ADR 0047 — the bundle may carry actions the link may not

The bootstrap's sharpest open question, and the framing was wrong. "State on
this machine" was being read as the filesystem and the service manager. A
service running on this machine IS part of this machine — writing a file and
creating a database in a local store differ in mechanism, not in scope.

The real question was underneath: must the host learn what a database is? It
must not. Giving it a `database` resource type means tier 0 knows Postgres, then
a bucket, then a virtual host — the host acquiring the substrate's vocabulary
one service at a time, which is what ADR 0037 exists to stop.

So the bundle declares an ACTION and the host runs it and verifies it. What a
database means stays with the module that provides one; the host knows only how
to run a declared action against something local and check the result. Its
vocabulary grows by one shape rather than by one resource type per service.

Actions are permitted in the bundle and forbidden over the link, and the
asymmetry is deliberate. A bundle arrives WITH the binary: anyone able to put a
hostile action in it could equally have put it in the host itself, so refusing
actions there buys nothing and costs the bootstrap. The link is a separate
party, reachable separately, and an action there is the unbounded blast radius
ADR 0039 refuses. That decision stands unchanged.

And ongoing provisioning is not the host's at all — the control plane does it
once a mesh exists — so the asymmetry costs nothing.

Which dissolves the earlier worry about one mechanism with a tier boundary
inside it: there are two mechanisms, with different actors, scopes and trust
models, and that is the answer rather than a compromise.

Named rather than hidden: this is the escape hatch research 011 warned about,
arbitrary code in the place hardest to remove later. It is bounded by being
bundle-only and by every action having to declare how it verifies itself, and
that boundary is the whole defence.

03-DESIGN/01-to-be/07-the-substrate.md

@@ -93,16 +93,20 @@ The order, from [research 011](../../01-RESEARCH/011-the-module-graph/worked-pro
 ```
 
 **Steps 2 and 3 happen before there is a mesh to do them**, which is why provisioning is part of
-the bootstrap rather than a service consumers use later — and why the host's declaration
-vocabulary has to reach further than files, directories and units.
+the bootstrap rather than a service consumers use later. They are **actions** the bundle
+declares and the host runs
+([ADR 0047](../../02-DECISIONS/0047-the-bundle-may-carry-actions-the-link-may-not.md)) — so the
+host's vocabulary grows by one shape rather than by one resource type per substrate service.
 
 ## Open
 
 - **Whether identity is the fifth.** Above; it follows from a decision not yet taken.
-- **Whether the host can do step 2.** Creating a database inside a running store is not node
-  state, and [ADR 0043](../../02-DECISIONS/0043-a-declaration-is-an-ordered-list-of-owned-resources.md)
-  has the host applying *state on this machine*. At bootstrap the store is on that machine, so it
-  is at least local. It is the sharpest unresolved thing in the bootstrap path.
+- ~~**Whether the host can do step 2.**~~ **Resolved** by
+  [ADR 0047](../../02-DECISIONS/0047-the-bundle-may-carry-actions-the-link-may-not.md). A service
+  running on this machine is part of this machine, so the scope was never in question — the real
+  question was whether the host must learn what a database is, and it must not. The bundle
+  declares an **action**; the host runs it and verifies it, and what a database means stays with
+  the module that provides one.
 - **Whether one host can raise all four.** The claim under stage 2 of
   [the node host](05-the-node-host.md), never proved. If it is false, the tier boundary moves.
 - **How the substrate is updated once a mesh exists.** Pinned by hand at bootstrap; afterwards