WBS: Phase 3.1 done — the store is adopted as the postgres module

One postgres, adopted in place, proven 22/22 in the one-node lab. Notes the
pre-filter exposure window as a follow-up.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

03-DESIGN/01-to-be/22-the-work-ahead.md

@@ -79,8 +79,14 @@ raises gitea and publishes the SDK before the base build. Those close together i
 **Why last.** The hardest and riskiest, and it needs everything above: an installer that completes,
 a protocol that agrees, a registry to publish to. Issue 051.
 
-- [ ] 3.1 the store is adopted — raised at genesis, then held as the `postgres` module; one server,
-      the controller's records and every module's database in it
+- [x] 3.1 the store is adopted — raised at genesis, then held as the `postgres` module; one server,
+      the controller's records and every module's database in it. *(Adopted in place: the module's
+      server names the same container and the same pinned upstream image the foundation runs, so the
+      applier reconciles it rather than raising a second postgres. Proven 22/22 in the one-node lab —
+      the catalogue, a `postgres-database` consumer, gets its database from it. Follow-up: the store
+      binds `0.0.0.0` from genesis so a mesh consumer can reach it, but the packet filter is
+      installed later — a brief pre-filter window where `mesh-store` is open before `from: mesh`
+      clamps it; bring the filter up earlier or bind narrower at genesis.)*
 - [ ] 3.2 the broker is adopted — one `lavinmq`, the `/` vhost for the mesh bus, a vhost per
       consumer that requires `amqp`; the second server gone
 - [ ] 3.3 an upgrade of each, proven: a store the controller reads from, a broker over the