Novox Mesh, Nox, and HQ becomes company-scoped

ADR 0027 — the product is Novox Mesh, shortened to mesh internally. HAL was
never chosen: it arrived with the dotfiles repository this grew out of, it
is borrowed, and it is borrowed from the canonical untrustworthy machine
intelligence, which is an odd flag for infrastructure trusted with
credentials. Timing is the substance of the decision, not an aside — the
skeleton is not built, so renaming costs a search and replace now and a
migration later.

Nox is an identity of Novox, and specifically the agent of the MESH rather
than of a node. Nodes keep their own identities. Nox addresses them, and a
human mostly talks to Nox — which makes it the concrete form of the
mission's vision: state an intent, and the mesh works out which node holds
the thing. It holds no private channel. The gap this opens is recorded:
ADR 0012 binds every agent to a home node, and a mesh-scoped agent has
none, so the model needs extending.

ADR 0028 — HQ is company-scoped, novox/hq, with the mesh as its first
product. Checked rather than assumed: the company organisation already
holds live projects that the mesh builds and deploys, so they are tenants
rather than peers, and the mesh is the ground they stand on. There is also
company work outside the mesh already, which strengthens the case and means
the eventual split is closer than "some day" — so each document's scope is
fixed now, in a table, making that split mechanical instead of
archaeological. The folders are deliberately not restructured yet.

The skeleton takes the new vocabulary: mesh-host, mesh-substrate,
mesh-control, mesh-surfaces, mesh-catalog. Substrate drops to four services
now that identity is a hosted workload rather than a dependency.

Research 009 opens the migration, with the reframing that lowers its risk:
replace the control plane, do not move the workloads. Their data never
moves, so it is re-declared rather than adopted — which keeps adoption out
of scope, as the lab design requires. Self-hosting is the last phase, or a
failed cutover takes away the means to fix it.

01-RESEARCH/006-mesh-from-scratch/code-skeleton.md

@@ -31,7 +31,7 @@ Run the test. *Can the control plane exist without a relational store?* No. **Po
 tier 1.** It lives once:
 
 ```
-hal-substrate/store/postgres/
+mesh-substrate/store/postgres/
 ```
 
 There is no second copy in the catalogue, because the thing that differs between the mesh's own
@@ -40,7 +40,7 @@ database and a project's database is **not the module**. It is how that instance
 | | The mesh's own instance | A project's database |
 |---|---|---|
 | Brought up by | the host, from the pinned bundle, with no control plane present | the ordinary delivery and provisioning path |
-| Declared in | `hal-substrate/bundle.yml` | the consuming module's `requires:` |
+| Declared in | `mesh-substrate/bundle.yml` | the consuming module's `requires:` |
 | Exists because | the control plane cannot start without it | something asked for it |
 
 Same module, two roles. **Tier is a property of the module** — what must exist before what — and
@@ -66,7 +66,7 @@ feels.
 ## Becoming self-hosting — the forge and the registries
 
 Self-improvement means the mesh hosts the things it improves itself with: a forge, an image
-registry, a package registry. The obvious worry is that these duplicate — a `hal-mesh-gitea`
+registry, a package registry. The obvious worry is that these duplicate — a `mesh-gitea`
 for the mesh and a `gitea` for everyone else. **They do not, and the reason is worth stating
 carefully, because it is the same reason the bootstrap keeps failing today.**
 
@@ -203,7 +203,7 @@ parts is not a module.
 Worked through for the substrate's relational store:
 
 ```
-hal-substrate/store/postgres/
+mesh-substrate/store/postgres/
     module.yml            provides: database · profiles: [managed]
     parts/
         service/          the container, its volume, its network exposure
@@ -215,7 +215,7 @@ hal-substrate/store/postgres/
 ## The tree, at file level
 
 ```
-hal-host/                          TIER 0
+mesh-host/                     TIER 0
     cmd/host/
     internal/
         apply/                     reconcile declared state
@@ -230,14 +230,14 @@ hal-host/                          TIER 0
         profile/                   managed · user · edge
     substrate.lock                 pinned tier-1 descriptor
 
-hal-substrate/                     TIER 1
+mesh-substrate/                TIER 1
     bundle.yml                     the pinned set, by digest
     store/postgres/
     bus/<broker>/
     objects/<object-store>/
     images/<registry>/
 
-hal-mesh/                          TIER 2
+mesh-control/                  TIER 2
     record/                        the event log contexts integrate through
     inventory/                     nodes · modules · assignments · versions
     config/                        settings · secrets · derivation
@@ -250,13 +250,13 @@ hal-mesh/                          TIER 2
     knowledge/                     memory · documents · retrieval
     api/                           the one interface surfaces speak to
 
-hal-surfaces/                      TIER 3
+mesh-surfaces/                 TIER 3
     tools/   web/   cli/
 
-hal-catalog/                       TIER 4
+mesh-catalog/                  TIER 4
     <domain>/<module>/             layout as above
 
-hal-lab/     hal-sdk/     hal-hq/
+mesh-lab/     mesh-sdk/     mesh-hq/
 ```
 
 ## What this does not settle