AMQP is a provision, not the bus

0117 went a step further than it had grounds for. It was right that the bus
is the only bus, and wrong that the amqp interface must therefore retire —
because it conflated two reasons to want a broker. Using one to reach
another module is a second bus and stays refused. Needing an AMQP broker as
a backing service, the way something needs a database, is ordinary, and
forbidding it would make the mesh unable to run normal software while
calling that architecture.

So the broker becomes a plain provider module: no seat, not foundation,
never raised at genesis, no retirement condition. lavinmq now claims nothing
and provides amqp; nats claims mesh-broker and provides nothing.

The rule that survives is about direction, not software: inter-module
communication goes over the bus. A module may hold a broker for itself; it
may not use one as a channel to another module. That is a review judgement
where 0117 could have used a parser, which is the honest cost.

0106's progressive insight was itself wrong and is corrected by a second one
there — nothing moves off the old broker, so its "one purpose" sentence does
not become true, it is just not what that server is.

The insight check needed two fixes it found itself: a date may carry
trailing words, and a bold run with a link is discussing an insight rather
than marking one. All four bad shapes still fire.

03-DESIGN/01-to-be/25-the-bus-on-nats.md

@@ -10,7 +10,7 @@ code:
 updated: 2026-09-26
 decisions:
   - 02-DECISIONS/0106-the-bus-is-nats.md
-  - 02-DECISIONS/0117-the-bus-is-the-only-broker.md
+  - 02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md
   - 02-DECISIONS/0116-the-bus-is-built-in-five-steps.md
   - 02-DECISIONS/0074-the-wire-is-specified-not-the-types.md
   - 02-DECISIONS/0079-the-foundation-seats-are-named-after-their-servers.md
@@ -214,11 +214,25 @@ current. Nothing is declared as `reload-on` or `restart-on` for this resource at
 
 Its guard is the same rule as the AMQP broker's: the monitoring port is refused from anything but
 the private network. It is raised at genesis like the store, adopted as a module in the same
-phase. The predecessor's AMQP broker remains a module of its own, `lavinmq-compat`, with a
-retirement condition: no client connected for a period the operator sets.
+phase.
+
+**The AMQP broker is an ordinary module, not a compatibility layer.** Revision, second review
+([ADR 0119](../../02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md)): earlier text here, and
+ADR 0106 before it, called it `lavinmq-compat` — one purpose, the predecessor's clients, and a
+retirement condition of no client connected for a period the operator sets. It is none of those.
+A module may legitimately need an AMQP broker as a **backing service**, the way it needs a
+database, and the provider that answers that is an ordinary module like any other: no seat, not
+foundation, never raised at genesis, installed when something wants it and absent from a mesh
+that does not. There is no retirement condition, because the day its last client disappears is
+not a day anything is waiting for.
+
+What is deprecated is AMQP as **the mesh's transport**, which is this whole document. The rule
+that remains is about direction rather than software: *inter-module communication goes over the
+bus.* A module may hold a broker, a database or a cache for itself; it may not use one as a
+channel to another module.
 
 **And with one purpose, which it did not have when this was written.** Revision, second review
-([ADR 0117](../../02-DECISIONS/0117-the-bus-is-the-only-broker.md)): two modules of the new mesh
+([ADR 0119](../../02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md) (superseding [ADR 0117](../../02-DECISIONS/0117-the-bus-is-the-only-broker.md))): two modules of the new mesh
 required a broker *of their own* from it — a private vhost per consumer, the analog of
 database-per-login, which is a different thing from the mesh's bus and was never examined here.
 **There is one bus, and no module is handed a broker as a resource.** A module's messaging is
@@ -436,7 +450,7 @@ find what changed and why.
 **Still open:**
 
 - ~~Whether EVENTS should be one stream or one per emitting module.~~ **Closed**
-  ([ADR 0117](../../02-DECISIONS/0117-the-bus-is-the-only-broker.md)): one stream, and not as a
+  ([ADR 0119](../../02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md) (superseding [ADR 0117](../../02-DECISIONS/0117-the-bus-is-the-only-broker.md))): one stream, and not as a
   preference — the streams the bus is made of are composed as configuration before any module
   runs, because a provisioner is itself a module that needs a bus account to start. Bootstrapping
   decides it.