Renumber the records 1 to 23

The consolidation left a sparse sequence -- 1, 4, 6, 7, 9, 10, 12, 15, 16, 18,
19, 25, 34, 35, 36, 37, 40, 42, 44, 45, 48, 49, 58 -- where the gaps were only
the archaeology of what used to be there.

Renumbered contiguously. Renames run in ascending order, so every target number
is already free and no two files ever collide.

The reference rewrite is one simultaneous pass rather than a sequence of
replacements. Numbers moved into slots other numbers were vacating -- the node
host went 37 to 16 while the lab went 16 to 9 -- so replacing one at a time
would have cascaded and silently pointed things at the wrong record.

Seven plain-text references survived the merges as prose rather than links,
naming records that no longer existed: the enrolment token, the link boundary,
what a declaration is, reachability, the repository structure. Each mapped to
the consolidated record that now holds it.

Verified rather than assumed: every [ADR NNNN](path) link now has matching text
and target, checked across the whole repository, and the checker passes.

Frontmatter `consolidates:` lists dropped -- they named records that are gone,
and each consolidated record already says in prose what it absorbed.

01-RESEARCH/011-the-module-graph/worked-provider.md

@@ -149,7 +149,7 @@ Steps 2 and 3 happen **before there is a mesh to do them**. So provisioning is n
 control-plane service that consumers use; it is part of the bootstrap, and part of what the
 carried bundle has to be able to express.
 
-**Which strains what a declaration is.** [ADR 0037](../../02-DECISIONS/0037-the-node-host.md)
+**Which strains what a declaration is.** [ADR 0016](../../02-DECISIONS/0016-the-node-host.md)
 has the host applying *declared state on this machine*. A database inside a running store is not
 a file or a unit — and at bootstrap it is, at least, local: the store is on the same machine as
 the host applying the bundle.
@@ -158,7 +158,7 @@ Later it is not. A consumer on one node provisioned from a store on another is t
 case, and reaching it is not the host's job.
 
 **Resolved as two mechanisms, which is the answer rather than a compromise**
-([ADR 0037](../../02-DECISIONS/0037-the-node-host.md)). The host
+([ADR 0016](../../02-DECISIONS/0016-the-node-host.md)). The host
 runs bootstrap actions locally from the bundle; the control plane provisions across the mesh
 afterwards. Different actors, different scopes, different trust paths — so there is no single
 operation with a tier boundary running through it.
@@ -279,7 +279,7 @@ of them is work.
 | Group | What happens under the rule |
 |---|---|
 | **The owner and its machinery** — the mesh module, the SDK, the environment and configuration synchronisers, secrets | Nothing. It owns the database. |
-| **Node appliers** — the overlay, the shell daemon, the resolver | **Already resolved.** [ADR 0037](../../02-DECISIONS/0037-the-node-host.md) stops the host querying the mesh database, decided for tier reasons with nothing to do with this. |
+| **Node appliers** — the overlay, the shell daemon, the resolver | **Already resolved.** [ADR 0016](../../02-DECISIONS/0016-the-node-host.md) stops the host querying the mesh database, decided for tier reasons with nothing to do with this. |
 | **Foreign tenants** — the work engine (10 tables), the knowledge base (2), pipeline logs (1) | They need **their own database**. They are not reading the registry; they are storing their own data in it. |
 | **Genuine cross-context reads** — the work engine reads `nodes`; two others read a handful | The only ones needing an interface or events. |
 
@@ -312,7 +312,7 @@ not the distinction.
 | when the other side is down | you cannot answer | you answer from your copy |
 | what you must handle | a round trip that can fail | events you missed while you were down |
 
-**What decides is not taste.** [ADR 0036](../../02-DECISIONS/0036-a-node-and-how-it-joins.md)
+**What decides is not taste.** [ADR 0015](../../02-DECISIONS/0015-a-node-and-how-it-joins.md)
 makes disconnection an ordinary situation rather than an exception. So:
 
 > **Anything that must keep working while disconnected cannot use a request** — there is nobody
@@ -354,14 +354,14 @@ proves it cannot be a global rule.
 
 **What happens to a grant when the consumer is removed?** The game is uninstalled. Its database
 still exists, holding its data. Dropping it silently is data loss; keeping it forever is a leak.
-[ADR 0037](../../02-DECISIONS/0037-the-node-host.md) says
+[ADR 0016](../../02-DECISIONS/0016-the-node-host.md) says
 the host removes what it applied and no longer declares — but this is not on the host, it is
 inside another module's state, and the same reasoning does not obviously carry.
 
 **Where does node-derived configuration come from?** (3) The control plane composes a
 declaration, and cannot know this machine's memory. Either the host fills in a blank the
 declaration leaves — which makes the host decide something, against
-[ADR 0037](../../02-DECISIONS/0037-the-node-host.md) — or the control
+[ADR 0016](../../02-DECISIONS/0016-the-node-host.md) — or the control
 plane reads the node's inventory first and composes with it. The second is consistent and means
 a declaration is composed *per node from what the node reported*, which is a stronger claim than
 anything recorded so far.
@@ -421,7 +421,7 @@ But two things differ *between* them, and both matter more than the similarity.
 
 [ADR 0001](../../02-DECISIONS/0001-nodes-communicate-over-a-broker.md) makes the broker the
 channel every node takes work from, and
-[ADR 0036](../../02-DECISIONS/0036-a-node-and-how-it-joins.md) makes it the security
+[ADR 0015](../../02-DECISIONS/0015-a-node-and-how-it-joins.md) makes it the security
 boundary — everything a node applies arrives through it.
 
 So the module providing the broker is also **the way modules are managed**. A declaration cannot
@@ -430,7 +430,7 @@ reconfigured. Nothing else in the catalogue has that property; the store is cons
 control plane but is not how the control plane *reaches* anything.
 
 This is exactly what the carried bundle exists for
-([ADR 0036](../../02-DECISIONS/0036-a-node-and-how-it-joins.md)): the broker is raised from
+([ADR 0015](../../02-DECISIONS/0015-a-node-and-how-it-joins.md)): the broker is raised from
 what the host carries, before there is a channel, because there is no other way to raise it.
 Recorded here because it is a constraint on *one module*, not a general rule, and a schema with
 no way to say so hides it.
@@ -439,7 +439,7 @@ no way to say so hides it.
 
 The broker is one per mesh — a single point of failure and a single point of trust, by decision
 rather than by accident. The store cannot be: a node that must keep working while disconnected
-([ADR 0036](../../02-DECISIONS/0036-a-node-and-how-it-joins.md)) cannot depend on a database
+([ADR 0015](../../02-DECISIONS/0015-a-node-and-how-it-joins.md)) cannot depend on a database
 somewhere else.
 
 Same nine properties, opposite answers. Which settles something the cases file left open: **how