Modules declare their own seats; the mesh reserves mesh-*

The architecture 0117 opened needs a module to offer a service as a role on
the bus — one holder, addressed by what it does. A closed table in the
controller cannot express that: a capability a module contributes would
require changing the mesh itself.

But 0110 closed the set for a good reason — nothing could say what seats a
mesh had, and the hand count came out at eleven of thirteen. That argues for
enumerable, not hardcoded, and 0110 weighed free-form against a fixed table
without considering a third option: closed at any moment and derived from
the catalogue. A derived list cannot drift, which is how the count broke.

So: the mesh's seats stay the mesh's, reserved by the mesh- prefix so the
prefix is the rule and there is no list to maintain; ten seats are renamed
to restore 0079's convention; everything 0110 decided about what a seat IS
survives untouched.

Design 29 carries the declaration model: three namespaces, subjects derived
from local names so a manifest survives the wire changing, queues never
declared, five relationships (the job and state shapes 0041 had no room
for), and the build-publish-deploy lifecycle with hard, soft and build-time
dependencies distinguished.

0041 gets a progressive insight: "no per-consumer setup, only a
subscription" was a fact about a topic exchange, and a JetStream durable
consumer is a real object someone creates.

WBS 1.3/1.4 were wrong and say so: streams come at registration and
consumers at assignment, so only the foundation set belongs at genesis.

03-DESIGN/01-to-be/28-building-the-bus.md

@@ -10,6 +10,7 @@ decisions:
   - 02-DECISIONS/0116-the-bus-is-built-in-five-steps.md
   - 02-DECISIONS/0106-the-bus-is-nats.md
   - 02-DECISIONS/0117-the-bus-is-the-only-broker.md
+  - 02-DECISIONS/0118-a-module-declares-its-own-seats.md
   - 02-DECISIONS/0074-the-wire-is-specified-not-the-types.md
   - 02-DECISIONS/0079-the-foundation-seats-are-named-after-their-servers.md
   - 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
@@ -115,6 +116,15 @@ step 5  the rollout
 
 ## Step 1 — the module, and genesis raises it
 
+> **Revised 2026-09-26** ([ADR 0118](../../02-DECISIONS/0118-a-module-declares-its-own-seats.md),
+> [design 29](29-what-a-module-declares.md)). Tasks 1.3 and 1.4 said the controller composes every
+> account and creates *the four streams* at genesis, from a fixed set. That is only the mesh's own
+> half. A module declares seats with their protocols, so streams are created **at registration**
+> and durable consumers **at assignment** — neither of which has happened at genesis. The fixed
+> foundation set stays here; the derived machinery moves to step 3, where the declaration model it
+> reads from is specified. Tasks 1.1 and 1.2, already done, are untouched by this: the module and
+> its reload mechanism do not care what the configuration says.
+
 **Why here.** Everything else needs a server to talk to, and genesis is where the foundation is
 defined. The mesh this is for will never travel this path — it is already running, and takes step 2
 — but genesis is the definition every other path is measured against, and one that exists only on
@@ -126,11 +136,14 @@ paper is wrong until there is a second mesh to find out.
 - [ ] 1.2 the composed configuration as a **directory** resource, and the entrypoint that watches
       the one file and signals the server itself — design 25 §5's correction, kept inside the module
       because a container has no reload and a recreate would drop every connection the mesh has
-- [ ] 1.3 the controller composes that file: accounts, permissions, TLS, JetStream — permissions
-      derived from `emits` and `consumes` and nothing else, plus each user's own ack subject and its
-      own inbox prefix (design 25 §4)
-- [ ] 1.4 the four streams, created at genesis and asserted idempotently on start, by the controller
-      as their only writer
+- [ ] 1.3 the controller composes that file: accounts, permissions, TLS, JetStream — a user's
+      permissions derived from its declaration and nothing else, over the three namespaces of
+      [design 29](29-what-a-module-declares.md) §2, plus its own ack subject and its own inbox
+      prefix (design 25 §4)
+- [ ] 1.4 the mesh's own streams, created at genesis and asserted idempotently on start, by the
+      controller as their only writer — **the mesh's own, not all of them**: a seat's streams are
+      created when the module declaring it is registered, and a module's durable consumers when it
+      is assigned, so this task is the fixed foundation set and 3.x carries the derived rest
 - [ ] 1.5 genesis raises it as foundation, claiming the seat **`mesh-broker`** — the seat is the
       server's role, not the product
 - [ ] 1.6 the genesis-broker bed
@@ -183,6 +196,15 @@ pays for itself furthest away.
 - [ ] 3.5 the host's link on NATS — mirroring, still importing nothing
 - [ ] 3.6 the tool runtime's client on NATS, behind the unchanged sdk contract
 - [ ] 3.7 the sdk's three stale comments, and nothing else in it
+- [ ] 3.8 **the declaration model** of [design 29](29-what-a-module-declares.md): local names
+      derived to subjects, the three namespaces, permissions computed from a declaration, and a
+      manifest that contains no subject
+- [ ] 3.9 **seats declared by modules** — registration creates a seat's streams and refuses a
+      `mesh-*` name, a duplicate declarer, an undeclared `uses`, and a holder that does not
+      satisfy the protocol; assignment creates the holder's work-queue consumer and refuses a
+      second holder
+- [ ] 3.10 **the ten seat renames**, carried as a migration with a mapping rather than an edit,
+      and the beds that name seats moved with them
 
 **Done when.** The fixtures are produced and consumed byte for byte by every implementation that
 claims the capability, and a module built before any of this serves its tools unchanged on the new