To-be 27 and ADR 0113 (proposed): a module requires, the mesh resolves

The design pass. Everything a module needs is a requirement: a name, a contract, and one of four kinds
of provider — a module, the node's host, the mesh, the operator. Installing a module resolves every
requirement or refuses, naming everything missing at once. It retires six mechanisms that grew
separately: provisions through bindings, settings, assigned ports, machine facts, minted secrets and
literals in the definition.

ADR 0113, proposed: a provider makes what it provides, and the mesh carries it back sealed to the
consumer's node. It is the return path ADR 0048 left "to a separate decision", now needed three ways:
data provisions with nothing to answer with, contracts needing a value the controller cannot make, and
a vault that generates nothing. Who a consumer is stays the mesh's (ADR 0049). Genesis is the one
exception. On acceptance it supersedes 0048 and amends 0085.

ADR 0112 is revised from three sources to that single concept.

ADR 0110 is amended for two points raised in review. The vault gets the mesh-vault seat (issue 106).
A seat's holder outranks co-location for a provision it delivers. Writing that down exposed an
inconsistency: mesh-store delivering postgres-database would have sent every database consumer to the
control-node, against to-be 23's node-local stores. So a seat delivers a provision only where the mesh
has one answer for everyone — artifact store, npm registry, git, vault — and mesh-store and mesh-broker
deliver nothing. 23 and 26 follow.

'Control plane' becomes 'controller' in the records written today.

03-DESIGN/01-to-be/23-choosing-a-provider.md

@@ -51,12 +51,15 @@ provider on a different node. That coupling is exactly what may not be guessed,
 names the provider. Naming it is also what makes a later move safe — the mesh knows the binding is
 to that provider and not to whichever one is nearest.
 
-**A seat names the mesh's one provider of a kind.** Where a seat delivers the provision, its holder
-answers for it when several providers exist and the consumer named none. That is not picking: the
-choice was made once, mesh-wide, by assigning the holder, rather than once per consumer by naming it
+**Some provisions have one provider for the whole mesh, and a seat names it.** Where a seat delivers
+the provision, its holder answers for it, **and co-location does not apply**: a second provider on the
+consumer's own machine does not take over for that consumer. That is not picking: the choice was made
+once, mesh-wide, by assigning the holder, rather than once per consumer by naming it
 ([ADR 0110](../../02-DECISIONS/0110-a-seat-is-a-module-assignment-from-a-closed-set.md),
 [26 — The seats](26-the-seats.md)). A named provider still wins over the seat, because a consumer
-coupled to particular contents has said so.
+coupled to particular contents has said so. Only provisions the design makes one-per-mesh are
+delivered by a seat: the artifact store, a package registry, git and the vault. A database is not.
+Node-local stores, served by co-location, are the rule above.
 
 **Ambiguity is refused, never resolved by picking.** If several providers of a kind exist, none is
 named, none is co-located, and no seat delivers it, the requirement is unsatisfiable and is refused