03-DESIGN/01-to-be/22-the-work-ahead.md

@@ -79,8 +79,14 @@ raises gitea and publishes the SDK before the base build. Those close together i
 **Why last.** The hardest and riskiest, and it needs everything above: an installer that completes,
 a protocol that agrees, a registry to publish to. Issue 051.
 
-- [ ] 3.1 the store is adopted — raised at genesis, then held as the `postgres` module; one server,
-      the controller's records and every module's database in it
+- [x] 3.1 the store is adopted — raised at genesis, then held as the `postgres` module; one server,
+      the controller's records and every module's database in it. *(Adopted in place: the module's
+      server names the same container and the same pinned upstream image the foundation runs, so the
+      applier reconciles it rather than raising a second postgres. Proven 22/22 in the one-node lab —
+      the catalogue, a `postgres-database` consumer, gets its database from it. Follow-up: the store
+      binds `0.0.0.0` from genesis so a mesh consumer can reach it, but the packet filter is
+      installed later — a brief pre-filter window where `mesh-store` is open before `from: mesh`
+      clamps it; bring the filter up earlier or bind narrower at genesis.)*
 - [ ] 3.2 the broker is adopted — one `lavinmq`, the `/` vhost for the mesh bus, a vhost per
       consumer that requires `amqp`; the second server gone
 - [ ] 3.3 an upgrade of each, proven: a store the controller reads from, a broker over the