Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

modules/minio/client.ts

@@ -1,4 +1,4 @@
-// The MinIO admin client — minio's own code, living in the module (novox/hq ADR 0044). Ported out
+// The MinIO admin client — minio's own code, living in the module (novox/hq ADR 0039). Ported out
 // of the shared hal sdk, where a change to MinIO's surface rebuilt everything; here it rebuilds only
 // minio. This module's tools, its provisioner and its events entrypoint import it; nothing outside
 // minio does.
@@ -207,7 +207,7 @@ export class MinioClient {
   /**
    * Create a service account scoped to one bucket, under a given access key and secret key, and
    * return the pair. The secret key is the mesh's — the mesh mints one password per consumer and
-   * hands a copy to both ends (novox/hq ADR 0053), so minio sets that as the secret rather than
+   * hands a copy to both ends (novox/hq ADR 0048), so minio sets that as the secret rather than
    * generating one the consumer could never learn. The MinIO admin REST API encrypts this request
    * with a key derived (Argon2) from the root secret, which node built-ins cannot reproduce — so, as
    * hal did, the module drives the `mc` CLI, which the runtime image bundles.

modules/minio/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-minio",
   "version": "0.1.0",
-  "description": "minio — S3-compatible object store. Its admin client, tools, provisioner and events live here (novox/hq ADR 0044).",
+  "description": "minio — S3-compatible object store. Its admin client, tools, provisioner and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {

modules/minio/provisioner/index.ts

@@ -1,13 +1,13 @@
 // minio's provisioner — the adapter that makes minio a provider of the mesh `s3-bucket` interface
 // (the name in module.json's `provides`). The reconcile loop, the contributions file, and reading
 // the mesh's minted secret are the sdk harness's; this writes only the per-service half: how minio
-// creates and removes a consumer's bucket and its scoped access key (novox/hq ADR 0044/0045/0053).
+// creates and removes a consumer's bucket and its scoped access key (novox/hq ADR 0039/0040/0048).
 //
 // The `s3-bucket` interface: a consumer connects to an S3 endpoint with an access key confined to
 // its own bucket. It depends on `s3-bucket`, not on minio, so any S3-compatible provider could serve
 // it.
 //
-// **The access key and its secret are the mesh's, not the provisioner's (ADR 0053).** The mesh
+// **The access key and its secret are the mesh's, not the provisioner's (ADR 0048).** The mesh
 // derives the login (the access-key id) and hands it to both ends, and mints the secret key. minio
 // creates the service account under exactly that access key with exactly that secret — a credential
 // the provisioner invented is one the consumer could never present. The bucket is derived from the

modules/minio/tools/index.ts

@@ -1,4 +1,4 @@
-// minio's tools — ported here from the shared sdk (novox/hq ADR 0044), importing minio's own client.
+// minio's tools — ported here from the shared sdk (novox/hq ADR 0039), importing minio's own client.
 // They return structured data; the mesh serves them through the sdk's tool harness. These are the
 // read/inspect operations useful to an operator; creating storage for a consumer is the provisioner's
 // job, not a tool's.