Merge main: renumber this branch's records around the trunk's

Both lines of work numbered from the same point, so four decision records and one design
document existed twice with different content. The trunk keeps its numbers and this branch
yields — the only rule that scales, because the trunk's are already cited by what merged
before them.

  0117 the bus is the only broker        -> 0125
  0118 a module declares its own seats   -> 0126
  0119 amqp is a provision, not the bus  -> 0127
  0120 the mesh bus is required          -> 0128
  0123 a seat carries its role's protocol -> 0129
  0124 the predecessor is ending          -> 0130
  design 29, what a module declares       -> design 32

Applied to the code repositories too, because a stale reference is worse when numbers
collide than when they dangle: the reader lands on a real record that decided something
else.

Two reconciliations the merge forced, both real:

**0110 was marked wholly superseded and was not.** Its successor says in as many words that
everything 0110 decided about what a seat *is* stands untouched — and two records that
landed on the trunk rest on exactly that part. So it is accepted again, extended rather than
replaced, with a note saying which of its claims moved and where.

**A seat's protocol becomes columns, not fields.** The trunk moved the seat set out of
compiled code into a table the controller owns. This branch had added what a role accepts,
emits and serves to the Go slice. The decision is unaffected and the mechanism is better for
it: giving a role a protocol is now a write rather than a rebuild, which is the trunk's own
argument applied to what this branch added.

One check still fails and it fails on main too: a record resting on ADR 0112 while that is
still 'proposed'. Left alone — it is not this merge's to answer.

03-DESIGN/01-to-be/25-the-bus-on-nats.md

@@ -10,7 +10,7 @@ code:
 updated: 2026-09-27
 decisions:
   - 02-DECISIONS/0106-the-bus-is-nats.md
-  - 02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md
+  - 02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md
   - 02-DECISIONS/0116-the-bus-is-built-in-five-steps.md
   - 02-DECISIONS/0074-the-wire-is-specified-not-the-types.md
   - 02-DECISIONS/0079-the-foundation-seats-are-named-after-their-servers.md
@@ -18,8 +18,8 @@ decisions:
   - 02-DECISIONS/0043-a-module-broker-account-is-scoped-by-emits-and-consumes.md
   - 02-DECISIONS/0083-one-push-leaves-the-mesh-consistent.md
   - 02-DECISIONS/0039-what-the-sdk-holds-and-refuses.md
-  - 02-DECISIONS/0121-a-seat-carries-the-protocol-of-its-role.md
-  - 02-DECISIONS/0122-the-predecessor-is-ending-and-its-broker-goes-with-it.md
+  - 02-DECISIONS/0129-a-seat-carries-the-protocol-of-its-role.md
+  - 02-DECISIONS/0130-the-predecessor-is-ending-and-its-broker-goes-with-it.md
 ---
 
 # 25. The bus on NATS
@@ -49,7 +49,7 @@ mesh's own state lives, and where what a module may say is decided by what it de
 The last two rows are the ones worth dwelling on, because they are not messaging in the sense of
 carrying bytes from A to B. **A role is addressable**, so a caller names the capability and never
 the module or the node — and the implementation can be replaced under it without a caller
-changing ([ADR 0118](../../02-DECISIONS/0118-a-module-declares-its-own-seats.md)). That is a
+changing ([ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md)). That is a
 property of the mesh's architecture that happens to be expressed in subjects.
 
 And more of the mesh lands here as it is built: conditions and observed state in key-value
@@ -60,7 +60,7 @@ is a message being moved; all of it is the bus being the mesh's centre.
 
 **What a module sees of it is small and derived.** It declares what it emits, consumes, serves
 and uses, and the subjects, streams, consumers and permissions all follow from that
-([design 29](29-what-a-module-declares.md)). The sdk's contract — `request`, `handle`, `publish`,
+([design 29](32-what-a-module-declares.md)). The sdk's contract — `request`, `handle`, `publish`,
 `subscribe`, `close` — is the whole surface, and it does not change
 ([ADR 0039](../../02-DECISIONS/0039-what-the-sdk-holds-and-refuses.md)).
 
@@ -82,7 +82,7 @@ mesh.seat.<seat>.tool.<verb>      a role's tool                (core request/rep
 mesh.ask.<node>.<command>         the controller's command api (core request/reply)
 ```
 
-**Revised 2026-09-27** ([ADR 0121](../../02-DECISIONS/0121-a-seat-carries-the-protocol-of-its-role.md)):
+**Revised 2026-09-27** ([ADR 0129](../../02-DECISIONS/0129-a-seat-carries-the-protocol-of-its-role.md)):
 **`mesh.build.request`, `mesh.control.built` and the BUILDS stream are gone.** A build is work submitted to a role, and the
 mesh already has a shape for that — a seat's `accept` subjects, on a work queue with a queue group of
 holders, which is what a build queue shared by several machines *is*. Keeping a second mechanism for it
@@ -91,7 +91,7 @@ seat's own event — which is why the control branch loses its copy too: one pub
 asked, the controller that records it and the catalogue that places it — the fan-out a shared exchange gave for free, as a derived subject rather than a
 configured topology.
 
-**Revised 2026-09-26** ([design 29](29-what-a-module-declares.md)): a module's events and tools
+**Revised 2026-09-26** ([design 29](32-what-a-module-declares.md)): a module's events and tools
 moved from `mesh.events.*` / `mesh.tools.*` into one namespace per module, `mesh.mod.<module>.>`,
 so a module's authority over its own name is a single subject pattern the server enforces — and
 each carries a **kind token**, without which an events stream's filter would capture tool calls.
@@ -303,7 +303,7 @@ the private network. It is raised at genesis like the store, adopted as a module
 phase.
 
 **The deprecated broker is an ordinary module, not a compatibility layer.** Revision, second review
-([ADR 0119](../../02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md)): earlier text here, and
+([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md)): earlier text here, and
 ADR 0106 before it, called it `lavinmq-compat` — one purpose, the predecessor's clients, and a
 retirement condition of no client connected for a period the operator sets. It is none of those.
 A module may legitimately need an AMQP broker as a **backing service**, the way it needs a
@@ -312,11 +312,11 @@ foundation, never raised at genesis, installed when something wants it and absen
 that does not. There is no retirement condition, because the day its last client disappears is
 not a day anything is waiting for.
 
-**Revised 2026-09-27** ([ADR 0122](../../02-DECISIONS/0122-the-predecessor-is-ending-and-its-broker-goes-with-it.md)):
+**Revised 2026-09-27** ([ADR 0130](../../02-DECISIONS/0130-the-predecessor-is-ending-and-its-broker-goes-with-it.md)):
 **that day is coming.** The predecessor is deprecated — some of it still running, none of it being
 migrated, left to stop rather than moved — so the broker retires once nothing requires `amqp`. Still no
 retirement *condition* and no end-date machinery: a provision with no consumers has its provider
-unassigned, which is the ordinary mechanism and is ADR 0119 being paid off rather than revised. What
+unassigned, which is the ordinary mechanism and is ADR 0127 being paid off rather than revised. What
 also goes with it is the tooling that reaches this installation's machines remotely, because the
 predecessor's own mesh talks over that broker — so the rollout is driven from the node, or before the
 broker stops.
@@ -534,7 +534,7 @@ find what changed and why.
 **Still open:**
 
 - ~~Whether EVENTS should be one stream or one per emitting module.~~ **Closed**
-  ([ADR 0119](../../02-DECISIONS/0119-amqp-is-a-provision-not-the-bus.md) (superseding [ADR 0117](../../02-DECISIONS/0117-the-bus-is-the-only-broker.md))): one stream, and not as a
+  ([ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md) (superseding [ADR 0125](../../02-DECISIONS/0125-the-bus-is-the-only-broker.md))): one stream, and not as a
   preference — the streams the bus is made of are composed as configuration before any module
   runs, because a provisioner is itself a module that needs a bus account to start. Bootstrapping
   decides it.