The broker precedes the control plane, and it is written in Go

Two things found by trying to build tier 2.

The substrate design asked whether the message broker has to be running before
the control plane, and framed it as depending on whether the control plane's
own parts talk to each other over it. They do not -- it is one process -- so
under that framing the broker stays out of the bundle.

The framing cannot answer the question. What decides it is how the control
plane reaches a node, and the answer was already decided: only ever over the
link, and the link is the broker. So provisioning the broker would require the
broker. The first node does not escape this by being local, because it enrols
the ordinary way, by dialling the broker at the address in its token -- which
was deliberate, and worth keeping.

The bundle is two images now. The record says what that costs, including a
certificate the broker needs at a moment when there is no mesh to issue one.

The language had never been decided for tier 2. Go, for the same reason the
host is: the bundle pins this image by digest and runs it where nothing can
check it, so the image should hold the program and nothing else.

Also corrects something already built: the bootstrap created one database and
called it 'mesh'. ADR 0008 grants a context only what it exclusively owns and
ADR 0006 says the mesh database names a thing that will not exist. One database
per context, so one today, called inventory.

02-DECISIONS/README.md

@@ -92,6 +92,7 @@ python3 00-META/checks/index.py            fail if stale
 - **0006** — [The substrate and the control plane](0006-the-substrate-and-the-control-plane.md)
 - **0007** — [Connectivity](0007-connectivity.md)
 - **0008** — [A context owns its store, exclusively](0008-a-context-owns-its-store.md)
+- **0024** — [Running the control plane](0024-running-the-control-plane.md)  *(proposed)*
 
 ### What runs on them, and how it gets there