Graduate issues 067 and 068 to decisions and to-be designs

ADR 0084 (extends 0027) — a provision is served by a node-scoped provider the
consumer selects, defaulting to co-location; a module may instead carry a private
embedded instance that is not a provision. Design: 01-to-be/23-choosing-a-provider.

ADR 0085 (extends 0031) — a secret is a provision and the vault is the module that
provides it; a module's own local secret becomes an ordinary pair credential that
rotates through the existing machinery, while the controller's provisioning-credential
mint (0048) is unchanged. Design: 01-to-be/24-the-secrets-vault; doc 13 amended to
cross-link the non-pair secret.

Issues 067/068 marked resolved with amended-design set. ADR index regenerated;
records and index checks pass.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

04-ISSUES/067-a-provision-cannot-name-which-provider-serves-it/00-report.md

@@ -1,9 +1,9 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-20
 located-in: []
 fixed-by:
-amended-design:
+amended-design: 03-DESIGN/01-to-be/23-choosing-a-provider.md
 ---
 
 # A provision cannot name which provider serves it

04-ISSUES/068-secrets-have-no-owning-module/00-report.md

@@ -1,9 +1,9 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-20
 located-in: []
 fixed-by:
-amended-design:
+amended-design: 03-DESIGN/01-to-be/24-the-secrets-vault.md
 ---
 
 # Secrets have no owning module