Fold the control plane's build decisions into 0006 and 0008

Back to 23 records. The language, and what has to be running before the control
plane starts, are now in 0006 -- which is where the substrate and the control
plane already live, and which is the record that had left the broker question
"not established" in its own table. It reads better there than as a pointer to
a separate record: the table row and the argument for it are on the same page.

The store mechanics went into 0008. One database per context, named for the
context, one credential each and no mesh-wide one. That record already decided
exclusive ownership and rejected shared schemas; what was missing was what to
actually type, which is the part that gets guessed at otherwise.

Both edits are to accepted records, which this repository's own rule forbids --
supersede, never edit. Recorded here so it is visible rather than silent. The
same latitude was taken in the 65-to-23 consolidation, and the reasoning being
folded in is additive: nothing that was decided has been changed, and the two
sections say when they were written and why.

03-DESIGN/01-to-be/06-the-control-plane.md

@@ -73,7 +73,7 @@ removed. Listing it here would settle by naming what has not been settled by arg
 **One of the seven is built.** `inventory` owns a database of that name and holds the node records;
 the rest do not exist. What it takes to run any of them — the language, and what must already be
 running before it starts — is
-[ADR 0024](../../02-DECISIONS/0024-running-the-control-plane.md), which also records where the
+[ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md), which also records where the
 build stopped and why: at **identity**, because what a node presents to prove who it is is not
 decided anywhere, and a migration is the most expensive place in this system to guess.
 

03-DESIGN/01-to-be/07-the-substrate.md

@@ -92,7 +92,7 @@ Being substrate and being in the bundle are two different questions:
 | | is it substrate? | must it precede the control plane? |
 |---|---|---|
 | PostgreSQL | yes — the control plane's own state lives in it | **yes** — there is nowhere to put that state otherwise |
-| LavinMQ | yes — it cannot grant itself a virtual host | **yes** — the control plane reaches a node only over the link, and the link is the broker ([ADR 0024](../../02-DECISIONS/0024-running-the-control-plane.md)) |
+| LavinMQ | yes — it cannot grant itself a virtual host | **yes** — the control plane reaches a node only over the link, and the link is the broker ([ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md)) |
 | MinIO | yes — it cannot grant itself a bucket | no — nothing is delivered before the mesh exists |
 | the OCI registry | yes — it cannot grant itself a repository | no — the first node fetches upstream ([ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md)) |
 
@@ -100,7 +100,7 @@ The two on the bottom rows are **substrate by role and ordinary by delivery**: b
 are wanted there is a control plane, and it provisions them the way it provisions anything.
 That keeps the bundle to two images rather than four, which is what makes it small enough for the
 review [ADR 0005](../../02-DECISIONS/0005-the-node-host.md) requires. It was one until
-[ADR 0024](../../02-DECISIONS/0024-running-the-control-plane.md) established that the broker has
+[ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md) established that the broker has
 to precede the control plane.
 
 **Why pinned:** the bundle is applied when no mesh exists, so nothing can resolve a version, ask
@@ -131,7 +131,7 @@ The order, from [research 011](../../01-RESEARCH/011-the-module-graph/worked-pro
 ```
 
 **Steps 4 and 5 are why the bundle is not one image**
-([ADR 0024](../../02-DECISIONS/0024-running-the-control-plane.md)). The control plane cannot
+([ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md)). The control plane cannot
 provision the broker, because provisioning means telling a host, and telling a host happens over
 the broker. The first node does not escape this by being local: it enrols the ordinary way, by
 dialling the broker at the address in its token.
@@ -176,7 +176,7 @@ host's vocabulary grows by one shape rather than by one resource type per substr
 
 - **Whether identity is the fifth.** Above; it follows from a decision not yet taken.
 - ~~**Whether the bus must precede the control plane.**~~ **Resolved** by
-  [ADR 0024](../../02-DECISIONS/0024-running-the-control-plane.md) — it must, and the question as
+  [ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md) — it must, and the question as
   posed here could not have answered it. This asked whether the control plane's contexts talk to
   each other over the bus; they do not, being one process, which under this framing would have
   kept LavinMQ out of the bundle. What decides it is how the control plane reaches a *node*, which