whether the bus joins it is left
open, because it turns on the control plane's internal shape.

Names the forge as Gitea, and records ingress/Traefik as an unclosed gap rather
than a naming one -- nothing says what terminates TLS or which tier owns it.

Fixes a miscount: the host's bootstrap vocabulary is six shapes, not five.

03-DESIGN/01-to-be/06-the-control-plane.md

@@ -2,7 +2,7 @@
 layer: to-be
 status: designed
 code: []
-updated: 2026-08-26
+updated: 2026-08-27
 decisions:
   - 02-DECISIONS/0037-the-host-applies-it-does-not-decide.md
   - 02-DECISIONS/0030-the-repository-structure.md
@@ -71,15 +71,16 @@ in front of them.
   node except through the host.
 - **Not a surface.** Tier 3 is how people and agents reach it. It has one interface; the
   surfaces are what speak to that interface.
-- **Not the substrate.** It *runs on* tier 1 — a store, a broker, an object store, a registry —
-  and cannot start without them, which is what makes them a lower tier.
+- **Not the substrate.** It *runs on* tier 1 — PostgreSQL, LavinMQ, MinIO, an OCI registry
+  ([ADR 0048](../../02-DECISIONS/0048-the-substrate-is-named.md)) — and cannot start without
+  them, which is what makes them a lower tier.
 - **Not privileged on a node.** It has no more access to a machine than the declaration
   vocabulary allows ([ADR 0039](../../02-DECISIONS/0039-the-link-is-the-security-boundary.md)).
 
 ## It is also a consumer
 
 The property that makes tier 2 unlike the others: **the control plane has requirements of its
-own.** It needs a database, a broker, and somewhere to keep artifacts — the same things any
+own.** It needs a PostgreSQL database, an AMQP virtual host, and a bucket — the same things any
 module needs, granted the same way.
 
 That is the circularity the tiers exist to resolve rather than hide: the control plane cannot