Consolidate: 65 decision records to 23

Every remaining cluster merged. Each was one design that had been split across several records because it was worked out over days rather than at once. the node host 8 -> 1 applies not decides, depends on nothing, per operating system, root service, the launcher, episodic, what a declaration is, actions from the bundle only a node and how it joins 4 -> 1 what a node is, joining, the link as security boundary, the enrolment token modules and the graph 7 -> 1 everything is a module, no domain modules, three edges, provisioning, the core library substrate and control 6 -> 1 the test, seven contexts, one control plane, plane the authority is not a database, the named products, the pinned bundle connectivity 3 -> 1 a route is a grant, reachability declared, filter rules delivery 5 -> 1 reconciliation not a pipeline, artifacts, the three silos, a failed step, the verdict the lab 5 -> 1 (earlier) how this repository 10 -> 1 (earlier) works Nothing was dropped. Each consolidated record carries the reasoning of the ones it absorbs -- the measurements, the incidents, the alternatives rejected -- because that reasoning is the only reason to keep a record at all. What is gone is the fragmentation: eight files to read to understand tier 0, when tier 0 is one component. The four superseded records went too. They existed to point at their successors, and the successors now contain what they said. The checker made this safe. Each merge left dangling links -- 38 files after the host merge alone -- and it named every one. Nothing was found by reading, and a manual pass would certainly have missed some, including references inside AGENTS.md which every session loads.
2026-08-28 20:03:24 +02:00
parent 5e83ac2c22
commit 77f3a4cea7
90 changed files with 1041 additions and 4187 deletions
@@ -5,8 +5,8 @@ code: [hal]
 updated: 2026-08-23
 decisions:
  - 02-DECISIONS/0001-nodes-communicate-over-a-broker.md
-  - 02-DECISIONS/0002-everything-is-a-module.md
-  - 02-DECISIONS/0003-the-mesh-database-is-the-source-of-truth.md
+  - 02-DECISIONS/0044-modules-and-the-graph.md
+  - 02-DECISIONS/0048-the-substrate-and-the-control-plane.md
 ---

 # The mesh as it stands
@@ -28,7 +28,7 @@ onto it and can be regenerated.
 containerised service is a module. A set of capabilities with no service behind them is a
 module. A bare marker whose whole content is that a node has it is a module. The mesh's own
 components are modules on exactly the same terms as everything else it carries
-([ADR 0002](../../02-DECISIONS/0002-everything-is-a-module.md)).
+([ADR 0044](../../02-DECISIONS/0044-modules-and-the-graph.md)).

 **An agent** is a participant. Some agents are human. What differs is modality — how the agent
 acts — and not category: both hold identity, both act, both accumulate memory
@@ -40,7 +40,7 @@ The repository defines **what exists**: the modules, what each declares, how eac

 The mesh database defines **what runs where**: which node is assigned which module, at which
 selection, with which overrides, plus the settings every node reads. No node-to-module mapping
-is ever committed ([ADR 0003](../../02-DECISIONS/0003-the-mesh-database-is-the-source-of-truth.md)).
+is ever committed ([ADR 0048](../../02-DECISIONS/0048-the-substrate-and-the-control-plane.md)).

 Everything on a node's disk is **derived** from those two, and is regenerated rather than
 edited ([ADR 0004](../../02-DECISIONS/0004-managed-files-are-generated-never-edited.md)). A node that
@@ -65,9 +65,9 @@ goes to where the capability is.
 A push to the forge is the only trigger. What follows is three silos with deliberately
 different cardinality: compile once, package and upload once, then install-configure-start-
 verify **on every assigned node**
-([ADR 0014](../../02-DECISIONS/0014-build-publish-and-deploy-are-three-silos.md)). What travels between
+([ADR 0058](../../02-DECISIONS/0058-delivery.md)). What travels between
 build and node is a self-contained build output, so a deploy is extract-and-run and touches no
-network ([ADR 0013](../../02-DECISIONS/0013-an-artifact-is-build-output.md)).
+network ([ADR 0058](../../02-DECISIONS/0058-delivery.md)).

 Modules are resolved into dependency levels and a level completes before the next begins, so a
 module always builds against its dependencies as they were just published.
@@ -78,7 +78,7 @@ A module declares what it **provides** and what it **requires**. The mesh satisf
 requirement: it creates the resource, generates the credential, records the grant, and writes
 the values where the module will read them. The module never learns which node its database
 lives on, and nobody ever writes a credential by hand
-([ADR 0005](../../02-DECISIONS/0005-capabilities-are-provisioned-on-declaration.md)).
+([ADR 0044](../../02-DECISIONS/0044-modules-and-the-graph.md)).

 This is the property the mesh's whole shape rests on, and it is why provisioning is treated as
 a core concern rather than as plumbing.
@@ -92,7 +92,7 @@ named for a feature the module does not declare, a stage that reported it had di
 message rather than that the effect happened, a package that 404ed from every mirror while the
 job went green.

-[ADR 0008](../../02-DECISIONS/0008-a-failed-step-fails-the-job.md) is the response, and it is applied
+[ADR 0058](../../02-DECISIONS/0058-delivery.md) is the response, and it is applied
 instance by instance rather than enforced by a mechanism. New instances are still being found.
 That is an as-is fact, not a criticism: it is the single most useful thing to know about this
 system before changing it.
@@ -5,7 +5,7 @@ code: [hal]
 updated: 2026-08-23
 decisions:
  - 02-DECISIONS/0001-nodes-communicate-over-a-broker.md
-  - 02-DECISIONS/0003-the-mesh-database-is-the-source-of-truth.md
+  - 02-DECISIONS/0048-the-substrate-and-the-control-plane.md
 ---

 # The mesh and its transport
@@ -4,7 +4,7 @@ status: implemented
 code: [hal]
 updated: 2026-08-23
 decisions:
-  - 02-DECISIONS/0002-everything-is-a-module.md
+  - 02-DECISIONS/0044-modules-and-the-graph.md
  - 02-DECISIONS/0006-schema-changes-are-numbered-migrations.md
  - 02-DECISIONS/0007-no-npm-workspace.md
 ---
@@ -4,7 +4,7 @@ status: implemented
 code: [hal]
 updated: 2026-08-23
 decisions:
-  - 02-DECISIONS/0005-capabilities-are-provisioned-on-declaration.md
+  - 02-DECISIONS/0044-modules-and-the-graph.md
  - 02-DECISIONS/0004-managed-files-are-generated-never-edited.md
 ---

@@ -4,9 +4,9 @@ status: implemented
 code: [hal]
 updated: 2026-08-23
 decisions:
-  - 02-DECISIONS/0014-build-publish-and-deploy-are-three-silos.md
-  - 02-DECISIONS/0013-an-artifact-is-build-output.md
-  - 02-DECISIONS/0008-a-failed-step-fails-the-job.md
+  - 02-DECISIONS/0058-delivery.md
+  - 02-DECISIONS/0058-delivery.md
+  - 02-DECISIONS/0058-delivery.md
 ---

 # Delivery — from a push to a running node
@@ -31,7 +31,7 @@ merge that created no pipeline, and nothing said so**.
 ## Three silos

 Cardinality is the whole point, and the three differ
-([ADR 0014](../../02-DECISIONS/0014-build-publish-and-deploy-are-three-silos.md)):
+([ADR 0058](../../02-DECISIONS/0058-delivery.md)):

 | Silo | Runs | Where | Does |
 |---|---|---|---|
@@ -50,7 +50,7 @@ later stage runs.
 ## The artifact

 The artifact is **build output** — compiled and bundled with its dependency graph inlined —
-never a filtered copy of source ([ADR 0013](../../02-DECISIONS/0013-an-artifact-is-build-output.md)).
+never a filtered copy of source ([ADR 0058](../../02-DECISIONS/0058-delivery.md)).
 A deploy is extract-and-run and touches no network.

 The consequence is the whole cost of the decision: **anything not in the build output does not
@@ -4,8 +4,8 @@ status: implemented
 code: [hal]
 updated: 2026-08-23
 decisions:
-  - 02-DECISIONS/0002-everything-is-a-module.md
-  - 02-DECISIONS/0011-the-installer-owns-linking.md
+  - 02-DECISIONS/0044-modules-and-the-graph.md
+  - 02-DECISIONS/0018-the-mesh-creates-no-symlinks.md
 ---

 # The node runtime, and how a node comes into being
@@ -57,7 +57,7 @@ outstanding local migrations, create data directories with the right ownership,
 service under supervision.

 **The installer is the only thing that creates a link** ([ADR
-0011](../../02-DECISIONS/0011-the-installer-owns-linking.md)). It reconciles rather than assumes: a
+0011](../../02-DECISIONS/0018-the-mesh-creates-no-symlinks.md)). It reconciles rather than assumes: a
 missing link is created, a stale one repointed, and a real file found where a link belongs is
 adopted into the node's override area and replaced. Nothing else — not a hook, not a fix, not a
 person debugging — creates one.
@@ -5,7 +5,7 @@ code: [hal]
 updated: 2026-08-23
 decisions:
  - 02-DECISIONS/0004-managed-files-are-generated-never-edited.md
-  - 02-DECISIONS/0005-capabilities-are-provisioned-on-declaration.md
+  - 02-DECISIONS/0044-modules-and-the-graph.md
 ---

 # Configuration and secrets
@@ -61,7 +61,7 @@ are both left behind. Configuration is additive in practice, whatever the manife
 Generated secrets are produced by the mesh, never authored. Provisioned credentials arrive as
 database overrides written by the provisioner and are marked as such, so they can be
 distinguished from a deliberate override and cleaned up when the grant is removed
-([ADR 0005](../../02-DECISIONS/0005-capabilities-are-provisioned-on-declaration.md)).
+([ADR 0044](../../02-DECISIONS/0044-modules-and-the-graph.md)).

 Nothing in the repository contains a credential. The repository has no per-node content at all,
 which is what makes that guarantee structural rather than a matter of care.
@@ -5,7 +5,7 @@ code: [hal]
 updated: 2026-08-23
 decisions:
  - 02-DECISIONS/0001-nodes-communicate-over-a-broker.md
-  - 02-DECISIONS/0008-a-failed-step-fails-the-job.md
+  - 02-DECISIONS/0058-delivery.md
 ---

 # Interfaces and observability
@@ -4,9 +4,9 @@ status: implemented
 code: [hal]
 updated: 2026-08-23
 decisions:
-  - 02-DECISIONS/0002-everything-is-a-module.md
+  - 02-DECISIONS/0044-modules-and-the-graph.md
  - 02-DECISIONS/0010-applications-live-in-their-own-repository.md
-  - 02-DECISIONS/0017-modules-outside-the-core-are-grouped-by-domain.md
+  - 02-DECISIONS/0044-modules-and-the-graph.md
 ---

 # The catalogue, and what its shape says
@@ -59,7 +59,7 @@ This is the same failure [ADR 0015](../../02-DECISIONS/0015-mesh-brokers-nodes-h
 names for the platform core — *boundaries drawn by deployment accident rather than by domain* —
 appearing outside it, at four times the scale. The core is being recomposed; the flat level is
 addressed in principle by
-[ADR 0017](../../02-DECISIONS/0017-modules-outside-the-core-are-grouped-by-domain.md), which
+[ADR 0044](../../02-DECISIONS/0044-modules-and-the-graph.md), which
 deliberately does not yet settle the domain list.

 ## Where the shape came from