diff --git a/modules/audit-logger/audit.ts b/modules/audit-logger/audit.ts
index aa7ee46..cba2ef7 100644
--- a/modules/audit-logger/audit.ts
+++ b/modules/audit-logger/audit.ts
@@ -1,6 +1,6 @@
 // The audit handler — appends one line per event to an append-only audit log. It is the whole of
 // the module's code: an audit logger is not a privileged component, only a module that listens to
-// everything and writes it down (novox/hq ADR 0046).
+// everything and writes it down (novox/hq ADR 0041).
 
 import { appendFile, mkdir } from "node:fs/promises";
 import { dirname } from "node:path";
@@ -12,7 +12,7 @@ export function auditLogPath(env: NodeJS.ProcessEnv = process.env): string {
 }
 
 /** Append an event to the trail as one JSON line, keeping the metadata an audit needs first. The id
- *  is the event's own x-event-id (ADR 0047) — the handle a reader dedups the at-least-once trail on. */
+ *  is the event's own x-event-id (ADR 0042) — the handle a reader dedups the at-least-once trail on. */
 export async function record(event: Event, path: string): Promise<void> {
   const line =
     JSON.stringify({
diff --git a/modules/bazarr/client.ts b/modules/bazarr/client.ts
index 9d6acce..c312938 100644
--- a/modules/bazarr/client.ts
+++ b/modules/bazarr/client.ts
@@ -1,4 +1,4 @@
-// The Bazarr API client — bazarr's own code, living in the module (novox/hq ADR 0044). Bazarr
+// The Bazarr API client — bazarr's own code, living in the module (novox/hq ADR 0039). Bazarr
 // manages subtitles for a Sonarr/Radarr library: it tracks which episodes and movies are still
 // missing subtitles, searches providers for them, and records what it downloaded. This client
 // talks its /api surface (keyed by an X-API-KEY header); bazarr's tools and events import it.
@@ -36,7 +36,7 @@ export interface HistoryEntry {
   description?: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/bazarr/index.ts b/modules/bazarr/index.ts
index d915972..42bbe4f 100644
--- a/modules/bazarr/index.ts
+++ b/modules/bazarr/index.ts
@@ -3,7 +3,7 @@
 // the missing-subtitle list, and when it succeeds a subtitle appears in its history. That is worth
 // announcing to the mesh.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.bazarr.subtitle.downloaded   — a subtitle was fetched for an episode or movie
 //
 // Bazarr has nothing on the mesh it usefully reacts to (a download completing is Sonarr/Radarr's
diff --git a/modules/bazarr/package.json b/modules/bazarr/package.json
index 20c3e13..de4a2cf 100644
--- a/modules/bazarr/package.json
+++ b/modules/bazarr/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-bazarr",
   "version": "0.1.0",
-  "description": "bazarr — subtitle management. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "bazarr — subtitle management. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/bazarr/tools/index.ts b/modules/bazarr/tools/index.ts
index 3e0a574..1cc571d 100644
--- a/modules/bazarr/tools/index.ts
+++ b/modules/bazarr/tools/index.ts
@@ -1,4 +1,4 @@
-// bazarr's tools — its own code (novox/hq ADR 0044), importing bazarr's client. They return
+// bazarr's tools — its own code (novox/hq ADR 0039), importing bazarr's client. They return
 // structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/bookshelf/client.ts b/modules/bookshelf/client.ts
index 7c9003a..14f63e4 100644
--- a/modules/bookshelf/client.ts
+++ b/modules/bookshelf/client.ts
@@ -1,4 +1,4 @@
-// The Bookshelf API client — bookshelf's own code, living in the module (novox/hq ADR 0044).
+// The Bookshelf API client — bookshelf's own code, living in the module (novox/hq ADR 0039).
 // Ported from the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own
 // copy, so a change to Bookshelf's API rebuilds only bookshelf and nothing else. Both this module's
 // tools and its events entrypoint import it, and nothing outside bookshelf does.
diff --git a/modules/bookshelf/index.ts b/modules/bookshelf/index.ts
index 6c3fcf4..3a7bfc5 100644
--- a/modules/bookshelf/index.ts
+++ b/modules/bookshelf/index.ts
@@ -2,7 +2,7 @@
 // download queue and turns its comings and goings into mesh events — the same mechanism radarr uses,
 // applied to a Servarr book manager.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.bookshelf.book.grabbed        — a release entered the queue (Bookshelf grabbed it)
 //   module.bookshelf.download.completed  — a release left the queue, imported. This routing key is
 //                                          what the plex module consumes (module.*.download.completed)
diff --git a/modules/bookshelf/package.json b/modules/bookshelf/package.json
index f39dee7..5328aaa 100644
--- a/modules/bookshelf/package.json
+++ b/modules/bookshelf/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-bookshelf",
   "version": "0.1.0",
-  "description": "bookshelf — ebook/audiobook management (Readarr fork). Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "bookshelf — ebook/audiobook management (Readarr fork). Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/bookshelf/tools/index.ts b/modules/bookshelf/tools/index.ts
index 1e00c90..c8a4e5a 100644
--- a/modules/bookshelf/tools/index.ts
+++ b/modules/bookshelf/tools/index.ts
@@ -1,4 +1,4 @@
-// bookshelf's tools — ported from the shared hal `arr` sdk (novox/hq ADR 0044), importing
+// bookshelf's tools — ported from the shared hal `arr` sdk (novox/hq ADR 0039), importing
 // bookshelf's own client. They return structured data (not the pre-formatted text hal returned); the
 // mesh serves them through the sdk's tool harness. Bookshelf has no calendar endpoint, so there is
 // no calendar tool — matching hal, which excluded it from its calendar-capable apps.
diff --git a/modules/cloudflare-dns/client.ts b/modules/cloudflare-dns/client.ts
index 725e042..80e848f 100644
--- a/modules/cloudflare-dns/client.ts
+++ b/modules/cloudflare-dns/client.ts
@@ -1,5 +1,5 @@
-// cloudflare-dns's own code (novox/hq ADR 0044). It provides the mesh `public-dns` interface
-// (ADR 0049): a public name that resolves to the mesh's public ingress. Cloudflare is one registrar
+// cloudflare-dns's own code (novox/hq ADR 0039). It provides the mesh `public-dns` interface
+// (ADR 0044): a public name that resolves to the mesh's public ingress. Cloudflare is one registrar
 // behind the neutral interface — a consumer names `public-dns`, never Cloudflare — so this file is
 // the only place Cloudflare's API appears, and swapping registrars swaps only this module.
 
@@ -24,7 +24,7 @@ export class CloudflareClient {
 
   static fromEnv(env: NodeJS.ProcessEnv = process.env): CloudflareClient {
     // Which zone, domain and ingress are a mesh's own facts, not this module's — so they are
-    // settings, merged into a config file the mesh manages (novox/hq ADR 0051), read here. The
+    // settings, merged into a config file the mesh manages (novox/hq ADR 0046), read here. The
     // token is the one secret and stays an own-secret. Env is honoured as a fallback for a
     // hand-run instance, but the deployed path is the config file settings fill.
     const config = readConfig(env.MESH_CLOUDFLARE_CONFIG_FILE);
diff --git a/modules/cloudflare-dns/package.json b/modules/cloudflare-dns/package.json
index 01e230a..a032b8e 100644
--- a/modules/cloudflare-dns/package.json
+++ b/modules/cloudflare-dns/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-cloudflare-dns",
   "version": "0.1.0",
-  "description": "cloudflare-dns — a public-dns provider (ADR 0049): registers public names at Cloudflare.
+  "description": "cloudflare-dns — a public-dns provider (ADR 0044): registers public names at Cloudflare.
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/cloudflare-dns/provisioner/index.ts b/modules/cloudflare-dns/provisioner/index.ts
index d214dab..e192843 100644
--- a/modules/cloudflare-dns/provisioner/index.ts
+++ b/modules/cloudflare-dns/provisioner/index.ts
@@ -1,14 +1,14 @@
 // cloudflare-dns's provisioner — the adapter making it a provider of the mesh `public-dns` interface
-// (novox/hq ADR 0049). The reconcile loop and the contributions file are the sdk harness's; this
+// (novox/hq ADR 0044). The reconcile loop and the contributions file are the sdk harness's; this
 // writes only the per-registrar half: register a consumer's public name at Cloudflare, pointing it
-// at the mesh's ingress, and remove it when the consumer is withdrawn (ADR 0053).
+// at the mesh's ingress, and remove it when the consumer is withdrawn (ADR 0048).
 //
 // The `public-dns` interface hands a consumer { fqdn, target, ttl } — a name that resolves publicly
 // and what it resolves to. Like umami's analytics it is a *data* provision, not a credential one:
 // nothing the mesh mints is set here (a DNS record is public, and the only secret is this module's
 // own Cloudflare token, which never leaves). So the password the harness carries is unused; the name
 // is derived from the login the mesh gave the consumer, which the consumer can derive too. Delivering
-// the record back to the consumer is the data-provision return path ADR 0053 leaves out of scope.
+// the record back to the consumer is the data-provision return path ADR 0048 leaves out of scope.
 
 import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { emit } from "@novox/mesh-sdk/events";
diff --git a/modules/dnsmasq/client.ts b/modules/dnsmasq/client.ts
index ae3540f..d0c8954 100644
--- a/modules/dnsmasq/client.ts
+++ b/modules/dnsmasq/client.ts
@@ -1,4 +1,4 @@
-// dnsmasq's own code, living in the module (novox/hq ADR 0044). dnsmasq here is a pure resolver: it
+// dnsmasq's own code, living in the module (novox/hq ADR 0039). dnsmasq here is a pure resolver: it
 // answers the mesh's generated wildcard names (<service>.<node>.<suffix>) and forwards nothing. So
 // its code reads what it was told to answer, and can resolve through itself to prove that it does.
 
diff --git a/modules/dnsmasq/index.ts b/modules/dnsmasq/index.ts
index 15a50b9..2c428c8 100644
--- a/modules/dnsmasq/index.ts
+++ b/modules/dnsmasq/index.ts
@@ -3,7 +3,7 @@
 // announces, from the resolver's own vantage, that a name became (or stopped being) resolvable on
 // this node: DNS having actually propagated here, distinct from the mesh's own node.* events.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.dnsmasq.name.added    — this node's resolver now answers a machine's name
 //   module.dnsmasq.name.removed  — it no longer does
 
diff --git a/modules/dnsmasq/tools/index.ts b/modules/dnsmasq/tools/index.ts
index 472d322..bfeb7d8 100644
--- a/modules/dnsmasq/tools/index.ts
+++ b/modules/dnsmasq/tools/index.ts
@@ -1,5 +1,5 @@
 // dnsmasq's tools — a resolver's two useful questions: what does it answer, and does it answer a
-// given name. Moved into the module (novox/hq ADR 0044); the mesh serves them through the sdk.
+// given name. Moved into the module (novox/hq ADR 0039); the mesh serves them through the sdk.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { DnsmasqClient } from "../client.js";
diff --git a/modules/fail2ban/client.ts b/modules/fail2ban/client.ts
index 109c4c1..1a117bc 100644
--- a/modules/fail2ban/client.ts
+++ b/modules/fail2ban/client.ts
@@ -1,4 +1,4 @@
-// fail2ban's own code, in the module (novox/hq ADR 0044). The jails and the daemon are declared
+// fail2ban's own code, in the module (novox/hq ADR 0039). The jails and the daemon are declared
 // resources — the mesh writes /etc/fail2ban/jail.d/* and keeps fail2ban.service running (see
 // module.json). This code exists only to read and steer the *live* state the daemon owns at
 // runtime: which IPs are banned right now, and the manual ban/unban an operator reaches for. That
diff --git a/modules/firewall/client.ts b/modules/firewall/client.ts
index 5b71df0..92d2be5 100644
--- a/modules/firewall/client.ts
+++ b/modules/firewall/client.ts
@@ -1,5 +1,5 @@
-// The firewall's own code, in the module (novox/hq ADR 0044). The mesh computes this node's whole
-// rule set from every module's `listens` and writes it to /etc/nftables.conf (novox/hq ADR 0050);
+// The firewall's own code, in the module (novox/hq ADR 0039). The mesh computes this node's whole
+// rule set from every module's `listens` and writes it to /etc/nftables.conf (novox/hq ADR 0045);
 // the module loads it (the nftables service, reloaded whenever the rules change). This code exists
 // only to read back what is actually enforced — the enforcement itself is declarative.
 
diff --git a/modules/firewall/package.json b/modules/firewall/package.json
index c80274f..381495e 100644
--- a/modules/firewall/package.json
+++ b/modules/firewall/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-firewall",
   "version": "0.1.0",
-  "description": "firewall — applies the mesh-computed packet filter (ADR 0050). Its diagnostic tool lives here.
+  "description": "firewall — applies the mesh-computed packet filter (ADR 0045). Its diagnostic tool lives here.
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/gitea/client.ts b/modules/gitea/client.ts
index 5fe7182..1fa36f4 100644
--- a/modules/gitea/client.ts
+++ b/modules/gitea/client.ts
@@ -1,4 +1,4 @@
-// The Gitea API client — gitea's own code, living in the module (novox/hq ADR 0044). Moved out of
+// The Gitea API client — gitea's own code, living in the module (novox/hq ADR 0039). Moved out of
 // the shared hal sdk, where a change to Gitea's API rebuilt everything; here it rebuilds only
 // gitea. Both this module's tools and its events entrypoint import it, and nothing outside gitea
 // does.
@@ -44,7 +44,7 @@ export interface GiteaLabel {
   name: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/gitea/index.ts b/modules/gitea/index.ts
index 15366b1..2731819 100644
--- a/modules/gitea/index.ts
+++ b/modules/gitea/index.ts
@@ -1,7 +1,7 @@
 // gitea's events. The tool runtime imports this once the broker is bound. It watches the forge and
 // emits what appeared.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.gitea.repo.created   — a repository appeared, however it was made (push, web UI, or tool)
 //
 // issue.opened and pull.merged are emitted from the tools (tools/index.ts), at the instant the mesh
diff --git a/modules/gitea/package.json b/modules/gitea/package.json
index fe30cf5..fe629bf 100644
--- a/modules/gitea/package.json
+++ b/modules/gitea/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-gitea",
   "version": "0.1.0",
-  "description": "gitea — git hosting. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "gitea — git hosting. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/gitea/tools/index.ts b/modules/gitea/tools/index.ts
index d970d9f..485521e 100644
--- a/modules/gitea/tools/index.ts
+++ b/modules/gitea/tools/index.ts
@@ -1,7 +1,7 @@
-// gitea's tools — moved here from the shared sdk (novox/hq ADR 0044), importing gitea's own client.
+// gitea's tools — moved here from the shared sdk (novox/hq ADR 0039), importing gitea's own client.
 // They return structured data; the mesh serves them through the sdk's tool harness.
 //
-// Two tools emit an event at the natural point of the action they take (novox/hq ADR 0046/0047):
+// Two tools emit an event at the natural point of the action they take (novox/hq ADR 0041/0042):
 // create-issue emits issue.opened, merge-pull-request emits pull.merged — the mesh's own hand on
 // the forge, announced the instant it moves. repo.created is deliberately NOT emitted here: repos
 // are far more often born from a `git push` or the web UI than from this tool, so the events
diff --git a/modules/grafana/client.ts b/modules/grafana/client.ts
index 00916c3..1e49069 100644
--- a/modules/grafana/client.ts
+++ b/modules/grafana/client.ts
@@ -1,4 +1,4 @@
-// Grafana's API client — grafana's own code, living in the module (novox/hq ADR 0044). Ported from
+// Grafana's API client — grafana's own code, living in the module (novox/hq ADR 0039). Ported from
 // the shared hal sdk, where a change here rebuilt everything; here it rebuilds only grafana. Both
 // this module's tools and its events entrypoint import it, and nothing outside grafana does.
 
@@ -37,7 +37,7 @@ export interface GrafanaAlert {
   activeAt?: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/grafana/index.ts b/modules/grafana/index.ts
index bb497c8..03e8814 100644
--- a/modules/grafana/index.ts
+++ b/modules/grafana/index.ts
@@ -1,7 +1,7 @@
 // grafana's events. The tool runtime imports this once the broker is bound. It watches unified
 // alerting and announces when an alert instance starts firing.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.grafana.alert.firing   — an alert instance entered the Alerting state
 //
 // A Grafana with no alerting configured simply never has a firing alert, so this observes nothing
diff --git a/modules/grafana/package.json b/modules/grafana/package.json
index 49003a9..cdeb561 100644
--- a/modules/grafana/package.json
+++ b/modules/grafana/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-grafana",
   "version": "0.1.0",
-  "description": "grafana — monitoring dashboards. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "grafana — monitoring dashboards. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/grafana/tools/index.ts b/modules/grafana/tools/index.ts
index 55fc89b..cc6bedd 100644
--- a/modules/grafana/tools/index.ts
+++ b/modules/grafana/tools/index.ts
@@ -1,4 +1,4 @@
-// grafana's tools — moved here from the shared hal sdk (novox/hq ADR 0044), importing grafana's own
+// grafana's tools — moved here from the shared hal sdk (novox/hq ADR 0039), importing grafana's own
 // client. They return structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/home-assistant/client.ts b/modules/home-assistant/client.ts
index d3900ba..525ec7e 100644
--- a/modules/home-assistant/client.ts
+++ b/modules/home-assistant/client.ts
@@ -1,5 +1,5 @@
 // The Home Assistant API client — home-assistant's own code, living in the module (novox/hq
-// ADR 0044). Both this module's tools and its events entrypoint import it, and nothing outside
+// ADR 0039). Both this module's tools and its events entrypoint import it, and nothing outside
 // home-assistant does. Talks to the HA REST API (/api) with a long-lived access token.
 
 import { readFileSync } from "node:fs";
@@ -20,7 +20,7 @@ export interface HAConfig {
   state?: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/home-assistant/index.ts b/modules/home-assistant/index.ts
index 0c9f275..aba7949 100644
--- a/modules/home-assistant/index.ts
+++ b/modules/home-assistant/index.ts
@@ -2,7 +2,7 @@
 // entities whose state changing is a real signal — a door opening, a lock turning, a switch
 // flipping — and emits when one does.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.home-assistant.state.changed   — a watched entity's state value changed
 //
 // Bounded on purpose. Home Assistant has hundreds of entities and many (temperature, humidity,
diff --git a/modules/home-assistant/package.json b/modules/home-assistant/package.json
index d5a8523..4118d4b 100644
--- a/modules/home-assistant/package.json
+++ b/modules/home-assistant/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-home-assistant",
   "version": "0.1.0",
-  "description": "home-assistant — home automation platform. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "home-assistant — home automation platform. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/home-assistant/tools/index.ts b/modules/home-assistant/tools/index.ts
index 4325658..154270b 100644
--- a/modules/home-assistant/tools/index.ts
+++ b/modules/home-assistant/tools/index.ts
@@ -1,4 +1,4 @@
-// home-assistant's tools — its own code (novox/hq ADR 0044), importing its own client. They return
+// home-assistant's tools — its own code (novox/hq ADR 0039), importing its own client. They return
 // structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/icecast/client.ts b/modules/icecast/client.ts
index 7035c3d..60f1b3a 100644
--- a/modules/icecast/client.ts
+++ b/modules/icecast/client.ts
@@ -1,4 +1,4 @@
-// Icecast's API client — icecast's own code, living in the module (novox/hq ADR 0044). Icecast is an
+// Icecast's API client — icecast's own code, living in the module (novox/hq ADR 0039). Icecast is an
 // audio streaming server: sources push mountpoints in, listeners pull them out. Its `/status-json.xsl`
 // endpoint reports the live mountpoints and their listener counts — the one thing worth watching, and
 // the basis for both the status tool and the stream started/stopped events.
@@ -35,7 +35,7 @@ interface RawSource {
   server_type?: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/icecast/index.ts b/modules/icecast/index.ts
index 38c2080..62523c3 100644
--- a/modules/icecast/index.ts
+++ b/modules/icecast/index.ts
@@ -1,7 +1,7 @@
 // icecast's events. The tool runtime imports this once the broker is bound. It watches the streaming
 // server and announces when a mountpoint goes live or drops.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.icecast.stream.started / .stopped   — a mountpoint appeared or disappeared
 //
 // A mountpoint exists only while a source is connected, so the set of mounts diffed over time is
diff --git a/modules/icecast/package.json b/modules/icecast/package.json
index fa2b925..8633cfe 100644
--- a/modules/icecast/package.json
+++ b/modules/icecast/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-icecast",
   "version": "0.1.0",
-  "description": "icecast — audio streaming server. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "icecast — audio streaming server. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/icecast/tools/index.ts b/modules/icecast/tools/index.ts
index 86b5828..82013d3 100644
--- a/modules/icecast/tools/index.ts
+++ b/modules/icecast/tools/index.ts
@@ -1,4 +1,4 @@
-// icecast's tools (novox/hq ADR 0044), importing icecast's own client.
+// icecast's tools (novox/hq ADR 0039), importing icecast's own client.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { IcecastClient } from "../client.js";
diff --git a/modules/influxdb/client.ts b/modules/influxdb/client.ts
index ab0fc73..120dfa2 100644
--- a/modules/influxdb/client.ts
+++ b/modules/influxdb/client.ts
@@ -1,4 +1,4 @@
-// The InfluxDB API client — influxdb's own code, living in the module (novox/hq ADR 0044). Only
+// The InfluxDB API client — influxdb's own code, living in the module (novox/hq ADR 0039). Only
 // this module's tools import it. Talks to the InfluxDB 2.x HTTP API (/api/v2) with a token.
 
 import { readFileSync } from "node:fs";
@@ -17,7 +17,7 @@ export interface InfluxBucket {
   retentionSeconds?: number;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/influxdb/package.json b/modules/influxdb/package.json
index ad7b949..50f3dfb 100644
--- a/modules/influxdb/package.json
+++ b/modules/influxdb/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-influxdb",
   "version": "0.1.0",
-  "description": "influxdb — time-series database. Its API client and tools live here (novox/hq ADR 0044).",
+  "description": "influxdb — time-series database. Its API client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/influxdb/tools/index.ts b/modules/influxdb/tools/index.ts
index a2e13ce..daa47ab 100644
--- a/modules/influxdb/tools/index.ts
+++ b/modules/influxdb/tools/index.ts
@@ -1,4 +1,4 @@
-// influxdb's tools — its own code (novox/hq ADR 0044), importing its own client. They return
+// influxdb's tools — its own code (novox/hq ADR 0039), importing its own client. They return
 // structured data; the mesh serves them through the sdk's tool harness. Read-only: health, bucket
 // listing, and Flux queries — no write path is exposed.
 
diff --git a/modules/jackett/client.ts b/modules/jackett/client.ts
index 1e76be3..61f5d92 100644
--- a/modules/jackett/client.ts
+++ b/modules/jackett/client.ts
@@ -1,4 +1,4 @@
-// The Jackett API client — jackett's own code, living in the module (novox/hq ADR 0044). Jackett is
+// The Jackett API client — jackett's own code, living in the module (novox/hq ADR 0039). Jackett is
 // an indexer proxy: it normalises many torrent trackers behind one Torznab surface. This client
 // talks its /api/v2.0 REST API, and only jackett's tools import it.
 
@@ -24,7 +24,7 @@ export interface JackettResult {
   link?: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/jackett/package.json b/modules/jackett/package.json
index 8ef721f..5f5e44b 100644
--- a/modules/jackett/package.json
+++ b/modules/jackett/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-jackett",
   "version": "0.1.0",
-  "description": "jackett — indexer proxy. Its API client and tools live here (novox/hq ADR 0044).",
+  "description": "jackett — indexer proxy. Its API client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/jackett/tools/index.ts b/modules/jackett/tools/index.ts
index b10ccad..ccb360a 100644
--- a/modules/jackett/tools/index.ts
+++ b/modules/jackett/tools/index.ts
@@ -1,4 +1,4 @@
-// jackett's tools — its own code (novox/hq ADR 0044), importing jackett's client. Jackett has
+// jackett's tools — its own code (novox/hq ADR 0039), importing jackett's client. Jackett has
 // nothing worth watching (an indexer proxy answers queries; it has no timeline of its own), so it
 // is a tools-only module: no events entrypoint, no broker. What is useful is asking it things.
 
diff --git a/modules/keycloak/client.ts b/modules/keycloak/client.ts
index 830418c..c5bedda 100644
--- a/modules/keycloak/client.ts
+++ b/modules/keycloak/client.ts
@@ -1,11 +1,11 @@
-// The Keycloak admin API client — keycloak's own code, living in the module (novox/hq ADR 0044).
+// The Keycloak admin API client — keycloak's own code, living in the module (novox/hq ADR 0039).
 // Moved out of the shared hal sdk, where a change to Keycloak's admin API rebuilt everything; here
 // it rebuilds only keycloak. Both this module's tools and its events entrypoint import it, and
 // nothing outside keycloak does.
 
 import { readFileSync } from "node:fs";
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/keycloak/index.ts b/modules/keycloak/index.ts
index 1a3bd85..451464c 100644
--- a/modules/keycloak/index.ts
+++ b/modules/keycloak/index.ts
@@ -1,6 +1,6 @@
 // keycloak's events. Keycloak's worth to the mesh is in what it changes — an identity created, a
 // client registered, a password reset — so its events are emitted from the admin actions themselves
-// (novox/hq ADR 0046/0047), not scraped back by polling. This module is the single vocabulary for
+// (novox/hq ADR 0041/0042), not scraped back by polling. This module is the single vocabulary for
 // them: every keycloak event goes through one of the helpers here, and the tools call them at the
 // point the change succeeds.
 //
diff --git a/modules/keycloak/package.json b/modules/keycloak/package.json
index 6076ad3..b94ee32 100644
--- a/modules/keycloak/package.json
+++ b/modules/keycloak/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-keycloak",
   "version": "0.1.0",
-  "description": "keycloak — identity and access. Its admin API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "keycloak — identity and access. Its admin API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/keycloak/tools/index.ts b/modules/keycloak/tools/index.ts
index 0382713..7f4bd30 100644
--- a/modules/keycloak/tools/index.ts
+++ b/modules/keycloak/tools/index.ts
@@ -1,4 +1,4 @@
-// keycloak's tools — moved here from the shared sdk (novox/hq ADR 0044), importing keycloak's own
+// keycloak's tools — moved here from the shared sdk (novox/hq ADR 0039), importing keycloak's own
 // client. They return structured data (not the hal MCP `{content:[...]}` shape); the mesh serves
 // them through the sdk's tool harness. Write actions announce themselves through the module's event
 // surface at the point they succeed.
diff --git a/modules/lidarr/client.ts b/modules/lidarr/client.ts
index fba07e1..8122bb2 100644
--- a/modules/lidarr/client.ts
+++ b/modules/lidarr/client.ts
@@ -1,4 +1,4 @@
-// The Lidarr API client — lidarr's own code, living in the module (novox/hq ADR 0044). Ported from
+// The Lidarr API client — lidarr's own code, living in the module (novox/hq ADR 0039). Ported from
 // the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own copy, so a
 // change to Lidarr's API rebuilds only lidarr and nothing else. Both this module's tools and its
 // events entrypoint import it, and nothing outside lidarr does.
diff --git a/modules/lidarr/index.ts b/modules/lidarr/index.ts
index 53e63db..10e4a81 100644
--- a/modules/lidarr/index.ts
+++ b/modules/lidarr/index.ts
@@ -1,7 +1,7 @@
 // lidarr's events. The tool runtime imports this once the broker is bound. It watches the download
 // queue and turns its comings and goings into mesh events.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.lidarr.album.grabbed        — a release entered the queue (Lidarr grabbed it)
 //   module.lidarr.download.completed   — a release left the queue, imported. The download.completed
 //                                        routing key matches what a media consumer subscribes to
diff --git a/modules/lidarr/package.json b/modules/lidarr/package.json
index c2a671d..deb03cf 100644
--- a/modules/lidarr/package.json
+++ b/modules/lidarr/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-lidarr",
   "version": "0.1.0",
-  "description": "lidarr — music management. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "lidarr — music management. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/lidarr/tools/index.ts b/modules/lidarr/tools/index.ts
index 85aee09..a0e78f3 100644
--- a/modules/lidarr/tools/index.ts
+++ b/modules/lidarr/tools/index.ts
@@ -1,4 +1,4 @@
-// lidarr's tools — ported from the shared hal sdk (novox/hq ADR 0044), importing lidarr's own
+// lidarr's tools — ported from the shared hal sdk (novox/hq ADR 0039), importing lidarr's own
 // client. They return structured data (not pre-formatted text as hal did); the mesh serves them
 // through the sdk's tool harness.
 
diff --git a/modules/mailu/client.ts b/modules/mailu/client.ts
index 32053cb..15d2203 100644
--- a/modules/mailu/client.ts
+++ b/modules/mailu/client.ts
@@ -1,4 +1,4 @@
-// The Mailu API client — mailu's own code, living in the module (novox/hq ADR 0044). Moved out of
+// The Mailu API client — mailu's own code, living in the module (novox/hq ADR 0039). Moved out of
 // the shared hal sdk, where a change to Mailu's surface rebuilt everything; here it rebuilds only
 // mailu. Both this module's tools and its events entrypoint import it, and nothing outside mailu does.
 //
@@ -45,7 +45,7 @@ export interface MailMessage {
 // The fields we ask doveadm for, once — kept together so read and search stay identical in shape.
 const FETCH_FIELDS = "date.received hdr.subject hdr.from body.snippet";
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/mailu/index.ts b/modules/mailu/index.ts
index 3526dd7..6c891b0 100644
--- a/modules/mailu/index.ts
+++ b/modules/mailu/index.ts
@@ -2,7 +2,7 @@
 // server's accounts and announces what changed, so the rest of the mesh can react to a mailbox
 // appearing or an alias being pointed somewhere new.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.mailu.user.created / .deleted     — a mailbox appeared or was removed
 //   module.mailu.alias.created / .deleted    — an alias was added or removed
 //
diff --git a/modules/mailu/package.json b/modules/mailu/package.json
index c640eac..00d231a 100644
--- a/modules/mailu/package.json
+++ b/modules/mailu/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-mailu",
   "version": "0.1.0",
-  "description": "mailu — mail server. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "mailu — mail server. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/mailu/tools/index.ts b/modules/mailu/tools/index.ts
index e948075..c1ab925 100644
--- a/modules/mailu/tools/index.ts
+++ b/modules/mailu/tools/index.ts
@@ -1,4 +1,4 @@
-// mailu's tools — moved here from the shared sdk (novox/hq ADR 0044), importing mailu's own client.
+// mailu's tools — moved here from the shared sdk (novox/hq ADR 0039), importing mailu's own client.
 // They return structured data; the mesh serves them through the sdk's tool harness. Deletions are
 // guarded by an explicit `confirm`, since removing a mailbox destroys its mail and cannot be undone.
 
diff --git a/modules/minio/client.ts b/modules/minio/client.ts
index 4086b58..a3f2ebe 100644
--- a/modules/minio/client.ts
+++ b/modules/minio/client.ts
@@ -1,4 +1,4 @@
-// The MinIO admin client — minio's own code, living in the module (novox/hq ADR 0044). Ported out
+// The MinIO admin client — minio's own code, living in the module (novox/hq ADR 0039). Ported out
 // of the shared hal sdk, where a change to MinIO's surface rebuilt everything; here it rebuilds only
 // minio. This module's tools, its provisioner and its events entrypoint import it; nothing outside
 // minio does.
@@ -207,7 +207,7 @@ export class MinioClient {
   /**
    * Create a service account scoped to one bucket, under a given access key and secret key, and
    * return the pair. The secret key is the mesh's — the mesh mints one password per consumer and
-   * hands a copy to both ends (novox/hq ADR 0053), so minio sets that as the secret rather than
+   * hands a copy to both ends (novox/hq ADR 0048), so minio sets that as the secret rather than
    * generating one the consumer could never learn. The MinIO admin REST API encrypts this request
    * with a key derived (Argon2) from the root secret, which node built-ins cannot reproduce — so, as
    * hal did, the module drives the `mc` CLI, which the runtime image bundles.
diff --git a/modules/minio/package.json b/modules/minio/package.json
index c1839d6..9e74934 100644
--- a/modules/minio/package.json
+++ b/modules/minio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-minio",
   "version": "0.1.0",
-  "description": "minio — S3-compatible object store. Its admin client, tools, provisioner and events live here (novox/hq ADR 0044).",
+  "description": "minio — S3-compatible object store. Its admin client, tools, provisioner and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/minio/provisioner/index.ts b/modules/minio/provisioner/index.ts
index dd5957b..cc07052 100644
--- a/modules/minio/provisioner/index.ts
+++ b/modules/minio/provisioner/index.ts
@@ -1,13 +1,13 @@
 // minio's provisioner — the adapter that makes minio a provider of the mesh `s3-bucket` interface
 // (the name in module.json's `provides`). The reconcile loop, the contributions file, and reading
 // the mesh's minted secret are the sdk harness's; this writes only the per-service half: how minio
-// creates and removes a consumer's bucket and its scoped access key (novox/hq ADR 0044/0045/0053).
+// creates and removes a consumer's bucket and its scoped access key (novox/hq ADR 0039/0040/0048).
 //
 // The `s3-bucket` interface: a consumer connects to an S3 endpoint with an access key confined to
 // its own bucket. It depends on `s3-bucket`, not on minio, so any S3-compatible provider could serve
 // it.
 //
-// **The access key and its secret are the mesh's, not the provisioner's (ADR 0053).** The mesh
+// **The access key and its secret are the mesh's, not the provisioner's (ADR 0048).** The mesh
 // derives the login (the access-key id) and hands it to both ends, and mints the secret key. minio
 // creates the service account under exactly that access key with exactly that secret — a credential
 // the provisioner invented is one the consumer could never present. The bucket is derived from the
diff --git a/modules/minio/tools/index.ts b/modules/minio/tools/index.ts
index dc218b5..cd19282 100644
--- a/modules/minio/tools/index.ts
+++ b/modules/minio/tools/index.ts
@@ -1,4 +1,4 @@
-// minio's tools — ported here from the shared sdk (novox/hq ADR 0044), importing minio's own client.
+// minio's tools — ported here from the shared sdk (novox/hq ADR 0039), importing minio's own client.
 // They return structured data; the mesh serves them through the sdk's tool harness. These are the
 // read/inspect operations useful to an operator; creating storage for a consumer is the provisioner's
 // job, not a tool's.
diff --git a/modules/mongodb/client.ts b/modules/mongodb/client.ts
index 18b5ffe..ce4f2e3 100644
--- a/modules/mongodb/client.ts
+++ b/modules/mongodb/client.ts
@@ -1,4 +1,4 @@
-// mongodb's admin client — mongodb's own code, living in the module (novox/hq ADR 0044). Both this
+// mongodb's admin client — mongodb's own code, living in the module (novox/hq ADR 0039). Both this
 // module's tools and its provisioner import it, and nothing outside mongodb does.
 //
 // Commands run through `mongosh`, not a wire-protocol driver: the module may take NO npm dependency
diff --git a/modules/mongodb/index.ts b/modules/mongodb/index.ts
index 1a8bf8b..c3bd40b 100644
--- a/modules/mongodb/index.ts
+++ b/modules/mongodb/index.ts
@@ -1,6 +1,6 @@
 // mongodb's events entrypoint, loaded by the per-node tool host (the provisioner container runs
 // ./provisioner separately). The database lifecycle events are EMITTED from the provisioner, where
-// the lifecycle actually happens (novox/hq ADR 0046/0047):
+// the lifecycle actually happens (novox/hq ADR 0041/0042):
 //   module.mongodb.database.provisioned    — a consumer's database + owning user was created
 //   module.mongodb.database.deprovisioned  — that database was removed
 // Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
diff --git a/modules/mongodb/package.json b/modules/mongodb/package.json
index 509b818..4195793 100644
--- a/modules/mongodb/package.json
+++ b/modules/mongodb/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-mongodb",
   "version": "0.1.0",
-  "description": "mongodb — provides the mesh mongodb-database interface. Its client, provisioner, tools and events live here (novox/hq ADR 0044).",
+  "description": "mongodb — provides the mesh mongodb-database interface. Its client, provisioner, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/mongodb/provisioner/index.ts b/modules/mongodb/provisioner/index.ts
index 27a069c..b42b2fc 100644
--- a/modules/mongodb/provisioner/index.ts
+++ b/modules/mongodb/provisioner/index.ts
@@ -1,12 +1,12 @@
 // mongodb's provisioner — the adapter that makes mongodb a provider of the mesh `mongodb-database`
 // interface. The reconcile loop, the contributions file, and reading the mesh's minted password are
 // the sdk harness's; this writes only the per-service half: how mongodb creates and removes a
-// consumer's database + owning user (novox/hq ADR 0044/0045/0053).
+// consumer's database + owning user (novox/hq ADR 0039/0040/0048).
 //
 // The `mongodb-database` interface: a consumer connects to a database it alone owns, as `as` with the
 // password the mesh minted, authenticating against that same database.
 //
-// **The user name and password are the mesh's, not the provisioner's (ADR 0053).** The mesh derives
+// **The user name and password are the mesh's, not the provisioner's (ADR 0048).** The mesh derives
 // the login and hands it to both ends, and mints the password. mongodb creates a user and a
 // same-named database under exactly that login — a name the consumer cannot learn is a database it
 // cannot reach.
diff --git a/modules/mongodb/tools/index.ts b/modules/mongodb/tools/index.ts
index 5c14acd..b45b804 100644
--- a/modules/mongodb/tools/index.ts
+++ b/modules/mongodb/tools/index.ts
@@ -1,4 +1,4 @@
-// mongodb's tools — mongodb's own code (novox/hq ADR 0044), importing mongodb's own client. They
+// mongodb's tools — mongodb's own code (novox/hq ADR 0039), importing mongodb's own client. They
 // return structured data; the mesh serves them through the sdk's tool harness. Both call through
 // MongoClient.evalJs(), the module's one execution boundary (see client.ts).
 
diff --git a/modules/mosquitto/client.ts b/modules/mosquitto/client.ts
index ca70939..3d63c42 100644
--- a/modules/mosquitto/client.ts
+++ b/modules/mosquitto/client.ts
@@ -1,4 +1,4 @@
-// mosquitto's admin client — mosquitto's own code, living in the module (novox/hq ADR 0044). Both
+// mosquitto's admin client — mosquitto's own code, living in the module (novox/hq ADR 0039). Both
 // this module's tools and its provisioner import it, and nothing outside mosquitto does.
 //
 // Client, role and ACL administration is driven through `mosquitto_ctrl dynsec`, not a hand-rolled
diff --git a/modules/mosquitto/index.ts b/modules/mosquitto/index.ts
index e3e3170..d91356c 100644
--- a/modules/mosquitto/index.ts
+++ b/modules/mosquitto/index.ts
@@ -1,6 +1,6 @@
 // mosquitto's events entrypoint, loaded by the per-node tool host (the provisioner container runs
 // ./provisioner separately). The topic lifecycle events are EMITTED from the provisioner, where the
-// lifecycle actually happens (novox/hq ADR 0046/0047):
+// lifecycle actually happens (novox/hq ADR 0041/0042):
 //   module.mosquitto.topic.provisioned    — a consumer's client + scoped role was created
 //   module.mosquitto.topic.deprovisioned  — that client was removed
 // Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
diff --git a/modules/mosquitto/package.json b/modules/mosquitto/package.json
index 5b89552..6f33f27 100644
--- a/modules/mosquitto/package.json
+++ b/modules/mosquitto/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-mosquitto",
   "version": "0.1.0",
-  "description": "mosquitto — provides the mesh mqtt-topic interface. Its admin client, provisioner, tools and events live here (novox/hq ADR 0044).",
+  "description": "mosquitto — provides the mesh mqtt-topic interface. Its admin client, provisioner, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/mosquitto/provisioner/index.ts b/modules/mosquitto/provisioner/index.ts
index 24c3bc7..39dc471 100644
--- a/modules/mosquitto/provisioner/index.ts
+++ b/modules/mosquitto/provisioner/index.ts
@@ -1,13 +1,13 @@
 // mosquitto's provisioner — the adapter that makes mosquitto a provider of the mesh `mqtt-topic`
 // interface. The reconcile loop, the contributions file, and reading the mesh's minted password are
 // the sdk harness's; this writes only the per-service half: how mosquitto creates and removes a
-// per-consumer MQTT client (novox/hq ADR 0044/0045/0053).
+// per-consumer MQTT client (novox/hq ADR 0039/0040/0048).
 //
 // The `mqtt-topic` interface: a consumer connects as `as` with the password the mesh minted, and
 // publishes and subscribes under `<as>/#`, isolated from every other consumer by a Dynamic Security
 // role scoped to exactly that subtree.
 //
-// **The login and password are the mesh's, not the provisioner's (ADR 0053).** The mesh derives the
+// **The login and password are the mesh's, not the provisioner's (ADR 0048).** The mesh derives the
 // login and hands it to both ends so they agree, and mints the password and delivers a copy to each.
 // mosquitto creates exactly that client with exactly that password — a name or password the
 // provisioner invented is one the consumer could never present.
diff --git a/modules/mosquitto/tools/index.ts b/modules/mosquitto/tools/index.ts
index ffbbcb0..bece477 100644
--- a/modules/mosquitto/tools/index.ts
+++ b/modules/mosquitto/tools/index.ts
@@ -1,4 +1,4 @@
-// mosquitto's tools — mosquitto's own code (novox/hq ADR 0044), importing mosquitto's own admin
+// mosquitto's tools — mosquitto's own code (novox/hq ADR 0039), importing mosquitto's own admin
 // client. They return structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/mssql/client.ts b/modules/mssql/client.ts
index 308bce2..4b1a89a 100644
--- a/modules/mssql/client.ts
+++ b/modules/mssql/client.ts
@@ -1,4 +1,4 @@
-// mssql's admin client — mssql's own code, living in the module (novox/hq ADR 0044). Both this
+// mssql's admin client — mssql's own code, living in the module (novox/hq ADR 0039). Both this
 // module's tools and its provisioner import it, and nothing outside mssql does.
 //
 // SQL is executed through `sqlcmd`, not a wire-protocol driver: the module may take NO npm
@@ -86,7 +86,7 @@ export class MssqlClient {
     // `-h -1` drops the column-header rule; `-y 0`/`-Y 0` lift the display-width cap so a long
     // JSON document is not truncated; `-W` trims trailing whitespace so the JSON chunks rejoin
     // cleanly. sqlcmd from the mssql-tools ships in the runtime container, the way `psql` ships
-    // with postgres's — the module owns its own code (ADR 0044) and shells out to it.
+    // with postgres's — the module owns its own code (ADR 0039) and shells out to it.
     const { stdout } = await run(
       "sqlcmd",
       [
@@ -109,7 +109,7 @@ export class MssqlClient {
   /**
    * Create a login and a database it owns (mapped as a db_owner user), idempotently. The login,
    * the database and the user all carry the consumer's minted name, so the consumer owns exactly
-   * its own database — a name it cannot learn is a database it cannot reach (ADR 0053).
+   * its own database — a name it cannot learn is a database it cannot reach (ADR 0048).
    */
   async createDatabaseAndLogin(database: string, login: string, password: string): Promise<void> {
     const logins = await this.query(
diff --git a/modules/mssql/index.ts b/modules/mssql/index.ts
index 5547a8e..873b569 100644
--- a/modules/mssql/index.ts
+++ b/modules/mssql/index.ts
@@ -1,6 +1,6 @@
 // mssql's events entrypoint, loaded by the per-node tool host (the provisioner container runs
 // ./provisioner separately). The database lifecycle events are EMITTED from the provisioner, where
-// the lifecycle actually happens (novox/hq ADR 0046/0047):
+// the lifecycle actually happens (novox/hq ADR 0041/0042):
 //   module.mssql.database.provisioned    — a consumer's database + login/user was created
 //   module.mssql.database.deprovisioned  — that database was removed
 // Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
diff --git a/modules/mssql/package.json b/modules/mssql/package.json
index d1a54ab..b0b97f6 100644
--- a/modules/mssql/package.json
+++ b/modules/mssql/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-mssql",
   "version": "0.1.0",
-  "description": "mssql — provides the mesh mssql-database interface. Its client, provisioner, tools and events live here (novox/hq ADR 0044).",
+  "description": "mssql — provides the mesh mssql-database interface. Its client, provisioner, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/mssql/provisioner/index.ts b/modules/mssql/provisioner/index.ts
index 5827dc1..e12e8b0 100644
--- a/modules/mssql/provisioner/index.ts
+++ b/modules/mssql/provisioner/index.ts
@@ -1,12 +1,12 @@
 // mssql's provisioner — the adapter that makes mssql a provider of the mesh `mssql-database`
 // interface. The reconcile loop, the contributions file, and reading the mesh's minted password
 // are the sdk harness's; this writes only the per-service half: how mssql creates and removes a
-// consumer's database + login/user with the mesh-minted credential (novox/hq ADR 0044/0045/0053).
+// consumer's database + login/user with the mesh-minted credential (novox/hq ADR 0039/0040/0048).
 //
 // The `mssql-database` interface: a consumer connects to a database it alone owns, as `as` with
 // the password the mesh minted.
 //
-// **The login name and password are the mesh's, not the provisioner's (ADR 0053).** The mesh
+// **The login name and password are the mesh's, not the provisioner's (ADR 0048).** The mesh
 // derives the login and hands it to both ends, and mints the password. mssql creates a login, a
 // same-named database, and a db_owner user under exactly that login — a name the consumer cannot
 // learn is a database it cannot reach.
diff --git a/modules/mssql/tools/index.ts b/modules/mssql/tools/index.ts
index 2ec40f3..8b91d2e 100644
--- a/modules/mssql/tools/index.ts
+++ b/modules/mssql/tools/index.ts
@@ -1,4 +1,4 @@
-// mssql's tools — mssql's own code (novox/hq ADR 0044), importing mssql's own client. They return
+// mssql's tools — mssql's own code (novox/hq ADR 0039), importing mssql's own client. They return
 // structured data; the mesh serves them through the sdk's tool harness. Both call through
 // MssqlClient, the module's one pending execution boundary (see client.ts): the tool shapes are
 // fixed and correct, and surface the work honestly through that boundary.
diff --git a/modules/nextcloud/client.ts b/modules/nextcloud/client.ts
index b860680..3ee0ce4 100644
--- a/modules/nextcloud/client.ts
+++ b/modules/nextcloud/client.ts
@@ -1,4 +1,4 @@
-// Nextcloud's client — nextcloud's own code, living in the module (novox/hq ADR 0044). Both this
+// Nextcloud's client — nextcloud's own code, living in the module (novox/hq ADR 0039). Both this
 // module's tools and its events entrypoint import it, and nothing outside nextcloud does.
 //
 // Nextcloud is administered two ways, and this client speaks both:
@@ -25,7 +25,7 @@ export interface NextcloudShare {
   owner: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/nextcloud/index.ts b/modules/nextcloud/index.ts
index 3fc26f1..aeaf61d 100644
--- a/modules/nextcloud/index.ts
+++ b/modules/nextcloud/index.ts
@@ -1,7 +1,7 @@
 // nextcloud's events. The tool runtime imports this once the broker is bound. It watches the user
 // list and the share list and announces new arrivals.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.nextcloud.user.created    — a user account appeared (occ user:list)
 //   module.nextcloud.share.created   — a share appeared (OCS shares)
 //
diff --git a/modules/nextcloud/package.json b/modules/nextcloud/package.json
index 841026f..f966b9d 100644
--- a/modules/nextcloud/package.json
+++ b/modules/nextcloud/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-nextcloud",
   "version": "0.1.0",
-  "description": "nextcloud — file sync and share. Its client, tools and events live here (novox/hq ADR 0044).",
+  "description": "nextcloud — file sync and share. Its client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/nextcloud/tools/index.ts b/modules/nextcloud/tools/index.ts
index 224e8b7..7161c31 100644
--- a/modules/nextcloud/tools/index.ts
+++ b/modules/nextcloud/tools/index.ts
@@ -1,4 +1,4 @@
-// nextcloud's tools — importing nextcloud's own client (novox/hq ADR 0044). occ runs inside the
+// nextcloud's tools — importing nextcloud's own client (novox/hq ADR 0039). occ runs inside the
 // container; shares come over OCS. They return structured data; the mesh serves them through the
 // sdk's tool harness.
 
diff --git a/modules/nodered/client.ts b/modules/nodered/client.ts
index d760ca6..0e8bf7c 100644
--- a/modules/nodered/client.ts
+++ b/modules/nodered/client.ts
@@ -1,4 +1,4 @@
-// Node-RED's admin-API client — nodered's own code, living in the module (novox/hq ADR 0044). Only
+// Node-RED's admin-API client — nodered's own code, living in the module (novox/hq ADR 0039). Only
 // this module's tools import it; nodered has nothing to poll, so there is no events entrypoint.
 //
 // Node-RED exposes a runtime admin API under its base URL: GET/POST /flows for the whole flow
@@ -20,7 +20,7 @@ export interface NodeRedNodeModule {
   types: string[];
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/nodered/package.json b/modules/nodered/package.json
index cfa5768..b8459ea 100644
--- a/modules/nodered/package.json
+++ b/modules/nodered/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-nodered",
   "version": "0.1.0",
-  "description": "nodered — flow-based automation. Its client and tools live here (novox/hq ADR 0044).",
+  "description": "nodered — flow-based automation. Its client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/nodered/tools/index.ts b/modules/nodered/tools/index.ts
index bd6c636..e19b6dc 100644
--- a/modules/nodered/tools/index.ts
+++ b/modules/nodered/tools/index.ts
@@ -1,7 +1,7 @@
-// nodered's tools — importing nodered's own admin-API client (novox/hq ADR 0044). They return
+// nodered's tools — importing nodered's own admin-API client (novox/hq ADR 0039). They return
 // structured data; the mesh serves them through the sdk's tool harness.
 //
-// The deploy tool is nodered's one event source (novox/hq ADR 0046/0047): a successful deploy
+// The deploy tool is nodered's one event source (novox/hq ADR 0041/0042): a successful deploy
 // emits module.nodered.flows.deployed. nodered has nothing to observe on a timer, so there is no
 // separate events entrypoint — the emit rides the action that causes it. The emit is best-effort:
 // if no broker is bound, the deploy still succeeds and the announcement is simply skipped.
diff --git a/modules/nzbget/client.ts b/modules/nzbget/client.ts
index e217387..cd5f0c3 100644
--- a/modules/nzbget/client.ts
+++ b/modules/nzbget/client.ts
@@ -1,4 +1,4 @@
-// The NZBGet API client — nzbget's own code, living in the module (novox/hq ADR 0044). Ported from
+// The NZBGet API client — nzbget's own code, living in the module (novox/hq ADR 0039). Ported from
 // hal's shared nzbget tools, but self-contained: a change to NZBGet's JSON-RPC now rebuilds only
 // nzbget and nothing else. Both this module's tools and its events entrypoint import it, and
 // nothing outside nzbget does. NZBGet speaks JSON-RPC at /jsonrpc, behind HTTP Basic auth.
@@ -41,7 +41,7 @@ export interface NzbgetHistoryItem {
   success: boolean;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/nzbget/index.ts b/modules/nzbget/index.ts
index bf576ae..16bfee3 100644
--- a/modules/nzbget/index.ts
+++ b/modules/nzbget/index.ts
@@ -1,7 +1,7 @@
 // nzbget's events. The tool runtime imports this once the broker is bound. It watches the download
 // queue and the history and turns their comings and goings into mesh events.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.nzbget.download.added       — an NZB entered the queue
 //   module.nzbget.download.completed   — an NZB finished successfully (left the queue, landed in
 //                                        history as SUCCESS). This exact routing key is what the
diff --git a/modules/nzbget/package.json b/modules/nzbget/package.json
index 6e1af7f..353da8a 100644
--- a/modules/nzbget/package.json
+++ b/modules/nzbget/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-nzbget",
   "version": "0.1.0",
-  "description": "nzbget — Usenet download client. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "nzbget — Usenet download client. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/nzbget/tools/index.ts b/modules/nzbget/tools/index.ts
index 1f87377..148a8f5 100644
--- a/modules/nzbget/tools/index.ts
+++ b/modules/nzbget/tools/index.ts
@@ -1,4 +1,4 @@
-// nzbget's tools — ported from the shared hal sdk (novox/hq ADR 0044), importing nzbget's own
+// nzbget's tools — ported from the shared hal sdk (novox/hq ADR 0039), importing nzbget's own
 // client. They return structured data (not the pre-formatted text hal returned); the mesh serves
 // them through the sdk's tool harness.
 
diff --git a/modules/ombi/client.ts b/modules/ombi/client.ts
index 8016ccb..8181140 100644
--- a/modules/ombi/client.ts
+++ b/modules/ombi/client.ts
@@ -1,4 +1,4 @@
-// The Ombi API client — ombi's own code, living in the module (novox/hq ADR 0044). Ombi is the
+// The Ombi API client — ombi's own code, living in the module (novox/hq ADR 0039). Ombi is the
 // request front-end: viewers ask for movies and shows, and an operator approves them. This client
 // talks its /api/v1 REST API (keyed by an ApiKey header); ombi's tools and events import it.
 
@@ -22,7 +22,7 @@ export interface RequestCounts {
   available: number;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/ombi/index.ts b/modules/ombi/index.ts
index 4b6ca9f..0c38b0f 100644
--- a/modules/ombi/index.ts
+++ b/modules/ombi/index.ts
@@ -3,7 +3,7 @@
 // are worth announcing — the mesh can notify on a new request, and act on an approval (that is when
 // a downloader should start looking).
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.ombi.request.created    — a viewer filed a new request
 //   module.ombi.request.approved   — a request was approved
 //
diff --git a/modules/ombi/package.json b/modules/ombi/package.json
index d7542a1..a1f9d58 100644
--- a/modules/ombi/package.json
+++ b/modules/ombi/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-ombi",
   "version": "0.1.0",
-  "description": "ombi — media requests. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "ombi — media requests. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/ombi/tools/index.ts b/modules/ombi/tools/index.ts
index 00d854e..70d38c3 100644
--- a/modules/ombi/tools/index.ts
+++ b/modules/ombi/tools/index.ts
@@ -1,4 +1,4 @@
-// ombi's tools — its own code (novox/hq ADR 0044), importing ombi's client. They return structured
+// ombi's tools — its own code (novox/hq ADR 0039), importing ombi's client. They return structured
 // data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/photos/client.ts b/modules/photos/client.ts
index 2305b1f..ce968eb 100644
--- a/modules/photos/client.ts
+++ b/modules/photos/client.ts
@@ -1,4 +1,4 @@
-// The photo app's API client — photos' own code, living in the module (novox/hq ADR 0044). The
+// The photo app's API client — photos' own code, living in the module (novox/hq ADR 0039). The
 // module packages a self-hosted photo library (immich-shaped: a REST API under `/api`, authenticated
 // by an API key sent as the `x-api-key` header). The client speaks only what the tools and the
 // item-added event need: server version and statistics, albums, and recent assets.
@@ -26,7 +26,7 @@ export interface PhotosAsset {
   createdAt?: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/photos/index.ts b/modules/photos/index.ts
index 45cf390..b2f457a 100644
--- a/modules/photos/index.ts
+++ b/modules/photos/index.ts
@@ -1,7 +1,7 @@
 // photos' events. The tool runtime imports this once the broker is bound. It watches the library and
 // announces newly added assets.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.photos.item.added   — a new asset appeared in the library
 //
 // New assets are found by diffing the recent-assets slice by asset id. Primed silently on the first
diff --git a/modules/photos/package.json b/modules/photos/package.json
index 0bb719b..8667c81 100644
--- a/modules/photos/package.json
+++ b/modules/photos/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-photos",
   "version": "0.1.0",
-  "description": "photos — self-hosted photo library. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "photos — self-hosted photo library. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/photos/tools/index.ts b/modules/photos/tools/index.ts
index b8c9619..63eb37c 100644
--- a/modules/photos/tools/index.ts
+++ b/modules/photos/tools/index.ts
@@ -1,4 +1,4 @@
-// photos' tools (novox/hq ADR 0044), importing photos' own client.
+// photos' tools (novox/hq ADR 0039), importing photos' own client.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { PhotosClient } from "../client.js";
diff --git a/modules/plex/client.ts b/modules/plex/client.ts
index 78c2288..8ff03bb 100644
--- a/modules/plex/client.ts
+++ b/modules/plex/client.ts
@@ -1,4 +1,4 @@
-// The Plex API client — plex's own code, living in the module (novox/hq ADR 0044). Moved out of the
+// The Plex API client — plex's own code, living in the module (novox/hq ADR 0039). Moved out of the
 // shared hal sdk, where a change to Plex's API rebuilt everything; here it rebuilds only plex. Both
 // this module's tools and its events entrypoint import it, and nothing outside plex does.
 
diff --git a/modules/plex/index.ts b/modules/plex/index.ts
index 74830e2..d4d48de 100644
--- a/modules/plex/index.ts
+++ b/modules/plex/index.ts
@@ -1,7 +1,7 @@
 // plex's events. The tool runtime imports this once the broker is bound, and it does two things:
 // it watches the server and emits what happened, and it reacts to the mesh's media events.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.plex.playback.started / .stopped   — someone began or ended watching
 //   module.plex.item.added                     — a new item appeared in a library
 // Consumes:
diff --git a/modules/plex/package.json b/modules/plex/package.json
index 65393e4..de67698 100644
--- a/modules/plex/package.json
+++ b/modules/plex/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-plex",
   "version": "0.1.0",
-  "description": "plex — media server. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "plex — media server. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/plex/tools/index.ts b/modules/plex/tools/index.ts
index 7a2115b..7cf344c 100644
--- a/modules/plex/tools/index.ts
+++ b/modules/plex/tools/index.ts
@@ -1,4 +1,4 @@
-// plex's tools — moved here from the shared sdk (novox/hq ADR 0044), importing plex's own client.
+// plex's tools — moved here from the shared sdk (novox/hq ADR 0039), importing plex's own client.
 // They return structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/portainer/client.ts b/modules/portainer/client.ts
index a7ac3d1..2a92393 100644
--- a/modules/portainer/client.ts
+++ b/modules/portainer/client.ts
@@ -1,4 +1,4 @@
-// The Portainer API client — portainer's own code, living in the module (novox/hq ADR 0044).
+// The Portainer API client — portainer's own code, living in the module (novox/hq ADR 0039).
 // portainer is tools-only: its "events" would really be the underlying containers' lifecycle,
 // which the host owns and emits — so this module reads Portainer's own resources (endpoints,
 // stacks, containers) and exposes them, and stops there.
@@ -29,7 +29,7 @@ export interface PortainerContainer {
   status: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/portainer/package.json b/modules/portainer/package.json
index 77ee328..b9726e8 100644
--- a/modules/portainer/package.json
+++ b/modules/portainer/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-portainer",
   "version": "0.1.0",
-  "description": "portainer — container management UI. Its API client and tools live here (novox/hq ADR 0044).",
+  "description": "portainer — container management UI. Its API client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/portainer/tools/index.ts b/modules/portainer/tools/index.ts
index 192d830..e750659 100644
--- a/modules/portainer/tools/index.ts
+++ b/modules/portainer/tools/index.ts
@@ -1,4 +1,4 @@
-// portainer's tools — its own code (novox/hq ADR 0044), importing portainer's own client. They
+// portainer's tools — its own code (novox/hq ADR 0039), importing portainer's own client. They
 // return structured data; the mesh serves them through the sdk's tool harness. portainer is
 // tools-only (no events entrypoint): a container starting or stopping is the host's signal to emit,
 // not Portainer's to re-announce.
diff --git a/modules/postgres/client.ts b/modules/postgres/client.ts
index aae7c60..7582494 100644
--- a/modules/postgres/client.ts
+++ b/modules/postgres/client.ts
@@ -1,4 +1,4 @@
-// postgres's admin client — postgres's own code, living in the module (novox/hq ADR 0044). Both this
+// postgres's admin client — postgres's own code, living in the module (novox/hq ADR 0039). Both this
 // module's tools and its provisioner import it, and nothing outside postgres does.
 //
 // SQL is executed through `psql`, not a wire-protocol driver: the module may take NO npm dependency
@@ -60,7 +60,7 @@ export class PostgresClient {
   async query(sql: string, database = "postgres"): Promise<QueryResult> {
     // Executed through `psql`, the way minio drives itself through `mc` and mailu through doveadm:
     // node has no postgres wire client without an npm dependency, and the module owns its own code
-    // (ADR 0044), so it shells out to the client the postgres tools ship. CSV so the rows come back
+    // (ADR 0039), so it shells out to the client the postgres tools ship. CSV so the rows come back
     // structured; ON_ERROR_STOP so a failed statement is an error here, not a success with a warning.
     const { stdout } = await run(
       "psql",
diff --git a/modules/postgres/index.ts b/modules/postgres/index.ts
index a7bbe12..61b1cff 100644
--- a/modules/postgres/index.ts
+++ b/modules/postgres/index.ts
@@ -1,6 +1,6 @@
 // postgres's events entrypoint, loaded by the per-node tool host (the provisioner container runs
 // ./provisioner separately). The database lifecycle events are EMITTED from the provisioner, where
-// the lifecycle actually happens (novox/hq ADR 0046/0047):
+// the lifecycle actually happens (novox/hq ADR 0041/0042):
 //   module.postgres.database.provisioned    — a consumer's database + owning role was created
 //   module.postgres.database.deprovisioned  — that database was removed
 // Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
diff --git a/modules/postgres/package.json b/modules/postgres/package.json
index 5412054..a348964 100644
--- a/modules/postgres/package.json
+++ b/modules/postgres/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-postgres",
   "version": "0.1.0",
-  "description": "postgres — provides the mesh postgres-database interface. Its client, provisioner, tools and events live here (novox/hq ADR 0044).",
+  "description": "postgres — provides the mesh postgres-database interface. Its client, provisioner, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/postgres/provisioner/index.ts b/modules/postgres/provisioner/index.ts
index b3a4303..16bd09e 100644
--- a/modules/postgres/provisioner/index.ts
+++ b/modules/postgres/provisioner/index.ts
@@ -1,12 +1,12 @@
 // postgres's provisioner — the adapter that makes postgres a provider of the mesh
 // `postgres-database` interface. The reconcile loop, the contributions file, and reading the mesh's
 // minted password are the sdk harness's; this writes only the per-service half: how postgres creates
-// and removes a consumer's database + owning role (novox/hq ADR 0044/0045/0053).
+// and removes a consumer's database + owning role (novox/hq ADR 0039/0040/0048).
 //
 // The `postgres-database` interface: a consumer connects to a database it alone owns, as `as` with
 // the password the mesh minted.
 //
-// **The role name and password are the mesh's, not the provisioner's (ADR 0053).** The mesh derives
+// **The role name and password are the mesh's, not the provisioner's (ADR 0048).** The mesh derives
 // the login and hands it to both ends, and mints the password. postgres creates a role and a
 // same-named database under exactly that login — a name the consumer cannot learn is a database it
 // cannot reach.
diff --git a/modules/postgres/tools/index.ts b/modules/postgres/tools/index.ts
index 31ad53b..51185be 100644
--- a/modules/postgres/tools/index.ts
+++ b/modules/postgres/tools/index.ts
@@ -1,4 +1,4 @@
-// postgres's tools — postgres's own code (novox/hq ADR 0044), importing postgres's own client. They
+// postgres's tools — postgres's own code (novox/hq ADR 0039), importing postgres's own client. They
 // return structured data; the mesh serves them through the sdk's tool harness. Both call through
 // PostgresClient.query(), the module's one pending execution boundary (see client.ts): the tool
 // shapes are fixed and correct, and surface the TODO honestly until that boundary is backed.
diff --git a/modules/qbittorrent/client.ts b/modules/qbittorrent/client.ts
index b59c171..2bf9964 100644
--- a/modules/qbittorrent/client.ts
+++ b/modules/qbittorrent/client.ts
@@ -1,4 +1,4 @@
-// The qBittorrent API client — qbittorrent's own code, living in the module (novox/hq ADR 0044).
+// The qBittorrent API client — qbittorrent's own code, living in the module (novox/hq ADR 0039).
 // Written against the WebUI API (/api/v2/...), self-contained so a change to it rebuilds only
 // qbittorrent. Both this module's tools and its events entrypoint import it, and nothing outside
 // qbittorrent does.
@@ -32,7 +32,7 @@ export interface QbTorrent {
   savePath: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/qbittorrent/index.ts b/modules/qbittorrent/index.ts
index 2b57c18..ae737fb 100644
--- a/modules/qbittorrent/index.ts
+++ b/modules/qbittorrent/index.ts
@@ -1,7 +1,7 @@
 // qbittorrent's events. The tool runtime imports this once the broker is bound. It watches the
 // torrent list and turns its comings and goings into mesh events.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.qbittorrent.download.added       — a torrent was added
 //   module.qbittorrent.download.completed   — a torrent finished downloading (progress reached 1).
 //                                             This exact routing key is what the plex module
diff --git a/modules/qbittorrent/package.json b/modules/qbittorrent/package.json
index 865b977..d49151a 100644
--- a/modules/qbittorrent/package.json
+++ b/modules/qbittorrent/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-qbittorrent",
   "version": "0.1.0",
-  "description": "qbittorrent — BitTorrent download client. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "qbittorrent — BitTorrent download client. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/qbittorrent/tools/index.ts b/modules/qbittorrent/tools/index.ts
index 49f9ec5..3e36611 100644
--- a/modules/qbittorrent/tools/index.ts
+++ b/modules/qbittorrent/tools/index.ts
@@ -1,4 +1,4 @@
-// qbittorrent's tools — living in the module (novox/hq ADR 0044), importing qbittorrent's own
+// qbittorrent's tools — living in the module (novox/hq ADR 0039), importing qbittorrent's own
 // client. They return structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/radarr/client.ts b/modules/radarr/client.ts
index 6a659eb..528d837 100644
--- a/modules/radarr/client.ts
+++ b/modules/radarr/client.ts
@@ -1,4 +1,4 @@
-// The Radarr API client — radarr's own code, living in the module (novox/hq ADR 0044). Ported from
+// The Radarr API client — radarr's own code, living in the module (novox/hq ADR 0039). Ported from
 // the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own copy, so a
 // change to Radarr's API rebuilds only radarr and nothing else. Both this module's tools and its
 // events entrypoint import it, and nothing outside radarr does.
diff --git a/modules/radarr/index.ts b/modules/radarr/index.ts
index 3b08be7..28cd367 100644
--- a/modules/radarr/index.ts
+++ b/modules/radarr/index.ts
@@ -1,7 +1,7 @@
 // radarr's events. The tool runtime imports this once the broker is bound. It watches the download
 // queue and turns its comings and goings into mesh events.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.radarr.movie.grabbed        — a release entered the queue (Radarr grabbed it)
 //   module.radarr.download.completed   — a release left the queue, imported. This exact routing key
 //                                        is what the plex module consumes (module.*.download.completed)
diff --git a/modules/radarr/package.json b/modules/radarr/package.json
index 9393ff4..af01eac 100644
--- a/modules/radarr/package.json
+++ b/modules/radarr/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-radarr",
   "version": "0.1.0",
-  "description": "radarr — movie management. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "radarr — movie management. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/radarr/tools/index.ts b/modules/radarr/tools/index.ts
index d147012..db0544a 100644
--- a/modules/radarr/tools/index.ts
+++ b/modules/radarr/tools/index.ts
@@ -1,4 +1,4 @@
-// radarr's tools — ported from the shared hal sdk (novox/hq ADR 0044), importing radarr's own
+// radarr's tools — ported from the shared hal sdk (novox/hq ADR 0039), importing radarr's own
 // client. They return structured data (not pre-formatted text as hal did); the mesh serves them
 // through the sdk's tool harness.
 
diff --git a/modules/redis/client.ts b/modules/redis/client.ts
index cb17695..d4eb35d 100644
--- a/modules/redis/client.ts
+++ b/modules/redis/client.ts
@@ -1,4 +1,4 @@
-// redis's admin client — redis's own code, living in the module (novox/hq ADR 0044). It speaks
+// redis's admin client — redis's own code, living in the module (novox/hq ADR 0039). It speaks
 // RESP directly over a raw TCP socket (node:net) so the module carries no npm dependency beyond
 // @novox/mesh-sdk: no redis driver, no redis-cli in the image. Both this module's tools and its
 // provisioner import it, and nothing outside redis does.
diff --git a/modules/redis/index.ts b/modules/redis/index.ts
index 870c886..d15c8ac 100644
--- a/modules/redis/index.ts
+++ b/modules/redis/index.ts
@@ -1,6 +1,6 @@
 // redis's events entrypoint, loaded by the per-node tool host (the provisioner container runs
 // ./provisioner separately). The cache lifecycle events are EMITTED from the provisioner, where the
-// lifecycle actually happens (novox/hq ADR 0046/0047):
+// lifecycle actually happens (novox/hq ADR 0041/0042):
 //   module.redis.cache.provisioned    — a consumer's ACL user + keyspace was created
 //   module.redis.cache.deprovisioned  — that user was removed
 // Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
diff --git a/modules/redis/package.json b/modules/redis/package.json
index 3032fb0..7d32bdb 100644
--- a/modules/redis/package.json
+++ b/modules/redis/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-redis",
   "version": "0.1.0",
-  "description": "redis — provides the mesh redis-cache interface. Its RESP client, provisioner, tools and events live here (novox/hq ADR 0044).",
+  "description": "redis — provides the mesh redis-cache interface. Its RESP client, provisioner, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/redis/provisioner/index.ts b/modules/redis/provisioner/index.ts
index 0ad363b..c3ea7f7 100644
--- a/modules/redis/provisioner/index.ts
+++ b/modules/redis/provisioner/index.ts
@@ -1,13 +1,13 @@
 // redis's provisioner — the adapter that makes redis a provider of the mesh `redis-cache`
 // interface. The reconcile loop, the contributions file, and reading the mesh's minted password are
 // the sdk harness's; this writes only the per-service half: how redis creates and removes a
-// per-consumer cache (novox/hq ADR 0044/0045/0053).
+// per-consumer cache (novox/hq ADR 0039/0040/0048).
 //
 // The `redis-cache` interface: a consumer connects as `as` with the password the mesh minted, and
 // stores its keys under `<as>:*`, isolated from every other consumer by an ACL user scoped to
 // exactly that prefix.
 //
-// **The login and password are the mesh's, not the provisioner's (ADR 0053).** The mesh derives the
+// **The login and password are the mesh's, not the provisioner's (ADR 0048).** The mesh derives the
 // login and hands it to both ends so they agree, and mints the password and delivers a copy to each.
 // redis creates exactly that login with exactly that password — a name or password the provisioner
 // invented is one the consumer could never present.
diff --git a/modules/redis/tools/index.ts b/modules/redis/tools/index.ts
index 239758c..f3f3e31 100644
--- a/modules/redis/tools/index.ts
+++ b/modules/redis/tools/index.ts
@@ -1,4 +1,4 @@
-// redis's tools — redis's own code (novox/hq ADR 0044), importing redis's own RESP client. They
+// redis's tools — redis's own code (novox/hq ADR 0039), importing redis's own RESP client. They
 // return structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/registry/client.ts b/modules/registry/client.ts
index d78d61f..5ff3457 100644
--- a/modules/registry/client.ts
+++ b/modules/registry/client.ts
@@ -1,4 +1,4 @@
-// The Docker Registry v2 client — registry's own code, living in the module (novox/hq ADR 0044).
+// The Docker Registry v2 client — registry's own code, living in the module (novox/hq ADR 0039).
 // Ported from the shared hal sdk, where a change to the registry API rebuilt everything; here it
 // rebuilds only registry. Both this module's tools and its events entrypoint import it.
 
diff --git a/modules/registry/index.ts b/modules/registry/index.ts
index 6bdd54f..86748b7 100644
--- a/modules/registry/index.ts
+++ b/modules/registry/index.ts
@@ -1,6 +1,6 @@
 // registry's events. The tool runtime imports this once the broker is bound.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.registry.image.pushed   — a new image (repo:tag) was published to the registry
 //
 // This is a genuinely useful signal: a build finished and its image is now pullable, so anything
diff --git a/modules/registry/package.json b/modules/registry/package.json
index 74a4955..8914148 100644
--- a/modules/registry/package.json
+++ b/modules/registry/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-registry",
   "version": "0.1.0",
-  "description": "registry — private Docker image registry. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "registry — private Docker image registry. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/registry/tools/index.ts b/modules/registry/tools/index.ts
index e354baf..62af115 100644
--- a/modules/registry/tools/index.ts
+++ b/modules/registry/tools/index.ts
@@ -1,4 +1,4 @@
-// registry's tools — moved here from the shared sdk (novox/hq ADR 0044), importing registry's own
+// registry's tools — moved here from the shared sdk (novox/hq ADR 0039), importing registry's own
 // client. They return structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/searxng/client.ts b/modules/searxng/client.ts
index 8bddb1a..c14ae42 100644
--- a/modules/searxng/client.ts
+++ b/modules/searxng/client.ts
@@ -1,4 +1,4 @@
-// SearXNG's API client — searxng's own code, living in the module (novox/hq ADR 0044). SearXNG is a
+// SearXNG's API client — searxng's own code, living in the module (novox/hq ADR 0039). SearXNG is a
 // privacy-respecting metasearch engine: it forwards a query to many upstream engines and returns the
 // merged results. Its JSON API (`/search?q=...&format=json`) is what makes a `searxng_search` tool
 // useful; the client speaks only that. No credential — the instance is reached inside the mesh.
@@ -28,7 +28,7 @@ export interface SearxOptions {
   pageno?: number;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/searxng/package.json b/modules/searxng/package.json
index 45c1fbd..36cc2ed 100644
--- a/modules/searxng/package.json
+++ b/modules/searxng/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-searxng",
   "version": "0.1.0",
-  "description": "searxng — privacy-respecting metasearch. Its API client and tools live here (novox/hq ADR 0044).",
+  "description": "searxng — privacy-respecting metasearch. Its API client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/searxng/tools/index.ts b/modules/searxng/tools/index.ts
index f30c8c2..e2ba0f1 100644
--- a/modules/searxng/tools/index.ts
+++ b/modules/searxng/tools/index.ts
@@ -1,4 +1,4 @@
-// searxng's tools (novox/hq ADR 0044), importing searxng's own client. A stateless metasearch: one
+// searxng's tools (novox/hq ADR 0039), importing searxng's own client. A stateless metasearch: one
 // query in, merged results out — genuinely useful, and with nothing to observe over time it stays
 // tools-only (no events, no broker).
 
diff --git a/modules/sonarr/client.ts b/modules/sonarr/client.ts
index fbf7ec2..47ff70b 100644
--- a/modules/sonarr/client.ts
+++ b/modules/sonarr/client.ts
@@ -1,4 +1,4 @@
-// The Sonarr API client — sonarr's own code, living in the module (novox/hq ADR 0044). Ported from
+// The Sonarr API client — sonarr's own code, living in the module (novox/hq ADR 0039). Ported from
 // the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own copy, so a
 // change to Sonarr's API rebuilds only sonarr and nothing else. Both this module's tools and its
 // events entrypoint import it, and nothing outside sonarr does.
diff --git a/modules/sonarr/index.ts b/modules/sonarr/index.ts
index fb03857..d2f1b05 100644
--- a/modules/sonarr/index.ts
+++ b/modules/sonarr/index.ts
@@ -1,7 +1,7 @@
 // sonarr's events. The tool runtime imports this once the broker is bound. It watches the download
 // queue and turns its comings and goings into mesh events.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.sonarr.episode.grabbed     — a release entered the queue (Sonarr grabbed it)
 //   module.sonarr.download.completed   — a release left the queue, imported. This exact routing key
 //                                        is what the plex module consumes (module.*.download.completed)
diff --git a/modules/sonarr/package.json b/modules/sonarr/package.json
index 7fd642d..fec0933 100644
--- a/modules/sonarr/package.json
+++ b/modules/sonarr/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-sonarr",
   "version": "0.1.0",
-  "description": "sonarr — TV series management. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "sonarr — TV series management. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/sonarr/tools/index.ts b/modules/sonarr/tools/index.ts
index ea5a586..fc8ce85 100644
--- a/modules/sonarr/tools/index.ts
+++ b/modules/sonarr/tools/index.ts
@@ -1,4 +1,4 @@
-// sonarr's tools — ported from the shared hal sdk (novox/hq ADR 0044), importing sonarr's own
+// sonarr's tools — ported from the shared hal sdk (novox/hq ADR 0039), importing sonarr's own
 // client. They return structured data (not pre-formatted text as hal did); the mesh serves them
 // through the sdk's tool harness.
 
diff --git a/modules/tautulli/client.ts b/modules/tautulli/client.ts
index 2096a07..69c71d5 100644
--- a/modules/tautulli/client.ts
+++ b/modules/tautulli/client.ts
@@ -1,4 +1,4 @@
-// Tautulli's API client — tautulli's own code, living in the module (novox/hq ADR 0044). Both this
+// Tautulli's API client — tautulli's own code, living in the module (novox/hq ADR 0039). Both this
 // module's tools and its events entrypoint import it, and nothing outside tautulli does.
 //
 // Tautulli speaks one endpoint: GET /api/v2?apikey=…&cmd=…&<params>, answering
@@ -34,7 +34,7 @@ export interface TautulliHomeStat {
   rows: Array<Record<string, unknown>>;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/tautulli/index.ts b/modules/tautulli/index.ts
index faa6c77..afbfc21 100644
--- a/modules/tautulli/index.ts
+++ b/modules/tautulli/index.ts
@@ -1,7 +1,7 @@
 // tautulli's events. The tool runtime imports this once the broker is bound. It watches Tautulli's
 // history and announces each newly recorded watch.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.tautulli.watch.recorded   — a play appeared in Tautulli's history
 //
 // Diffed on the history row id and primed silently on the first look, so a restart does not
diff --git a/modules/tautulli/package.json b/modules/tautulli/package.json
index 9cd4335..b8e3718 100644
--- a/modules/tautulli/package.json
+++ b/modules/tautulli/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-tautulli",
   "version": "0.1.0",
-  "description": "tautulli — Plex watch statistics. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "tautulli — Plex watch statistics. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/tautulli/tools/index.ts b/modules/tautulli/tools/index.ts
index b5697d6..1ef4eed 100644
--- a/modules/tautulli/tools/index.ts
+++ b/modules/tautulli/tools/index.ts
@@ -1,4 +1,4 @@
-// tautulli's tools — importing tautulli's own client (novox/hq ADR 0044). They return structured
+// tautulli's tools — importing tautulli's own client (novox/hq ADR 0039). They return structured
 // data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
diff --git a/modules/umami/client.ts b/modules/umami/client.ts
index 1c960ac..4ef410c 100644
--- a/modules/umami/client.ts
+++ b/modules/umami/client.ts
@@ -1,5 +1,5 @@
 // The umami API client — moved here from the shared sdk, because it is umami's own code and
-// changes when umami's API does (novox/hq ADR 0044). Both this module's tools and its provisioner
+// changes when umami's API does (novox/hq ADR 0039). Both this module's tools and its provisioner
 // import it; nothing outside umami does.
 
 export interface Website {
diff --git a/modules/umami/provisioner/index.ts b/modules/umami/provisioner/index.ts
index f9ba5c2..de13f96 100644
--- a/modules/umami/provisioner/index.ts
+++ b/modules/umami/provisioner/index.ts
@@ -1,11 +1,11 @@
 // umami's provisioner — the adapter that makes umami a provider of the mesh `analytics` interface.
 // The reconcile loop and the contributions file are the sdk harness's; this writes only the
-// per-service half: how umami creates and removes a tracked site (novox/hq ADR 0044/0045/0053).
+// per-service half: how umami creates and removes a tracked site (novox/hq ADR 0039/0040/0048).
 //
 // The `analytics` interface: a consumer contributes `{ domain }` (the site it wants tracked) and
 // receives `{ siteId, snippet, dashboard }`.
 //
-// **A note on scope (ADR 0053).** ADR 0053 corrects *credential* provisions: the mesh mints a secret
+// **A note on scope (ADR 0048).** ADR 0048 corrects *credential* provisions: the mesh mints a secret
 // and the provider creates a login with it. Analytics is not that shape — it mints no secret the
 // consumer authenticates with; what the consumer needs back is data umami *generates* (the siteId).
 // The credential-provisioner contract returns nothing, so the siteId does not travel back to the
diff --git a/modules/umami/tools/index.ts b/modules/umami/tools/index.ts
index 88b8f28..a50f648 100644
--- a/modules/umami/tools/index.ts
+++ b/modules/umami/tools/index.ts
@@ -1,4 +1,4 @@
-// umami's tools — moved here from the shared sdk (novox/hq ADR 0044). They import umami's own
+// umami's tools — moved here from the shared sdk (novox/hq ADR 0039). They import umami's own
 // client (../client) and plug into the mesh through the sdk's tool harness. Editing them rebuilds
 // umami and nothing else.
 
diff --git a/modules/unifi/client.ts b/modules/unifi/client.ts
index f6fbe6d..fda068c 100644
--- a/modules/unifi/client.ts
+++ b/modules/unifi/client.ts
@@ -1,4 +1,4 @@
-// The UniFi controller API client — unifi's own code, living in the module (novox/hq ADR 0044).
+// The UniFi controller API client — unifi's own code, living in the module (novox/hq ADR 0039).
 // Moved out of the shared hal sdk, where a change to the UniFi API rebuilt everything; here it
 // rebuilds only unifi. This module's tools import it, and nothing outside unifi does.
 //
@@ -112,7 +112,7 @@ function uniFetch(url: string, init?: UniInit): Promise<UniReply> {
   });
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, username, password,
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, username, password,
  *  site }. Read from MESH_UNIFI_CONFIG_FILE; absent or unreadable is an empty config, not a throw. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
diff --git a/modules/unifi/package.json b/modules/unifi/package.json
index 19c01d6..2cab945 100644
--- a/modules/unifi/package.json
+++ b/modules/unifi/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-unifi",
   "version": "0.1.0",
-  "description": "unifi — the UniFi network controller. Its API client and tools live here (novox/hq ADR 0044).",
+  "description": "unifi — the UniFi network controller. Its API client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/unifi/tools/index.ts b/modules/unifi/tools/index.ts
index c637129..da26751 100644
--- a/modules/unifi/tools/index.ts
+++ b/modules/unifi/tools/index.ts
@@ -1,4 +1,4 @@
-// unifi's tools — its own code (novox/hq ADR 0044), importing unifi's own client. They return
+// unifi's tools — its own code (novox/hq ADR 0039), importing unifi's own client. They return
 // structured data; the mesh serves them through the sdk's tool harness. unifi is tools-only (no
 // events entrypoint): the controller does not push lifecycle events the mesh consumes, so this
 // module reads its resources — port forwards, devices, clients — and exposes them, and stops there.
diff --git a/modules/verdaccio/client.ts b/modules/verdaccio/client.ts
index 0a9acb0..9c5feb1 100644
--- a/modules/verdaccio/client.ts
+++ b/modules/verdaccio/client.ts
@@ -1,5 +1,5 @@
 // The Verdaccio (npm registry) client — verdaccio's own code, living in the module (novox/hq
-// ADR 0044). Both this module's tools and its events entrypoint import it, and nothing outside
+// ADR 0039). Both this module's tools and its events entrypoint import it, and nothing outside
 // verdaccio does.
 
 import { readFileSync } from "node:fs";
@@ -19,7 +19,7 @@ export interface PackageInfo {
   modified?: string;
 }
 
-/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
   try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
diff --git a/modules/verdaccio/index.ts b/modules/verdaccio/index.ts
index 6eeb889..0c23d9e 100644
--- a/modules/verdaccio/index.ts
+++ b/modules/verdaccio/index.ts
@@ -1,6 +1,6 @@
 // verdaccio's events. The tool runtime imports this once the broker is bound.
 //
-// Emits (novox/hq ADR 0046/0047):
+// Emits (novox/hq ADR 0041/0042):
 //   module.verdaccio.package.published   — a new package version was published to the registry
 //
 // A genuinely useful signal: a package was just published, so anything on the mesh that pins,
diff --git a/modules/verdaccio/package.json b/modules/verdaccio/package.json
index 644ef27..a3c21eb 100644
--- a/modules/verdaccio/package.json
+++ b/modules/verdaccio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@novox/module-verdaccio",
   "version": "0.1.0",
-  "description": "verdaccio — private npm registry. Its API client, tools and events live here (novox/hq ADR 0044).",
+  "description": "verdaccio — private npm registry. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
   "dependencies": {
diff --git a/modules/verdaccio/tools/index.ts b/modules/verdaccio/tools/index.ts
index 055745d..5632bef 100644
--- a/modules/verdaccio/tools/index.ts
+++ b/modules/verdaccio/tools/index.ts
@@ -1,4 +1,4 @@
-// verdaccio's tools — its own code (novox/hq ADR 0044), importing verdaccio's own client. They
+// verdaccio's tools — its own code (novox/hq ADR 0039), importing verdaccio's own client. They
 // return structured data; the mesh serves them through the sdk's tool harness.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";