Consolidate: 65 decision records to 52

Jochen: a normal application has 3-5 ADRs, maybe 10 for a large one, and we are
at 65. Fair, and the cause is mine -- I recorded every FINDING as a decision
rather than every fork in the road.

Two merges, both cases where one decision had been split across many records
because it was taken over several days rather than at once.

0019 absorbs ten records about how this repository works: what it is and that
it is public, the folder flow, the two design layers, the issue front door,
status in frontmatter, playbooks, the naming rule, the product name. Those were
never ten decisions -- they were one, seen from ten angles as the repository
took shape.

0016 absorbs the five about the lab: a node is a virtual machine, a router is
scenery, a scenario declares the underlay, a scenario is a closed address
space, and the two scenario classes. Same pattern -- one design, split by the
order it was worked out in.

The consolidated 0019 also raises the bar for what earns a record, since that
is what produced 65: a record is warranted when there is a genuine fork -- a
direction reversed, an alternative that will be proposed again, something
contested. A finding is not a decision, and a bug is certainly not. Everything
else belongs in the design document where the reasoning is actually read.

The checker earned its place here. Deleting nine records left 13 dangling links
across the repository and it named every one, including in AGENTS.md. Nothing
was found by reading.

Remaining clusters worth the same treatment: the host (8 records), delivery
(5), modules (6), connectivity (4), substrate and control plane (4). That would
be 52 down to roughly 30.

02-DECISIONS/0016-the-lab.md

@@ -0,0 +1,84 @@
+---
+status: accepted
+date: 2026-08-28
+deciders: jochen
+reconstructed: false
+consolidates: [0029, 0031, 0032, 0033]
+---
+
+# 16. The lab
+
+*Consolidated 2026-08-28 from five records. The lab is one design and was split across five
+decisions taken over three days; the reasoning is kept, the fragmentation is not.*
+
+The environment a change is run against before it reaches real machines.
+
+## A node in the lab is a virtual machine
+
+It boots a stock Linux image, runs the real install, and becomes a node. **It is not a model of
+a node**, so no question arises about how good the model is — which is the whole reason for
+paying the cost of virtual machines rather than containers.
+
+The lab is driven by **incus**, and a scenario is raised from a declaration.
+
+## A router is scenery, and is therefore a container
+
+**Nothing under test runs on a router.** It is not a participant, holds no identity, has nothing
+installed on it by the mesh, and no assertion is ever made about its internals. It exists so that
+packets between machines behave the way they behave in the world.
+
+The fidelity argument that makes a node a virtual machine does not reach it: what a router *is*
+does not matter, only what it *does to traffic*. So a router is a system container, and the lab
+is cheaper for it.
+
+## A scenario declares the underlay, and only the underlay
+
+**What a hosting provider and a home router would have provided**, before any of our software
+touched the machine:
+
+- which segments exist, and their address ranges
+- which machine sits on which segment, at which address
+- what NAT sits between them, and which ports are forwarded through it
+- which machines are detached, and may be attached or detached during a run
+
+**A scenario declares nothing about the overlay** — no overlay addresses, no hub, no peering, no
+names, no certificates. Those are the mesh's job, and a scenario that supplied them would be
+testing itself.
+
+> A scenario provides what a hosting provider and a home router would provide, and nothing our
+> software is responsible for.
+
+## A scenario is a closed address space
+
+Every segment materialises as its own isolated link belonging to one scenario instance. **Two
+scenarios raised from the same declaration hold the same addresses and never meet**, because
+nothing joins their links. The declaration therefore keeps its literal addresses and they mean
+exactly what they say.
+
+**The consequence that constrains everything else: the lab never reaches into a scenario over
+IP.** It talks to a machine through the virtualisation layer's own channel — the way one would
+use a console rather than the network. That is what makes two identical scenarios able to run at
+once, and it is why placing anything inside a machine is a hypervisor operation rather than a
+network one.
+
+## Two scenario classes, and the first has no pipeline
+
+| | **bootstrap** | **full** |
+|---|---|---|
+| contains | machines, the host binary, a pinned substrate bundle | a complete mesh: forge, coordinator, delivery, modules |
+| verdict from | what the host reports about the state it reconciled | a delivery result ending in verification |
+| exercises | tiers 0 and 1 | tiers 2 and above, and modules |
+
+**The bootstrap class comes first**, because it is what develops the node host, and because a
+full scenario needs tiers that do not exist yet. A lab that could only raise the larger class
+would be a lab nobody could use until everything else was built.
+
+## Consequences
+
+- **The lab tests the real code path**, not a reimplementation of it. The network a scenario
+  produces is generated by the same code production runs.
+- **Isolation is what makes it usable in parallel**, and it costs the ability to reach in over
+  IP. Everything the lab puts inside a machine — a binary, an image, a file — goes through the
+  hypervisor.
+- **A sealed scenario cannot fetch anything**, which is a real limit rather than an inconvenience:
+  it is why images have to be placed and why a container runtime has to be in the base image.