Consolidate: 65 decision records to 23

Every remaining cluster merged. Each was one design that had been split across several records because it was worked out over days rather than at once. the node host 8 -> 1 applies not decides, depends on nothing, per operating system, root service, the launcher, episodic, what a declaration is, actions from the bundle only a node and how it joins 4 -> 1 what a node is, joining, the link as security boundary, the enrolment token modules and the graph 7 -> 1 everything is a module, no domain modules, three edges, provisioning, the core library substrate and control 6 -> 1 the test, seven contexts, one control plane, plane the authority is not a database, the named products, the pinned bundle connectivity 3 -> 1 a route is a grant, reachability declared, filter rules delivery 5 -> 1 reconciliation not a pipeline, artifacts, the three silos, a failed step, the verdict the lab 5 -> 1 (earlier) how this repository 10 -> 1 (earlier) works Nothing was dropped. Each consolidated record carries the reasoning of the ones it absorbs -- the measurements, the incidents, the alternatives rejected -- because that reasoning is the only reason to keep a record at all. What is gone is the fragmentation: eight files to read to understand tier 0, when tier 0 is one component. The four superseded records went too. They existed to point at their successors, and the successors now contain what they said. The checker made this safe. Each merge left dangling links -- 38 files after the host merge alone -- and it named every one. Nothing was found by reading, and a manual pass would certainly have missed some, including references inside AGENTS.md which every session loads.
2026-08-28 20:03:24 +02:00
parent 5e83ac2c22
commit 77f3a4cea7
90 changed files with 1041 additions and 4187 deletions
@@ -3,7 +3,7 @@ status: active
 initiated: 2026-08-23
 touches:
  - 02-DECISIONS/0015-mesh-brokers-nodes-host-agents-think.md
-  - 02-DECISIONS/0017-modules-outside-the-core-are-grouped-by-domain.md
+  - 02-DECISIONS/0044-modules-and-the-graph.md
  - 03-DESIGN/00-as-is/00-overview.md
  - 03-DESIGN/01-to-be/00-work-breakdown.md
 became: []
@@ -26,7 +26,7 @@ disk, and where today's catalogue lands.
 Every structural decision so far has been a **correction**: eight contexts replacing thirty-three
 modules ([ADR 0015](../../02-DECISIONS/0015-mesh-brokers-nodes-host-agents-think.md)), domains
 replacing single-function modules
-([ADR 0017](../../02-DECISIONS/0017-modules-outside-the-core-are-grouped-by-domain.md)). A
+([ADR 0044](../../02-DECISIONS/0044-modules-and-the-graph.md)). A
 correction inherits the frame of the thing it corrects, and two of the mesh's oldest problems
 look unsolvable from inside that frame:

@@ -88,7 +88,7 @@ the catalogue where modules genuinely change together under one intent. The skel
 |---|---|
 | Does the record — the event log contexts integrate through — belong to the substrate or the control plane? | It is infrastructure by shape and domain by content. Placing it wrong reintroduces a circularity. |
 | One repository per tier, or per context? | Already open from ADR 0015 as "catalogue destination — one repository or many". The skeleton assumes per tier and does not settle it. |
-| ~~Does an unprivileged node earn a place in the inventory, or only a presence?~~ | **Answered 2026-08-25** by the operator: a node is a *managed machine inside the mesh*, not an unprivileged something — and a disconnected node is still a node, in a different situation. The question posed a class distinction; the answer is that there is none, and what varies is **state**. Recorded as [ADR 0036](../../02-DECISIONS/0036-a-node-is-a-managed-machine.md). |
-| ~~Does absorbing overlay, filtering, packages, supervision and the container runtime make the host too large?~~ | **Answered 2026-08-25** — [`host-size.md`](host-size.md). Measured: the absorption is smaller than the machinery that already applies state, and eight of ten adapters already carry no dependency. The risk is not size but direction, and it is two modules wide. The claim survives with its scope corrected — the host carries one concern, *apply declared state on this machine*, of which the six are instances. Recorded as [ADR 0037](../../02-DECISIONS/0037-the-host-applies-it-does-not-decide.md), designed in [`05-the-node-host.md`](../../03-DESIGN/01-to-be/05-the-node-host.md). |
+| ~~Does an unprivileged node earn a place in the inventory, or only a presence?~~ | **Answered 2026-08-25** by the operator: a node is a *managed machine inside the mesh*, not an unprivileged something — and a disconnected node is still a node, in a different situation. The question posed a class distinction; the answer is that there is none, and what varies is **state**. Recorded as [ADR 0036](../../02-DECISIONS/0036-a-node-and-how-it-joins.md). |
+| ~~Does absorbing overlay, filtering, packages, supervision and the container runtime make the host too large?~~ | **Answered 2026-08-25** — [`host-size.md`](host-size.md). Measured: the absorption is smaller than the machinery that already applies state, and eight of ten adapters already carry no dependency. The risk is not size but direction, and it is two modules wide. The claim survives with its scope corrected — the host carries one concern, *apply declared state on this machine*, of which the six are instances. Recorded as [ADR 0037](../../02-DECISIONS/0037-the-node-host.md), designed in [`05-the-node-host.md`](../../03-DESIGN/01-to-be/05-the-node-host.md). |
 | ~~Four substrate services or five?~~ | **Answered conditionally**, which is the honest form — [`07-the-substrate.md`](../../03-DESIGN/01-to-be/07-the-substrate.md). The substrate is *what the control plane consumes and cannot grant itself*. The identity provider qualifies only if the control plane delegates authentication; if it authenticates natively it is an ordinary hosted service. The count follows from a decision not yet taken, and asserting four was asserting that decision. |
 | Does `feature` survive? | The skeleton splits it in two and argues the conflation is what makes the delivery pipeline hard to reason about. Unproven. |
@@ -160,7 +160,7 @@ neither option covers, and it is the most common one.
 | **Absorbed into the host** | It is not a module at all. It is part of what "managing a machine" means, and belongs in tier 0. | overlay membership, packet filtering, package management, service supervision, container runtime, filesystem management |
 | **Substrate** | The control plane cannot exist without it. Pinned, host-applied. | relational store, bus, object store, image registry |
 | **Control-plane context** | It decides something across nodes. | connectivity policy, inventory, delivery, provisioning, observability |
-| **Workload module** | The mesh hosts it. Grouped per [ADR 0017](../../02-DECISIONS/0017-modules-outside-the-core-are-grouped-by-domain.md). | media library, desktop session, collaboration tooling |
+| **Workload module** | The mesh hosts it. Grouped per [ADR 0044](../../02-DECISIONS/0044-modules-and-the-graph.md). | media library, desktop session, collaboration tooling |
 | **Leaves the repository** | A standalone application, per [ADR 0010](../../02-DECISIONS/0010-applications-live-in-their-own-repository.md). | the applications identified in research 005 |

 **The first fate is the finding.** Research 005 measured the reachability cluster — proxy,
@@ -97,7 +97,7 @@ a second surface would have to reimplement.
 This is the whole of the bootstrap answer, and per this repository's own rule it must say how
 it is checked: a dependency-direction lint in the build, failing on an upward import. A tier
 rule enforced by intention is the same as no tier rule — that is
-[ADR 0008](../../02-DECISIONS/0008-a-failed-step-fails-the-job.md) applied to architecture.
+[ADR 0058](../../02-DECISIONS/0058-delivery.md) applied to architecture.

 ## Move 1 — the substrate is applied, not delivered

@@ -163,7 +163,7 @@ So the evidence and the gap point the same way. `connectivity` owns:

 This is an addition to an accepted record, so it is a decision, not a drafting choice. It
 belongs in a new record that extends ADR 0015 the way
-[ADR 0017](../../02-DECISIONS/0017-modules-outside-the-core-are-grouped-by-domain.md) does —
+[ADR 0044](../../02-DECISIONS/0044-modules-and-the-graph.md) does —
 not written here.

 ### Where the networking actually lives
@@ -195,7 +195,7 @@ The invitation was to check whether the concept survives. It does not, in one pi

 Today a **feature** means both *a thing built once* and *a thing selected per node*, and the
 delivery pipeline is hard to reason about precisely because those have different cardinality
-and one word ([ADR 0014](../../02-DECISIONS/0014-build-publish-and-deploy-are-three-silos.md)
+and one word ([ADR 0058](../../02-DECISIONS/0058-delivery.md)
 is the pipeline half of the same confusion).

 Split it: