A provision names its engine; the substrate supplies only the control plane

**0027 — provisions.** A module written against PostgreSQL could be
matched to a provider of SQL Server, resolve as satisfied, and fail on
its first query. The name said the role, so nothing distinguished
engines. Refusing on ambiguity could not help: with one provider of
each name nothing is ambiguous. Enforced at parse rather than
documented, because the old naming was the documentation.

**0028 — the substrate.** 0006 admits an object store on the grounds
that it cannot grant itself a bucket. That answers the second half of
the test and assumes the first: the control plane does not need one.
Verified — no S3 client in mesh-control, and internal/builder/registry.go
records the deliberate choice to put artifacts in the OCI registry as
content-addressed blobs. The row was inherited from the system being
replaced, where an object store distributed module tarballs, and was
never re-tested against the definition above it.

So an object store is an ordinary module, and a mesh with nothing
needing one runs none. Migrating it is module work, not substrate work.

0028 also states what 0006 left unsaid: a substrate service and a
module of the same product are different instances. The substrate is
raised from the bundle before any mesh exists, so it is not in the
module graph — a workload depending on it would depend on something the
graph cannot see, cannot rotate a credential for, and cannot move, and
would put workload data in the store the control plane keeps its own
state in.

Both records were found by reading code against design rather than
design against itself, which is the review that should have happened
sooner.

03-DESIGN/01-to-be/07-the-substrate.md

@@ -36,12 +36,22 @@ The test, applied:
 |---|---|---|---|
 | a relational store — **PostgreSQL** | its own state lives there | no — provisioning needs the store | **substrate** |
 | a message bus — **LavinMQ** | it reaches nodes over it ([ADR 0002](../../02-DECISIONS/0002-nodes-communicate-over-a-broker.md)) | no — it cannot grant itself a virtual host | **substrate** |
-| an object store — **MinIO** | artifacts and blobs it delivers | no — it needs a bucket to hold them | **substrate** |
+| ~~an object store~~ | ~~artifacts and blobs it delivers~~ | — | **not substrate** — [ADR 0028](../../02-DECISIONS/0028-the-substrate-supplies-the-control-plane-and-nothing-else.md) |
 | an image registry — **the OCI registry** | images it delivers to nodes | no — it needs a repository | **substrate** |
 | an identity provider | only if it delegates authentication | — | **conditional, below** |
 | ingress — **Traefik** | not to start; only to be reached by name | — it grants itself one afterwards | **not substrate** ([ADR 0007](../../02-DECISIONS/0007-connectivity.md)) |
 | anything else the mesh hosts | no | — | not substrate |
 
+*The object-store row was wrong, and how it was wrong is worth keeping.* It answered *can it
+grant itself one* — no, it cannot grant itself a bucket — while assuming the first column. **The
+control plane does not need an object store**: it has no S3 client and never has, and artifacts
+reach nodes as content-addressed blobs in the registry. The row was inherited from the system being
+replaced, where an object store distributed module tarballs, and was never re-tested against the
+definition above it. *Both columns must be answered, and the second is true of almost any service.*
+
+**An object store is an ordinary module**, required through the module graph by whatever wants one.
+A mesh with no workload needing one runs none.
+
 **The role and the product are both written**, here and everywhere
 ([ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md)). The role is what the argument
 turns on — the test above works on roles, and would give the same answers for a different store.
@@ -83,6 +93,17 @@ cannot obtain it* is.
   its own.* A substrate service is an upstream image, pinned, with configuration.
 - **Not privileged.** The substrate is provisioned *from* by the control plane and grants
   nothing on its own initiative.
+- **Not the mesh's supply of anything**
+  ([ADR 0028](../../02-DECISIONS/0028-the-substrate-supplies-the-control-plane-and-nothing-else.md)).
+  A substrate service and a module of the same product are **different instances**. The mesh's own
+  PostgreSQL and a PostgreSQL a workload was given are two servers, and a node hosting both runs
+  two containers — expected, not duplication to be tidied away.
+
+  The substrate is raised from the bundle before any mesh exists, so **it is not in the module
+  graph**: a workload depending on it would depend on something the graph cannot see, cannot rotate
+  a credential for, and cannot move. It would also put workload data in the store the control plane
+  keeps its own state in, where a workload that fills a disk takes down the one thing needed to fix
+  it.
 
 ## The pinned bundle