Design 25: a host directory bind, not a named volume

Issue 115 is resolved and converted four modules away from named volumes;
the bus's own data is not the place to bring one back. Also: NATS carries
TLS on the client port rather than beside a plaintext one, so there is no
5671/5672 pair to mirror.

03-DESIGN/01-to-be/25-the-bus-on-nats.md

@@ -158,9 +158,14 @@ signing hierarchy for nothing.
 
 `nats` is a catalogue module claiming the seat `mesh-broker`
 ([ADR 0079](../../02-DECISIONS/0079-the-foundation-seats-are-named-after-their-servers.md): the seat
-is the server, and the server changes). It declares one container (a single binary; JetStream on a
-named volume), its listening ports — client, TLS, and the monitoring endpoint on loopback — and a
-configuration file the controller composes (accounts, permissions, TLS, JetStream).
+is the server, and the server changes). It declares one container (a single binary; **JetStream on a host
+directory bind, not a named volume** — revision, second review:
+[issue 115](../../04-ISSUES/115-a-named-docker-volume-is-invisible-and-one-flag-from-gone/00-report.md)
+is resolved, and converted the store, the broker and two others away from named volumes for the
+reason it names; the bus's own data is not the place to reintroduce one), its listening ports —
+**the client port, which carries TLS itself** rather than standing beside a plaintext one as the
+AMQP broker's 5671/5672 pair did, and the monitoring endpoint on loopback — and a configuration
+file the controller composes (accounts, permissions, TLS, JetStream).
 
 **How that file's changes reach the running server, corrected on revision.** First review: the
 earlier draft named `reload-on` as the mechanism, citing the container runtime's own trust file as