ADR 0047 — the bundle may carry actions the link may not

The bootstrap's sharpest open question, and the framing was wrong. "State on
this machine" was being read as the filesystem and the service manager. A
service running on this machine IS part of this machine — writing a file and
creating a database in a local store differ in mechanism, not in scope.

The real question was underneath: must the host learn what a database is? It
must not. Giving it a `database` resource type means tier 0 knows Postgres, then
a bucket, then a virtual host — the host acquiring the substrate's vocabulary
one service at a time, which is what ADR 0037 exists to stop.

So the bundle declares an ACTION and the host runs it and verifies it. What a
database means stays with the module that provides one; the host knows only how
to run a declared action against something local and check the result. Its
vocabulary grows by one shape rather than by one resource type per service.

Actions are permitted in the bundle and forbidden over the link, and the
asymmetry is deliberate. A bundle arrives WITH the binary: anyone able to put a
hostile action in it could equally have put it in the host itself, so refusing
actions there buys nothing and costs the bootstrap. The link is a separate
party, reachable separately, and an action there is the unbounded blast radius
ADR 0039 refuses. That decision stands unchanged.

And ongoing provisioning is not the host's at all — the control plane does it
once a mesh exists — so the asymmetry costs nothing.

Which dissolves the earlier worry about one mechanism with a tier boundary
inside it: there are two mechanisms, with different actors, scopes and trust
models, and that is the answer rather than a compromise.

Named rather than hidden: this is the escape hatch research 011 warned about,
arbitrary code in the place hardest to remove later. It is bounded by being
bundle-only and by every action having to declare how it verifies itself, and
that boundary is the whole defence.

01-RESEARCH/011-the-module-graph/worked-provider.md

@@ -155,9 +155,13 @@ a file or a unit — and at bootstrap it is, at least, local: the store is on th
 the host applying the bundle.
 
 Later it is not. A consumer on one node provisioned from a store on another is the ordinary
-case, and reaching it is not the host's job. So the same operation is local at bootstrap and
-remote afterwards, which is either two mechanisms or one mechanism with a boundary crossing in
-it. Undecided, and it is the sharpest unresolved thing in this file.
+case, and reaching it is not the host's job.
+
+**Resolved as two mechanisms, which is the answer rather than a compromise**
+([ADR 0047](../../02-DECISIONS/0047-the-bundle-may-carry-actions-the-link-may-not.md)). The host
+runs bootstrap actions locally from the bundle; the control plane provisions across the mesh
+afterwards. Different actors, different scopes, different trust paths — so there is no single
+operation with a tier boundary running through it.
 
 ## Several modules, one database — and the case for refusing