Merge main: renumber this branch's records around the trunk's

Both lines of work numbered from the same point, so four decision records and one design
document existed twice with different content. The trunk keeps its numbers and this branch
yields — the only rule that scales, because the trunk's are already cited by what merged
before them.

  0117 the bus is the only broker        -> 0125
  0118 a module declares its own seats   -> 0126
  0119 amqp is a provision, not the bus  -> 0127
  0120 the mesh bus is required          -> 0128
  0123 a seat carries its role's protocol -> 0129
  0124 the predecessor is ending          -> 0130
  design 29, what a module declares       -> design 32

Applied to the code repositories too, because a stale reference is worse when numbers
collide than when they dangle: the reader lands on a real record that decided something
else.

Two reconciliations the merge forced, both real:

**0110 was marked wholly superseded and was not.** Its successor says in as many words that
everything 0110 decided about what a seat *is* stands untouched — and two records that
landed on the trunk rest on exactly that part. So it is accepted again, extended rather than
replaced, with a note saying which of its claims moved and where.

**A seat's protocol becomes columns, not fields.** The trunk moved the seat set out of
compiled code into a table the controller owns. This branch had added what a role accepts,
emits and serves to the Go slice. The decision is unaffected and the mechanism is better for
it: giving a role a protocol is now a write rather than a rebuild, which is the trunk's own
argument applied to what this branch added.

One check still fails and it fails on main too: a record resting on ADR 0112 while that is
still 'proposed'. Left alone — it is not this merge's to answer.

03-DESIGN/01-to-be/26-the-seats.md

@@ -8,12 +8,13 @@ code:
   - mesh-controller cmd/mesh-controller/source.go
   - mesh-controller internal/inventory/migrations/0032-a-source-may-live-on-a-seat.sql
   - mesh-catalog modules/gitea/module.json
-updated: 2026-09-26
+updated: 2026-09-27
 decisions:
-  - 02-DECISIONS/0118-a-module-declares-its-own-seats.md
-  - 02-DECISIONS/0120-the-mesh-bus-is-required-not-ambient.md
+  - 02-DECISIONS/0126-a-module-declares-its-own-seats.md
+  - 02-DECISIONS/0128-the-mesh-bus-is-required-not-ambient.md
   - 02-DECISIONS/0111-a-build-source-is-on-the-git-seat-or-external.md
   - 02-DECISIONS/0109-a-package-registry-seat-is-one-per-ecosystem.md
+  - 02-DECISIONS/0117-a-machines-uplink-is-a-seat.md
 ---
 
 # 26 — The seats
@@ -49,13 +50,26 @@ nobody argued for is an entry nobody can explain.
 ## The set
 
 **The set is derived, and only the mesh's half is written here.** Revision, 2026-09-26
-([ADR 0118](../../02-DECISIONS/0118-a-module-declares-its-own-seats.md), superseding
+([ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md), superseding
 [ADR 0110](../../02-DECISIONS/0110-a-seat-is-a-module-assignment-from-a-closed-set.md)): a module
 declares its own seats with their protocols, so the seats a mesh has are the mesh's own **plus
 every registered module's**. The set is still closed — a seat named nowhere is refused — but it is
 computed from the catalogue rather than maintained by hand, which is the property 0110 actually
 needed and the table could not keep.
 
+**And the mesh's own half is data, named for its scope.** Revision, 2026-09-27, reconciling two
+records made in parallel: [ADR 0121](../../02-DECISIONS/0121-a-system-seat-is-named-for-its-scope-and-modules-define-their-own.md)
+names a system seat for the scope it is held at — `mesh-*` for one per mesh, `node-*` for one per
+machine — and [ADR 0122](../../02-DECISIONS/0122-a-seat-is-data-a-rename-is-a-database-update.md) moves
+the set out of compiled code into a table the controller owns, so a rename is one write rather than a
+rebuild of everything that names one.
+
+So the set has two halves and neither is written out here: the mesh's own, which the controller holds
+as rows, and every registered module's, which is computed from the catalogue. What this document keeps
+is what a seat *is* — the rest would be a third copy, stale the first time somebody renamed one, which
+is the fault ADR 0122 exists about.
+
+
 **Every seat below is named `mesh-*`, and the prefix is the reservation rule**: a module declaring
 any `mesh-*` name is refused at registration, so there is no reserved-names list to drift. Ten of
 these are renamed to restore [ADR 0079](../../02-DECISIONS/0079-the-foundation-seats-are-named-after-their-servers.md)'s
@@ -82,7 +96,7 @@ convention, which later seats departed from.
 The controller holds **the mesh's own** entries in code, and a test asserts their size and that
 every one names the record that made it a seat. A module's seats are not here and never will be —
 they are read from the catalogue. **This table and
-[ADR 0118](../../02-DECISIONS/0118-a-module-declares-its-own-seats.md) govern, and code that
+[ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md) govern, and code that
 disagrees is what is wrong.** The implementation in progress predates several
 things here: seats held by assignments rather than claimed by definitions, the `mesh-vault` seat and
 its reservation, and the foundation's seats delivering nothing. It is brought to this table before it
@@ -171,7 +185,7 @@ still to take.
 
 ## How it is checked
 
-The rules here are [ADR 0118](../../02-DECISIONS/0118-a-module-declares-its-own-seats.md)'s —
+The rules here are [ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md)'s —
 which supersedes [ADR 0110](../../02-DECISIONS/0110-a-seat-is-a-module-assignment-from-a-closed-set.md)
 and keeps every rule below except how the set is formed — and
 [ADR 0111](../../02-DECISIONS/0111-a-build-source-is-on-the-git-seat-or-external.md)'s. Each is