The vault shipped: as-is 06 describes it, design 24 is implemented, 071 names its merges

03-DESIGN/01-to-be/07-the-foundation.md

@@ -5,6 +5,9 @@ code:
   - mesh-host examples/foundation-first-node.lock
   - mesh-host internal/apply
   - mesh-host internal/bootstrap/phase3.go
+  - mesh-host internal/bootstrap/rootsecrets.go
+  - mesh-host internal/bootstrap/operator.go
+  - mesh-catalog modules/mesh-vault
   - mesh-catalog modules/postgres
   - mesh-catalog modules/lavinmq
   - mesh-lab test/integration/mesh.test.ts (a bare machine becomes a mesh)

03-DESIGN/01-to-be/24-the-secrets-vault.md

@@ -1,8 +1,8 @@
 ---
 layer: to-be
-status: in-progress
-code: [mesh-catalog, mesh-controller]
-updated: 2026-09-20
+status: implemented
+code: [mesh-catalog, mesh-controller, mesh-host]
+updated: 2026-09-21
 decisions:
   - 02-DECISIONS/0085-a-secret-is-a-provision.md
   - 02-DECISIONS/0031-the-control-plane-authenticates-nobody.md
@@ -106,9 +106,9 @@ The vault's second job is to hold these, and it does so without holding a value:
   answered by it.
 
 **Genesis** makes the operator key first and mints real root secrets in place of the fixed ones the
-foundation is raised with, so the mesh is handed over with nothing well-known in it. That step is
-the installer's and is not yet built; until it is, the fixed credentials are the as-is and are
-said so in [21](21-the-installation-in-full.md).
+foundation is raised with, so the mesh is handed over with nothing well-known in it. The installer
+does this ([21](21-the-installation-in-full.md)); what it runs is described in the as-is
+([`00-as-is/06`](../00-as-is/06-configuration-and-secrets.md)).
 
 A module's vault-provided secret — the pair credential of
 [13](13-credentials-and-their-rotation.md) — is sealed to the operator the same way, as is every