Merge branch 'issue/021-provider-port-published-on-loopback' into design/bootstrap-is-a-pivot

# Conflicts:
#	03-DESIGN/01-to-be/04-lab-installation.md

03-DESIGN/01-to-be/04-lab-installation.md

@@ -1,18 +1,18 @@
 ---
 layer: to-be
-status: designed
+status: in-progress
 code: [mesh-lab]
 updated: 2026-09-11
 decisions:
-  - 02-DECISIONS/0029-the-labs-first-scenario-has-no-pipeline.md
-  - 02-DECISIONS/0008-a-failed-step-fails-the-job.md
+  - 02-DECISIONS/0016-the-lab.md
+  - 02-DECISIONS/0010-delivery.md
 ---
 
 # Installing the lab on a clean machine
 
 The lab has prerequisites — a virtualisation daemon, copy-on-write storage, a pool, an identity
 permitted to talk to it — and it cannot get them from the mesh, because it is where the mesh is
-built ([ADR 0029](../../02-DECISIONS/0029-the-labs-first-scenario-has-no-pipeline.md)).
+built ([ADR 0016](../../02-DECISIONS/0016-the-lab.md)).
 
 So the lab needs an install path of its own. This describes it, and the shape it has to take is
 determined by two failures observed while measuring
@@ -56,7 +56,7 @@ and unbounded at worst.
 
 **The lab refuses to run degraded.** It does not warn and continue: a warning about a slow inner
 loop is read once and ignored forever, and the loop stays slow. This is
-[ADR 0008](../../02-DECISIONS/0008-a-failed-step-fails-the-job.md) applied where the failure is
+[ADR 0010](../../02-DECISIONS/0010-delivery.md) applied where the failure is
 performance rather than an error.
 
 ## Two ways the prerequisites arrive